Malware Analysis Report

2025-01-18 20:42

Sample ID 241122-2vh7gaxmfl
Target Batch_5.zip
SHA256 51b3773145652b5d559396a08e1282a3a1d92d4df473f774d61791386fca0598
Tags
discovery evasion persistence upx trojan spyware stealer credential_access privilege_escalation ransomware defense_evasion execution impact xorist hydracrypt pony rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral32

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

51b3773145652b5d559396a08e1282a3a1d92d4df473f774d61791386fca0598

Threat Level: Known bad

The file Batch_5.zip was found to be: Known bad.

Malicious Activity Summary

discovery evasion persistence upx trojan spyware stealer credential_access privilege_escalation ransomware defense_evasion execution impact xorist hydracrypt pony rat

Modifies WinLogon for persistence

Hydracrypt family

HydraCrypt

Pony,Fareit

Xorist Ransomware

Pony family

Detected Xorist Ransomware

Xorist family

UAC bypass

Renames multiple (908) files with added filename extension

Renames multiple (5276) files with added filename extension

Renames multiple (2189) files with added filename extension

Renames multiple (6563) files with added filename extension

Deletes shadow copies

Indicator Removal: Network Share Connection Removal

Disables RegEdit via registry modification

Drops file in Drivers directory

Blocklisted process makes network request

Checks computer location settings

Drops startup file

Deletes itself

Unsecured Credentials: Credentials In Files

Reads user/profile data of web browsers

Executes dropped EXE

Reads data files stored by FTP clients

Credentials from Password Stores: Windows Credential Manager

Adds Run key to start application

Checks installed software on the system

Declares broadcast receivers with permission to handle system events

Requests dangerous framework permissions

Checks whether UAC is enabled

Enumerates connected drives

Looks up external IP address via web service

Drops desktop.ini file(s)

UPX packed file

Drops file in System32 directory

AutoIT Executable

Suspicious use of SetThreadContext

Drops file in Windows directory

Drops file in Program Files directory

Event Triggered Execution: Netsh Helper DLL

Browser Information Discovery

Unsigned PE

System Location Discovery: System Language Discovery

Program crash

Enumerates physical storage devices

Checks processor information in registry

Modifies Internet Explorer Phishing Filter

Interacts with shadow copies

Runs regedit.exe

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Modifies data under HKEY_USERS

System policy modification

Kills process with taskkill

Uses Volume Shadow Copy service COM API

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Modifies registry class

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious behavior: RenamesItself

Enumerates system info in registry

Runs net.exe

Checks SCSI registry key(s)

Modifies Internet Explorer settings

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-22 22:54

Signatures

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral30

Detonation Overview

Submitted

2024-11-22 22:54

Reported

2024-11-22 22:56

Platform

win10v2004-20241007-en

Max time kernel

93s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c3dd2e3cf0ebeec7a6c280e187a044a32b54b369a78aaaa89c600a0767b49704.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c3dd2e3cf0ebeec7a6c280e187a044a32b54b369a78aaaa89c600a0767b49704.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\c3dd2e3cf0ebeec7a6c280e187a044a32b54b369a78aaaa89c600a0767b49704.exe

"C:\Users\Admin\AppData\Local\Temp\c3dd2e3cf0ebeec7a6c280e187a044a32b54b369a78aaaa89c600a0767b49704.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1608 -ip 1608

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 320

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 98.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp

Files

memory/1608-0-0x0000000000540000-0x0000000000541000-memory.dmp

Analysis: behavioral32

Detonation Overview

Submitted

2024-11-22 22:54

Reported

2024-11-22 22:56

Platform

win10v2004-20241007-en

Max time kernel

93s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c8462829871b7bdb005f4dd881d253aa255a1b2f6f3d89edb1d609b51f5d04fd.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c8462829871b7bdb005f4dd881d253aa255a1b2f6f3d89edb1d609b51f5d04fd.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1304 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\c8462829871b7bdb005f4dd881d253aa255a1b2f6f3d89edb1d609b51f5d04fd.exe C:\Users\Admin\AppData\Local\Temp\c8462829871b7bdb005f4dd881d253aa255a1b2f6f3d89edb1d609b51f5d04fd.exe
PID 1304 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\c8462829871b7bdb005f4dd881d253aa255a1b2f6f3d89edb1d609b51f5d04fd.exe C:\Users\Admin\AppData\Local\Temp\c8462829871b7bdb005f4dd881d253aa255a1b2f6f3d89edb1d609b51f5d04fd.exe
PID 1304 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\c8462829871b7bdb005f4dd881d253aa255a1b2f6f3d89edb1d609b51f5d04fd.exe C:\Users\Admin\AppData\Local\Temp\c8462829871b7bdb005f4dd881d253aa255a1b2f6f3d89edb1d609b51f5d04fd.exe
PID 1304 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\c8462829871b7bdb005f4dd881d253aa255a1b2f6f3d89edb1d609b51f5d04fd.exe C:\Users\Admin\AppData\Local\Temp\c8462829871b7bdb005f4dd881d253aa255a1b2f6f3d89edb1d609b51f5d04fd.exe
PID 1304 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\c8462829871b7bdb005f4dd881d253aa255a1b2f6f3d89edb1d609b51f5d04fd.exe C:\Users\Admin\AppData\Local\Temp\c8462829871b7bdb005f4dd881d253aa255a1b2f6f3d89edb1d609b51f5d04fd.exe
PID 1304 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\c8462829871b7bdb005f4dd881d253aa255a1b2f6f3d89edb1d609b51f5d04fd.exe C:\Users\Admin\AppData\Local\Temp\c8462829871b7bdb005f4dd881d253aa255a1b2f6f3d89edb1d609b51f5d04fd.exe
PID 1304 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\c8462829871b7bdb005f4dd881d253aa255a1b2f6f3d89edb1d609b51f5d04fd.exe C:\Users\Admin\AppData\Local\Temp\c8462829871b7bdb005f4dd881d253aa255a1b2f6f3d89edb1d609b51f5d04fd.exe
PID 1304 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\c8462829871b7bdb005f4dd881d253aa255a1b2f6f3d89edb1d609b51f5d04fd.exe C:\Users\Admin\AppData\Local\Temp\c8462829871b7bdb005f4dd881d253aa255a1b2f6f3d89edb1d609b51f5d04fd.exe
PID 1304 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\c8462829871b7bdb005f4dd881d253aa255a1b2f6f3d89edb1d609b51f5d04fd.exe C:\Users\Admin\AppData\Local\Temp\c8462829871b7bdb005f4dd881d253aa255a1b2f6f3d89edb1d609b51f5d04fd.exe
PID 1304 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\c8462829871b7bdb005f4dd881d253aa255a1b2f6f3d89edb1d609b51f5d04fd.exe C:\Users\Admin\AppData\Local\Temp\c8462829871b7bdb005f4dd881d253aa255a1b2f6f3d89edb1d609b51f5d04fd.exe
PID 1304 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\c8462829871b7bdb005f4dd881d253aa255a1b2f6f3d89edb1d609b51f5d04fd.exe C:\Users\Admin\AppData\Local\Temp\c8462829871b7bdb005f4dd881d253aa255a1b2f6f3d89edb1d609b51f5d04fd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c8462829871b7bdb005f4dd881d253aa255a1b2f6f3d89edb1d609b51f5d04fd.exe

"C:\Users\Admin\AppData\Local\Temp\c8462829871b7bdb005f4dd881d253aa255a1b2f6f3d89edb1d609b51f5d04fd.exe"

C:\Users\Admin\AppData\Local\Temp\c8462829871b7bdb005f4dd881d253aa255a1b2f6f3d89edb1d609b51f5d04fd.exe

"C:\Users\Admin\AppData\Local\Temp\c8462829871b7bdb005f4dd881d253aa255a1b2f6f3d89edb1d609b51f5d04fd.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp

Files

memory/2728-0-0x0000000000400000-0x00000000004A0000-memory.dmp

memory/2728-2-0x0000000000400000-0x00000000004A0000-memory.dmp

memory/2728-3-0x0000000000400000-0x00000000004A0000-memory.dmp

memory/2728-4-0x0000000000400000-0x00000000004A0000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-22 22:54

Reported

2024-11-22 22:56

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Abrechnung.exe"

Signatures

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\svchost.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5D1EA93C = "C:\\Users\\Admin\\AppData\\Roaming\\Pkbrysp\\870A69705D1EA93C27C9.exe" C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3460 set thread context of 2092 N/A C:\Users\Admin\AppData\Local\Temp\Abrechnung.exe C:\Users\Admin\AppData\Local\Temp\Abrechnung.exe
PID 3300 set thread context of 2452 N/A C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Abrechnung.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Abrechnung.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr C:\Windows\system32\vssvc.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f59c2d6185d8bf0c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f59c2d610000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900f59c2d61000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df59c2d61000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f59c2d6100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\srtasks.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3460 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\Abrechnung.exe C:\Users\Admin\AppData\Local\Temp\Abrechnung.exe
PID 3460 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\Abrechnung.exe C:\Users\Admin\AppData\Local\Temp\Abrechnung.exe
PID 3460 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\Abrechnung.exe C:\Users\Admin\AppData\Local\Temp\Abrechnung.exe
PID 3460 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\Abrechnung.exe C:\Users\Admin\AppData\Local\Temp\Abrechnung.exe
PID 3460 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\Abrechnung.exe C:\Users\Admin\AppData\Local\Temp\Abrechnung.exe
PID 3460 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\Abrechnung.exe C:\Users\Admin\AppData\Local\Temp\Abrechnung.exe
PID 3460 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\Abrechnung.exe C:\Users\Admin\AppData\Local\Temp\Abrechnung.exe
PID 3460 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\Abrechnung.exe C:\Users\Admin\AppData\Local\Temp\Abrechnung.exe
PID 2092 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Local\Temp\Abrechnung.exe C:\Windows\SysWOW64\svchost.exe
PID 2092 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Local\Temp\Abrechnung.exe C:\Windows\SysWOW64\svchost.exe
PID 2092 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Local\Temp\Abrechnung.exe C:\Windows\SysWOW64\svchost.exe
PID 2092 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Local\Temp\Abrechnung.exe C:\Windows\SysWOW64\svchost.exe
PID 4948 wrote to memory of 3300 N/A C:\Windows\SysWOW64\svchost.exe C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre
PID 4948 wrote to memory of 3300 N/A C:\Windows\SysWOW64\svchost.exe C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre
PID 4948 wrote to memory of 3300 N/A C:\Windows\SysWOW64\svchost.exe C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre
PID 3300 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre
PID 3300 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre
PID 3300 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre
PID 3300 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre
PID 3300 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre
PID 3300 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre
PID 3300 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre
PID 3300 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre
PID 2452 wrote to memory of 4132 N/A C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre C:\Windows\SysWOW64\svchost.exe
PID 2452 wrote to memory of 4132 N/A C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre C:\Windows\SysWOW64\svchost.exe
PID 2452 wrote to memory of 4132 N/A C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre C:\Windows\SysWOW64\svchost.exe
PID 2452 wrote to memory of 4132 N/A C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre C:\Windows\SysWOW64\svchost.exe
PID 4132 wrote to memory of 860 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\reg.exe
PID 4132 wrote to memory of 860 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\reg.exe
PID 4132 wrote to memory of 860 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\reg.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\Abrechnung.exe

"C:\Users\Admin\AppData\Local\Temp\Abrechnung.exe"

C:\Users\Admin\AppData\Local\Temp\Abrechnung.exe

C:\Users\Admin\AppData\Local\Temp\Abrechnung.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre

C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre

C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre

C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Windows\SysWOW64\reg.exe

reg.exe add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\srtasks.exe

C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 155.57.22.2.in-addr.arpa udp
US 8.8.8.8:53 horad-forum.com udp
US 8.8.8.8:53 spatbe-web.com udp
US 8.8.8.8:53 qoa-acc.com udp
US 8.8.8.8:53 horad-fo.com udp
US 8.8.8.8:53 spatbe-w.com udp
US 8.8.8.8:53 qoa-a.com udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 31.73.42.20.in-addr.arpa udp

Files

memory/2092-0-0x0000000000400000-0x0000000000417000-memory.dmp

memory/3460-1-0x0000000000400000-0x0000000000421000-memory.dmp

memory/2092-3-0x0000000000400000-0x0000000000417000-memory.dmp

memory/2092-5-0x0000000000400000-0x0000000000417000-memory.dmp

memory/2092-4-0x0000000000400000-0x0000000000417000-memory.dmp

memory/4948-6-0x000000007FBF0000-0x000000007FC01000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\znydskbyrp.pre

MD5 81ff324d2023d8ecb98a127b87d51450
SHA1 acd24c80f6a02f7fe7a388a6779ea49be64674bc
SHA256 7d9fc496bc0ade736bf75e05564e9c93167362ef18450d75222deef0664f9ed5
SHA512 38b17683e835e7259a6972d0f920f9ac7f5823591962c624aa795c39c3213d0735bacd76c72b7255be1cefeb9c298ffc31266513f088684969e5e18ad4e0a139

memory/4948-13-0x000000007FBF0000-0x000000007FC01000-memory.dmp

memory/3300-17-0x0000000000400000-0x0000000000421000-memory.dmp

memory/2452-23-0x0000000000400000-0x0000000000417000-memory.dmp

memory/4132-25-0x000000007FCD0000-0x000000007FCE1000-memory.dmp

memory/4132-21-0x000000007FCD0000-0x000000007FCE1000-memory.dmp

memory/4132-26-0x000000007FCD0000-0x000000007FCE1000-memory.dmp

memory/4132-30-0x000000007FCD0000-0x000000007FCE1000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-11-22 22:54

Reported

2024-11-22 22:56

Platform

win10v2004-20241007-en

Max time kernel

140s

Max time network

136s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a7768f4973ad7cf8217212a4d12dbae0.exe" C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4900 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe C:\Windows\SysWOW64\cmd.exe
PID 3276 wrote to memory of 3636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3276 wrote to memory of 3636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3276 wrote to memory of 3636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4900 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe C:\Windows\SysWOW64\cmd.exe
PID 5024 wrote to memory of 3528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 5024 wrote to memory of 3528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 5024 wrote to memory of 3528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4900 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe C:\Windows\SysWOW64\cmd.exe
PID 1332 wrote to memory of 1820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1332 wrote to memory of 1820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1332 wrote to memory of 1820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4900 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe C:\Windows\SysWOW64\cmd.exe
PID 3912 wrote to memory of 716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3912 wrote to memory of 716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3912 wrote to memory of 716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4900 wrote to memory of 684 N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 684 N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 684 N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe C:\Windows\SysWOW64\cmd.exe
PID 684 wrote to memory of 920 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 684 wrote to memory of 920 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 684 wrote to memory of 920 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4900 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe C:\Windows\SysWOW64\cmd.exe
PID 2132 wrote to memory of 1972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2132 wrote to memory of 1972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2132 wrote to memory of 1972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4900 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe C:\Windows\SysWOW64\cmd.exe
PID 4472 wrote to memory of 3108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4472 wrote to memory of 3108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4472 wrote to memory of 3108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4900 wrote to memory of 3332 N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 3332 N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 3332 N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe C:\Windows\SysWOW64\cmd.exe
PID 3332 wrote to memory of 2080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3332 wrote to memory of 2080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3332 wrote to memory of 2080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4900 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe C:\Windows\SysWOW64\cmd.exe
PID 2364 wrote to memory of 1376 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2364 wrote to memory of 1376 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2364 wrote to memory of 1376 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4900 wrote to memory of 4432 N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 4432 N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 4432 N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe C:\Windows\SysWOW64\cmd.exe
PID 4432 wrote to memory of 2036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4432 wrote to memory of 2036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4432 wrote to memory of 2036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4900 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe C:\Windows\SysWOW64\cmd.exe
PID 1516 wrote to memory of 2656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe

"C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

Network

Country Destination Domain Proto
RU 95.163.104.80:80 tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 66.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

memory/4900-0-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/4900-1-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/4900-2-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/4900-3-0x0000000000400000-0x00000000004C2000-memory.dmp

Analysis: behavioral18

Detonation Overview

Submitted

2024-11-22 22:54

Reported

2024-11-22 22:56

Platform

win10v2004-20241007-en

Max time kernel

101s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\bc557a7bfec430aab3a1b326f35c8d6c1d2de0532263df872b2280af65f32b8f.exe"

Signatures

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zcrypt.lnk C:\Users\Admin\AppData\Local\Temp\bc557a7bfec430aab3a1b326f35c8d6c1d2de0532263df872b2280af65f32b8f.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\zcrypt.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zcrypt = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\bc557a7bfec430aab3a1b326f35c8d6c1d2de0532263df872b2280af65f32b8f.exe\" " C:\Users\Admin\AppData\Local\Temp\bc557a7bfec430aab3a1b326f35c8d6c1d2de0532263df872b2280af65f32b8f.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\7-Zip\History.txt C:\Users\Admin\AppData\Local\Temp\bc557a7bfec430aab3a1b326f35c8d6c1d2de0532263df872b2280af65f32b8f.exe N/A
File created C:\Program Files\7-Zip\History.txt.zcrypt C:\Users\Admin\AppData\Local\Temp\bc557a7bfec430aab3a1b326f35c8d6c1d2de0532263df872b2280af65f32b8f.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\bc557a7bfec430aab3a1b326f35c8d6c1d2de0532263df872b2280af65f32b8f.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\zcrypt.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\bc557a7bfec430aab3a1b326f35c8d6c1d2de0532263df872b2280af65f32b8f.exe

"C:\Users\Admin\AppData\Local\Temp\bc557a7bfec430aab3a1b326f35c8d6c1d2de0532263df872b2280af65f32b8f.exe"

C:\Users\Admin\AppData\Roaming\zcrypt.exe

C:\Users\Admin\AppData\Roaming\zcrypt.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 poiuytrewq.ml udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 101.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 74.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Roaming\zcrypt.exe

MD5 d1e75b274211a78d9c5d38c8ff2e1778
SHA1 d14954a7b9e0c778909fe8dcad99ad4120365b2e
SHA256 bc557a7bfec430aab3a1b326f35c8d6c1d2de0532263df872b2280af65f32b8f
SHA512 1ec3fbb0bf17d4ad6397ba2e58daa210745f10f88f6722971464a6eeb7573f49be6d65e70a497002d6d00745317f11442bdeaf999b91127b123c11dfe9b088c2

Analysis: behavioral23

Detonation Overview

Submitted

2024-11-22 22:54

Reported

2024-11-22 22:56

Platform

win10v2004-20241007-en

Max time kernel

144s

Max time network

152s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\bfb8f7f6cbe24330a310e5c7cbe99ed4_api-ms-win-system-wer-l1-1-0.dll,#1

Signatures

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\X: C:\Windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\I: C:\Windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\Y: C:\Windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\V: C:\Windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\P: C:\Windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\K: C:\Windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\B: C:\Windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\Z: C:\Windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\W: C:\Windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\U: C:\Windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\R: C:\Windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\O: C:\Windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\T: C:\Windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\S: C:\Windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\Q: C:\Windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\N: C:\Windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\rundll32.exe N/A
File opened (read-only) \??\J: C:\Windows\SysWOW64\rundll32.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\PROGRA~3\RUNDLL32.EXE-1192.txt C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\PROGRA~3\RUNDLL32.EXE-3836.txt C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\PROGRA~3\3EB10C382B31.dat C:\Windows\SysWOW64\rundll32.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\SysWOW64\rundll32.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4220 wrote to memory of 1192 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4220 wrote to memory of 1192 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4220 wrote to memory of 1192 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1192 wrote to memory of 3836 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1192 wrote to memory of 3836 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1192 wrote to memory of 3836 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\bfb8f7f6cbe24330a310e5c7cbe99ed4_api-ms-win-system-wer-l1-1-0.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\bfb8f7f6cbe24330a310e5c7cbe99ed4_api-ms-win-system-wer-l1-1-0.dll,#1

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\bfb8f7f6cbe24330a310e5c7cbe99ed4_api-ms-win-system-wer-l1-1-0.dll,AccessToken

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
DE 146.0.42.68:443 tcp
US 8.8.8.8:53 68.42.0.146.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
DE 146.0.42.68:443 tcp

Files

memory/1192-0-0x0000000000810000-0x0000000000811000-memory.dmp

memory/1192-1-0x000000000B000000-0x000000000B06F000-memory.dmp

memory/3836-14-0x000000000B000000-0x000000000B06F000-memory.dmp

memory/3836-15-0x000000000B000000-0x000000000B06F000-memory.dmp

memory/3836-16-0x000000000B000000-0x000000000B06F000-memory.dmp

Analysis: behavioral24

Detonation Overview

Submitted

2024-11-22 22:54

Reported

2024-11-22 22:56

Platform

win10v2004-20241007-en

Max time kernel

140s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\bldjad.ex1.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\bldjad.ex1.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\bldjad.ex1.exe

"C:\Users\Admin\AppData\Local\Temp\bldjad.ex1.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 74.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

memory/3896-0-0x00000000005D0000-0x0000000000600000-memory.dmp

memory/3896-1-0x0000000000400000-0x0000000000430000-memory.dmp

memory/3896-2-0x00000000005D0000-0x0000000000600000-memory.dmp

memory/3896-4-0x0000000000400000-0x0000000000430000-memory.dmp

Analysis: behavioral28

Detonation Overview

Submitted

2024-11-22 22:54

Reported

2024-11-22 22:56

Platform

win10v2004-20241007-en

Max time kernel

91s

Max time network

139s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\c325092750dd55898c47be7ec8a7622c3bf8d1a79c40b160ef7901c2ef18f5db.apk

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\c325092750dd55898c47be7ec8a7622c3bf8d1a79c40b160ef7901c2ef18f5db.apk

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 73.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 96.136.73.23.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-22 22:54

Reported

2024-11-22 22:57

Platform

win10v2004-20241007-en

Max time kernel

203s

Max time network

203s

Command Line

"C:\Users\Admin\AppData\Local\Temp\AES-NI.exe"

Signatures

Renames multiple (5276) files with added filename extension

ransomware

Credentials from Password Stores: Windows Credential Manager

credential_access stealer

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-4089630652-1596403869-279772308-1000\desktop.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Users\Public\AccountPictures\desktop.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Users\Admin\3D Objects\desktop.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Windows\SysWOW64\svchost.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ipinfo.io N/A N/A
N/A ipinfo.io N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D73CE810F817D372CC78C5824C36E338 C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D73CE810F817D372CC78C5824C36E338 C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\state.tmp C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content C:\Windows\SysWOW64\svchost.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailSmallTile.scale-200.png C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\MSFT_PackageManagement.schema.mfl C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\!!! READ THIS - IMPORTANT !!!.txt C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\es-es\ui-strings.js C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\SearchEmail.png C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Windows NT\Accessories\en-US\!!! READ THIS - IMPORTANT !!!.txt C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalSplashScreen.scale-100_contrast-white.png C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\cs-cz\!!! READ THIS - IMPORTANT !!!.txt C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\scan_poster.jpg C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\!!! READ THIS - IMPORTANT !!!.txt C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\!!! READ THIS - IMPORTANT !!!.txt C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\Advertising C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-black_targetsize-20.png C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\meta\!!! READ THIS - IMPORTANT !!!.txt C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\!!! READ THIS - IMPORTANT !!!.txt C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-48_altform-lightunplated.png C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\selector.js C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\!!! READ THIS - IMPORTANT !!!.txt C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarWideTile.scale-100.png C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\vlc.mo C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\checkmark.png C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\!!! READ THIS - IMPORTANT !!!.txt C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\lt_get.svg C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\AddressBook2x.png C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-36_contrast-white.png C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\!!! READ THIS - IMPORTANT !!!.txt C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailLargeTile.scale-125.png C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.27405.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\!!! READ THIS - IMPORTANT !!!.txt C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\SplashScreen.scale-125_contrast-black.png C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\!!! READ THIS - IMPORTANT !!!.txt C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_ru_135x40.svg C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptySearch.scale-100.png C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Google.scale-100.png C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\skins\default.vlt C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-60.png C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\contrast-white\!!! READ THIS - IMPORTANT !!!.txt C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Config\VMRCaptureConfig.json C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ru-ru\!!! READ THIS - IMPORTANT !!!.txt C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\!!! READ THIS - IMPORTANT !!!.txt C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-80_altform-unplated.png C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MEIPreload\!!! READ THIS - IMPORTANT !!!.txt C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pl-pl\ui-strings.js C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\!!! READ THIS - IMPORTANT !!!.txt C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Generic-Light.scale-400.png C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-256.png C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\nl-nl\ui-strings.js C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\!!! READ THIS - IMPORTANT !!!.txt C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-200.png C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\!!! READ THIS - IMPORTANT !!!.txt C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\pl-pl\!!! READ THIS - IMPORTANT !!!.txt C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-black\!!! READ THIS - IMPORTANT !!!.txt C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxLargeTile.scale-200.png C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\SmallTile.scale-125.png C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\!!! READ THIS - IMPORTANT !!!.txt C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarSplashLogo.scale-100.png C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\FileAssociation\!!! READ THIS - IMPORTANT !!!.txt C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-si\ui-strings.js C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\FileExtension.targetsize-16.png C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\WideLogo.scale-125_contrast-white.png C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\!!! READ THIS - IMPORTANT !!!.txt C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\s_filetype_xd.svg C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\StoreLogo.scale-200_contrast-white.png C:\Windows\SysWOW64\svchost.exe N/A

Browser Information Discovery

discovery

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\regedit.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\regedit.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\AES-NI.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\regedit.exe N/A
Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\regedit.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\regedit.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\regedit.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\regedit.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\regedit.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\regedit.exe N/A
Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\regedit.exe N/A
Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\regedit.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\regedit.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000 C:\Windows\regedit.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0 C:\Windows\regedit.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController C:\Windows\regedit.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController C:\Windows\regedit.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 C:\Windows\regedit.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral C:\Windows\regedit.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 C:\Windows\regedit.exe N/A
Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\regedit.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses C:\Windows\regedit.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1 C:\Windows\regedit.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral C:\Windows\regedit.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus C:\Windows\regedit.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000 C:\Windows\regedit.exe N/A
Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral C:\Windows\regedit.exe N/A
Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 C:\Windows\regedit.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 C:\Windows\regedit.exe N/A
Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus C:\Windows\regedit.exe N/A
Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 C:\Windows\regedit.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor C:\Windows\regedit.exe N/A
Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor C:\Windows\regedit.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 C:\Windows\regedit.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 C:\Windows\regedit.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral C:\Windows\regedit.exe N/A
Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController C:\Windows\regedit.exe N/A
Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 C:\Windows\regedit.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\regedit.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor C:\Windows\regedit.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 C:\Windows\regedit.exe N/A
Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral C:\Windows\regedit.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 C:\Windows\regedit.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses C:\Windows\regedit.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus C:\Windows\regedit.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor C:\Windows\regedit.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 C:\Windows\regedit.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus C:\Windows\regedit.exe N/A
Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1 C:\Windows\regedit.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter C:\Windows\regedit.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter C:\Windows\regedit.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 C:\Windows\regedit.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController C:\Windows\regedit.exe N/A
Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 C:\Windows\regedit.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 C:\Windows\regedit.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 C:\Windows\regedit.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 C:\Windows\regedit.exe N/A
Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0 C:\Windows\regedit.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1 C:\Windows\regedit.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController C:\Windows\regedit.exe N/A
Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 C:\Windows\regedit.exe N/A
Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 C:\Windows\regedit.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter C:\Windows\regedit.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 C:\Windows\regedit.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController C:\Windows\regedit.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0 C:\Windows\regedit.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 C:\Windows\regedit.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral C:\Windows\regedit.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral C:\Windows\regedit.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral C:\Windows\regedit.exe N/A
Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter C:\Windows\regedit.exe N/A
Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 C:\Windows\regedit.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 C:\Windows\regedit.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\regedit.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133767897072534488" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\svchost.exe N/A

Runs regedit.exe

Description Indicator Process Target
N/A N/A C:\Windows\regedit.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\regedit.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\AES-NI.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4488 wrote to memory of 3436 N/A C:\Users\Admin\AppData\Local\Temp\AES-NI.exe C:\Windows\SysWOW64\svchost.exe
PID 1448 wrote to memory of 2984 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 2984 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 1556 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 1556 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 1556 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 1556 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 1556 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 1556 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 1556 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 1556 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 1556 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 1556 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 1556 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 1556 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 1556 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 1556 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 1556 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 1556 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 1556 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 1556 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 1556 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 1556 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 1556 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 1556 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 1556 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 1556 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 1556 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 1556 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 1556 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 1556 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 1556 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 1556 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 4280 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 4280 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 4216 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 4216 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 4216 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 4216 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 4216 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 4216 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 4216 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 4216 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 4216 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 4216 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 4216 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 4216 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 4216 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 4216 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 4216 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 4216 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 4216 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 4216 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 4216 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 4216 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 4216 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 4216 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 4216 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 4216 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 4216 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 4216 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 4216 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 4216 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1448 wrote to memory of 4216 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\AES-NI.exe

"C:\Users\Admin\AppData\Local\Temp\AES-NI.exe"

C:\Windows\SysWOW64\svchost.exe

"C:\Windows\SysWOW64\svchost.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff92b0bcc40,0x7ff92b0bcc4c,0x7ff92b0bcc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1840,i,18254194378069585772,14315345606273405129,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1836 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2180,i,18254194378069585772,14315345606273405129,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2228 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2280,i,18254194378069585772,14315345606273405129,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2468 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3140,i,18254194378069585772,14315345606273405129,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3160 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3284,i,18254194378069585772,14315345606273405129,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3300 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4048,i,18254194378069585772,14315345606273405129,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3752 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4836,i,18254194378069585772,14315345606273405129,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4852 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4880,i,18254194378069585772,14315345606273405129,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4924 /prefetch:8

C:\Windows\regedit.exe

"C:\Windows\regedit.exe"

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\!!! READ THIS - IMPORTANT !!!.txt

Network

Country Destination Domain Proto
US 8.8.8.8:53 ipinfo.io udp
N/A 127.0.0.1:55469 tcp
US 34.117.59.81:443 ipinfo.io tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 66.208.201.84.in-addr.arpa udp
US 8.8.8.8:53 r11.o.lencr.org udp
GB 104.77.118.64:80 r11.o.lencr.org tcp
US 8.8.8.8:53 81.59.117.34.in-addr.arpa udp
US 8.8.8.8:53 125.101.20.2.in-addr.arpa udp
US 8.8.8.8:53 64.118.77.104.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
AT 86.59.21.38:443 tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
DE 131.188.40.189:443 tcp
US 8.8.8.8:53 189.40.188.131.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
GB 172.217.16.228:443 www.google.com tcp
US 8.8.8.8:53 202.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 228.16.217.172.in-addr.arpa udp
GB 172.217.16.228:443 www.google.com udp
US 8.8.8.8:53 clients2.google.com udp
GB 142.250.178.14:443 clients2.google.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 14.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 102.208.201.84.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp

Files

memory/3436-0-0x0000000001910000-0x0000000001A0E000-memory.dmp

memory/3436-1-0x0000000001910000-0x0000000001A0E000-memory.dmp

memory/3436-3-0x0000000001910000-0x0000000001A0E000-memory.dmp

memory/3436-2-0x0000000004E00000-0x0000000004FC3000-memory.dmp

memory/3436-4-0x0000000004E00000-0x0000000004FC3000-memory.dmp

memory/3436-5-0x0000000004E00000-0x0000000004FC3000-memory.dmp

memory/3436-6-0x0000000004E00000-0x0000000004FC3000-memory.dmp

memory/3436-14-0x0000000001910000-0x0000000001A0E000-memory.dmp

memory/3436-15-0x0000000004E00000-0x0000000004FC3000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

MD5 74ba39c56424391810eceda0603e9704
SHA1 3f3114aabf8f981dcc8228ea86b4b3f0ac3d1c26
SHA256 299d18d40699d242074f45717c0f13cea2dc0da2e13c3561b495096937e6f250
SHA512 c37f32473b51a30415268870b7ce93a9af935764696d3f6b92854087db1689043c7e614011857f86abc6fed376ac6944f039f8fc4569f1e0a1fd75865ceb126e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 67504afafefd8527ce0f0c5afb9dd486
SHA1 0b317a82fc4014237674752bca0bf7ef780c0dcf
SHA256 360d8a39f31d73ed4f8400e1649af9ac92340a34793a7c7aeef02bd79e0a4d05
SHA512 980ef467fc639d584a90e6856818c01e5b31d0c276a3fa4683f02d0133ba5703bfc0be86f4022618f5567a9c5fa1efec68e8ead06519259cd466579c3f2db868

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 786c558788e6671b273bd7c6ca866a35
SHA1 924b9fa9172bb572b0d9b984a8760778fcdb5dd8
SHA256 cce0ed2fdd26498814dbeb22bdffd9e07bfb084bb42fc94b33d6223792fadaf8
SHA512 103731e03afdd576f18c6fb1d269770dd53ef0b7e2f171d3dd63fc3900edf748bf8f5d594cfa996739b462ddf9f7a0f59d6cce5d13e96c2ce543c544de95bcee

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 c01d55b0d079730cba5dcbcee4e24702
SHA1 bf6ad935c45918d4269f497e875ba6d1795ed5b1
SHA256 a6bb7fbcc559f3b1f68ce5821777451dcbd7d81037afa7acf5820b1f812233d7
SHA512 f65dc2dafdf93dee6c3600eef345e196c43e2a12e009ca4f0d5ed0b7cec984bcf91943b20c68961b583aad4572b0c78bce7c9a8b580fe8e3a1a9b9ef6ffd207c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 ce263be4d951717a11bd2b9fa5b7d71e
SHA1 622c94d4d669149461a61395d1219d1e7bc46a2b
SHA256 37d5fec9e3eb5569c4e67e8e66f3c83cf2b6c08a87dc638480cdececf02c40d7
SHA512 7737a9c919459a72f0f88d7fa0579a65c69a40fc8f1436ba12821501e1bd866b5b1207ece2d411919fa73aef0e548d58e37328b80d30787638673cd71b0df546

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 8ed3a288461216d5cc62dfc6c1a75e8c
SHA1 614fde314adf21b48c23b32010531ff945ba7106
SHA256 065f08442002d3a433b47e8b9ac0fe386f26235d07e9801f8081b6ed241bba73
SHA512 09305e15faebfb122bf3e6c4039f360721f759a912220f810478f3f04ea05d0242c964d8f3c8d37ec021faa977cac0c156e6f55879c4a547f2be4a22cde75ae5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

memory/3436-142-0x0000000001910000-0x0000000001A0E000-memory.dmp

memory/3436-190-0x0000000001910000-0x0000000001A0E000-memory.dmp

C:\Users\Public\!!! READ THIS - IMPORTANT !!!.txt

MD5 1ad9f49d132a3a0cb8d72f528d8027c9
SHA1 9067822f3059f2e4a4f634ddce2d14c0adbc14b4
SHA256 9830ae9d40a9a2d223cb570a8ea8496656bb063c98f64311001e05bb15507e10
SHA512 f3178e8cad45fc9122606b3000d0d41d7fd8deebf5001d66f1fe2323772e1c258f1c2613c62c86c2b20746e26bfd610f51cea7de947b3ace631153fe15df98db

memory/3436-151-0x0000000001910000-0x0000000001A0E000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db

MD5 24981129047fabba60eb9ff14480a7f8
SHA1 8385e8257ab3e09b877493ca35fc67871474d8c8
SHA256 5c955a1fc712aacb226c173b5d30210e241ae1c3fbef80cf31625357e64aa5f9
SHA512 39d3f5848d1ef4023403dd01937a6ab92df82eaccb062ff1bbc80110fd47a1852ddd6a3223b401f71e1d1e3af80d2c708e97c10546817548bd0a69d6f3f1571e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

MD5 ef48733031b712ca7027624fff3ab208
SHA1 da4f3812e6afc4b90d2185f4709dfbb6b47714fa
SHA256 c9ce8dbbe51a4131073db3d6ceef1e11eaca6308ad88a86125f221102d2cee99
SHA512 ce3a5a429e3796977a8019f47806b8c0671b597ead642fcbfbe3144e2b8112d35a9f2250896b7f215d237d0d19c5966caf3fe674165a6d50e14cb2b88c892029

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db-journal

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser

MD5 ef6204d1c447519357b5fd217f782a07
SHA1 37dcb24929c9c70f2f371cb7cb0b01ef0c9dc24d
SHA256 d6b16c80dd78cfb5aa746108adad85f1f33459ece1d9c05657bb919b445328aa
SHA512 14608a36cfca745fca5a7b2f178aba65d52c991af1653e67a0492684943a05d4beb6da1d703c903b8f31548ac314c3040ff3bfe4a1e6329abe63d111e93c7e08

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

MD5 bded23322341bd09f87dd22f01567ca1
SHA1 c36dbe60efb0d0de39d84135e7ee1332a25fcb07
SHA256 46a620e0967cda45a21ad6682310d4bb85df4dd73a4516259e316be14caf35f7
SHA512 6d8e17b7ec02b9ab6b96768302970c137b1272059fccb6956d1567f1d365e3e8ba1c68b18b2f11332aabd715e408750fef5dfefc67a84471007341c48ce4fd10

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 024c920ca941a5b0d794bf6bf5d3f481
SHA1 2a157198c2e219983f3aabc2e124a50c6a9a6968
SHA256 a2e0b0a7063442f9ebbb3367d2d193edbbeb02fd1ce6034eb3f7b12fd91d0251
SHA512 e6b52106ded6935963b0ae12f019c4ce2a9692daedc3e2b321326276bfa8fb8b9be813d13cc6749c550ef6490a15831eced705e47488f6038c1f14abb717de36

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

MD5 16bdb5cd3222e70d3dc8223d20fca109
SHA1 71de75edd74b204a1ee5377d5719cb8ad72fc843
SHA256 9c70b466720c6fc1f070645b969b9c9c66b7d7abeee9575ef2f0666512ae51d4
SHA512 72e90914cf4c70860a31c2cb86cd5f3f2924eea3fffd44c3171131749c81b6fdd692720b26268e322dc9e24f2d40458d55caf64409a000b6619d799ac61a183a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1

MD5 a2b99f58be432967fd562c2d4fb74fda
SHA1 924f2092a6d63f7972f41686acc48846cc888ca5
SHA256 32b2e1ec41bf092ebaffda1a024bd0045e59de52e79ea0f563e4a1a2b23f1cf7
SHA512 273aee3975cf0ef720b5db4a2393d522ab0f45f45b46add69d6ae64e2881524da8e8055cf0d0a5d1e9938424bd6730a35137d0a0c72ff3c8653a36a052f46955

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3

MD5 f9e43691c768dcb5c3c3937570040cff
SHA1 61787e476c7d1a7266ace274d7447b5bc7a46816
SHA256 a365e6d6c760db67acc7b7d04e8eb40ad9089ca879a2a0b0bab5f07c97055ca7
SHA512 5ee99e5296b2b70e342f2046d85ef13a65df6c90c1909ca08830e6b19414fef3e590fea9f5637b5de7359f386f90a7f133a69a82fd6d31690f2a91d381edd0e3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 18c61714ffca60677ba1e1ab85a0c72e
SHA1 0c0371b8185f3fbab5951784fbee6a7dfe51ef80
SHA256 15855254b57a146a0c09ad678cbbff0c00fae54d5340061d1d60eeb8d9360695
SHA512 8696188d6b1ca0c27aa9836f7d452bc51ddf605b3bf401cab55f7211f76fb84a966bff34d5bd618a54af79ab83ee2175b9eed68c1353adccb006db1f40badfc2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 2a55dc3c2b6bf639f6ee044d46d95ce1
SHA1 6a033e2f84b7315a657d89722b9c4fd206bbde33
SHA256 951fda715cbac1c7a78332849e741464e81ca2361ee93b39f006e19bb1b6a554
SHA512 52345c6a1dbf47135ef3dea872ef04da13feacdd2c8d9bafaeb8a26dca4093282078d585b8d635827e8c7a2a4f8fcfbff757c5fffb1ec5748e1479d3eebe8dd8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

MD5 5ca14edb78269b90d20b6d94f0627e29
SHA1 c0f35649e40be5e7674680f926e54c1d6f71e2e0
SHA256 a97c9e52727760fca12e0460eb6cd5fa4abd051d45b94de66becbf3e8f4aed89
SHA512 b7c929cb4d1bb21d1a203395b91f42b30686d4bd8ee4acd53556fb0ed3cfa6d15d734fbaf30ef71cb9228544d7057658ad67cb978b8936131cdcce9a824ae4dd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager

MD5 cefa092d1ca979fda16607a0f259fc09
SHA1 29b636134b58715370774ae44ec1de0783727dde
SHA256 daae4de02622629d05e7ba5721ea212672fc9a8e4cabb90ab01ec6f5b03b8ae8
SHA512 f4a9aa91e71ceaeebb91999c2b9e108a4e008086135cea14a19b18f38cce7d5fbfb8e33d1a8a7c1e8e37681337301c239f36b61d714c82caada511728562b01c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1

MD5 0db43dccbe22897934d6cd085b9bdf23
SHA1 9c705e3a7e3e4f5e456e9df1fe84aa40eafd387f
SHA256 3c6500854a4eccb7dfcce8a5058a66caaacd0f5768dca61650f315ca41bda771
SHA512 b1bd37dc2e1e337e7e1df658df05109b5fae512562e2bfea7e5175a2d742c951a08194d270f2ed3cc3b9c0783dbcebcb20df686f73e0d85785b161864040dcd8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0

MD5 32102db0d48f950b023828d0e12b3393
SHA1 3d4d370b2e4beca953c11a5ddc71c0dc8cca5f49
SHA256 36d6a76a9b6e285f9c24d0c07576e8142bc3cfb143d30c8cac225f17529f5087
SHA512 d007cc30952971f9fd1f80ba46acaad008a7ab3afe31f830c359aa3aad56da81bb36917bb415c9d22d533587406fcce6193d567f7a7779171cf9b9a0954fb2db

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG

MD5 6938f3c2308852f41cf4adc19a605754
SHA1 c8c91a37dfcff34fd3d45fc98a013e6ea2a08d40
SHA256 6aa95b191151de149a5ca42e6ac14353636844eb9475c25dffae01ecf3586b3a
SHA512 635b96010055e59b7645e68d72859c99c7f4f649e01c1df067ebc112ce8db0abb297f78342bc75694959836d050cf3c95593a3b106f38829ee6f74e6bae7f5fa

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13376789705994808

MD5 373709aa679a3cf0d9b76f950f9bd7c5
SHA1 303b1ff00d34ae7df9c6519989d64db2c9fe71f4
SHA256 844e88e0836146f9fc9886c0f6dedf9cd4870d7a53e1210dee32b53b49007875
SHA512 5035e5b20ec737f3394a3d84859b9a412e6dbe9d1685d90e56bd6476b3a36cdfbc1b6af6ecc535cc0c132043fd8160827a634271ec53609fe4c7acbf6fe96588

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_3

MD5 2e0faaa4b5384a0761b6060259a1f22c
SHA1 25cd3833e2185b983a5644046494ff5bed97e80c
SHA256 421070d6d8b16ae591c9f9845677555dc0b3ae313e44737810ab10d6997824da
SHA512 a93e617711f2a722c43d036556ecd904597f04afd158b2693c6178573528c44588df2aa8f5f7d7d09f45171bb6e80ae5c5d5afba921421757e590edf54310ab7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\LOG

MD5 a35de9df82eff9a7101633d05cfc3743
SHA1 fe16253defaa7ceb7bbb8dd91b7eff063011ad8c
SHA256 04e1c531e866501d8f1f7d8c0d6bc0d18759807cd64a6d618aafae7acfbc0558
SHA512 29711ac467a9160b9fe41f1736ac0c056a735f247179d67c982b5ce2bd27d15b974b3c10a456e147e38b73c6c576da48d8bcb0df38fffe091adc090c435f486f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_2

MD5 edfb7db274cd03b1e418cef76d221fc4
SHA1 e291a5709a44ff04ae4940afdc6a79279e26c1f1
SHA256 1ad8a95455317ae96563865b15c99aa76d077460071b9b7115095da52c17946b
SHA512 26b0e98ccaea0524bc8553ddfa29d1ec54f5b757dcdbcbeaa5d603b70ee6217a36321698ff22cdb63130de9903d062eedb6de310a131d6211a79d042d9be2afb

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

MD5 6199976893acb84658a427869dcdd5ba
SHA1 b346f5749c087e0742ad879f3ef6ead1755e0e33
SHA256 f1e104f6b3a05de3421c7e7c6a836ba7e16f40c7c385624b8d8682c7f0410004
SHA512 ea5ff41422dde2110784705e9ed15eadb431ccf7a5be720375560192fb92d50177c7068292d95014e341dae6d5c2ba4de60a36e73d74349cb11edfe752dfa6fe

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0

MD5 d4851cc2df28a196fb1d98e00ea1cbda
SHA1 9c8dac168f9eb36c5d78674c4410ec7c698823ea
SHA256 df0660435a79f823c3f9c959be19f49d3ea03fe84565d130f08210814871854b
SHA512 fdfccdc6330d96594870af3839a22a1a15df151630b8b4c6c6afb0c315483c66b6191964479a6afb8fd57d7d456bde6180cb7e70698ed7ba390f5a99d374920a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG

MD5 fd5b3a542973b1d019e521205a13f45c
SHA1 3becef18fea70b00fba396765201ff2b8991899d
SHA256 d1b6fd19441c901135faa45b0b815434eaf7d2b1381f11a77226c766a8ab1187
SHA512 b34d854396f54135fe86adb544933f4b4313ef11dfb9298b52783fcb18fa549713c9e0ae2418405530387969368d2ac80332e9be2c76eab3993cd9fd4d66f11d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 ea96ba98f5187e1c1d04be0136c16dfa
SHA1 d3e89241e3424bc2991c252b768b3d7c9ae01690
SHA256 bae4eca7823acb342b8782dcfe0687e25a441b060ed749bf74110a06efd56d16
SHA512 c625b9792390d2eeabdeb67c214bb498b3900ceb9049b61f526f9f87727b1660d0bf7679ed1c37e8571919ffe5b6f6767cb1116af3f2eb72c7d91af756258d8f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL

MD5 972cf964ab9d897959ce7d0ba84c4c97
SHA1 5da2fd8ddcb437ce6ed1c5a73b787c6202a98851
SHA256 fd7c0be7a823ef114da4b2f4fa25cadd34a8745cd8d643cfbf35919bb654b0d6
SHA512 9cb891baa6cb9a0cbd774f58f7383d5e836d95d27f3447bcc527ce40d335db5c11967a73ea808e20eec4dcad03fa3cb3fac7804c950be7df35807f9ce5b880b8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 9c97297575ef9a81b28b0cbd24d5ac7d
SHA1 f0f3b0f024ec954b23f44f70c438fc4d26db7100
SHA256 c4c0022275e68ba410803a2a80df7f04fb78b712e56f3f3b44c1be8106cad655
SHA512 00eeac217335baacede5c878647f7240541f264e14bf8162d457b5bd7aab9f4a062c9ded21cc2223e4317535b27c0b6a324d27f9ca6692299836aada077a52da

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies

MD5 1761e3da3953d5aa332a1ce04383e235
SHA1 32a05b812a5aad04fb88c94ec2340e115cb7b6b2
SHA256 0a348da2637f76077c949a0c659b4761d99366c3ba13b0fca7c4f1536245575e
SHA512 fa300da4df7dcafaf7cd641985ac1f51174ed13e447c66881c67e64a2ceb194804320141d56beecfcc103638a9cb0d8c345070f619996b914ca5b6d063d92e49

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG

MD5 37da1a52f09a4bd87a95cbe282a771cd
SHA1 ab47fb756995476db181a928b2e33eafc90e60d5
SHA256 f5f68d4a4727632fd7798a83f06c7d9b53a590be7f83317a18ae15759219570a
SHA512 3ead959f5f25715c496710225b2ea545f50f66281615f4aecc1d46c5a3453a52f3bd1c04930172c983461896fdee4e99d3a1b148e8e56bcad516e8aab5a804da

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG

MD5 c504f8871f32246fd5fe3cda50e31181
SHA1 56df34dc024316e934d7e4b5df8683a336c4c255
SHA256 18f0a114f2a63440e857572e714b3b91b184d458ace51e3dc944d643257baaa5
SHA512 725c70593b05cc77b8f0ed9886751e18f638c4a1de7609005e0e3b0483df158eef1a81e48d4c336ce3c9d566d33ef8a1c8cfdbb5b59521a6f7e56bc2bcbce998

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG

MD5 60a392689a92d166a95a0b69cc046e6a
SHA1 a3e120e245d7e32d5aa218c30925331945ee4ce0
SHA256 8bb58fe6dd4979ea6d069f2f375a00eb73a114a9e5e5ab0d2748faff41ef0ae3
SHA512 c1d72ae9cfb3dfb5db8b77cae30a08d6a44a8276c7dce455ac2a26ac8f6c070966f4496e4da6672f8f0cd6c843d5cdb6b7c740336866ec784fb12bf663f4f5c6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG

MD5 b8f7cda985ccb2a0d39b94889ec532b7
SHA1 629a164de036e2a42c91cc0455bcb9b29e8198c2
SHA256 b295dadd5230da7b92251586e993366f2cf528a2c5d46d3e3998a9fe3fadad27
SHA512 bece351604d1e90fed350f7baccd4facc25be4c506131a9ad0fc73b217e02bec1c9a45474bff4be289e502213f21f8e1163e920c4ae754d3277e407ccab721a8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG

MD5 52d9189a369d62c03af2de61a01d7329
SHA1 d027d7cc76bf72ceee81c9b1a43aeb3b24ea0378
SHA256 f268032b7cf249d4bf68fb91ef3a5526c6a1923057c617e82e048ee1ba2e362c
SHA512 0861d7e63fa2c83245f5095062cb346aeaa7f7280c5fe0e5e41ca8f6ec2b8416b7e3a33454244b52507b8db5d81897b1b6f44df752110f8ee1240f9805d9d8cb

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG

MD5 3c89f06657175475b8674435096c0ad0
SHA1 f5f5a3ff5f71f99de57f7e74f742d5f3685514fb
SHA256 d2c41f3cd8cb7da7887c33893e457905867ad646c455dbfcd74fa5a527d52eb6
SHA512 5e9ded9c21a8a1008b4b7efe4a4672fcd1bcbbf3a528e1ad9d589a6732cf33b044fc8440ce1a76b9f90169dbf9fc67040448ee5c580bac60fdf904dd83b8fc14

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

MD5 ed9d14f456c7b0a459aa45effb8f08b4
SHA1 9b65f552e410d85d1886451851cb27e721ee7716
SHA256 4d3378cf69e1c767b9076f2f7f569bcc261f1147ef87c91dcae07f587bf2232a
SHA512 a48608df682f57b058015b64dedd92b2b97ab0f23a1b7357f28e11043718f2f3b3d564ff9aeca637f5779617b9f69118574262c0101fc6c32b91dd0ab176a7ba

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

MD5 930a7081bcc7b94403305592f5f8b113
SHA1 55ca0c55af1cbcebf54c94ba2ac43a626eb0faa8
SHA256 5925ae5f3c737f90b40e0e698d33a132042c1f1c994b751eeea97ba773603847
SHA512 e38976d0ed53336297dd6682a1266084eb36a3e706680ca25248c8f242298e2a97ab9c79b1404e4a2fce964171e0cab11e5dd74e270324c486b817310714601c

memory/3436-25721-0x0000000001910000-0x0000000001A0E000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-4089630652-1596403869-279772308-1000\desktop.ini

MD5 7148b1f36bc1cb13a0c2c97ad73d6ba9
SHA1 5e3a5373b447e2638b05edc1fd8274b52db54fd7
SHA256 0fb417762742644b2da83496982449679b5673cf1489bcbbb6ea8317b55abf86
SHA512 a95e8943785902f60173e6959e675f90556d88f9645fec33e71a880111465ca67af2854e90d6db46cf332623949e90ab4d37333baced39a8cfd2a883bd3dcd33

Analysis: behavioral5

Detonation Overview

Submitted

2024-11-22 22:54

Reported

2024-11-22 22:56

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a66dde22983583da6d3b1e5b9eb1e8fb019f5157eda508305942292c0d10fa43.exe"

Signatures

Deletes shadow copies

ransomware defense_evasion impact execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jqipaviz = "\"C:\\Windows\\cdykubdg.exe\"" C:\Windows\SysWOW64\explorer.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\a66dde22983583da6d3b1e5b9eb1e8fb019f5157eda508305942292c0d10fa43.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2472 set thread context of 1484 N/A C:\Users\Admin\AppData\Local\Temp\a66dde22983583da6d3b1e5b9eb1e8fb019f5157eda508305942292c0d10fa43.exe C:\Windows\SysWOW64\explorer.exe

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\cdykubdg.exe C:\Windows\SysWOW64\explorer.exe N/A
File created C:\Windows\cdykubdg.exe C:\Windows\SysWOW64\explorer.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a66dde22983583da6d3b1e5b9eb1e8fb019f5157eda508305942292c0d10fa43.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A

Modifies Internet Explorer Phishing Filter

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\PhishingFilter C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0" C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\a66dde22983583da6d3b1e5b9eb1e8fb019f5157eda508305942292c0d10fa43.exe

"C:\Users\Admin\AppData\Local\Temp\a66dde22983583da6d3b1e5b9eb1e8fb019f5157eda508305942292c0d10fa43.exe"

C:\Windows\SysWOW64\explorer.exe

"C:\Windows\system32\explorer.exe"

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 piglexer.com udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 96.136.73.23.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 piglexer.com udp
US 8.8.8.8:53 piglexer.com udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 piglexer.com udp
US 8.8.8.8:53 piglexer.com udp
US 8.8.8.8:53 piglexer.com udp
US 8.8.8.8:53 piglexer.com udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 121.118.77.104.in-addr.arpa udp
US 8.8.8.8:53 piglexer.com udp
US 8.8.8.8:53 piglexer.com udp
US 8.8.8.8:53 piglexer.com udp
US 8.8.8.8:53 piglexer.com udp
US 8.8.8.8:53 piglexer.com udp
US 8.8.8.8:53 piglexer.com udp
US 8.8.8.8:53 138.136.73.23.in-addr.arpa udp
US 8.8.8.8:53 piglexer.com udp
US 8.8.8.8:53 piglexer.com udp
US 8.8.8.8:53 piglexer.com udp
US 8.8.8.8:53 piglexer.com udp
US 8.8.8.8:53 piglexer.com udp
US 8.8.8.8:53 piglexer.com udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 piglexer.com udp
US 8.8.8.8:53 piglexer.com udp
US 8.8.8.8:53 piglexer.com udp
US 8.8.8.8:53 piglexer.com udp
US 8.8.8.8:53 piglexer.com udp
US 8.8.8.8:53 piglexer.com udp
US 8.8.8.8:53 piglexer.com udp
US 8.8.8.8:53 piglexer.com udp
US 8.8.8.8:53 piglexer.com udp
US 8.8.8.8:53 piglexer.com udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp

Files

memory/1484-2-0x0000000000800000-0x0000000000838000-memory.dmp

C:\ProgramData\abekelataheficij\01000000

MD5 d6d1c8fbb124b1fb48ebfee6ebbc30cb
SHA1 8aadacd8913e4c51a1a6630335d896cc7d6aea55
SHA256 67691b9abbfb53e5d4a755077749fccc637219f5d1bef4b248f51c2c89eaa00d
SHA512 456433369157acb4b48f4b5fc2c7dd22a4930fb79e70ddc87af30e8708f34d8dbac5690ad649eaa82a3024184b75f4d9e2c1c0497617d7f9def8f57b6b8b577c

memory/1484-7-0x0000000000800000-0x0000000000838000-memory.dmp

memory/1484-11-0x0000000000800000-0x0000000000838000-memory.dmp

memory/1484-14-0x0000000000800000-0x0000000000838000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-11-22 22:54

Reported

2024-11-22 22:56

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\aa7ff3bc285bcb4ec48bf2f361f0ad0a1d9fc8f17b7323d2f0615ade68973c1e.exe"

Signatures

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HTCryptor.exe C:\Users\Admin\AppData\Local\Temp\aa7ff3bc285bcb4ec48bf2f361f0ad0a1d9fc8f17b7323d2f0615ade68973c1e.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Crypt = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HTCryptor.exe\"" C:\Users\Admin\AppData\Local\Temp\aa7ff3bc285bcb4ec48bf2f361f0ad0a1d9fc8f17b7323d2f0615ade68973c1e.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\aa7ff3bc285bcb4ec48bf2f361f0ad0a1d9fc8f17b7323d2f0615ade68973c1e.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aa7ff3bc285bcb4ec48bf2f361f0ad0a1d9fc8f17b7323d2f0615ade68973c1e.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\aa7ff3bc285bcb4ec48bf2f361f0ad0a1d9fc8f17b7323d2f0615ade68973c1e.exe

"C:\Users\Admin\AppData\Local\Temp\aa7ff3bc285bcb4ec48bf2f361f0ad0a1d9fc8f17b7323d2f0615ade68973c1e.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 98.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 100.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 27.173.189.20.in-addr.arpa udp

Files

memory/2068-0-0x000000007534E000-0x000000007534F000-memory.dmp

memory/2068-1-0x00000000003C0000-0x0000000000450000-memory.dmp

memory/2068-2-0x00000000053D0000-0x0000000005974000-memory.dmp

memory/2068-3-0x0000000004CE0000-0x0000000004D72000-memory.dmp

memory/2068-4-0x0000000004DA0000-0x0000000004DAA000-memory.dmp

memory/2068-5-0x0000000075340000-0x0000000075AF0000-memory.dmp

memory/2068-8-0x0000000075340000-0x0000000075AF0000-memory.dmp

memory/2068-9-0x0000000075340000-0x0000000075AF0000-memory.dmp

Analysis: behavioral20

Detonation Overview

Submitted

2024-11-22 22:54

Reported

2024-11-22 22:56

Platform

win10v2004-20241007-en

Max time kernel

94s

Max time network

138s

Command Line

"C:\Users\Admin\AppData\Local\Temp\be03e43db0b190b879c893102a76183231ea39ec51206d25651a3cacffa8d81d_Dumped_TDS=4F8C315F.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer_new.exe" C:\Users\Admin\AppData\Local\Temp\be03e43db0b190b879c893102a76183231ea39ec51206d25651a3cacffa8d81d_Dumped_TDS=4F8C315F.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\be03e43db0b190b879c893102a76183231ea39ec51206d25651a3cacffa8d81d_Dumped_TDS=4F8C315F.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kdxwdmvfnabjgcv = "C:\\Windows\\qiiggznfupvnnoafvmsz.exe" C:\Users\Admin\AppData\Local\Temp\be03e43db0b190b879c893102a76183231ea39ec51206d25651a3cacffa8d81d_Dumped_TDS=4F8C315F.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kdxwdmvfnabjgcv = "C:\\Windows\\qiiggznfupvnnoafvmsz.exe" C:\Users\Admin\AppData\Local\Temp\be03e43db0b190b879c893102a76183231ea39ec51206d25651a3cacffa8d81d_Dumped_TDS=4F8C315F.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kdxwdmvfnabjgcv = "C:\\ProgramData\\qiiggznfupvnnoafvmsz.exe" C:\Users\Admin\AppData\Local\Temp\be03e43db0b190b879c893102a76183231ea39ec51206d25651a3cacffa8d81d_Dumped_TDS=4F8C315F.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kdxwdmvfnabjgcv = "C:\\ProgramData\\qiiggznfupvnnoafvmsz.exe" C:\Users\Admin\AppData\Local\Temp\be03e43db0b190b879c893102a76183231ea39ec51206d25651a3cacffa8d81d_Dumped_TDS=4F8C315F.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\be03e43db0b190b879c893102a76183231ea39ec51206d25651a3cacffa8d81d_Dumped_TDS=4F8C315F.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\be03e43db0b190b879c893102a76183231ea39ec51206d25651a3cacffa8d81d_Dumped_TDS=4F8C315F.exe

"C:\Users\Admin\AppData\Local\Temp\be03e43db0b190b879c893102a76183231ea39ec51206d25651a3cacffa8d81d_Dumped_TDS=4F8C315F.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 trybesmart.in udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

memory/1316-0-0x0000000000F90000-0x0000000000FAD000-memory.dmp

C:\ProgramData\xplmpxsutrsturxfwltxrnfgojlwggul

MD5 1b66d1b5fc55429b5dc1f7e9b868f5c5
SHA1 4b1e580efe98737f04c102a35e8280bd8126a578
SHA256 3c28b281f86b61ca554cfb318fa1c320e8716b204e11f89392226c2bd248e93c
SHA512 c51525614acfeaff5c144acb054c70e121471d68b554537a3cf744bbaecafb7f8d548c3ba9441e01fadcfd5c370574ba080ed517e73eecbfc822684133befe72

memory/1316-14-0x0000000000F90000-0x0000000000FAD000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-11-22 22:54

Reported

2024-11-22 22:56

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Box (2).exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Box (2).exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Box (2).exe

"C:\Users\Admin\AppData\Local\Temp\Box (2).exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 106.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 96.136.73.23.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 2.173.189.20.in-addr.arpa udp

Files

memory/1884-0-0x00000000749CE000-0x00000000749CF000-memory.dmp

memory/1884-1-0x0000000000960000-0x00000000009D4000-memory.dmp

memory/1884-2-0x0000000005940000-0x0000000005EE4000-memory.dmp

memory/1884-3-0x0000000005430000-0x00000000054C2000-memory.dmp

memory/1884-4-0x00000000053F0000-0x00000000053FA000-memory.dmp

memory/1884-5-0x00000000749C0000-0x0000000075170000-memory.dmp

memory/1884-6-0x00000000749C0000-0x0000000075170000-memory.dmp

memory/1884-7-0x00000000749CE000-0x00000000749CF000-memory.dmp

memory/1884-8-0x00000000749C0000-0x0000000075170000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2024-11-22 22:54

Reported

2024-11-22 22:56

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b56c4569d639e8ce104d9e52dffeba6d18813c058887a3404350904811f32d54_not_packed_maybe_useless.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b56c4569d639e8ce104d9e52dffeba6d18813c058887a3404350904811f32d54_not_packed_maybe_useless.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\b56c4569d639e8ce104d9e52dffeba6d18813c058887a3404350904811f32d54_not_packed_maybe_useless.exe

"C:\Users\Admin\AppData\Local\Temp\b56c4569d639e8ce104d9e52dffeba6d18813c058887a3404350904811f32d54_not_packed_maybe_useless.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5068 -ip 5068

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 376

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 96.136.73.23.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 130.118.77.104.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 90.16.208.104.in-addr.arpa udp

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-11-22 22:54

Reported

2024-11-22 22:54

Platform

win10v2004-20241007-en

Max time kernel

0s

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

Country Destination Domain Proto
N/A 20.72.205.209:443 tcp

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-11-22 22:54

Reported

2024-11-22 22:56

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0.8476237917779167.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0.8476237917779167.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\0.8476237917779167.exe

"C:\Users\Admin\AppData\Local\Temp\0.8476237917779167.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4164 -ip 4164

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 296

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 90.16.208.104.in-addr.arpa udp

Files

memory/4164-0-0x00000000004A0000-0x00000000004A1000-memory.dmp

Analysis: behavioral19

Detonation Overview

Submitted

2024-11-22 22:54

Reported

2024-11-22 22:56

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bd2d4d43009623941f49554f5932188154fc9d16d820e00db1281d057468b017.vbs"

Signatures

N/A

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bd2d4d43009623941f49554f5932188154fc9d16d820e00db1281d057468b017.vbs"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 121.118.77.104.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 89.16.208.104.in-addr.arpa udp

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-11-22 22:54

Reported

2024-11-22 22:56

Platform

win10v2004-20241007-en

Max time kernel

93s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\be03e43db0b190b879c893102a76183231ea39ec51206d25651a3cacffa8d81d_TDS=4F90A68A.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\be03e43db0b190b879c893102a76183231ea39ec51206d25651a3cacffa8d81d_TDS=4F90A68A.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\be03e43db0b190b879c893102a76183231ea39ec51206d25651a3cacffa8d81d_TDS=4F90A68A.exe

"C:\Users\Admin\AppData\Local\Temp\be03e43db0b190b879c893102a76183231ea39ec51206d25651a3cacffa8d81d_TDS=4F90A68A.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 228 -ip 228

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 292

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 67.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

memory/228-0-0x0000000000780000-0x0000000000781000-memory.dmp

Analysis: behavioral25

Detonation Overview

Submitted

2024-11-22 22:54

Reported

2024-11-22 22:56

Platform

win10v2004-20241007-en

Max time kernel

140s

Max time network

137s

Command Line

"C:\Users\Admin\AppData\Local\Temp\bldjad.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\bldjad.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\bldjad.exe

"C:\Users\Admin\AppData\Local\Temp\bldjad.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 73.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 104.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

memory/2156-0-0x0000000002170000-0x00000000021A0000-memory.dmp

memory/2156-1-0x0000000000400000-0x0000000000430000-memory.dmp

memory/2156-2-0x0000000002170000-0x00000000021A0000-memory.dmp

Analysis: behavioral29

Detonation Overview

Submitted

2024-11-22 22:54

Reported

2024-11-22 22:56

Platform

win10v2004-20241007-en

Max time kernel

91s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c36c46f4de045ef332decc006694db6e.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c36c46f4de045ef332decc006694db6e.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\c36c46f4de045ef332decc006694db6e.exe

"C:\Users\Admin\AppData\Local\Temp\c36c46f4de045ef332decc006694db6e.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3588 -ip 3588

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 228

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 130.118.77.104.in-addr.arpa udp

Files

N/A

Analysis: behavioral31

Detonation Overview

Submitted

2024-11-22 22:54

Reported

2024-11-22 22:56

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\software = "C:\\Users\\Admin\\AppData\\Roaming\\cryptohost.exe" C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\software = "C:\\Users\\Admin\\AppData\\Roaming\\cryptohost.exe" C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2404 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe
PID 2404 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe
PID 2404 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe
PID 2404 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe
PID 2404 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe
PID 2404 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe
PID 2404 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe
PID 2404 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe
PID 4864 wrote to memory of 3672 N/A C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe C:\Users\Admin\AppData\Roaming\cryptohost.exe
PID 4864 wrote to memory of 3672 N/A C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe C:\Users\Admin\AppData\Roaming\cryptohost.exe
PID 4864 wrote to memory of 3672 N/A C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe C:\Users\Admin\AppData\Roaming\cryptohost.exe
PID 3672 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe C:\Users\Admin\AppData\Roaming\cryptohost.exe
PID 3672 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe C:\Users\Admin\AppData\Roaming\cryptohost.exe
PID 3672 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe C:\Users\Admin\AppData\Roaming\cryptohost.exe
PID 3672 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe C:\Users\Admin\AppData\Roaming\cryptohost.exe
PID 3672 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe C:\Users\Admin\AppData\Roaming\cryptohost.exe
PID 3672 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe C:\Users\Admin\AppData\Roaming\cryptohost.exe
PID 3672 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe C:\Users\Admin\AppData\Roaming\cryptohost.exe
PID 3672 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Roaming\cryptohost.exe C:\Users\Admin\AppData\Roaming\cryptohost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe

"C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe"

C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe

"C:\Users\Admin\AppData\Local\Temp\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe"

C:\Users\Admin\AppData\Roaming\cryptohost.exe

"C:\Users\Admin\AppData\Roaming\cryptohost.exe"

C:\Users\Admin\AppData\Roaming\cryptohost.exe

"C:\Users\Admin\AppData\Roaming\cryptohost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 100.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 blockchain.info udp
US 104.16.237.243:443 blockchain.info tcp
US 8.8.8.8:53 www.blockchain.com udp
US 104.16.57.69:443 www.blockchain.com tcp
US 8.8.8.8:53 243.237.16.104.in-addr.arpa udp
US 8.8.8.8:53 69.57.16.104.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp

Files

memory/2404-0-0x0000000075452000-0x0000000075453000-memory.dmp

memory/2404-1-0x0000000075450000-0x0000000075A01000-memory.dmp

memory/2404-2-0x0000000075450000-0x0000000075A01000-memory.dmp

memory/2404-3-0x0000000075452000-0x0000000075453000-memory.dmp

memory/2404-4-0x0000000075450000-0x0000000075A01000-memory.dmp

memory/4864-7-0x00000000009B0000-0x0000000000A30000-memory.dmp

memory/4864-5-0x00000000009B0000-0x0000000000A30000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe.log

MD5 da4fafeffe21b7cb3a8c170ca7911976
SHA1 50ef77e2451ab60f93f4db88325b897d215be5ad
SHA256 7341a4a13e81cbb5b7f39ec47bb45f84836b08b8d8e3ea231d2c7dad982094f7
SHA512 0bc24b69460f31a0ebc0628b99908d818ee85feb7e4b663271d9375b30cced0cd55a0bbf8edff1281a4c886ddf4476ffc989c283069cdcb1235ffcb265580fc6

memory/4864-6-0x00000000009B0000-0x0000000000A30000-memory.dmp

memory/4864-11-0x0000000075450000-0x0000000075A01000-memory.dmp

memory/2404-10-0x0000000075450000-0x0000000075A01000-memory.dmp

memory/4864-15-0x00000000009B0000-0x0000000000A30000-memory.dmp

memory/4864-28-0x00000000009B0000-0x0000000000A30000-memory.dmp

memory/4864-33-0x0000000075450000-0x0000000075A01000-memory.dmp

memory/4864-34-0x0000000075450000-0x0000000075A01000-memory.dmp

memory/4864-32-0x00000000009B0000-0x0000000000A30000-memory.dmp

memory/4864-30-0x00000000009B0000-0x0000000000A30000-memory.dmp

memory/4864-29-0x00000000009B0000-0x0000000000A30000-memory.dmp

memory/4864-27-0x00000000009B0000-0x0000000000A30000-memory.dmp

memory/4864-26-0x00000000009B0000-0x0000000000A30000-memory.dmp

memory/4864-24-0x00000000009B0000-0x0000000000A30000-memory.dmp

memory/4864-23-0x00000000009B0000-0x0000000000A30000-memory.dmp

memory/4864-22-0x00000000009B0000-0x0000000000A30000-memory.dmp

memory/4864-21-0x00000000009B0000-0x0000000000A30000-memory.dmp

memory/4864-20-0x00000000009B0000-0x0000000000A30000-memory.dmp

memory/4864-19-0x00000000009B0000-0x0000000000A30000-memory.dmp

memory/4864-18-0x00000000009B0000-0x0000000000A30000-memory.dmp

memory/4864-17-0x00000000009B0000-0x0000000000A30000-memory.dmp

memory/4864-16-0x00000000009B0000-0x0000000000A30000-memory.dmp

memory/4864-31-0x00000000009B0000-0x0000000000A30000-memory.dmp

memory/4864-14-0x00000000009B0000-0x0000000000A30000-memory.dmp

memory/4864-13-0x00000000009B0000-0x0000000000A30000-memory.dmp

memory/4864-35-0x0000000075450000-0x0000000075A01000-memory.dmp

memory/4864-36-0x0000000075450000-0x0000000075A01000-memory.dmp

memory/4864-37-0x0000000075450000-0x0000000075A01000-memory.dmp

memory/4864-38-0x0000000075450000-0x0000000075A01000-memory.dmp

memory/4864-39-0x0000000075450000-0x0000000075A01000-memory.dmp

memory/4864-40-0x0000000075450000-0x0000000075A01000-memory.dmp

C:\Users\Admin\AppData\Roaming\cryptohost.exe

MD5 3a37931a0c7f2c8ec5c38b04380c69e1
SHA1 61ac0d9783a744dfc02f4b6dd880c82e24a274b0
SHA256 c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3
SHA512 9be09704ae50a657793ddee577e69967483858aa42c92eb3403c79a195c2d11a6f84f274cb6c5e8e357b9e8627ae347d9a11a39d1549a15690765dcf1f3579da

memory/4864-50-0x0000000075450000-0x0000000075A01000-memory.dmp

memory/3672-51-0x0000000075450000-0x0000000075A01000-memory.dmp

memory/3672-52-0x0000000075450000-0x0000000075A01000-memory.dmp

memory/4864-49-0x0000000075450000-0x0000000075A01000-memory.dmp

memory/3672-53-0x0000000075450000-0x0000000075A01000-memory.dmp

memory/3672-61-0x0000000075450000-0x0000000075A01000-memory.dmp

memory/4656-62-0x0000000075450000-0x0000000075A01000-memory.dmp

memory/4656-84-0x0000000075450000-0x0000000075A01000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-11-22 22:54

Reported

2024-11-22 22:56

Platform

win10v2004-20241007-en

Max time kernel

93s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Box.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Box.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Box.exe

"C:\Users\Admin\AppData\Local\Temp\Box.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 130.118.77.104.in-addr.arpa udp

Files

memory/3036-0-0x0000000074AEE000-0x0000000074AEF000-memory.dmp

memory/3036-1-0x0000000000AA0000-0x0000000000B14000-memory.dmp

memory/3036-2-0x0000000005A80000-0x0000000006024000-memory.dmp

memory/3036-3-0x00000000054D0000-0x0000000005562000-memory.dmp

memory/3036-4-0x00000000053D0000-0x00000000053DA000-memory.dmp

memory/3036-5-0x0000000074AE0000-0x0000000075290000-memory.dmp

memory/3036-6-0x0000000074AE0000-0x0000000075290000-memory.dmp

memory/3036-7-0x0000000074AEE000-0x0000000074AEF000-memory.dmp

memory/3036-8-0x0000000074AE0000-0x0000000075290000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2024-11-22 22:54

Reported

2024-11-22 22:56

Platform

win10v2004-20241007-en

Max time kernel

93s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\aace43af8d0932a7b01c5b8fb71c8199.exe"

Signatures

Indicator Removal: Network Share Connection Removal

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\net.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\aace43af8d0932a7b01c5b8fb71c8199.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\aace43af8d0932a7b01c5b8fb71c8199.exe

"C:\Users\Admin\AppData\Local\Temp\aace43af8d0932a7b01c5b8fb71c8199.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net use * /DELETE /Y

C:\Windows\SysWOW64\net.exe

net use * /DELETE /Y

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 96.136.73.23.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-11-22 22:54

Reported

2024-11-22 22:56

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe"

Signatures

Detected Xorist Ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xorist Ransomware

ransomware xorist

Xorist family

xorist

Renames multiple (2189) files with added filename extension

ransomware

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\drivers\en-US\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\SysWOW64\drivers\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\SysWOW64\drivers\uk-UA\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vQVykYApjMM758B.exe" C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\DriverStore\FileRepository\prnms011.inf_amd64_f83138380f5fb6ab\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\whyperkbd.inf_amd64_6c54f73a58d5fb2c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\GroupSet\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_b748590104fe1c15\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmgl008.inf_amd64_c0d977e565fdc839\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmpenr.inf_amd64_20c8782372e47bd2\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mtconfig.inf_amd64_fe91941ed205cd9b\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\remoteposdrv.inf_amd64_0f0da968c1cfce06\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\SysWOW64\fr\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\SysWOW64\IME\SHARED\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Appx\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\es-ES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_smartcardreader.inf_amd64_33a0db63c0afb351\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_adeb6424513f60a2\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmags64.inf_amd64_767b2d723d0fe83b\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netwtw08.inf_amd64_7c0c516fb22456cd\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\es-ES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\it-IT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_media.inf_amd64_2dec3adbda5f7bb6\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmmega.inf_amd64_f35131186d3026aa\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\net1ic64.inf_amd64_5f033e913d34d111\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\usbnet.inf_amd64_9e6bb7a4b7338267\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\v_mscdsc.inf_amd64_05925c79fbad7433\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\SysWOW64\XPSViewer\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\acpipmi.inf_amd64_310dc613a7e31ec8\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\btampm.inf_amd64_445ffdc4132cbc59\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\SysWOW64\InstallShield\setupdir\0003\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\SysWOW64\spp\tokens\skus\csvlk-pack\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_securitydevices.inf_amd64_f10a5650b96630b9\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\ndisvirtualbus.inf_amd64_e8d548ad6f0a613a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netax88772.inf_amd64_5d1c92f42d958529\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\ConfigCI\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnms005.inf_amd64_add71423ba73e797\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\SysWOW64\et-EE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\SysWOW64\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_diskdrive.inf_amd64_1debcd2bd95e9c0c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmgl004.inf_amd64_189d0189716edeb1\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmtkr.inf_amd64_a8a4ecec7082e1aa\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\xboxgip.inf_amd64_90ed6b3fdc759a5b\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_6649425cdcae9b5f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\wpdmtphw.inf_amd64_1aae998f86058cec\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\es-ES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\en-US\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\swenum.inf_amd64_16a14542b63c02af\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\tsprint.inf_amd64_6066bc96a5f28b44\amd64\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\SysWOW64\IME\IMEKR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_receiptprinter.inf_amd64_7952e4baaee88d58\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmtexas.inf_amd64_ed0ab85128ed7a01\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\microsoft_bluetooth_a2dp_snk.inf_amd64_213eeba98cc6f2f4\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\sisraid2.inf_amd64_845e008c32615283\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\stornvme.inf_amd64_1218fad01506b7af\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\SysWOW64\MUI\0410\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\SysWOW64\InstallShield\setupdir\0404\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmomrn3.inf_amd64_c2314613ba3f3585\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\msux64w10.inf_amd64_5aa81644af5957b3\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\scmvolume.inf_amd64_6957cfb7d6fea5c7\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\scrawpdo.inf_amd64_466615aad3be8e26\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\vhdmp.inf_amd64_aa94d04ecf56de1f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_extension.inf_amd64_7891c7d003f5e96b\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3964 set thread context of 208 N/A C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_contrast-white.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-150_8wekyb3d8bbwe\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_Tracing.jpg C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionMedTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\arrow-up.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.scale-100.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-96_altform-fullcolor.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\images\example_icons2x.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageSplashScreen.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_~_8wekyb3d8bbwe\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\BadgeLogo.scale-200.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\cs-cz\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_Safety_NoObjects.jpg C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreWideTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\29.jpg C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Programmer.targetsize-24_contrast-black.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Programmer.targetsize-64_contrast-white.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-72_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\Confirmation2x.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageSplashScreen.scale-200.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallTile.scale-150_contrast-white.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-60_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\example_icons.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\WorldClockLargeTile.contrast-white_scale-200.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-40_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-48_contrast-black.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\Classic\TriPeaks.Large.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\TagAlbumDefinitions\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailWideTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-125_contrast-white.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-60_contrast-black.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\ccloud.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\de-de\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hu-hu\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\1.jpg C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-256_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-20_altform-fullcolor.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ContactPhoto.scale-180.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sign-in.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubAppList.scale-125_contrast-white.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\FileExtension.targetsize-20.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-ae\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Program Files (x86)\Common Files\System\ado\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\MedTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\inline-error-2x.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-24.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-80_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-72.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\sv-SE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.scale-400.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.173_none_6486f23c2831aaf3\InputApp\InputApp\Assets\SquareLogo44x44.scale-200.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_netevbda.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d70f748b0b85cf11\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_system.enterpriseservices_b03f5f7f11d50a3a_4.0.15805.0_none_30ac0cb79940c9ef\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_machine.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_9d80f1db805c34f8\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-a..re-multimedia-other_31bf3856ad364e35_10.0.19041.1_none_60905a204445357d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-f...appxmain.resources_31bf3856ad364e35_10.0.19041.1_it-it_91c1403566d0303c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..rs-browserdeclutter_31bf3856ad364e35_10.0.19041.746_none_928b656d6ff51d59\n\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-d..anagement-cmgrcspps_31bf3856ad364e35_10.0.19041.1_none_3867c1f4e3869206\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-s..g-jscript.resources_31bf3856ad364e35_11.0.19041.1_fr-fr_eab090ecb7fb906a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-windowui_31bf3856ad364e35_10.0.19041.264_none_ef8072da76d7bd33\f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes.resources\v4.0_4.0.0.0_es_31bf3856ad364e35\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..zer-it-it-n-onecore_31bf3856ad364e35_10.0.19041.1_none_9b7fd5ffd3bdbe94\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\msil_presentationframework.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_eb98ed2864eed774\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1_none_a068a30a6853aaec\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-netplwiz_31bf3856ad364e35_10.0.19041.610_none_33c1bfdd48a2f243\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-creddialogbroker_31bf3856ad364e35_10.0.19041.264_none_8c0ea69ad94a2cef\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rformance.resources_31bf3856ad364e35_10.0.19041.1_it-it_7c51c56901426d56\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-ui-networkuxcontroller_31bf3856ad364e35_10.0.19041.1_none_9553a3077532cf63\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-dot3helperclass_31bf3856ad364e35_10.0.19041.746_none_67696347d9aae07c\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-security-spp-ux_31bf3856ad364e35_10.0.19041.264_none_43f7e9f032144ba9\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..stedsignal-credprov_31bf3856ad364e35_10.0.19041.746_none_ac5c820a398ca985\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-credprovhelper-library_31bf3856ad364e35_10.0.19041.928_none_046f1d70ddb55dd3\f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\x86_microsoft-windows-msmq-installer_31bf3856ad364e35_10.0.19041.746_none_fcec547ba6a66740\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Assets\square44x44logo.scale-400_contrast-white.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..p-support.resources_31bf3856ad364e35_11.0.19041.1_en-us_88f3b3af5bf180c7\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-ndis-minwin_31bf3856ad364e35_10.0.19041.84_none_50f89b6d5629756f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..card-gids-simulator_31bf3856ad364e35_10.0.19041.1_none_935a42bd0bdee053\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.19041.1202_none_d081f9868ac0a804\Error.htm C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-dxptasks-sync_31bf3856ad364e35_10.0.19041.423_none_770a8c6340c32e8a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_athw8x.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ea2d4750f9ec42b8\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_10.0.19041.1288_none_ff9a0c377d92f65b\f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Wide310x150Logo.scale-150.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-sounds_31bf3856ad364e35_10.0.19041.1_none_cd0389b654e71da2\Alarm08.wav C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft.build_b03f5f7f11d50a3a_4.0.15805.0_none_6f75c71ae986f4fd\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Windows\SystemResources\Windows.ParentalControlsSettings\Images\MicrosoftFamily.scale-150_contrast-white.png C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-mdm-adm.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_67dae27e3653435a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-t..shell-adm.resources_31bf3856ad364e35_10.0.19041.1_en-us_cbba47c77411d25d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-p..lcontrols-webfilter_31bf3856ad364e35_10.0.19041.964_none_136d9868b6bde066\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-p..-workflow.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_27d9ea3d75eed2a2\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-ui-cred-library_31bf3856ad364e35_10.0.19041.1_none_754052fd31c4ba96\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-wsp-health.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_7539be2347ae4a0c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\oobe-retaildemo-exit-dialog-template.html C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-w32time-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_bad9e3495d7d9485\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft.windows.p..sc.events.resources_31bf3856ad364e35_10.0.19041.1_it-it_04cfeb8eb47bc291\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\x86_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.19041.1023_fr-fr_1e05b1b885a307ff\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-linkinfo_31bf3856ad364e35_10.0.19041.1_none_ee563fa044b1982d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ds-ce-rll.resources_31bf3856ad364e35_10.0.19041.1_de-de_1b191db1d1db8b95\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-p..space-launcher-tool_31bf3856ad364e35_10.0.19041.746_none_948bc3f58c193023\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-r..component.resources_31bf3856ad364e35_10.0.19041.1_es-es_503c624eeca1a522\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-w..r-webclnt.resources_31bf3856ad364e35_10.0.19041.1_es-es_f5275ef67022cea8\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\wow64_windows-gaming-input-winrt.resources_31bf3856ad364e35_10.0.19041.1_en-us_c5e8f04350d9d967\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_eventviewersettings_31bf3856ad364e35_10.0.19041.1_none_aae8e58aa310aa7d\Event Viewer.lnk C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-bioenrollment.appxmain_31bf3856ad364e35_10.0.19041.844_none_de5d9fe254d9f8c4\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-mdm-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_1c6739a2547c2f8e\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_msgpiowin32.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_aac7473ee40faded\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..trolpanel.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_d23715c9ea6f2f2c\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..o-multi-dimensional_31bf3856ad364e35_10.0.19041.746_none_fca035ac04c15c30\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-w..geacquisition-winrt_31bf3856ad364e35_10.0.19041.264_none_ea6cf49ad27069a4\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_hyperv-isolatedvm-svc-extension_31bf3856ad364e35_10.0.19041.1266_none_ba2d7b1e644c55e4\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-f..vider-adm.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_9c4d3bdf673e0e81\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
File created C:\Windows\WinSxS\amd64_net8187bv64.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_023c7a00f572ee7d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZIBXKKHVYMVCCPW\ = "CRYPTED!" C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZIBXKKHVYMVCCPW\shell\open\command C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZIBXKKHVYMVCCPW\shell C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZIBXKKHVYMVCCPW\shell\open C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "ZIBXKKHVYMVCCPW" C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZIBXKKHVYMVCCPW C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZIBXKKHVYMVCCPW\DefaultIcon C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZIBXKKHVYMVCCPW\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vQVykYApjMM758B.exe,0" C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZIBXKKHVYMVCCPW\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vQVykYApjMM758B.exe" C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3964 wrote to memory of 208 N/A C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe
PID 3964 wrote to memory of 208 N/A C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe
PID 3964 wrote to memory of 208 N/A C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe
PID 3964 wrote to memory of 208 N/A C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe
PID 3964 wrote to memory of 208 N/A C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe
PID 3964 wrote to memory of 208 N/A C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe
PID 3964 wrote to memory of 208 N/A C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe
PID 3964 wrote to memory of 208 N/A C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe

"C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe"

C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe

"C:\Users\Admin\AppData\Local\Temp\b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 90.16.208.104.in-addr.arpa udp

Files

memory/3964-0-0x0000000000400000-0x000000000041D000-memory.dmp

memory/3964-3-0x00000000021D0000-0x00000000021D1000-memory.dmp

memory/3964-4-0x0000000002210000-0x0000000002211000-memory.dmp

memory/208-5-0x0000000000400000-0x000000000040C000-memory.dmp

memory/3964-9-0x0000000000400000-0x000000000041D000-memory.dmp

memory/208-8-0x0000000000400000-0x000000000040C000-memory.dmp

memory/208-11-0x0000000000400000-0x000000000040C000-memory.dmp

memory/208-10-0x0000000000400000-0x000000000040C000-memory.dmp

C:\Program Files\7-Zip\Lang\HOW TO DECRYPT FILES.txt

MD5 84aa889a87f60a5efba19bf8d6464613
SHA1 4fe67d41d2ed917651e5820f131780bf078e3c7f
SHA256 43fc35d4b08e00236a28300d95f7426593db8f95f47e995477a77bfa5fb0ec99
SHA512 1d67c2552d16b8c9fa33417d45c8229d291077f45a12692d8a7e9ade813dbc629a4b13eb4107a773896386b9c4e6993fbefe54348568ef28f44f40c6153ff0a4

C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

MD5 27c9d1245163f6a2ba76cc91b0c3bb3c
SHA1 5f126d6fca1dd15ee1a058e5e96a0b3c89dbbfab
SHA256 e25e7c97fca79b1146429e074fd830cea1283c464836c5b0e9676054e9469542
SHA512 c331ac3a69f9c599bf00cf6bc934ddb6195d8454af11603a7e954115376c8e0d1d7d9513357c2012c200a57e9ef6d43caa2d3bb3f2eae4eb0a063a825edf616d

C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

MD5 447ba3078ae39c96bad23284c0ce1c37
SHA1 407e455937c8a09cc916aab769f35c0a328622da
SHA256 fb72cbca2416887d19dd6c75032a265d4d5f6c45304ae2eb33ba7b92583f412a
SHA512 f5e99b5ec64b071cd6c33c44559a07e79c5a383bb7ca8e22dfa7e7cb52411e3ca9a55b24519664c7827f019f6986aa6a2eb07dbc89eaa25fac1c10d1fafa7300

C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

MD5 0a61124ff4d5f5a4a8877a01c03e7e85
SHA1 0f5d643f988157f06fcd64e78ad53722c63379bc
SHA256 b01dd5be355ca9febb829e219f9a1d7ba82bba03128895b95df4a0c85ff0405a
SHA512 a9baa426a3ce56d6401a9a46afcc12c355eefa1a974535d640ea52ad697d307bba6fa5978ba86b13221c73909f98a54bfcb7685477850dc9e77fc2d021c7a7ca

C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

MD5 62fc029f21f901df1a8b3f7068fbc679
SHA1 13f2627718807512efbd105c157e06ef33ad57fa
SHA256 3a082e02197b77cc70741d4339c2ccf2d89413f696ea1a4fda5c63790acd165d
SHA512 c4980e6658e4724d5868cf3c58422f3962d715debe02e2bdf0f31d918f013d169521dc6edea92feb35e5f7f52f4887a07b12aef49a0c933686288ebf0e0ec21e

C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

MD5 24e46dd90848f164ed8ed0af5211f0fb
SHA1 3126b4a0e282a46a71c416e78c0313134ca6161a
SHA256 7d5cf5a621b00c8aa82f189226a23c96aa935ba6e01b33e41e34434da006c8ae
SHA512 54ee08298c9778f3f13086c65cf71a43fd84d355ff59b194f19abe1d5592998573cd5fb120e7196e6acc9747fde12a97a840bc964cfe624fe9ce46242ff85ef2

C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

MD5 cd7df679fa4e95668164470324d1eabf
SHA1 c68d6eb1b8bddfea694f04849c2e630d20a441f0
SHA256 481640b504204be5790aa88b1ee1ba09f455151a182751f51b99840b44360fa3
SHA512 3e7895b2d0edd990dd999f73ff2f6f6b7995e20833481087e3fcdbef1802296bc6e4cc2be967fd322c48171ea066a963cebc047f72a09c236f6c0181d8b7311b

C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

MD5 6cc01d5205d4eec2db36048c409889ca
SHA1 6fa02d3ea4d0dd2f2c002fa149e495759d9a084a
SHA256 0c5a6bb3e2d0c5f28ff3d51735e20626533befd8f73d2dd2d32d7095797a09c4
SHA512 28988ff14047d4890db5f7f477cfc038a372eda7318fc6dd7dfb7859f2ed969d6ed1acf256ad3468808ac8f96c3d9df0ae6353d9d48cc6e62cfb3b67a34e1c1b

C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

MD5 bc95c74cd948546d8d4951c2e6525fe7
SHA1 ff6e0e18cd8feca8fa360cc8d1f4c5640e91016f
SHA256 8ade00f1a561cb6ef988b2ea80491ebeb90d2e6c0053c16d3599313ef4465078
SHA512 ad5ae0f72d29528b52b95b0b05e61d59d5542d3e2be7fed368b4aedd586ee58d522b9da76de5d7c19e2182396d54a82cef8ef992b49b9b6607c1b8e9f6ac54ec

C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

MD5 2138d8e6dc4c2842e859fafc4b374f48
SHA1 22f6855bdd11690dc136b320a177bd22224ed51a
SHA256 edb4544c79834f9d09af2ff71761387f187aae4843516604cd0a6e72dfc87c59
SHA512 f729b860c2dd48dcd17cdb68f28653e6d3a21f76d82105a2f75982e59b744435fc5f4ed82836629d96b7ec72aeab505efe435b5f03ca58d8d22cd0ba86dfde1b

C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

MD5 d3171f6edc094f61cd44236e1088d1b7
SHA1 0dd2aaefc21c3f177f14ab2d1cce51bca560e604
SHA256 89d42d61a9fbfc6fa5187df61bc6b23108d0ca20efa9d48d19c86b069bce77c4
SHA512 2e0a6dc4a5e757a8c53ee742ed7eacb721700e8671460384fa6e60d0448255da1e247f6da47a7a59998a4b3ab2cf2b035a7f5913b3d0ca7a973f9d27aa080cb5

C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

MD5 ea7ba5a415f120f7cb54d79985e04fe4
SHA1 c1b88c54fbc3539cd1e25decb277a23d0030ffcb
SHA256 62f0ff6ee63cc7e5c11a004109828a5c79e05906dd8e650b095ba99b6ac5c790
SHA512 df0e3de5bdca4d445f084794e837d8098b95270dfac65112cfcbea4c041ea023c91ae034c0a437eed420008adc6304b56d7232839c4fc34a3ee3aaee7069c0a7

C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

MD5 f98dccff5d73ca90421557f690008b6f
SHA1 46d23a7d333888a1a332674784fad6c206e8ea52
SHA256 fab0df9c789cc984987c78dcdc254d371b2e6316e8484d428ede96f5cd44dc26
SHA512 18e9380c3763b7c7dca6a36ed83d89671480c69e99d9e5b984f59521cb85ae82060b2faf458135953bdf6ad00bf24853ed23f905ee896775620ccabbf29a0777

C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

MD5 5b9bf7c00a193c1b622d3a3c64ec31a1
SHA1 17f5c63ca77bb07df2def21694561b2ac9ab9a8c
SHA256 6c90339cd7dfabff5ebd48745e89012db00c0ecd0b4fc9a6e178e1c31804eff0
SHA512 daaf102852ed8c2668c2cb3353efff1f712620f2a3db72b565bc0faf2e8cf5e96749104e18d3b57aff06be21d4e5e331dcdb895851513391ad2897c267af177a

C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

MD5 3a0b928f57979541130f1e8b56dbe3a0
SHA1 e35beb4d0cae820e9887c457c4f240ed2d3e6700
SHA256 b6bd0a404ecda0fe3de79292938e4c55b2a625038470eb575482b4ffddd16979
SHA512 dc731b0338b6953752ba7a0247828ad214b8da7bd31df46372f4359fab025f2f9743ad94555b3c4cce8be0ff76eaa766fb1db850fd5b62a6e59092f368ba16b2

C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

MD5 1e40ab651b8fa79fd8660a7cf5220886
SHA1 c33c170e510fad9dd2d0073df05d80ba38c7584b
SHA256 eb96a1ec2b646f70a4531b150f308550d53182c9d574b72c343a471ae748b1a8
SHA512 a254a3023a4cf55a066a61c44bd818eb40994ee471ce2bc16dcab4d589f5d8b51f1f99dd49603b0f21c102e633837d9e5a01bb1a895362eda2aa590bca812bd1

C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

MD5 d89ee322babbc83289180cc7cc83c05f
SHA1 2276ccd03b7cf06f935a66720252061941a9593f
SHA256 6e50614b4cca3dbb28c2ff6c0c908507b60ed710dd7ce115e974d06872eeb498
SHA512 39fa84c9ddf27331597090960af8a96c3e2bfef1bb328e457a31ca29fbc093a4866b191c2e1baa79b35ded544fbeaff4c9a43817fc2d37958ed69b19835d3d0b

C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

MD5 5d556908daf9cd748181dc320c63a44d
SHA1 1a1e1715cce0cccb7795163b753587f5586b2fdf
SHA256 886abb82a69889db6fb21d7be3183483aa46b8963c817423ca8dbbdf841ffc67
SHA512 2812b2a7d4e14e3178b82dc68bce092ee9a87c03af0c55413cd225103ce8808134900a1ec36222dfbb4fef8f1902402bb7e99abd2bac1e1fb591fc48f8be8e68

C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

MD5 07c656010b4241f8038e9054226b97d7
SHA1 1352bcf05d373feda4df2925d5c58d969faa0b36
SHA256 d93c6864eafdc7b7cae2df8c0c7ebaa0e5f2f69939d0b1b6a5935c63478fd95c
SHA512 a83d0a41186e2afef2ea76b7a31443043f5e391876019ba269ef3974edd7e4b70f0cd10266998701f7fcecd6712d94f5ec3eff96aa58b7c3450e50006f6da1e9

C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

MD5 b12fc4195c69d41d03a4535d825a01f0
SHA1 1f4ef8d178888182387d61c5451a731b5f369e11
SHA256 987cd759c0f19bbcc56aa50ad588599c7a549d3f2535d7e51c1503cd91753988
SHA512 d92701a8f3bc5e0e16840056e274c52921113567386648b16396b6616445119d998bfcb31da51010b25437cd54d460f4659b2d756f8bed4b1a32af31cf49e687

C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

MD5 b42114995b66874e65c3fcec2e89c375
SHA1 f1b2f091e6b42c2d9cc74a3ed8aae7fc4dd58666
SHA256 4a82fe9743373256d199907fca7dd6e3b156764dce58576b272c67857499f4cb
SHA512 7c8a856ba15ee63bd5555518c69a130bbc0ae8f6fe607709b28605cbff80b46df7174466228c8626c2fb16de25888fb7eb8f38c7812bea68f0866b7f55351bcc

C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

MD5 771242022f8e2a744f95950de824592b
SHA1 be11ef5269f8377f77fea0d44e8d255dcaa6367c
SHA256 c93aa5f59901c20a40a2f0632d1d08d899ed2ff1e9834cdb790a362df8a0dfe5
SHA512 7188047144704851aaf58fe0a3aab20d987368a02eb20c8536f8452f4866ee23b2e2f1b93ea0396ca428614a240a9e0433fd4e3d7c9bb53a3bc38829902c6bd7

C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

MD5 dfc0fde76a3ef23b5cc19fcf4f942d9e
SHA1 0e534e2e58d4c5dc9fd1179219e2c53c845bbd00
SHA256 85b51240ba6b44e961b61984d82752b2040ea89a58a1fc75e3926995737b1804
SHA512 2405710e6cb54f980ff06a95a04266d750a516198b443a7b3296440c80afe27c3757e1e18beb49834481f90c8f57c1ee36fd4d4db39946607a18e4751ac75576

C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

MD5 2300cddbe7b5d2f9840ca30dda229f20
SHA1 91854de0d057a1b244f290f661412f2fd22fba49
SHA256 274d6bc145fa91c54e7ceac1c2076f2019741249711aafc429b31283981b7403
SHA512 80c8ccd0cef2e64a54315e0f662977edd537478c109f06a27943a1e5546ca3e5968d492cfcfd6f364cdcc24ceab4957c29538bf2de61771f1ad8d2bb87fde3da

C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

MD5 edd1cae4cc4bc7a88e2fb96464e885d0
SHA1 60f44f61d2cb1666e6619c48f9b6eb191439524f
SHA256 e86bab5ccc767da63b6799d2a7b7ab7be8e298b203382477204ef74c158d44cf
SHA512 dc6e6874150259e957a1928e6a7008079c6939c4f69ae5c49e82ebf1e71ae7fd60a2b230c5d2e2ad308ce0381c902199e2422908aecadce18f6ce4acb791c173

C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

MD5 80e7bad3dc9dbee24849dad9cd734a9c
SHA1 70cc34f74246f6c3f9c666022c8259b20612ed5f
SHA256 1cefb01933c29f688116208f8df5e0c72a23431eca82ac82e56e2485793a3834
SHA512 33b2ed9f9c68d7944a1ed7581f133e4d6b4bc1ead9d05416169b8b66a40d01068548e4c0ffff9a31e8d0b9703d86831a64f492477ad94cba09f512cbb1336941

C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

MD5 8bd5eb39a0c5cfde449b8f2a8dbca4ef
SHA1 3d1be6338ce65a2a2ac0b4165db24ae1d65cca93
SHA256 3b9180e2cf0fb6cc80cffb6808fe87b731db12af5cf9b2ce0f43d585599b841f
SHA512 6f7f1ddf36b7f2c48ef0dd01bf1621ede5829e217a0f286bbef2486cbb89e7246370b3acee25dc2674c6765f916809da4cf7f9507bda9529c6ee4d88122b1a08

C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

MD5 897ea2f793badf25a193bf6c8b5eb50a
SHA1 b7a8b181a6e4b8df2a903c6d7e385e5e39a54277
SHA256 ad68f7cc4f3ce9325d63e3195c3e861d7d50c7b1a89dbc02b7c858df570a372f
SHA512 0a79365e7f1aaa356a70fb995c9ce51a9e3014b56b967e59b12d20dffc8614ac114bb98b1ed56dc018905c6d769071b32ada2e92c3d5d5ce11749c2703948962

C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

MD5 b37de7090c0461728c0f4440b9d659b1
SHA1 debdfe834fe042938ec17dfa7a0536f89f274ffb
SHA256 70241000a40bf3e3ed1f80162acfd3bdfb551eab0fbb35a5858460d9e159b667
SHA512 57788cadd0438879eb1cafc9e32b616f9e2d85732b830ce852d97a48535b42a407e4e0bfea8770652c5cbe1a912dbb0173a0421d13fa876d6c0bdb39688089b4

C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

MD5 ac9eb4713a288421f9d8766cb622d9d9
SHA1 fcebd66c899c077f63704d2f699b12f9260273cc
SHA256 566cae4fe94744824db4e1b1fd0c04efdd42e61e47126e7c8c0b4ceb89df9b46
SHA512 c17740a745a0197ae73d14ea6530f55d2982710b989763ac184a0971a195663fd22b4de76aa885a97d1c72ddba25bdb4b2b458143d679e34256d7b788c8a21f5

C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

MD5 30aca111cd7ae7f5c5686622e48453f2
SHA1 091b1b4d35fcae059b6aab9ac874ff0d9cdb8971
SHA256 0efa0ac778d3dfe1e3dddbdb3b8e89b01c407a5ac8a938b188fcae80aad73d5f
SHA512 499b249b4a4e3b74712ef45eb1ce08c630a44522ee7fba3b85f39cce24365c50387a046b5d852f9a6931f00b13620c7df48283ccb01fbec24585b5b764df53b3

C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

MD5 96b826b13f9afc0534131c336647ec39
SHA1 27ea3855a05c61d0247d030062c9e73d3461e7e0
SHA256 e2a1bf1d800879b45acf29a2b1b4fec474d16e1ce3453487dc8949a9f12f2f66
SHA512 d1c41d7f79cfc6d0c0f63c112fdf93615ee5610e9cb37ddbdd01acc580366507f78cc07fafa1d7127f7d839cb22b8f38982ab87c412924b4ff09b599623f1efd

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

MD5 804effa43aae5f83333c8d5d4f523e0e
SHA1 367714459f011afbec55e06e55ad6cd8c34eaf95
SHA256 e70de21f35ce75990c07c968170bb9ac7ca3a016748e1b4975ab8f62a18acdde
SHA512 6904be78ad2e558a5dd1cb1c2264ffe6c3ac6d92a06a3e2e619e004fa6cb39f19e8ad1919eb750852d49c7cd56dd6bfc5112ce89529af7d05237b91edd58d211

C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

MD5 30f320fe9b1a0500b86af632749812d3
SHA1 16c94c1ff3014b329d4a1d6ff2b271fff13093da
SHA256 256940f1373c20076f8b928d83224950bbc9a6e53ae8201952a34ecb59bd65d1
SHA512 50cdcc8a25c3223609554bd13fe2fc0e5923c850d9a1507c2af160d791859bcebcc9da9120e9c0ad050e6131119fdd46d48f5547349a8b698a6f4cdd4aecffe7

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

MD5 1ac36a46a9621df7206315184b5e7bec
SHA1 b79cefc470751759372872075cd9189be3e9ac3d
SHA256 2e4b0f3a7aaaebbfc11697a66894493bbe50327292d55ac04ecd8adb7524c09b
SHA512 99531e54ef994ce6e2869abb894f1d88cf8dd195860610f924d8ffeaf04c9343109aabf534253b29ba0874578da20365659dc0395c507ba2e9db353d3ef6ca7d

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

MD5 1d6d0587b145abb11de19c40b570646a
SHA1 dca9ce36c5a18b2ced30fca5311602dedd65daf4
SHA256 abea6a4ea56f99f5e990d753d51813834bca437dc29baf7b9925d1f21f6ef3c8
SHA512 a0f7c0ab679fb3061f9e1246ac4f22904894e4a6b7c624323178f202524793da560915e05d0d6c423fc716c1d722a62230cab093d0adcadf8fb91d5991776b9c

C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

MD5 e078b6263bdd685926dc4a12cde47a03
SHA1 6eba6606569bc3f0617c982ab18215bdf7c07585
SHA256 c16c8301777988bcedb3bceb4101cfbec5990bf5551fdb299407b53be256226e
SHA512 b1f9ec99d32f4746737247e106ccb694a29a6a26ea1148faf99e21299d7bdc2d4a1d2119de0752ae2086540fceee00f625d59695fc9cb1c8f8358b6e6b396371

C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

MD5 72925f67742f3e57831c5bad34949210
SHA1 d8acc705adddda42bc7dad76b6caa4f24b2ba387
SHA256 39c0145eb75906cd091f6ea86e8a1288737b57c9b6acb7e3a4807a5f76b2881c
SHA512 de27105efb8873d5a4d996f0abde297a8d1d264932e41c6f39b8cfb04f91dd42562e600f99a03b4221f320b403871cd36a001d4fae32aeea1bfce0208dc764e0

C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

MD5 1d8323e4194a5f683fa24a3f37b7fe81
SHA1 655d6c8ff01c9250878f66b17f371d8b375131af
SHA256 b2dc94f4c6b972324f6602d5454d5200395b39c761cee6687bcfef52422189d7
SHA512 fbc9ebb24d84db95acd4d1ea283703d2b508010ab5d11221bca54b477c44af3e784ae2957baab84f8df52bef7defa7d0400559fbf5ab86e3e2125313fe9e8217

C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

MD5 95733793649ab4147c5fcd54a20e8c4c
SHA1 047fe5e9ca63ceea9085562e65bb43617fcce56c
SHA256 cea05c4266acd306b174a85beed817aff137ef80d041d1806f602644c59b54fe
SHA512 873928daf2abcb351ea6e6bb604b61be6e8d78733ab342e4c625b45eb5debb3c4631c625651c250d3518356a17b39c72925071cece335da311096d1d5f237d08

C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

MD5 504f8f8c03aec9c47dc484f92c7219cb
SHA1 e432e02ec26c1367fdfa0bebca6f5c9a9a991356
SHA256 d7921e8760f22cc69ca1c77a08cf4d008b9378230a6be6ad76f03e1da1541481
SHA512 f162a3ad2ac6909936451087256820618177d0dc539f39acaa26c36f7130d5d916ec1bd4384ec34cf1419002ca8b4256200c610146fcbed9d0353008e5a32640

C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

MD5 478d1b7d51abe37a14aa9144b1cd3d92
SHA1 7f8d547de5534f8d2bcca68cc8d0f985f8774434
SHA256 04e3ddbb8cfd270c3b780c2def2d184b3cd46e25a9c30f1ea7fcbc52279e4fab
SHA512 917bb9c2c978c807f31df898fc803868811bbf8be2872e2b6a206536b58714be8c58226b7cbbb784b78fc2928ff5b5ead0c48385322c41cac5e3d4e2feecf39f

C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

MD5 1b0007b5ee36c1428670691402a5c1e9
SHA1 7b941926c6ca84361e04d9b4063a69cd954b2833
SHA256 3f0332813c3efd7a1b8953755c4c782313ac7c49da429be06e8465ec8b92de8b
SHA512 d736d73d75534baf294bb5759f13247c14d15171807c6f575cd1694253407c1571b2a6cd6c89cc21d318750d5b819cddaf922c03b8c1d6915a84c8286fb84b35

C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

MD5 b5ba00f5ec2dbf6b1fcec0ac6063233b
SHA1 b2b6225f1f8aedcece2ddc54944ef8fa4c3f9b93
SHA256 314e683877ba1290c8f661be0692a3128a92a0073997b38ed9afa5c6f8f01958
SHA512 6371fdd94e905e30d02e39db82b4ee5274e40ee12d6c49c94a59a45ce4bcaa33a20c4ee03d3211bfc4e5ad9d7c563984bb533a59dd2ce84b49fa82fb54cc70d5

C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

MD5 089a26fb8eb056cea370e280137a3ec1
SHA1 59a2d5fdf8c655164080792f95a37b99305c8fa3
SHA256 fcf418bc162502420a70ac77aa46f31be4bb88b73469bdde386e24ac1bf0da58
SHA512 6a51d032fc21c2722dec3b55c175666637dc4ba62cbd4cc4eb3c6a6df0388adb6c214bb162f2c20f4b0ab855695e398bf54256ef3c944b9c56347ac4d6511809

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

MD5 742cfd1b2c91f0bc866443ebf8b58740
SHA1 091eff805dd145f609f19070620db2a1c5c69399
SHA256 688417adb50242ee6144e6f8888fea3a1a556aa06f21fe90208714bf177e0208
SHA512 6048d201144edee673d9c574db969c694b96a953dd9b66fb86a46ca23555645c483a352b5dac0091719e30dc9833d76c5f7b25ff82466e1b9fc2b8c3f88e93c8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

MD5 d398bf414601efc3f232b2cadafb266a
SHA1 2ba655c502004f441095a589386db3a4e142da2e
SHA256 082eab0cc4395597babec03c0907f291637e6513039f332b48f8a647912eda8f
SHA512 b1b1cd4251fb21edf68b242a8ba3652a5ac225670f23698e00a2caafe312770eacd4d5d13b007313f9557abf6cc3a4ec007332ba00d70c456a7d74a6b0307739

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

MD5 4fd34bef279e7f94904ffd09eff264e3
SHA1 dfc962967577d69534c830aa2a9dbc9d742c2413
SHA256 e16bd2ec9893d9e7fad9fc10ea015e99b50a52d79c5340bb9b5e9404a5e5229f
SHA512 39c44987de4c912cd7292b503a844fcb299347aaf81903a269ec8ff8792e59e5e021fd82e046f2ee974ad7754836912fac5fc8cdcb4a3e27b7cd27d7504d9897

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

MD5 bbb418f1cafff805415a4fd09401b0ad
SHA1 147ecdf6c26b5f1e50740ed3d9a26bf090e42e82
SHA256 87d17a8055ff1618863016aed0a9000be967cb0a23de1d2c395d5982bd809e24
SHA512 dab813790f9925bca6359016a1751375c83305921b54733cf52c8a178e330a3f39a1af6f7b4d30392dac24d11f9594a9630559e52e345bfb9b763028d775254c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

MD5 0250891f51f1a19982361f7d72309dbc
SHA1 beb69feeb4333088fec978aeb7fd8ce3250392af
SHA256 13211b854cea9f9307bc741c4bb9803a8b3b4b3259c0702426a41cd2d84dd3ba
SHA512 6d1e00e492c9434b31fc4dbb0291a4bc9ba293ef3b09053217549261ada0f670e3915ff64d186b3f3dea981b2e94b221b018f71d2d050d68baa2d78d9ba708f2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

MD5 bd19b88bd84cd377c30100e86d909d23
SHA1 178137a6a52c426c030f5a1c1ebb8d3dc20eb16d
SHA256 bb64e7ffa5b89a93471694cc248d76c87021863f93bbeb61f904d96dcf585f1b
SHA512 51bcefb3149c657dd697366df613954b7cf758ebe1f942b572601d249ba9e7364e9f32a15890d65dd6368829713eb32054c009273a4e03e722d56938cd8573a5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

MD5 5f00bfa28141430d2a7c32a1f9a79d9f
SHA1 5f9be308d6eb54fc23ecb0f49319e45a5f5a4561
SHA256 da042c976b4468e9d5752e86f58bcff665e3bffe9bc56f7924fab5683ec14a1a
SHA512 99ff557c3bded9451062a3c3f4f15897bb785fe056d617563658b9333c2d7d8e9380ca42b16a7d3be19ad98f1d74adbbfa341d05bb15c6ffa2a752720d9b1599

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

MD5 2840306cda70f778c0cda646dd69940e
SHA1 b9bcc01283df7bf1dd0bcfe1ad1220004927e250
SHA256 68ddbdf4d7bb9bf723015de77d65e304d2cb96e6771e55c25166d07d8af977ea
SHA512 cd36efbb35686ef6f55f5dd5d409a2cb8f88a69d068012b160306e4816c4f3097f12327b88be086afdfddad544aac52ab78dbc500e5115f5be40399a8b18f298

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

MD5 571a288b1b2c856fbb2af9df718f8468
SHA1 0bdfe49922b3b0a6bb5ef093cabecabb8098d4ce
SHA256 453e79b99434f037dfaa0543ba56d06a8111a3d5747e9d9d794fcd77c3ba2342
SHA512 ab956852e45fa2240f6529e8373b0241d7ef0745883c52c4434cebc1893d0a75fd64afdf5907cfbf9d8ff263ea0d2889c6c60e8b2a338c213be727da5a038cbb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

MD5 6c09e177ca946b0b987ae192fcb2d058
SHA1 6e831e91312ede1df72df54994a13afbc98127a1
SHA256 c8eb2566c67ecc64578d57d8a5ca399407e9496f27ce4d4b65d03d80d1358dd6
SHA512 d0affb17bda7452ee056a5010d1682175eea7829596b510039a10d89361be7495408c41b4d68994258c9cc25f66d9278149c4ba4f78b851c9f7adcf12ed5a25a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

MD5 8fb3b5bff2873d01417fe38ad15c6416
SHA1 a8f9fc32ccfb103511014f3c6064704bcfe5f08d
SHA256 efc54132e962100b780d93da7ae388d68cac77677d6f80e5a9843033b36c8aa1
SHA512 33781a2a89d27d833bc2bf77b91d1391503959d76cc84e6e8f56773a50f4d440cb9413899e7f93ab19fda6e9785e78a40ff7b7a462b36fa6c0d0fe4d9bf044ab

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

MD5 5ba5fdedf2ddb1cb9810e52fa76cd462
SHA1 bafb01d7f71e7d12f0847f6230fc6adc2d1481cc
SHA256 4c812cce04e4a120d8bc170be6773d7f6fcf9812260c2aa297df204959c0e8d8
SHA512 328e88e1416b6d6cf3e42b82fb0419e5702a092e79794e8b88e30309b8f3669abaf840472da8e5acb036936d594e4bce0cc6388f085316fd11acdc2af7fa7923

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

MD5 cba735be654054a5ad9368a2526a2a72
SHA1 9b7ca90a9d028efd98ef9dbb6a3bd050ccc30e30
SHA256 becca10f94dd0569c09c2b8bc323fb0fe4722fd873ebe827fa876dfeb600a82b
SHA512 982f9c5b2c5e9fd206fb941ecc13c363459404b1b9b399458725ee8156722a43922de1c32fb9ca4f74519ff2d170fc583cb75acb48dad9f031d70bdf08f352bd

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

MD5 5717558bc21fc7dc0f00ff23b0c19b2e
SHA1 936704aa0d2822a1e7fc9c4c7d5aa19aed4f9524
SHA256 6a3dfe71abf3f8cedaa4054978621fe720f3c53db6d79a7995cd8cfd703a3d0b
SHA512 38b59649c07c9989363b6e086cffe331c31a4913d4e1732c8c8931688eed41c319f01fbb01789210fcc7c7b0527690d51734943f6f78f3d5eee06b5b901c2f15

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

MD5 b1d87b479c0956c65570bf2b656b5e5a
SHA1 8722cb1762c073e0a118b0f013300f7afcc82df9
SHA256 f64121d9ed18ea96800cd55ef4fc7ffb6e60c050cb4b7a738f37268a1600fe1e
SHA512 cabc634644b112d5dbb50f4f18a3a83b8d3e1a4f4c3354acb88dc909dae880a8774fc69d51f945b9509c3d04fdbf34f5e2cac10f30ee7bb04f76731bfac9a5a4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

MD5 61d2ee4a76aab8678cc8193b67e37346
SHA1 cd5e05eabd65e3989d5147e52d2052ad41b58b9a
SHA256 0283a8da988a750768959fdbaba5f4623b78a6ad00b022bc85bce84b8934d009
SHA512 b7f5bbb93073705b2516457eb89471e481dd9badc17d71facda3cf7be4d0cf6ac1b0c60ea63fe0071b394cb09ab8d0b1a210548f38e2f2c9292757f85277b0b5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

MD5 bd8d57332060ca14f9fc453dab7eedf3
SHA1 c87e358b84570d11f95dcea372615eb722a991a7
SHA256 6a3e95b10b298e317418f81dfa2badaaab6abd157c066fcdb9ec14878a8f1622
SHA512 97b762a6a9b7d329945f2b654761274bb25171a69551a2ad0447de3a4667d42e569c34ce758f95fb18e5e997f88e608a01dc6adf36c6ce920f8da9095089966c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

MD5 454f14554289db3acc0a5adf6378bc7a
SHA1 649841330e47afefb1e09037061b6bb7d334a70d
SHA256 a3bfc24f626d242c24ed0cf8bc7556700259fe671e6556fcf4bdfd5cf14605f1
SHA512 7bd4ec16fc837d19b81f40b1d416132d8bd69a43e994774219241faca507d6b0d27e345640432a455786d6c4e49056214235c14fba2b19238c3df60cea8c031e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

MD5 1993287394ed12b823855d40fd41341c
SHA1 949cc5a1895a82f8abb1188fd5569adc5011595a
SHA256 94c81ad025ecef750cdc5408e8a7719ab2d1d5e53f93f552a27a1180fa9fdcd1
SHA512 577b93beecfcab3851f39231fe7865e5ca90d17ca6a9da3cb2ea488c3ecc3ac77bbab255aabc865c34b465133cbfe83e274875024d469265c4e8a8f2ed0422a5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

MD5 cc4253515e8c6b6f19274cb337badb52
SHA1 1393cba3fb26171612ca052a776e8eb74bfa76f4
SHA256 532730a6e0c1374c8070ccbbc094d7c11d5489cc027f3fe537137a0f621b2249
SHA512 f74dafa4fca581408e4d1c1ca81ffb3f12bc9c0cf6f3a031269d10894ad4e5633e0296c5b39dd6f330221ea128bd7d212717bef65870838463016338500a313b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

MD5 e6e48ac34995c24f356137e1c8460d5c
SHA1 43dd65e226192ccd624616a03334e663b1f0b134
SHA256 d4ae7cec8c9138dbb10f2ccfd60fda7572c0ca781e220aa1c134ecc22249f944
SHA512 0134ed538ccbe2d2236de892a502abf913d6c8e66b21e56202d4a9b0f714adddad04a9f32c13b88abc657ba37f1249c07f412cf6e5750318136c5c2ccd0c1c9b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

MD5 12d5e12cc5f03b148b2aa782e0906610
SHA1 d3a0e5253e250a3ebc21613ab5a5bd9330ef918c
SHA256 4a8ad411cad4e221d256408c663e003940315cc9763e642da79ac2d11ad8e532
SHA512 70a5377b73b2211f88ee0587324717d4c36b86d2f2a97723d2f703158d2bb5c58c3ea952abfede5916f33b5ba4ece79694ba04eb3ee5746adf678b78e01ac7e9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

MD5 897c883a30e927a0bca5e4a441db8cf2
SHA1 20414e69d2a453b553533848be1e21af6dacb45f
SHA256 bae94c2d8bec01f639fa8f4b9db25914c4c3887a60d53fe3841a0caf7c769c22
SHA512 6d25d6727f1c5855366e3b3c9f8ba1c3088138107fe08471f3fb0a44354e4a87b96efc9e2e4a59caf4ecc0c2e0894aabc332956fe9f7cb9033980054375c4f8f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

MD5 12929e4040bcf36477cc2cbc733c2176
SHA1 04867208170beab54be8dd06a5ab09feee98e828
SHA256 28b02a2cb73edb39643caca30275859d7b81df5e28191c95aabb23c15bb40cba
SHA512 05647eb1b16b361a940c549f405ec033e4d3d74884ed4096b2f9a6d9b264d53dcbc30495c07375c03f5c790347ea12cbc7aa726b40dd60880de3b90aede4e1c5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

MD5 22a6543bb16946c08079d6e39500887a
SHA1 eb8a8d191c8705f0a179ee1542965c8fddc0d89c
SHA256 fcc4bbf7c489df258e952e29975c6ad3a4553578e8d0d9523c203aab9d0722d9
SHA512 6983473826be1ae793f85e53e552d379002310d36c70c7068e3a0cfc6c5157b28bc0041e2a04a1a82073c17277e6f6175842dc8e107afde32d4012d979ae7548

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

MD5 922e201c23d671691f4b70a369e986fe
SHA1 146c0e3c6fb160081d89aa4b88a3be36740556bb
SHA256 f37e57d289722b91aaf87e6afbf85ca3aec80030b1e747c4bbf84e6e7d55a385
SHA512 aee7fb0106f93d251cf71230b5a25bc07507a9feedb87eb10057073e39784c9b146e788ac8bbd8be4c0f19c8b5a68304518a1de2122ed8d4a8228bb38cc2bec1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

MD5 cea97013e3eaebeaec69c11824f323ee
SHA1 d04666b0fe9984c85377f40100ea58c90d218ea0
SHA256 fca536933f5a7ddf0bd7ced131076892fbf165c3dc29ad486dc9a27cbf3a43c7
SHA512 037df1a97f61c822ceb7a648b561f7d6e7c92481de3b373bb64714a1b977837049b48a21f71d7957267e62235241312ff3379007ade7eb486b48748318b9fe73

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

MD5 c366809c7c412ba8079df18e4857457d
SHA1 5a77e5f6aeea38fd559edd22870c6142f2e224c4
SHA256 24aefd4bb5b78b0ef4229ae255f09152f093f095cba81e5896a5b9426396482a
SHA512 2725f8f995fa17f6feaf08710997c09effa35c2ee6c3237e289466f5a6b129a25e052e02ad849ffe43900b2fcc279ed1f527898ffe5a33ee36a1cd1366a81d30

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

MD5 a46c064a820cb4f4ad7fa7f28d3b9c98
SHA1 c27e76c2dcaef876abc568e55dce1fba19b6c6eb
SHA256 caa4c3cbc82f67b8c9ac2384baaa6197fe3a7503f805231c93c5f902d201dce4
SHA512 492562ace0a15ddeed7644265b5dc827d787d7e57eb0ddc834ecd8330d9123b31451aaedf0e1db5ad46080433e54ef29141092c2c5155c4bf41531d157256d70

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

MD5 d4e8642b606afd7d2a5a89a94990b148
SHA1 0af3d7dbc3fc036b5e1f48e52ab216dae3293aac
SHA256 055bc8e41b22f9e181ff7ea87c87ffe21a9c15c46f44e2f0366f9268ee5608eb
SHA512 524fd5f9e32ff764d7ee0f018a27920ad03fb1e35d1466e8fa8bb691d6f167a26a49b4403dee3558fa2c506e0d6256c2bc6d03b53a78efd57177343c0889c20c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

MD5 ef011752436c5ef86147b99bb6abf644
SHA1 39479d7cc673795cb12cbf7f226dbfdcbbb1b1b1
SHA256 b005bb41de6bc8733ee9cc1c0b8da37ebd71d02d55b07527230c3a559e30c716
SHA512 459114c48cfa5a70459bbefc075e875c75e9864a5dd00417796737840c2c70ca0ac0ba2292b7bfb46ccb7ddce8841b57da43bb9a0195da8617f510890a873288

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

MD5 239b8016067d55e8f2ffe89f1faf13fd
SHA1 5cbe2345182839eca2f3053c9cf8af4aed6e99d4
SHA256 7de25db9ea7b649b34e1e3d9a416b0c2264742fa4e6598ade94b5766b60952e6
SHA512 ed928b4b912e6fadbff56c717420abde6d74c4b4291941310a93f720c3712f7475b27db60e333917812755c5a4a6aa842553319c0cef3af18db422d5062e08d6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

MD5 e5566b65431d9506ed9e439942697671
SHA1 a6e95f3fbc0466ba29278d307453ca6e69f6e610
SHA256 b710ec83792dc0a02f8773c8e9d6851f74c44973299d2bffc3c101cefb8ced53
SHA512 f4d5a0adc30f4a2c6be4c78576a52a1bb48bea7c3bb85ff2d738b2f7c1e4d2882e21686b1373744b9044f8921355e191ae582aecc136d14d9cab4b4cbadce12e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

MD5 8fe3cec6d9dd45354f2443b8060d82ef
SHA1 b607cb4e2810048e9d57a8bc218ddf9e88227731
SHA256 5e944cb5c444bf39a04431d47b250c54391cd51a44629f37291fa6e1ef501e77
SHA512 d30529dfb4d42233977ae995f70239f3b27bb11dc418e22528f61f6681378938185bc2fbb1089695993a27d117663b72e0d1788f7bc2c807e8c2043ff93db7da

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

MD5 372972c295563a9f4f30416586fbb3b0
SHA1 54bc6d9fbb3e7a6670992a3a9cb529eb9befa902
SHA256 ca29081ebb879418fa08a3bec305a02375ae9f2c72142bfba0b81544aa9912f0
SHA512 437cc9c169ddd2ff0feb49ba8498f4278bc60201d716ef13accaa79e842d642d3e6d71369930a205ce73764f126675a7b3331f211b76539c3b0c202b6250af89

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

MD5 6adf4391a3523b218b0998631f5a506e
SHA1 fb3f8408fb3f7111f7a1ea6c051a1fbcbd7fba3f
SHA256 69971803353c9070b66bdb01a6fddf71a03b860c3f246a2ccaa0b410e44bcffa
SHA512 b10f61d9cab2920d612d5ae42296fd14db96f6aa10d55b471ea1f027a0bca0f7a700a2295baacb97354ef2b6a77da007607af33daa93258fd79cc72d36c0a538

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

MD5 aa342183320cea15a8630d235b2fa9fa
SHA1 be0646e0c58a96f6ae2cbe9a23a8f3a859543f51
SHA256 1ab299f972d95c56a72773724307ed4676fd7f7a5efefb08377333ee6143d074
SHA512 8bf4a3e0a8a9649837817d50466fbdc88a82b6498975e968881d8656003b03a7b48f89dc281407d4aabf1b99dc2283c106ae15c212982b65f320e89b8fbb7068

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

MD5 60fb13617090fee4f9b0be2f7a5f4abd
SHA1 3cb97e88c3ec718ee591a104b81b8e4af87bdd66
SHA256 4c16a175d3b988c63c92081793b03dba1edbf835828d31a7f3260b3a8e69c132
SHA512 d4c6ef2fb1f4486484b587fac74344dde35bf0134edf0a79e4c552a8cfa06f435f1dceeda3909bf3009af2bd5b1de4be77f0d641331bed3a21c1ce615167aa54

memory/208-5318-0x0000000000400000-0x000000000040C000-memory.dmp

memory/208-5880-0x0000000000400000-0x000000000040C000-memory.dmp

memory/208-5875-0x0000000000400000-0x000000000040C000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727662610078916.txt

MD5 d256571f74b67098a61f77858b23ffe1
SHA1 c76b6836faa18cc6163925dcab0be184f70e0f5d
SHA256 c7e9054db8c82e681bcc39eb109b92057a0cc8218e229882bebc8c778261746b
SHA512 477a15de816c54730250f77f921cdb271f3e304963f75c935edd0114d0046450021cfd46130dd48c8ebf35a2125e03471ca2beea99a915ea1f401c952c3a7a32

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663116015387.txt

MD5 0209b6b641b4136d7622095c71d083ab
SHA1 bdf6d4767b1456b4842a1dce313c38ce9256bcb0
SHA256 0e18a1ac2eb04e9a7729a967b1268a23c459417f3149de6678d40a9009963d30
SHA512 2fcfab3fc77c3fc36dfc52c4a225a95929b447bced60818f7121075fef237c93f89f49cdfc36e275714f72a4a7a26be5de67af6c4ae5ca300c83d81d4fdcacdf

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727669820222616.txt

MD5 a93b9a53597e97cab3c2c3546e59c984
SHA1 77de8114041c9314f81917a4e113f1701987f3a3
SHA256 1c2fcf008dcd782f7d30544f0464cf17a7043d507e0ade02469d95482c4953c4
SHA512 180e25180b0dcc7939d74fac9d051cf3a183e93a34a3e27fd545f67bf4abccbf30d925bd0257dc9d04b6fdec5c5f2b5e17fe22ce093690b777556f5e83f46a88

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727672589120253.txt

MD5 321c273c19781d564a9bd530fe585aa0
SHA1 3dd7fd0a3c8a1a0ec75489432ab7c03cf47000d3
SHA256 d27b8de4f41f021eb49fd890a63ffd218ae2cb116a6eef3b7ecfe2ec14858baf
SHA512 531dde5b52415c508c77e1e1ce2b69dfd82b8f278360a6ef8f12302c8d090dfa0406349f6238ba25528ff22c2e11347a32bf922d2ff030406dc30cf6e7f4fbf5

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

MD5 30f6cade378618c6e9dc777ad2e274b7
SHA1 ce94ac4b712d2b7aa9b36e50f7d9a9c96a200f20
SHA256 872be5aa3e7662c53478f6d92ecc1299ee69af57bbc365e0df19e5ed1bb9026f
SHA512 7f4bde656c7671249e6ed14569d88e63fe73cde01326bed41aca03d2cebcee43d887e694c4f1e9fb34d97ef2ed7cecceb9fdde57edfe89ca128e36ddc3fda990

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

MD5 66c643fe3add0b511f0667f7190daa3d
SHA1 bede5464a77e2b9241103883351d67591f3c829c
SHA256 53841b17be03947251789fd8843814b2d686a330e353d0934ba59e8a42d440c5
SHA512 ed3f84325e86115948b8b59a534f5cd7153b9b9e1fa6e532ba092ec77eb60fd43f57bc3056bcca6f171ca59dcabe5964a864c2b9299846e0a9163a1ce9e28578

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

MD5 95e26a99f1735b921594c263341ce2c1
SHA1 01b3a9a236573f120f0c786124ee9ff2ba96f700
SHA256 59105a9f1c1c11ca4e7abb87a266e7b2bc594d6a9d4b49d51bd4afc958b4713b
SHA512 30ee1538d076d742a8e684d157c16d71daa37f7054711bb9368e3d2f69a2795a0f972fcb298becb527eaf1dae4632aae86db09e210af75f1ad554eb07e8a484c

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

MD5 c4c893bd72e7f20347c96166150212be
SHA1 b521785d1972475fc0451b4e185b69d70a0f002d
SHA256 b3065b47d6999dd2dff7f1cbd2a490a1a0cc14925264e77ffe4a78c40f2fa014
SHA512 d9a994ad6d864e2b890047e14a55cb354d03a782387276f45dce56019ce32daf4e25d01d59ffe337e54645f7f94ff790ae81218ba04a37b941295066e11e5da5

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

MD5 92ca8e0fcf7c5f1c4094b66090b90391
SHA1 73f9dada15010e660e996c270b7e66dd4fdd4cff
SHA256 e3bcfd660c68d3dcb98f84447d260f4adccacbea46f6deec8dfc315a0ae8366a
SHA512 1df478d4a29b9b853d4f4270a48d1233afe397537ef6685e2a9145b00e89fba82780c4638afe6fc8dd14ebfb17b5429a8492c40e531fe674df41bc674ac6057d

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

MD5 48d0e43e1ff4c61cbb4819b6cc87b8e9
SHA1 78b5ed201b438366946419de394450d6dd63adcd
SHA256 f8642f052cfe5bc6543252bc9ac14dd3d5323d7e9cafe0e2e0d4d8ce08224f6d
SHA512 d7ace69436d70f1b19b0069ef55773d8e9a2a9b8ce5795649141deb9ec2ba83b42b836830e3bf53f2be66ff3f6b14a7ac208b908864f100ed492048158240750

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

MD5 91f00ff2312c7974c0d2902391da8399
SHA1 4f8ad04d575cc8914fc6cf58695429836eaf711e
SHA256 542013c56fb0fa58084282b35891362bf8d2a516cfcc418ea3efc7e8a37db86b
SHA512 42ec7fd1e2646ce908e60480d51c021ab4fc78aae43e8004b33400d38d620c3fbbb4454d61cd7ee8db84d7742085ad2eecac0e2ac090af52c642d942614bf2a0

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

MD5 74a92b45e5cded1b5af9fcb568ef242d
SHA1 c5d110452493c1b92cf3db67b39779e5a3e7ec6f
SHA256 93afba154fd15e29879528cd877791b73dd2acbd8549020b912450ca3e26dd59
SHA512 72eff94a1b385c602720d437e8d1ca273c0c7556b2dfeefe571e455ab884574ab80e2e19770572cdbda0330fe5d19388aa8da7d82d703c4a5dfc53163e8b8c8b

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

MD5 c184ee4c96058287f30cac484bd9ee8d
SHA1 7a8ee8b9769d276b1aeea044fc74c1cd441a3d6d
SHA256 45ee7e26cb782243f7ae1f50c99dd6bfc77fe844dccf875d349781ef044ba4c4
SHA512 a40597141e860e48bf58f8a6f9d41edb8ea01a6cf3baa82d86242898c4b44821471722b5bd12c3b42ac15f8c989ad9697c724026555d8585c9ac25792418e495

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

MD5 e464aeb5dfe85b1a1ccb00ef09935905
SHA1 f89e3586da1385be7826f4a3163bbe75ae84594a
SHA256 ab393467312bd56b428392b869cef5ad1778ff3af8cdc4c58d636600cc597078
SHA512 3efa2c00c0b96e566a3aa9d5b0ab04a75116655a7d8af0e45795e26992e31ac8f8f5f696b76573c2b208232ea53b8b8b33514d957fb9a25ba719733c641f77e8

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

MD5 6e7f2dd48c147b13d485f6c839d41846
SHA1 ab257d2d00400f165c3848af78e984f9cb6bf767
SHA256 f7e05c4121962c4c052c81b0b8c0151afa4ae01eb2b52c37f4c626c2f9a22b05
SHA512 7f36fbfad0aeeb038ecbdd3bdd182cdecbfd624db8f7c69e58f569e35e29c592db66dbed0aab025ecaa9c1f7cf6c6df9957195207288c42feec72f6de0814789

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

MD5 41526eaef057cc772abb093fcf3a2f09
SHA1 7ac26633f72ef4e634f665242977ceb9405bc983
SHA256 70964a3775e2d2e9dbc68ac218fb0a30b45460f8327d0dce70eefa439f9de82d
SHA512 89d44d65d738891559d0ee3e78fe3dfa46476d7418b5be8d989f3788d19a09914b41b2c8cdcdb126b2e1fc106832382038a2a201d2df6e531bd375fcca38162a

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

MD5 744e7b23d328c836034fd5ca01423ddf
SHA1 b1e81e0d03a722341145e2e4e17dd69dd2285010
SHA256 727ea69cbf7f5d1e7bfb12d05ca3adb4ed647b548a41eadcf7ea66508aecdd4a
SHA512 f7c9facf0e90e8a091465fe124389b89793c55b7eed21bab610da5a606d57e9009ce9c394b60ee6cdcbf118b628cdf9f37d58d49c0a8370c3f1a95edf81f1ad5

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

MD5 f1d235b8ead9bae3004d2828c13c95f6
SHA1 d88007a4623301884d63365b7f5f5576adea7e92
SHA256 feca6b69af4912dd3b1f04dfc091bd73070f2f29abcdc38ef69f185526f5c769
SHA512 07af1cd5cc2e753b056d2ef70f1775f40b814721672229f243f6cfe0f2a3a0ad7952ec1b903e870c355f135a65d0a1334403e3370c72d71b0fa6e36cbca97577

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

MD5 0cba4e5e16ab58e7b932c885915de1d2
SHA1 07cdfdd0dd483b5200e3e8a838cce317365534a9
SHA256 6ae30d8599094052b05af2e94519d3f0f8905a425ed9e6538ee3b65980f9bce3
SHA512 366d986db2aec0158a48d079f1f12dc30d7cf1db717cf1608d95d971d0d9850752a87e938533f3062a8c15126c5fc3a13249a0d2b44b58fbbbfcfc997cd08e73

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

MD5 26ba333e7a7d012f740b211ac508d149
SHA1 ec4b64c6de7c16249ef9aa7ad2c28cce782f7140
SHA256 315291cc7a3b5aa1fc7eed56347bdd68fdff3cd77240ee58ad07b73388408de3
SHA512 0acaa61a8b6f6984137d20389a7c6085afbde06df45cff2fb112bf9884280b7dba6a38ceb9cd92124f53c1d1a9ffea0691a371525da4048c2ba8358f57f621bc

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

MD5 7344a100eae6134cca920134ba6f3d1d
SHA1 02659c0b1d95addb9498beac7faf7d0acac7e34f
SHA256 8f6ab273a64fb63622e6c307b270f5d5c9c6ce9012b385ed5e5426801899eba0
SHA512 d61814141277177fe26dd04f86bf736d705cd655db9342031945d1a89f5a39913f3d2d1ac2a7826ce1561a544dfd6a8bd0f24cc6459ddafe54f8f49da1274607

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

MD5 c91b066a1b530051bce4a7f151360a30
SHA1 53d692c382654a2e0367b3883615afec6d19a84e
SHA256 0665431f66eaa96cc58429173f6038595bc8a804a5b22f36f99706393135c6bd
SHA512 48a1da5e7b8f21bfcb404858e752225bcd658a2ab80be4686dbabbe2595783e260733401af567cefc46e8547b90e7fc114bfcacb93e32bccc1078631fe8c522b

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

MD5 d699ee58b59a5fd70a6a9ec0c9008d28
SHA1 60c79962f0e97acbf50b5aee77069bdb8d25e7e8
SHA256 d13dd805537bb9daf623c22e3ea786253548d4f6cd0d6a671169d07e8a11dab2
SHA512 ed94abf926a7c9ca2645b3e38a61b222d59438f112ae07bb3ed1bc517eaf3d5980ebac97e7c62cfab5af4deb0665fe279b22bf8edb6c486ea28ae5aa9e8119ab

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

MD5 54d9dec62c5e50e662d0dc25668a93df
SHA1 8b1913cb98d4e6d8a04106c57531dd68dc5c5886
SHA256 8fa9074d1df2ca313abceb75c82408bcc1e1bd740d916f51ab9f3fff67793b4b
SHA512 48cb6ed223d6fbb8803e3c81fb2d3c9a263e5b67967b3d9976856f03f523888180c22a220d280fe33d12abd30104b9c651287ad3c1d5e076a54edd20bc01867f

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

MD5 197b8c4cd38e024f9fc67f494fd45163
SHA1 ec3ea42d155de56f09bc5e1774207685cfa18301
SHA256 077878b3392822aa4f63dca1b5dc48a98b442c5d5f1f022e62f7377188383446
SHA512 9036a3d553b18f0117c3fe0f023ce2016d99b60f862094a357d5dd7b0cbf6129c30923b67ceb2bc4f0bbf7d4d91659a28fb468e542aeddbf54260520e6dd07ec

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

MD5 1fab9d1a05875bfc3ebd76e5de2f9ce9
SHA1 77dcbcfa6b335033787308e0ddcf62ebb3038426
SHA256 70e15f7cef50cca926cd68397d41afb1b0528a9afda5333c03a3323381bcf577
SHA512 73adc099b8f474caa9d75b60ed3ac4b222c06b35d79465f6e3d6b8c8cee7f0a676e3c2557b5e0bd2fd537de62e44df489f346fd43ab5888c698d5e37cd148b15

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

MD5 80409a71641f2992ca4afaf6f7c8bf35
SHA1 cb266f557225af36d425c423825dce435f341e89
SHA256 58d295b012e27baa0680ed3c306d0f0435ba582355b34afb89296124f209b250
SHA512 0cca876b77c4a20aea33d1d73e44de24341466b2892e807fafd473c7831f130852eb992a0af5e5086e8f61a029c97cb271f162b5058e906b4a6d8c9ff770bea0

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

MD5 f405e6a11a28db1289c606974a55f0bf
SHA1 b4ee285f424c43cb9a5881b90ffb83cee6f90ae4
SHA256 d9bc33caa9a1cb31644a8f42988354d1205d44c55f7c885e793a30210b735f29
SHA512 ef8f9bef0a78a0e1e4e1509595c8564f610f845abd42476cdaa948f2adfccce7008df4f7f391744cc6c0474f1e5ef71b70402fbaf10705d2170a80770610075f

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

MD5 301165ab2726f760eb41862125665764
SHA1 fc6f0a1b18af33538df6d98c81e8002011bbcb08
SHA256 505a71607260838393afd0a848c3469f2c8a38a5c968879471aca20e09478982
SHA512 477338c92efde8ee023f615ed0c4d596fdb9bbbf48541b0ea733364ed140e517401be8b06071d9fe04b06d8876c4e02feb71dc2e3d712b52c7ecce2b3192b338

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

MD5 107a6e0b037c7934a47ddc69b6b098b7
SHA1 ee83b1ad6f7c49610f5b0cdb53863101da359ba8
SHA256 cfb414002063d8e3f1f11bf1a4f4d769e67165c2fd8f6eaebcce08faecc76e4f
SHA512 9544356a073c14329bbbd8b5f602ca6cfae77770025a70c31531b05f480fdec38db070f227fbce56a8705a9432e1a9a09c689c13f2309d8a0968a9454b0ccd79

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

MD5 c8186f4dd5709e657d6b97d2c50c2e41
SHA1 17d0f35b21b3105e56cd02541937f291945b9437
SHA256 22c2758395a801273f9c3bf3af1859a9dad4e1ca0bd93996d9a9ecc5533b2280
SHA512 e6f27098db83f8b5ccf9265e1b16c7c5409b21200860437bb15ac3c61d67ce1e709d3511a19dc455ab2bd495966fae74012a913bb3b00894e7f8f5825e6783ee

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

MD5 048c96bc4f18f0d14a0e1b733ec9cbe9
SHA1 fe84da663980058c9b92bbc073185cca5e9cf963
SHA256 bfcc837d38d966d0de421a07625fe883a646e1aa36e99a2cc24c45e802f5c348
SHA512 82a507db83b73c33b2ae7e2df4518b2f04536566121a49313b2ba04b2385520917803c0e8f741a173ab326d2517bfcafae347de7b55c93075987d6a9292d5928

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

MD5 520ced1129ddfb0d8454ae117c72cf43
SHA1 b5f746b2ffd9e4590274a0c46681e428d2ca3ec8
SHA256 2504dd32ac30cc846c41ac8e15158fd240b956b996fa2b17b198a29d11a28ca3
SHA512 837a28006fc291f2eb13882e98b9ff37bab2fe0c936a79e2acc1e7a7ebf177c2f3224d344c35d6b010738ab9c79dd8d7b1b3567966dcc12722d66126a9fec2ad

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

MD5 da1489b2b965a88b1c8e045e0989ec28
SHA1 bd02cfdbaf3bedad233858a86c97a6c0f54fc1a2
SHA256 e7073ed51a40c1c998158542cfef0a9b5d19f0a5fd01739d44ea29dfdd4ce5f3
SHA512 3f332e0db8ae579904731a754ef86a7a85f86444ac359f3b9468e442f4ad48433622a5a02d5a8ff919b2fe25a5b95efe76b42227c42de28b329827fa974d6653

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

MD5 3a9c4066595b9570089ea4dcef87490a
SHA1 b504092392cda25c986f02737b0eb291ffa13651
SHA256 83fd31b533bde176e75ace9c4bc68a17f295f3b7aa09867bd05d42d6a30b771a
SHA512 d96c37df5558470ade88ed0617a03a906e3353b6539aeaf5800491732eff4da89a72e19170310c87b896901ed85dd0b2fcfe38160975b8c7dad1e41c0d745143

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

MD5 6f5b1392972639ac020831b36b22d8e5
SHA1 61d57d3e8ef363708a61a1a27a9406553cab983f
SHA256 afc78069c618c480edd44fd49cf6e427d6d2f73925fb81601f031417fee8c47e
SHA512 921b7f834f5c23b792cae3e5e07950e4d6eb63c31a82ac516ee118e2d7af48597a0c40be0fbd0799033bcee5d302e152466a594e11a969c0897d5a81b4d99010

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

MD5 94f2854105a4500197bcb11d51f3fc7d
SHA1 8ebe5dd4a745a5a87caf17f123b52e1fe2dab47a
SHA256 34fb0761596919a95478020644d8b4e6e41830d4f6659728bc32b510ac831b0b
SHA512 c8db9ca36175cac6f0080de6d7655b85ed6f0f9f2174d20b0e32a9c2a59f6814db7b8e3822343df9576998bde842d4550da67ab954fe8f24e8a95ffbec0f2de4

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

MD5 9cdfcbf2b0d1b285acc256f7ddc852cf
SHA1 763143705df7fbbf16467c1d5b30eef7e07a00e0
SHA256 6c678dd4db578c2a955105dac18370337aeb79a2e8489ec203ccab8df39b2595
SHA512 30866baf903ca7950fe5f44547a768cb00cd52203391e7b9c5a987acbbbab94f2535f00fc787930c54d0b37b0a1b23f679186dfe22ca8ecbb4343ceddd79246d

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

MD5 112e2ddb55610636ffe807082b7c8239
SHA1 454b66cd1e654b93fab014a1270472c0febec6d4
SHA256 ef1427b4073ad7789b144d2ff507f7e377d983592eb219c12edb45c039c686bb
SHA512 73de138154ed5ed487d1eea658df44d17cc3fc4442d7948d10b9ca72ec979fe2821126716af54e48d9aad54f2abdc538cb2f402f1228063dd3129b796a241572

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

MD5 73d95331ea801ab4c38782f8f5f191e3
SHA1 bfedb2e9962238cb903db4392f93dc7439c7e62f
SHA256 39ddc6d346de6b782e9b2c9dcee23dd1d409b68e8368791e3257473c5643a9af
SHA512 0562b2574504bcf1c2ee16f9fbfc9a020b12e04fbb56a66dee43c38b156dd3dfc2d69166cbd1c50d237e5972a573abd4ed0a7b818aba33ccdcf5e59e5ed92067

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

MD5 67d9bfe3ec21cd2c3155d2c0271f4663
SHA1 b3d7ef2414f2840ff726ca43b65729fc5a8d70fc
SHA256 4303e608dbd410e1c30fbf5b18ba6af5be54bdcc0652b8e6a0b0c77e9999e562
SHA512 31fb557627f393fc9704fc76dcb749d100527ab7fd8f6e9b71c004cc3da404e0f16d59f9e815844df291b654cf543eae3c8c55d4379e5fdee4ef44a8193af46e

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

MD5 f37ab8968a057eb9252c2b3554d86f60
SHA1 836d06606a165aef703b5ac8df1032d85056c2cb
SHA256 0d575122f783456d96730628683f8173d04c710ef42788f3dc6be27c5f85906c
SHA512 ac6eaea23de9a98acbf8f572d8fb9f101a7058c7e00133402421a67bc822464dd36f5a8354e9eef58a0e329a4fc03881a2a8a83de0c960ef399cf417b16abf57

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

MD5 0a31dd22b97b31b434c66306c8770ee1
SHA1 904ab000e6a9f0bde89b2792b376e96e14f78e4e
SHA256 02df4a5e9442390cc39dcc23575f25a8464ae24a9e7076ca8e6fb457ec62137a
SHA512 db3a823e251fb2cb8924ce96bfb39bed4f2ba0b47b157c9b12b6aaccdcb80a8ba60a6281241dd135c104c6a349f76d3b34e551a773bc4116c54231b376867705

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

MD5 66d95dab8c867c757e286847efaa0039
SHA1 88f017d787da5d0924c22d9daacfdcf9c2b5241c
SHA256 40a14b95a9ea5ceb499c5087312caff53757f5fc9a31da0248e6819cdce7e6db
SHA512 5014da183bf3842e85aa199f7db1b4958904ba289f6c696c462157d389daafd11d9a74d88b6928b7ef0655f9e2db70b7b734dfd82b363a60fee1c526f06e160b

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

MD5 1d6b2348d9ca540e2047dcf9296edc2a
SHA1 8d3f6f72851350c2189ad8c6f731e98cf57bc60b
SHA256 8c507b0b1fcb06c4a10a0a8c014e7a8459a9ce6ca7e630ee80e1c59ee3bf4977
SHA512 99027a4a0579d124cd81d6fa1636187ca13e192feb30c9f5a0035b1020ddcbc7eefbd80c42320e0783248524c140ff58b931ef4609d44bee9e5a64a8bad514dc

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

MD5 b04d613e7b3a74d757a89101c51cf873
SHA1 2782dbafbbe100f889e1846b1be736230c8c3e2a
SHA256 4b0fef85e8fb781bfe90d719ef473da1e844ee877d5f46dacb4ad10fbcbf0973
SHA512 011d0ead131abfc1934a50f14807977378ce4a7bc706249fdecd32726fce70966612d71f6794043c67853fa7157b1fe00a4de31b195f5f96ebb29b5aba62f8af

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

MD5 ff3f6b3f1496386c6584046ab5dd7ad6
SHA1 316b2d38aa5951e40401657d71f70f07e5f88e49
SHA256 beb24ddb693005c3c27af72465ccfb2abf51612a13e5c788a4c65859f8e84297
SHA512 6bac0ac2ceb3260c718101f611c8223594f3938ee1bf3cfbc9e45f46c6a3ca4732c9e793f302f3f24066e032fb0f4203ad54daac6d402afcc8b32dfcf2857287

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

MD5 dd7f9a0c9ef154f860d6d9e41a7279b3
SHA1 39cabe865c6c3e7ec4686fbf19b4804d4946d21d
SHA256 d8c925fdba38da814403e24198ac45449f9b3f81647c7af7c6efb05bb2dc29c7
SHA512 e03190d47d3ec40db8b26fcfc06cbc262e9bb82c18af1dc75f0fd5c5d5b7865fc5139702046f8acdfd01320db8d3b7f576ad0908811183933fca5f2a8d374dfa

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

MD5 ad798bfb325c0e5ad6d33f2acb06b9a4
SHA1 b98ada32e1691b9271ccd872c68d78812efecc13
SHA256 19d31f773e164f7b9d70cb254c2c28d4dd3d4d7edf9891fdc4fa39a597317158
SHA512 4eb415ec370ecc8bdb53f7c6bf9c0bacb8cc8fa2c766aa92131a02c3536fec7d33d5340fd2ad44d7a9e01c3152ee76c4ec9e4ffe736488c9f2d980652301fc00

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

MD5 2c18b295a5862b229ee119980fd74ebf
SHA1 463df16e00f05d2fda7c12f3e5351b762e319def
SHA256 4ea289652baa7648a0c1a5401637ef59d7d7521d49bb94f27f0e430549e3fbad
SHA512 69297d405ff48849ba3205da013329490abb4892c6ad1d96b6062730f2c39c70efa67ec5407b4856438465a7c90508e2a96797b87c84dd8389e3493664ae671f

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

MD5 66c703a2c6489050e0d7871239fb0252
SHA1 8faddf0337fe1c1611e825e7668756bea288361c
SHA256 4936528b2b484bb1554e4ae33a9e8cba747d3896d420b4c98c42db469fcecdff
SHA512 d9bce55c5a92496aaa8eb0d6e18a48dcbf527dde55001ecc20af6d8fe2af4773c9678215da19ad2f2c0f83cab6647baabf88ecf77ad11a48a5e4a7a5fb415bb6

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

MD5 392c0cd7e1271603c7248f6c8dad76c3
SHA1 3e10c105e65fa7dbc617a90cd2f5f3de9dfca29d
SHA256 24cfa9182e928045b10c506f60c5088b18131c166653671403a116ba9c29888c
SHA512 3c170fb5a6028dceb4ec861e6a33a3b9f2e801647c3376cbb17f943afcee920c0b136c2da105a507a6de8ed0c151fc4000c024f9f2c30ba1817b59d1978d85d2

memory/208-10053-0x0000000000400000-0x000000000040C000-memory.dmp

memory/208-10904-0x0000000000400000-0x000000000040C000-memory.dmp

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

MD5 fc16b79527dcb115c908034366b3d29a
SHA1 28a1d7a6be1823ffaf6648f92b98162599fdb93b
SHA256 6a4c52f94144bd8eaf7bcf374c12a33e8f7aa79cee7d957c30f911a0f8b25bf0
SHA512 1e316d5adb5d6e1415743f6fdd6efa444714f0f15c6b7059a95ddd9e8fd470db6decb74b413346cea991f66437f29ba68c8d7aaf1d21e9c4ef94689893bd270e

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

MD5 6934d310b64bc2fef416d3042549f229
SHA1 fc94928ecb380bc2307810fcd83d7216b8746704
SHA256 5d2583d080df3760814a9e2c2969f597b8197652d20860f75a3faa421922c655
SHA512 49f996bb3e25a98a71e4ccc6dd9bf3e02c67aa3c54793b0ad74a8ea0cef84ab1ed9d46aa806554429a49861d5ce4ac18251de2f1ca0c2faf2d9d001e3a251360

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

MD5 3d822fcbd564864160a4bc96ce6ab132
SHA1 da0975708c2e518c21b6902425e287b7818de61c
SHA256 b0c97c789a8ed5072ed6d5c5bfdd1d3a55d7b70f5f3e26db731ab1b3136854d8
SHA512 dfd2bf7f8cd970ffce267a5f234418ee21e6cd10af4440e7d6ea62be70d9c1a6a6dff64aa6b1642133ba230beb4b32b754914ff3550e15e475bed32dfa889de3

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

MD5 a730b91fdce8b20de037293d56302f48
SHA1 b0bb39c0f1a5070c35c653abdc539a48dac504e7
SHA256 fb9ad4369e729caacb545fcfc349a53162700f24240243fcab68d894c1189ca0
SHA512 ed7ab5e4c0c0925d281594e3f48fcbeca02d21e106d9e8b484124a41549bfd54e7a10a0b3dac218778127b24b846bb97094502210f09d11b6298bae32606eb1c

memory/208-11243-0x0000000000400000-0x000000000040C000-memory.dmp

memory/208-11244-0x0000000000400000-0x000000000040C000-memory.dmp

C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

MD5 d34b23b53461c8cc212c3057cdd07901
SHA1 b632713b4aef2e96d33aa6069b7db47cbdbe2205
SHA256 469abd1bc402e1b845816dec8106fac6b43eaf3c030f25ea16e6cd195885868a
SHA512 2ee97b8d49eac8a9a774f9cdb705828b19db9948fc1f91f8ed28ec76aee4a77c3721cd17a6ccee5031f553f0f8d01ac0317416767f9de006ebd6dfe4a8e98d35

memory/208-11249-0x0000000000400000-0x000000000040C000-memory.dmp

memory/208-11251-0x0000000000400000-0x000000000040C000-memory.dmp

Analysis: behavioral26

Detonation Overview

Submitted

2024-11-22 22:54

Reported

2024-11-22 22:56

Platform

win10v2004-20241007-en

Max time kernel

93s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\bldjad2.exe"

Signatures

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4076 set thread context of 2328 N/A C:\Users\Admin\AppData\Local\Temp\bldjad2.exe C:\Users\Admin\AppData\Local\Temp\bldjad2.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\bldjad2.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\bldjad2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\bldjad2.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\bldjad2.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\bldjad2.exe

"C:\Users\Admin\AppData\Local\Temp\bldjad2.exe"

C:\Users\Admin\AppData\Local\Temp\bldjad2.exe

"C:\Users\Admin\AppData\Local\Temp\bldjad2.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2328 -ip 2328

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 408

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 138.136.73.23.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

memory/4076-0-0x0000000000400000-0x0000000000456000-memory.dmp

memory/4076-1-0x00000000001C0000-0x00000000001C3000-memory.dmp

memory/2328-4-0x0000000000400000-0x0000000000435000-memory.dmp

memory/2328-7-0x0000000000400000-0x0000000000435000-memory.dmp

memory/4076-10-0x00000000001C0000-0x00000000001C3000-memory.dmp

memory/4076-9-0x0000000000400000-0x0000000000456000-memory.dmp

Analysis: behavioral27

Detonation Overview

Submitted

2024-11-22 22:54

Reported

2024-11-22 22:56

Platform

win10v2004-20241007-en

Max time kernel

93s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c145a26dd6d200080c16300456e7c0bc95f2b71f56d94136619e239e466a04a0.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c145a26dd6d200080c16300456e7c0bc95f2b71f56d94136619e239e466a04a0.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\c145a26dd6d200080c16300456e7c0bc95f2b71f56d94136619e239e466a04a0.exe

"C:\Users\Admin\AppData\Local\Temp\c145a26dd6d200080c16300456e7c0bc95f2b71f56d94136619e239e466a04a0.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 71.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 99.208.201.84.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

memory/3296-0-0x000000007535E000-0x000000007535F000-memory.dmp

memory/3296-1-0x0000000000FA0000-0x0000000000FAC000-memory.dmp

memory/3296-2-0x0000000005940000-0x00000000059DC000-memory.dmp

memory/3296-3-0x0000000005F90000-0x0000000006534000-memory.dmp

memory/3296-4-0x0000000005A80000-0x0000000005B12000-memory.dmp

memory/3296-5-0x0000000005A30000-0x0000000005A3A000-memory.dmp

memory/3296-6-0x0000000005BE0000-0x0000000005C36000-memory.dmp

memory/3296-7-0x0000000075350000-0x0000000075B00000-memory.dmp

memory/3296-8-0x000000007535E000-0x000000007535F000-memory.dmp

memory/3296-9-0x0000000075350000-0x0000000075B00000-memory.dmp

memory/3296-10-0x0000000075350000-0x0000000075B00000-memory.dmp

memory/3296-11-0x0000000075350000-0x0000000075B00000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2024-11-22 22:54

Reported

2024-11-22 22:56

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe"

Signatures

HydraCrypt

ransomware hydracrypt

Hydracrypt family

hydracrypt

Deletes shadow copies

ransomware defense_evasion impact execution

Renames multiple (908) files with added filename extension

ransomware

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.hydracrypttmp_ID_9fac38b1 C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.hydracrypt_ID_9fac38b1 C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ChromeSettingsStart3264 = "\"C:\\Users\\Admin\\AppData\\Roaming\\ChromeSetings3264\\zalibuke.exe\"" C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Internet Explorer Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe\"" C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Admin\3D Objects\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-2437139445-1151884604-3026847218-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2437139445-1151884604-3026847218-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4460 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe
PID 4460 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe
PID 4460 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe
PID 4460 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe
PID 4460 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe
PID 4460 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe
PID 4460 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe
PID 4460 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe
PID 4460 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe
PID 4460 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe
PID 4460 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe
PID 4460 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe
PID 4460 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe
PID 2912 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 1236 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 1236 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 1236 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 4632 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 4632 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 4632 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 224 wrote to memory of 3096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 224 wrote to memory of 3096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 224 wrote to memory of 3096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2912 wrote to memory of 3904 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 3904 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 3904 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 3096 wrote to memory of 3692 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3096 wrote to memory of 3692 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3096 wrote to memory of 3692 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2912 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 3436 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 3436 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 3436 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 3844 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 3844 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 3844 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 3180 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 3180 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 3180 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 3396 wrote to memory of 4880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 3396 wrote to memory of 4880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 3396 wrote to memory of 4880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2912 wrote to memory of 4924 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 4924 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 4924 N/A C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe C:\Windows\SysWOW64\cmd.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe

"C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe"

C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe

C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C net stop vss

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /All

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Z: /All

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Y: /All

C:\Windows\SysWOW64\net.exe

net stop vss

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=X: /All

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop vss

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=W: /All

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=V: /All

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=U: /All

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=T: /All

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=S: /All

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=R: /All

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Q: /All

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=P: /All

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=O: /All

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=N: /All

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=M: /All

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=L: /All

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=K: /All

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=J: /All

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=I: /All

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=H: /All

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=G: /All

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=F: /All

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=E: /All

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=D: /All

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=C: /All

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=B: /All

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=A: /All

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2912 -ip 2912

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 1872

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 google.com udp
GB 142.250.187.238:80 google.com tcp
US 8.8.8.8:53 238.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 drivers-softprotect.eu udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
GB 142.250.187.238:80 google.com tcp
US 8.8.8.8:53 drivers-softprotect.eu udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 96.136.73.23.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 31.73.42.20.in-addr.arpa udp

Files

memory/4460-0-0x0000000000AA0000-0x0000000000AA5000-memory.dmp

memory/2912-1-0x0000000000400000-0x0000000000978000-memory.dmp

memory/2912-3-0x0000000000400000-0x0000000000978000-memory.dmp

C:\Users\Admin\AppData\Roaming\1$FUWW$FFHEX.dat

MD5 6a16061f1c0240d859b754017eb171e7
SHA1 d70b85dba1068db46cbe78ad8febb05e9baa8ca2
SHA256 0de37df83833651ea7b4a36cb58365b54070f116b2b0123ef71f958c13bd9a46
SHA512 be595408c4d128fd2a7563f7b638f6c97948b89495f11a3711addaa721d7ea7efd45ad4bacf3760d1538e4fabfa0af90ed0d7410fdbfa15db932550a0cc1ac48

memory/2912-966-0x0000000000400000-0x000000000040E000-memory.dmp

memory/2912-969-0x0000000000400000-0x0000000000978000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml.hydracrypttmp_ID_9fac38b1

MD5 f65472746d0fa1b3447412f20c897881
SHA1 bb7611de1395501d38acb3361cfa59ba0b80210a
SHA256 0ecfff4008516764f48d52cb10575b3ac253d1d31f0ab67dd54420e83686dc24
SHA512 7470d925d9ba18f764c7cd5ffe9d6dc9f19b234b38456c80e6267cfb904228bea34f29fe92ab1138af6b5f621e84f5e37d8190b0e4ae9b9ece201dec8eac3017

C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\onenote.exe.db.hydracrypttmp_ID_9fac38b1

MD5 0a9e4942c1dc0c971e7709d003724bfa
SHA1 a7fce2b9be799d49c84cb9b7cb85f08d417fa4a6
SHA256 a86c60cad98ebbd330ccbdcbeb0de5cd9e9c274356d054f753449dcc73f38d71
SHA512 3a9d50a664deba3b789c3cbaec264566786da63bda09b14817e2dd3c52ecddbde5440ce6086cf667167867085382cc47dd0fd58075f0b5346ae6e5ffb841545f

C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini.hydracrypttmp_ID_9fac38b1

MD5 e746585202167ade5841c39a805a3785
SHA1 e9ffa2f9bd89e31bc0444f5ec0ef871cebeba698
SHA256 f499bc72163069199e28da00c98c26a9cbe1f70cf6e1a611d0b5b4f7982f7b09
SHA512 110272da23d144b4978a2b7282283782e61f277cf3a7c3810d557d6deceaf59c7488a41083d438d03480e1ae578fa029cfa2721ab666a4fe15a83c2b2fdf1a7e

C:\Users\Admin\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat.hydracrypttmp_ID_9fac38b1

MD5 ce33d261914cfaf12c574de8bb35deea
SHA1 53c29649b1ee9d14e5b6ecf8cb6f57a4d025aa76
SHA256 f8b4058fc260e3923df76875a1bb244111df16196dfcb1e781dc83cfb1649785
SHA512 e42c610d84e5bbfdc7181d59b9c413e510adafd3ee56b57a005368b6d007c27619da4af74df0e590aadf4ba10f64d285b34462f8d550da61abd2464867d60e0f

C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.hydracrypt_ID_9fac38b1

MD5 053805885ad570f3006fe9490a585037
SHA1 484cdea5678996ef0aced24e0c613ba671f71349
SHA256 f6ed1af2fd1bd8f914585e54a0ac9844e2ca6ab1ef40822340068a5d416a4dca
SHA512 7941ea23d33452446d3fbba8421b55b423fcc70cefdce69740514ed824b60099b5a5adea42430cd672589829b66a084a2b94d135cda7c4995368bf639e329aeb

memory/2912-3042-0x0000000000400000-0x000000000040E000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{e1b98d9c-2917-4e0c-8723-46d9c100b538}\0.1.filtertrie.intermediate.txt.hydracrypttmp_ID_9fac38b1

MD5 9f3ba37329fbf83afba69d20c61c0cb7
SHA1 c47e76f26ad8e9c5d4a0aa919cfd1d78605f174a
SHA256 52ef0981b2ee86479e71e9f934b1fd5d2451a31ec836d9168a516a0d8e4c70a0
SHA512 55a52af59a5f65a82e413cca81f44961efaea83b113384253820a4471b78ed69477582bd2bb0a776ad62f3eeba166b0a5da84e9c4bfac82d3e6230f335a44be8

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{e1b98d9c-2917-4e0c-8723-46d9c100b538}\0.2.filtertrie.intermediate.txt.hydracrypttmp_ID_9fac38b1

MD5 bc72a76b12154af3fbd2d32258460cb3
SHA1 cb3c73b390281243bfcc422e840a8f95ed7481a7
SHA256 99db54e52642ab369450e247085e1c0a942ac56fe2d4fa4479117d074438775a
SHA512 08a640ecaa95b7769cd5cec86a409bb0fbadd3e2f04d310e9a5be98c028742018be04e2566f12f4298cbe79c4d55f50d5e00c9b5207dd15f22ea5001f047e8ce

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656060295712.txt.hydracrypttmp_ID_9fac38b1

MD5 48958521babf310f356f82ef749032cc
SHA1 f3fd18a31905fcac56ac8bc46917d2f25b01a686
SHA256 b117d7c62e11e13f82a27dfd4eaaab438b9c469c8fdae14c445a4c9dd21e7df0
SHA512 c1f9709f360f2804f30ffe152784a31e7e8e01eb7876e8a2b2920b701d63b8e16f2ad6a5d0a43d92886e768756fb2be653c1b34ca0c40acf8ff5e174537ac1b0

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656525478361.txt.hydracrypttmp_ID_9fac38b1

MD5 ca845a99cbaea4b8ba658376bf4fc0b0
SHA1 975e85b50bb25cc669428daad72e45d57b3d7c56
SHA256 34accaaa51a2bc3aee2bc227a509aedb04d74b006302add9527d0ab35beed429
SHA512 6a8a0fdb8021ae7725d0d7f772b2e46c98a2c8295814e8c08cf93abb70318230da3636d774dfbe246527b1ec9c6d08b155c080db1c1b4a539e7c9458f6b474ac

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663169040966.txt.hydracrypttmp_ID_9fac38b1

MD5 7b9adad5667966362a732713a6bc63b0
SHA1 b588e06bac597bbac0d6fb5418fcfe5ac85d2160
SHA256 093181893d31d961a909705a1387cf5f888d6096789bd5835e2032efba751156
SHA512 b07f0f827b749815db64e25414cd6905baacc7d9c6701dac5ba1f9f89b597de782f9d2c23ffa50c27fcded22c5e6d434cf29391eeb4d299969966c2b6254bd78

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727665885684530.txt.hydracrypttmp_ID_9fac38b1

MD5 4d618ce38af9a188151ac240a797f597
SHA1 09298644190d55440ff201a9ccfc1befcd90a4cd
SHA256 ce9012006572e4fb5675359b8aafab978616ba4266cbb38dd0067300662cd0bf
SHA512 085286b5b5bdfda49c108d2161bd0d52041ce7f8d823b2a3f4dad9663e3ece6eaab721c16762e702a0eb28e45cea3b31900532d895c498b1bfc95ac6c53c80cb

C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20241007_091147539.html.hydracrypttmp_ID_9fac38b1

MD5 01b03268955c57e71e48d5b6a7eed689
SHA1 35b07416900b00e7b8cdf4e39b5c0013e1a9cf78
SHA256 34a54a0b3b67beb92f61d3c68b05608e7dbbe34a243bf51c69078fcc177e59f8
SHA512 48a1c417ec2b40898027d7f0538614958c976c827df1cd45d3e036cef6c9f384c345a8daeb473673292b599e1cd33d43ec3ca8faa987b7870cc433a5fbb8faed

C:\Users\Admin\AppData\Local\Temp\wct53C3.tmp.hydracrypttmp_ID_9fac38b1

MD5 ea5ba7cf0604aee0287745428607e0fe
SHA1 0772290d2a95551052f7d86c48ec5357bdfb53e8
SHA256 7eba66a495a6b52e00d6fb39eeba9f00ab5885d1b717586bbf0f706c22b6a290
SHA512 36e5a7f11a2043ac0c91fc89f29b8de2581907bf1ec955541c91e14e012651e6c5caba5eb08fef6caee3ec19b9d153ffa3e7f528f526771ebfa55fbcae46fbe1

C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.hydracrypttmp_ID_9fac38b1

MD5 1161d8890c7005ea477400e0e1d3997e
SHA1 f837f070825ac791548853453f7b2703657f7948
SHA256 3a1dcc14202bcae103c17c40c004d83aa4abbb6f210e84e57f2ec7889ec88dcf
SHA512 159aeefaff247aa22111bc819eb07631c70683db12628c74d48aaa1fea161f96f5a8fec7653b493adf65a7c49246542f5bcae3cf637576f37fb0e45e832b7ebc

C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.hydracrypttmp_ID_9fac38b1

MD5 97df3636d5be325392edc424e873cefb
SHA1 687596d7b3ce4e28b8f3d37c849cab5a72a02939
SHA256 8c4a6f82334dbd48c335f52dd777dd106466e5f19f456075afe4bb2b861fd017
SHA512 0002cf64756d744a461a108a52fc633b8508ea89c9b4a172c5273d37a02a9acf56e761faeadc62affd4408e8b16abfe178003fd38a8d02d4a8f445bcaa962516

C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml.hydracrypttmp_ID_9fac38b1

MD5 fe4a80d9f130bdf2326681e9548e807e
SHA1 73bd39c3f798521a0bf2d4b7db4311f619f05476
SHA256 f32fc0ceb021061927e0cf4fc3381fa3f5aa3df2fc56e9ddfa3298a2ecbcdf52
SHA512 748d1d142b6dce13f47a4fb6bd2f23f1dad2536e2cbb8767aa7b717d425dce9aec9ed58e7fbd28d2b2caef87a63dd178c742d0b23e2d579acca52413f96e27c7

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini.hydracrypttmp_ID_9fac38b1

MD5 eb819576447f1ce5765cef3b91fe14a1
SHA1 47794cd725dbadf85dd6384b3807d83ffef896c8
SHA256 2fb9aa57912db6b0d02fda0c9d80c4ff0c7dbf316f7ffbc7840877eb446cce8c
SHA512 b6d93d47001c5c719ea80196d6ed52328ebedc563efac8c028e96ebd4d8eab96661212f9e57f420b75112e0fe6a521c316786356faea083d462d1dd585e000f2

memory/2912-5323-0x0000000000400000-0x000000000040E000-memory.dmp

C:\Users\Public\Documents\README_DECRYPT_HYDRA_ID_9fac38b1.txt

MD5 e6f34e223b172686c2e35cb9d513fc39
SHA1 31dddfb65fd3ea8fe4c71f936bb6b0bf062aab2a
SHA256 fc49609f3841a03a163fdaeeae740fb1d0d8807a52a2baebc47ea6517cb49f9b
SHA512 3655617c9424272032a35bbc6144db981c2e7eaf79121f94af3119e50421eb243c0269eb151fe8fc9e38711934951dacd4ad77ff2ac6a0a0654296a38b31b640

memory/2912-5346-0x0000000000400000-0x0000000000978000-memory.dmp

Analysis: behavioral14

Detonation Overview

Submitted

2024-11-22 22:54

Reported

2024-11-22 22:56

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\zsgblrbrumorwxfizuke.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\zsgblrbrumorwxfizuke.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\zsgblrbrumorwxfizuke.exe

"C:\Users\Admin\AppData\Local\Temp\zsgblrbrumorwxfizuke.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2232 -ip 2232

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 296

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 75.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

memory/2232-0-0x0000000000570000-0x0000000000571000-memory.dmp

Analysis: behavioral15

Detonation Overview

Submitted

2024-11-22 22:54

Reported

2024-11-22 22:56

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b7d9f11c166fa1a4ceef446dd9c8561c77115cb3ce4910a056dd6a361338a2b0.exe"

Signatures

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\sethc.exe C:\Users\Admin\AppData\Local\Temp\b7d9f11c166fa1a4ceef446dd9c8561c77115cb3ce4910a056dd6a361338a2b0.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b7d9f11c166fa1a4ceef446dd9c8561c77115cb3ce4910a056dd6a361338a2b0.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7d9f11c166fa1a4ceef446dd9c8561c77115cb3ce4910a056dd6a361338a2b0.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b7d9f11c166fa1a4ceef446dd9c8561c77115cb3ce4910a056dd6a361338a2b0.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\b7d9f11c166fa1a4ceef446dd9c8561c77115cb3ce4910a056dd6a361338a2b0.exe

"C:\Users\Admin\AppData\Local\Temp\b7d9f11c166fa1a4ceef446dd9c8561c77115cb3ce4910a056dd6a361338a2b0.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 api.sypexgeo.net udp
GB 89.38.146.218:80 api.sypexgeo.net tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 218.146.38.89.in-addr.arpa udp
US 8.8.8.8:53 104.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 67.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 138.136.73.23.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

memory/4744-0-0x0000000000400000-0x0000000000576000-memory.dmp

memory/4744-1-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\b7d9f11c166fa1a4ceef446dd9c8561c77115cb3ce4910a056dd6a361338a2b0.exe

MD5 4523ccfd191dcceeae8e884f82f5c7ad
SHA1 00107a6bdc9886e69425b7b0b761dcc8324946d3
SHA256 b7d9f11c166fa1a4ceef446dd9c8561c77115cb3ce4910a056dd6a361338a2b0
SHA512 79df12b1abb0d2ddab35e898aa01baaf7ea737fa37331c926b07d0ca478aa9c1c3d14795241e11d7dcff06ec3c5de93b2819cfbc0fd6db5bf6e752c52cfad5a5

memory/4744-3-0x0000000000400000-0x0000000000576000-memory.dmp

memory/4744-5-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

memory/4744-6-0x0000000000400000-0x0000000000576000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2024-11-22 22:54

Reported

2024-11-22 22:56

Platform

win10v2004-20241007-en

Max time kernel

141s

Max time network

152s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad3cc219a818047d6d3c38a8e4662e21dfedc858578cb2bde2c127d66dfeb7de_PonyNews.dll,#1

Signatures

Pony family

pony

Pony,Fareit

rat spyware stealer pony

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Checks installed software on the system

discovery

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeImpersonatePrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1060 wrote to memory of 2392 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1060 wrote to memory of 2392 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1060 wrote to memory of 2392 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad3cc219a818047d6d3c38a8e4662e21dfedc858578cb2bde2c127d66dfeb7de_PonyNews.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad3cc219a818047d6d3c38a8e4662e21dfedc858578cb2bde2c127d66dfeb7de_PonyNews.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

memory/2392-0-0x0000000074F09000-0x0000000074F0A000-memory.dmp

memory/2392-2-0x0000000074F00000-0x0000000074F1C000-memory.dmp

memory/2392-4-0x0000000074F00000-0x0000000074F3F000-memory.dmp

memory/2392-7-0x0000000000BA0000-0x0000000000BB3000-memory.dmp

memory/2392-9-0x0000000074F09000-0x0000000074F0A000-memory.dmp

memory/2392-8-0x0000000000BD0000-0x0000000000BD8000-memory.dmp

memory/2392-10-0x0000000074F00000-0x0000000074F3F000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2024-11-22 22:54

Reported

2024-11-22 22:56

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe"

Signatures

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\ielowutil.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "439081063" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\VersionManager C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2603724340" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31145265" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31145265" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2603724340" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\VersionManager C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31145265" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C6CA870F-A924-11EF-91C3-CAFD856C81B1} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2605911278" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe

"C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x2c8 0x494

C:\Program Files (x86)\Internet Explorer\ielowutil.exe

"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:464 CREDAT:17410 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 checkip.dyndns.org udp
JP 132.226.8.169:80 checkip.dyndns.org tcp
NL 109.236.82.8:80 tcp
US 8.8.8.8:53 169.8.226.132.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
NL 109.236.82.8:80 tcp
US 8.8.8.8:53 215.143.182.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-940901362-3608833189-1915618603-1000\0f5007522459c86e95ffcc62f32308f1_f2cdb6fb-4ab8-4547-9f25-fad1f7a44351

MD5 a78dcd7c50d4536c24d693c8994e87e0
SHA1 521e4781ce5229832f2806285724cb3a454cda11
SHA256 682a01bd6df1972a184ca2ce9ac21cf0f3e7215b61389c2fd974dcc1b9283516
SHA512 2fb222f1d9b89694b7cceb3c2085378acec6ee196a6d05538179d6ad28ae04353ed08e25b40153d7a83498ffff0cf121faf338de75972494088fbff6742e8fcb

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-940901362-3608833189-1915618603-1000\0f5007522459c86e95ffcc62f32308f1_f2cdb6fb-4ab8-4547-9f25-fad1f7a44351

MD5 cfd1379b09123fdd96086cd235f53e27
SHA1 fcecacab6a1115d342ad4967137466d74ea64548
SHA256 21d4490df248284bed1f2c65a7e404c5afb9b5c7c2528b5c1a439fc078fa214a
SHA512 ec6f2755dcc622c8f91b6454cc23c2a28c25253744899a0b1e832219d953084b9a180954c9d88abea13e1b850b20a682d1214d699ce1da12546e9994a2e0a35b

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-940901362-3608833189-1915618603-1000\0f5007522459c86e95ffcc62f32308f1_f2cdb6fb-4ab8-4547-9f25-fad1f7a44351

MD5 be2c340bf7342fb9922b531a501a2734
SHA1 8645cb1a0529889265a541b83c2879bc2f61059a
SHA256 d6c153ca79cc27f0cd9738b203b3ce5ba4980434cbda8704683d3d29d6c78a77
SHA512 dbd5f62b3dde64831ba6bf0b26ccc8d71601e6c30a4bd0e842b14214ffc0f43011c92eec10131b883e45f5d96c16e8795faabb76d9604e44eb122053a8c2a1c5

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-940901362-3608833189-1915618603-1000\0f5007522459c86e95ffcc62f32308f1_f2cdb6fb-4ab8-4547-9f25-fad1f7a44351

MD5 ba293e7fec187ef9777d90d5ded97da5
SHA1 1798b8c5204556d247637726d8ee01a04e753630
SHA256 39343a843942909e97bfd22296f18dc91651ffeeb5ee343ccde868ed7fff43e2
SHA512 eb62e9cfe61fca9645d63a38428678471128d2724fefb16873b055aeecab509d4ff8b1078cd2aa7b6b7cacd61ee71c393db9d0bc0ab90a0e8544ff658dcd4fc1

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-940901362-3608833189-1915618603-1000\0f5007522459c86e95ffcc62f32308f1_f2cdb6fb-4ab8-4547-9f25-fad1f7a44351

MD5 29c446e05055cccc4d04d0ee6419af0e
SHA1 cce9bdede5909f04d9b027e1de67d6e0ddcc8f81
SHA256 dfd406ce88540bf298704d0082194ed7acb26d9ed64daaf94c52d22c4bb3b4d5
SHA512 0639a929967f7a286e59225ae5ea4359de93d29951e8cd3cc4b5c4453d8d1b7451b9b916f963b10688372d1b16e1c645b864e40008e4214d2e115e25dc982c9b

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-940901362-3608833189-1915618603-1000\0f5007522459c86e95ffcc62f32308f1_f2cdb6fb-4ab8-4547-9f25-fad1f7a44351

MD5 0bb9b3e1c71fe0ae3db7beea85a980d9
SHA1 a2858dfdf93f24129675b345a1146b0e50f3b792
SHA256 5671cc7644c53bcdf15d4fcff12e044ed29e524fb70a9ba22d89a45dfc05182d
SHA512 4c0ae4339bed7d042d4da42f56424c49edf2ec5a49b4849a7c2ce4b0750ebfa470f67b14fb4e174306a6ed863775409ac29cf630197775b08fc1f3260d6ebb9a

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-940901362-3608833189-1915618603-1000\0f5007522459c86e95ffcc62f32308f1_f2cdb6fb-4ab8-4547-9f25-fad1f7a44351

MD5 5dcf6f53db8f1a34b4d35ee562634b4c
SHA1 1685291c3fc2297e5bbbaff7360864b44bdd09c5
SHA256 bf76e40ede13266939559fb2347f9855e577f5ccda003611807c5c15c00b7277
SHA512 1829da94e1fb249cbe016cf33689bc84742f9e9a79f666113f1dd0ee9d8691b3164c273c940551f131e98b13b98e627c2a348c0353d3459aa533771ce72b0034

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-940901362-3608833189-1915618603-1000\0f5007522459c86e95ffcc62f32308f1_f2cdb6fb-4ab8-4547-9f25-fad1f7a44351

MD5 6bfc8379ea59310bb2024819b8491211
SHA1 730c496dec38133c3362b0a1b04f91ed6bf26b48
SHA256 946de55402a08137a3c3981bb231f9b3c9f60582e30d1f43d8252ed5442a5498
SHA512 e77c79bc8f9f57df5c0f1cb58b6eef79f6fc32931030ff76e767599bea20f34c5f5ae4f426c0444725dbf35077559fb84e4432030944467f7b9bbfac67730798

memory/2264-134-0x0000000002E70000-0x0000000002ED0000-memory.dmp

memory/2264-135-0x0000000002D60000-0x0000000002D61000-memory.dmp

memory/2264-136-0x0000000002E70000-0x0000000002ED0000-memory.dmp

memory/2264-137-0x0000000002D60000-0x0000000002D61000-memory.dmp

memory/2264-138-0x0000000002D60000-0x0000000002D61000-memory.dmp

memory/2264-139-0x0000000002D60000-0x0000000002D61000-memory.dmp

memory/2264-140-0x0000000002D60000-0x0000000002D61000-memory.dmp

memory/2264-141-0x0000000000400000-0x000000000043B000-memory.dmp

memory/2264-143-0x0000000000400000-0x000000000043B000-memory.dmp

memory/2264-144-0x0000000002D60000-0x0000000002D61000-memory.dmp

memory/2264-145-0x0000000002D60000-0x0000000002D61000-memory.dmp

memory/2264-146-0x0000000002D60000-0x0000000002D61000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

MD5 a988860b03479abf60836ba5f04675dc
SHA1 5bd62ab48c54a636e852f5a8794bb71a1a1cbe51
SHA256 e77b0f7fcc02c28de2ae4cc7db1232ddfee287483a8ede6bb9999a941b119eaa
SHA512 d385560f9001ee0b768b4e6b829d5669a6cf1ca0d435c0b4efdcb0febc38b33101c1ea1f0a8c3dc49ea0e962c47f749d22f2192f821e8b724f6b6e018d4afb26

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

MD5 a5d59031144ac6ab3dbf6358566aa618
SHA1 f6fb4567bbfd07f0df27083b36a179e00c263c5d
SHA256 039ec47b1e431e2555dc8da6bff06a3c78b242c01c9553286128c0f94d4c55ff
SHA512 a3049b32be6a7e8a4b1522d32df205e6433fa81fd540893ca917eb6ca33f51f79ec5571f144727bf145f00a457b4705942f0c55c85ddad96a227465345fc866f

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XH3Z2ZON\suggestions[1].en-US

MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Analysis: behavioral22

Detonation Overview

Submitted

2024-11-22 22:54

Reported

2024-11-22 22:56

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\be514549a2e654706aeeaa15c8cffce504f0e271c904fe07d865f3999ebaa61f.exe"

Signatures

Renames multiple (6563) files with added filename extension

ransomware

Credentials from Password Stores: Windows Credential Manager

credential_access stealer

Deletes itself

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update Svc = "C:\\Program Files (x86)\\windowsupdate.exe" C:\Users\Admin\AppData\Local\Temp\be514549a2e654706aeeaa15c8cffce504f0e271c904fe07d865f3999ebaa61f.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update Svc = "C:\\Program Files (x86)\\windowsupdate.exe" C:\Users\Admin\AppData\Local\Temp\be514549a2e654706aeeaa15c8cffce504f0e271c904fe07d865f3999ebaa61f.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Program Files (x86)\windowsupdate.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsWideTile.scale-100.png C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreLogo.png C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookWideTile.scale-200.png C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\TXP_DiningReservation.png C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsStoreLogo.scale-100.png C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\FillnSign_visual.svg C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\cs_get.svg C:\Program Files (x86)\windowsupdate.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul-oob.xrm-ms.How_To_Decrypt.txt C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyView.scale-125.png C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubSmallTile.scale-200.png C:\Program Files (x86)\windowsupdate.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\A12_Spinner_2x.gif.How_To_Decrypt.txt C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-pl.xrm-ms C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\LibrarySquare71x71Logo.scale-100.png C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.scale-100.png C:\Program Files (x86)\windowsupdate.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\ui-strings.js.How_To_Decrypt.txt C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-ae\ui-strings.js C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Bark.jpg C:\Program Files (x86)\windowsupdate.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugin.js.How_To_Decrypt.txt C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.pdf C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\da-dk\ui-strings.js C:\Program Files (x86)\windowsupdate.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\resources.pak.DATA.How_To_Decrypt.txt C:\Program Files (x86)\windowsupdate.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-pl.xrm-ms.How_To_Decrypt.txt C:\Program Files (x86)\windowsupdate.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\vlc.mo.How_To_Decrypt.txt C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-16_altform-unplated_contrast-white.png C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_~_kzf8qxf38zg5c\AppxMetadata\AppxBundleManifest.xml C:\Program Files (x86)\windowsupdate.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fi_get.svg.How_To_Decrypt.txt C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\da-dk\ui-strings.js C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_Tracing.jpg C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarSplashLogo.scale-100.png C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\Assets\MixerBranding\Mixer_logo_DarkBlue_RGB.png C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\ui-strings.js C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-40.png C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-30_altform-lightunplated.png C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp2.scale-100.png C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ul-oob.xrm-ms C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\OFFSYMSL.TTF C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteWideTile.scale-125.png C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\he.txt C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-phn.xrm-ms C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppUpdate.svg C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSplashLogo.scale-250.png C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarLargeTile.scale-200.png C:\Program Files (x86)\windowsupdate.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\MEIPreload\manifest.json.How_To_Decrypt.txt C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql2000.xsl C:\Program Files (x86)\windowsupdate.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE.How_To_Decrypt.txt C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubSplashWideTile.scale-125_contrast-black.png C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxLargeTile.scale-400.png C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Advanced-Dark.scale-125.png C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_fillandsign_18.svg C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\fr-FR\MSFT_PackageManagementSource.strings.psd1 C:\Program Files (x86)\windowsupdate.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md.How_To_Decrypt.txt C:\Program Files (x86)\windowsupdate.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul.xrm-ms.How_To_Decrypt.txt C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.SPClient.Interfaces.DLL C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-200_contrast-white.png C:\Program Files (x86)\windowsupdate.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL054.XML.How_To_Decrypt.txt C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-24_altform-unplated.png C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\en-US.pak.DATA C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ps.txt C:\Program Files (x86)\windowsupdate.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-phn.xrm-ms.How_To_Decrypt.txt C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ppd.xrm-ms C:\Program Files (x86)\windowsupdate.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionSmallTile.scale-125.png C:\Program Files (x86)\windowsupdate.exe N/A

Browser Information Discovery

discovery

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\be514549a2e654706aeeaa15c8cffce504f0e271c904fe07d865f3999ebaa61f.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\windowsupdate.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A
N/A N/A C:\Program Files (x86)\windowsupdate.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\be514549a2e654706aeeaa15c8cffce504f0e271c904fe07d865f3999ebaa61f.exe

"C:\Users\Admin\AppData\Local\Temp\be514549a2e654706aeeaa15c8cffce504f0e271c904fe07d865f3999ebaa61f.exe"

C:\Program Files (x86)\windowsupdate.exe

C:\Users\Admin\AppData\Local\Temp\be514549a2e654706aeeaa15c8cffce504f0e271c904fe07d865f3999ebaa61f.exe

C:\Windows\explorer.exe

explorer.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 89.16.208.104.in-addr.arpa udp

Files

C:\Program Files (x86)\windowsupdate.exe

MD5 0c526b77abfe8d54363e3d14aa28acfe
SHA1 3239434398da123454635d8fdb0bedc9f40d831a
SHA256 be514549a2e654706aeeaa15c8cffce504f0e271c904fe07d865f3999ebaa61f
SHA512 6c201b45e2041d3f96b05e0275c7e1164ea481b704b49767d2decba19e1587fc93ae54078c89fcb6d937de345697fe7196e49cf8245a53b8f519fa63970b40e4

C:\Program Files\7-Zip\History.txt.How_To_Decrypt.txt

MD5 026abc0114bae5f316aa5efd8485427f
SHA1 a4a598c546c94a80e45c9baa3d0eb16d2abb2b13
SHA256 b6fbd939345a1a5e755aa2e02d120e1c8dc16db0e45ec5c0a26994270289cd3b
SHA512 e0431e4f17b729f57ceacc9898bfec95bafea221a45462c8fbbfa1cb4a8502926e5da98b4d7214d2b1e83a89dd59cd2a37daf0a836aa0ae1ec437212170805f8

C:\Program Files\7-Zip\Lang\id.txt

MD5 1521e225481270a91aae29ee1f048ca8
SHA1 059a5a17606c20aa8194302d7b401c213ed18914
SHA256 835797eebd4831649dd5683457f86eb161cbdede066079b4a07aa6292d3e494c
SHA512 11309dfe36acb5fbe84d343e30e7c952d5151bbca677adabf5aa2d88641baab65eac0fb78d769b49fd07e8169d772fb79159fc603410ba537a06dade046b5bd4

C:\Program Files\Java\jdk-1.8\jre\COPYRIGHT

MD5 d5c430a0e294b7c30457559cff071e4d
SHA1 43ef09f8dfde569957ca38e7b9c2246b802441e7
SHA256 20b0fe3a1ce207bf12531b560b79c8dc0d9e5418967670f05273005c21bef528
SHA512 c20425568ac6ecf1038d504bf66b8b817055505e85dc7e03f76e39567e7d920ed14c3497b613a7e60b8550c7b58231c9f28c540e446c5f43272ce5aaf3487f4c

C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_TW.properties.encrypted

MD5 3aa243f502b6bbdcdc06729ee6a9c3e6
SHA1 b78a172202967160486b09aedef415e364b6ea8b
SHA256 72b409d8ec4be2bf7446da80f8384bd6e2a134512e8f820b19f40a0da75b317b
SHA512 9096f458c3a6d7663022ecce4ddde4d095258618efc9f13e84fd8722c1a0f404cc28fdb884fc549b21314a17bef4841878a82c9387e551d440af82027e4f5c39

C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif

MD5 b36ad0856f76c6b6740ae4e2fe0bd5ae
SHA1 1d3ffb14da0379717657d731195961ff1923702b
SHA256 341114f534411e64338a382722108149a920f3dcb812f1f5c529332fb4ee6121
SHA512 e025a5774c4a44ce98e986ec10dfabd23151d35f1b064b3460e352030be3e3314bb21af7863e8cb3563d11fc9a546d16411690974a9b263284cc72467c93f132

C:\Program Files\Java\jdk-1.8\legal\javafx\glib.md

MD5 c53cd274692aa4e0b6dbab184f123226
SHA1 fbbd671e29a07f8df113439e4309c9f5bad98aaf
SHA256 cb3f1fd6608c9512afd81727841471d70655d6a4c9e4afa83a17ba5abf357170
SHA512 cee8e8eefda113e554ed0187cdb7a868c3f47f7ae70a5bf6b00c4aecc80f2299246d1b39d0e7e1559a6b8a902af88fca4894abfe1c917a01e7d63b54051c7a07

C:\Program Files\Java\jdk-1.8\legal\javafx\directshow.md.encrypted

MD5 824659c1edfd285866533c2ac7d344b8
SHA1 9f374a16610cb30720740fb68bbab01adf3e3cd4
SHA256 44844821d5f55789ba4a27372f54903aabda273bf87f1b2c3a9ffd27c50c0f2d
SHA512 7e7081d88994041d93be585f93fe656c9bca2d4b2b4f58e952b0a8fd2fb217b5714346d677933405a7cfdf2eb24109f48b8809e296af3e91606b932a1f75052c

C:\Program Files\Java\jdk-1.8\legal\javafx\icu_web.md

MD5 286312d6e30f3329f97075b1542eedb4
SHA1 4af4bbebb62a670fc9853e6f0c5c6e028336bda6
SHA256 2d72994a763e7bac3b191dd74d3c889f44b68de6637ff96b9bd5f7ee66c28677
SHA512 ef0cadd115774eade4bfba750fe5c1ea404cbb1c8313fdc0ecd2dfd7a1e83e22a1dcfc5bac7acd6a60b37e6af97ef710bb7b221beae49bcc149a2c50c82a18cd

C:\Program Files\Java\jdk-1.8\legal\javafx\jpeg_fx.md

MD5 653c76f8878360fae2d234b494339c28
SHA1 ba2fa3485fe7a7e8329e71cefe06b348202cfc4b
SHA256 bb6f5e0ae09ec8a1dbf2671781684774fe90ccde028f0c534cc7097f0ee580e1
SHA512 53886362ae9a086e839fff23cf26b0801e01f659e2d81db20a3ef0698de6a675ca74f74c6f79d73cc45f78306195137eb23d4170d3e490af638cc27e9ff482a1

C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md

MD5 878c4c03ebc2cb345fa6895a87f43379
SHA1 f954cf55d2e110c358b4cc54627ebc7a08aac935
SHA256 33ef0c78f4ad5d7597349ad820ce3b2e83bb83d458ac923aed7f7f7e4bc17486
SHA512 53d950fd3c40fb14f8cad8071d5d3e68ddca4602dabfcc50ee964412a094d6a578ee7f0036507a610c0d70277b3794bc4a29d31d925c33f3980a4c8aeec7116a

C:\Program Files\Java\jdk-1.8\legal\javafx\libxml2.md

MD5 7587022a84de16df0a94312f3ba1060a
SHA1 3ab9c04475833a78444194c6845188c4d3364b28
SHA256 98bbd250d4775a5f7ef3e360f8007bd3e7fc067e66ba29e052b732d9b991080a
SHA512 7157d01c72d7691b6d75ab538d11658197178d9bac849ec9abb4e3ac5f39f93a639e9e385c5f5714cb9b826056e7d6cdae2ee26c64a7ad2c54f61e24434a108a

C:\Program Files\Java\jdk-1.8\legal\javafx\libxslt.md

MD5 e10eb911d75f8764d2b5a77e04cd3695
SHA1 92498d403d3ea650ad9bdcfa1474ddf62bc65e49
SHA256 626e73a1d7cc6c49e8b9280d25c92173e35e47915b819551e2f6d2455d5d121d
SHA512 a66af38e85d69b8cc7a9d9da5f75e265166bfe33063503abf5d761b10c8e68042e528d4cab0d7415127bde45d5eb73e1cab222295a97e4b493b5a73ba2fba3d9

C:\Program Files\Java\jdk-1.8\legal\javafx\public_suffix.md

MD5 33ab7d4d11173f93a2a09957716158e8
SHA1 52bf0f80f6d7e8718e3777a0db8e468c91f411aa
SHA256 164e4ff4c8d6755b39b2ee85cf3d6d3cdfbb00b091ad99ecf3a6ddf0ac2a33a1
SHA512 bcf16c252902b171d4c3b5c62f490042448b6073df130600718ee6b20cdf27904933b9e3ec0b3e5a5be06f49311152d7c92dbf333f14971c9c85b2b12a889e5b

C:\Program Files\Java\jdk-1.8\legal\javafx\mesa3d.md.encrypted

MD5 4829039f4cb51121661cf13810693bbb
SHA1 ac4e644a99061e2b979f0fe46cde695dc866285d
SHA256 f2b7411e8eb31e307b115f8f8e52257a1f23890bf6e8964a09b7e5642b1a50c6
SHA512 89750f3eca9a66d1f8f6d0e640831c3e7db95c7f909206aad37601ef15d9a13fbf53f79e46979e51817c98ad0b24a47bb8f9a804950d10f6ba6099718d627f15

C:\Program Files\Java\jdk-1.8\legal\javafx\webkit.md

MD5 4bd4ae390e2c16c471025bf150db396d
SHA1 f2d1417f86ebb1e4fe830ea37e2e46899a37baed
SHA256 7c113f466b0ac493aeb0df1b0690e279aaa07dce02b6caf46107a1246bf2b5d9
SHA512 f215e0aeafb44ad251d78160dd46916e11d98f5340a32048abe30db861421a14d758211e85e146154bf26d66673b3e0e2a8d64f43aeae3fc4552dd3dee89d40f

C:\Program Files\Java\jdk-1.8\legal\jdk\asm.md

MD5 6cfb4d9044f50e66dee1fc5c07c65797
SHA1 403a1df131783d83531115c825b51f784f2ddddf
SHA256 97bf219dfc4275782b620b19013679170cda6ea4bb8c5247bfb46fce73aa058a
SHA512 bb07a913d386745d07fea22566e3e608b3782fab547683868b55b1e0190169147062f6a48a7939cbd7c7a00027b10c85ea893686589498f3150291cb6d8d67f6

C:\Program Files\Java\jdk-1.8\legal\jdk\bcel.md.encrypted

MD5 9593428da58e047c131e1510f57cce5a
SHA1 f8638b761163d5a8ae9fab62063a44f453b4cedc
SHA256 1a2423aca051bbda0fe748c0cd03861735da22af63c2cad12dbec80dec86f013
SHA512 0a8c13f16941a21c25f8cc5256365e48850f2726e549ff9fdcae1dabfc4f499160522f4b032f0d0b5d9d7d2d7601d282b31683fc2079dff3c7b2a7b41ad65995

C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md

MD5 3c57d28a79534f129fc6c4fd942572bb
SHA1 f2287c2b0385746b036826e9767f9ec0062dea46
SHA256 469d6f9a2e7dba4074b7b7e573ea163108ab86158e10111a94369e996c2c8f88
SHA512 f3e253a31b297f7ab090c8f657c8aefd0fd09736dcf54623bf41ffcc8f054a3c481fbf56f4bec4a9e54744bbcc49fb68856c95d9fc874bd8123367b619fd587e

C:\Program Files\Java\jdk-1.8\legal\jdk\colorimaging.md

MD5 478709b1c79c1df60901d068b93360e0
SHA1 aaba864dd81f1bcc9ab276b2ddf4be05b29e5462
SHA256 f0bb4674b0e420df86ad7b272e1a150a0f4a3bccd0f78a2543191669ead4639a
SHA512 3ceb19736bd5e5e3e0543bccb7df876875547f014b151a58189d94c544751ab2cd497057221b384aca4ac18123c510e5bb189cbff247152a74b992b11838f54d

C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md

MD5 a6116f4d69ca490a6b2534366f143e79
SHA1 e507cf81bd24a7d2524b80d7142ba81d4b137005
SHA256 6bc6c117400d9e4115c800524982f9aa7df4d90f5c81f8861d9bd24c9a1f5609
SHA512 95bd3ce16191f41e63973083dfdc3030281e72e44b4f35f3a57c7cbaaff0bd919b95e1f7a17a655ce00b06f5e6a5982dad04fdd98b3d342d4cd35074612f9bb2

C:\Program Files\Java\jdk-1.8\legal\jdk\dom.md.encrypted

MD5 596bd5b83b337b3e7dc4a772b4ea339b
SHA1 deb4f68b0ad35fed3755a000c96890d2abf7fbb5
SHA256 7e8a76281c1b5bedd907fc758413492adb82f1a137a65c62873324d491e46962
SHA512 b9e9ae3f869ac59be06f2f9267621abad1da0396362b82b05db52124d54258b6af008a2a8176832757a8d78eb685623c14a6a79df3e07aa31a38adaaa8a87cc2

C:\Program Files\Java\jdk-1.8\legal\jdk\dynalink.md

MD5 71e6303154ab96f19b2f8ddc7452fc90
SHA1 84fea3185d21e629a3cc8037198a2fbdf7750aa2
SHA256 72af761e82e09bb70958b9a610ebf3a66037acfe90c762f5883c3082d98c4536
SHA512 63a357e53948efaff22a361209b7b8f4ea37300634d3f327c7ee100883750c0c2dbfe018f31b40202ec8c21b64bfb90eed97dc35986c2f23a623f8417fcb0be9

C:\Program Files\Java\jdk-1.8\legal\jdk\ecc.md.encrypted

MD5 c3ded20ea8de1bbf98b9a98b29937edc
SHA1 ea08fe23d822b4abbbb4e32a6f16f3988366df1a
SHA256 8b68aa25fc38fe148dce72aa4e526bc328abb451aab9a7c4de24d5bb5293174e
SHA512 4bacce671a33b3e08ad93cd0d4d1da80d074f64be1e82a9990ea6ad496ac248e26d5ee80a8b865421fe7057b35ff26de5372731046690d68c32b3302d8359a4e

C:\Program Files\Java\jdk-1.8\legal\jdk\freebxml.md

MD5 5aa329207042f3f46565e98c714a0a4b
SHA1 ace019e13dd1b70186123f718f553fde99c66cfd
SHA256 0a31421fea0884eab002900f9e541ac6ed958ff0f9f17bc163a4e0c0c9b59070
SHA512 b77fb66b82449a36ab86d4ea703449915b43eac2ea9985367f79369f768fb7f0bde3e4d666050c7942eab43e786324941389d9d898672d92904908c3db7fa72d

C:\Program Files\Java\jdk-1.8\legal\jdk\giflib.md

MD5 91c75c72664f424fd143be2d93e20097
SHA1 74d8027537e6e376307ada038b1acbcfae1ec943
SHA256 d00a4546f1b9353cf686a3d54a7c9adb1c1629c83f08c8bb6c269b67d1b5f197
SHA512 477079edf4ad7f5f48e8d6f58180ff61f8e980c4bcf456778bc83849bc98f4f2effda8ee3e77396703e1d080ccdc91369fdf384956dd2c7c341cfe940c5792f5

C:\Program Files\Java\jdk-1.8\legal\jdk\icu.md

MD5 ac5df64c3008bc57685603fe3d66bafe
SHA1 0f55375e7d45aeb95eafdd3bffab2aba063e2f1a
SHA256 bdf526069c5bb9240f13a8e90cf1581ab38d1c7920885e546cf545c56b65b430
SHA512 09dbf8f89954c0be104044873fb74822b104821b2fac4b066996cb2f09e0e12080f882a0f690a987b31ce0b0392d2e1aa28372a6cd67f6382489712554da24ef

C:\Program Files\Java\jdk-1.8\legal\jdk\jcup.md.encrypted

MD5 2aa48de1cbdc75d9f0957fefc84d79cf
SHA1 bf376e5a5ca96c26ef766109d399e6404d0ad2fa
SHA256 53b7cf3d9dbee7325f746493cc03f0e7883656b84d582ffedf7ac7bffb8b9bc3
SHA512 1965e3cfeb12d8e6d7839fe74ec51d8ce0fed64e63350aad271d1a49aba9876ec539fbb0db0eba5de62e60c1d37c9cc740e442c54ab323cabd0d7ad03dcb755a

C:\Program Files\Java\jdk-1.8\legal\jdk\joni.md

MD5 63808db0e928e22589d7a0c42784f106
SHA1 e1164570e4feb58621550a9a90be973891046e0e
SHA256 6259639fa43d5a2a2864a180a4de8f6689a48f6d147749ac4e7c1c078e5b3519
SHA512 cbaccb62873f154a434963c6f8431cf36bead11e91ff237ace26a713bb40b9d2ca2beff451898f01ec7279274cf0a77ff10f2f5d5d3694cce428831c06302c7b

C:\Program Files\Java\jdk-1.8\legal\jdk\jopt-simple.md

MD5 7cf5332bb60a7e1fefb2995ebc69ca51
SHA1 ad0b172d9d4c30e83e3961e16f33f6dc87dac7bb
SHA256 99efea76f36ade98dffbaff9eb66804092bca74aa2cabf2b963d89957ae0d1c9
SHA512 82b9b45da674e26a3f37f17f15a901c698db682dfd74d12268bf96978a5aed24186c97ca7d45bae1ae9646f2727306b56a769680ed74f3b160a71d3c932f61f1

C:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md

MD5 6ffe4ec05518c354049d271b4dee9654
SHA1 b51b35bf779723af65843523b90662eb2590fe43
SHA256 fb04b7d398456cb4b7c9fbf9c323002266ecddd735bd0aaa6f303294108181fe
SHA512 506ccc4018d5f2e91bb904d57b5d2f2f2765fd061a5c114c080934b922181fb1e703c803fcecce285d6a1ed74cbf105698cce9f35137dc298809e89877b610c0

C:\Program Files\Java\jdk-1.8\legal\jdk\libpng.md.encrypted

MD5 6d44a41a4afc3ab5ee8aeacf4c67a9e4
SHA1 9ae8e4188d7d0db1aeac98b81d25c4c90e9f4ae5
SHA256 780c15ba04ff7dcdbefbdea56db5b2d3ecc6b5b3f38e4758c8f9671dada8be41
SHA512 523513d33d2f66839baeccd44dc2435b627395c3f0443e811a550957bfad46a12d90512ad11db06bdd1b374998f7833c538c07ff944bd30fc28216a30543a1c5

C:\Program Files\Java\jdk-1.8\legal\jdk\mesa3d.md

MD5 32da7ad792836e76882d75ffea9656a3
SHA1 cccc39c7b3af3c35534666d5bd1dbf0b564d663e
SHA256 173ea6f3f6cfdfc883f72249a98a89401b75d59c4d04ca8748ba40939343683f
SHA512 fab2ce8b1b4a2fd9015a4f28f973d4bb563468e4b730418610d61452e053b0c2e2ca52061c63d1062d20b05f1846bc5026a61b1745dcfda9431d31dd6277f66a

C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11cryptotoken.md

MD5 470e3b139ffb4bc91d1d76a0ff28861f
SHA1 4fbff330f98780acac9acd4d66aed6b1dcb31abf
SHA256 dbef63f04a8f0f5d7ce9689a7eb455230404dfc67a7b0e96449f07414b855d4e
SHA512 bdf527c318153092afa9fbc6c2cc3367372ebd5ea022a9c5d33bee054f6ae3bd2e59c74f30019263e6fa0e128302b0d6a51b81481921cc4066b1cc3f368daf79

C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md

MD5 0b2443bff3f7e2b5c45ec58373de96d4
SHA1 a793964f1bbe132829f17364d2e94a680548708b
SHA256 bc449a1991022f17225585b2880b919e8f0a9ddbedf6fcec4fb4cabc2126e74d
SHA512 671732c30aaa8bfed19014d84322995e4ce61723230e4ae1fccfc31024ae204616e9f6d5a2668f8c11237b0e702b3561753d40e9c5b7c90f35a0ffe65bc66b55

C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11wrapper.md

MD5 f66ce0d54b7242f7926ff7d3629aa71d
SHA1 11ea1a196a530a502cdc2bddebc7dac57496e705
SHA256 0e022013b11341e6b7a9e8b0ce8f887b33fe73978bd79051f5a13c00411c8b69
SHA512 a88d1143b62da9ee751527204dcc3b934e3b4773267cf6afb4e1e3dc3468a35f0643b5d456e870d30b7cddb91ab84a33a2de42ad9786098acab5b73f0b969a34

C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngdatatype.md

MD5 b746ecad96ceff245c23446305f948a9
SHA1 060f4782e56d6944c14497595e1a071de1a593ab
SHA256 d6a86ce5f220df24d0ad3e6585a40cf1ccc64d76e81c191a51453da752a71bd7
SHA512 0a3ec66606516942ac288dbfc3951ddabbc139c2b26e95b3b0dc6033c95fd99e955904eae28663a0783b4d72c739af854cbd35a46d73de9586413b79b9b2af40

C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngom.md.encrypted

MD5 6b12abdd89ca94fb8cbd694737d3efab
SHA1 b63ce4f6c2dbe25199dda99604db85aba8cc9d5f
SHA256 6ec1a3c7af7dc79ba7ddabde2f41e0ea6ac39733fedb16d5b10ff96d92e473e8
SHA512 e3de4c4c3bce029e51555858e5f4d2344f340619b44c141dfd0c2ff277fa3892d4df503670a9612ba814680f9b75b3095d73af0584231edbecf256142abf1cfa

C:\Program Files\Java\jdk-1.8\legal\jdk\santuario.md

MD5 a7a7f3c50b308e4f27d33e36ea6a5bbf
SHA1 a30232d083ca7be6da8069ef056157d721277c56
SHA256 66de4d1b9c3989593b130c80886a2ca3ae29ddf4ebac719993e7b1afc181e56a
SHA512 6600773bda7a80304d2c4693326f91a07957f3be98569e4ba2083996fe29afe46ae23d48d5d74ce840399ca22149cc196845e48595fe06c07b8bb0da441cd27f

C:\Program Files\Java\jdk-1.8\legal\jdk\thaidict.md.encrypted

MD5 2d000674e6f77c8e07a2fce7c384c7b5
SHA1 b434b5ef66bd0f8235a9c5efa7a542d12de4c301
SHA256 5d5e2a702d2ce38f73af10581570bc8de6d882c888d5840127f47b0ddd1d8c7f
SHA512 e9a122bbec7f78d521ed8520c1484e32e67b6156047d99ece94159015711eb744632b823f8dd4578f526b794e34c657101f92b55e3d873f4387d74806a07f665

C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md

MD5 ff42c6bccc237c7787f28d2d399aac16
SHA1 c8c6557a1eb20c88084fba1dd21704bf43f05d4b
SHA256 a142172bdce7c39be9111a2d93553fe5c1310e2721d9c9f6cd305c59eefa4ff9
SHA512 28a62ede0269427b27e57b1fa2d3e727274709f2351e525f267f84f43e3f6a83ae48efa1594a3f2b7700aa4f59926afc891e3ccc713316f3c80163fdb8502b81

C:\Program Files\Java\jdk-1.8\legal\jdk\xerces.md

MD5 9e14f8d36e411a0a73df774c338ddea7
SHA1 8a244425a1dcc8938b94de76312f30fec9059ac5
SHA256 2d2ce8e41dc076b7687dc672e5f200c67bea58f9c4acc633f757cb9688c5f127
SHA512 0f48c2447880d813c24d4d1e78452db5d1104bafbfd8a53096ab553f830ddd5687480b939e2f5d0bca1592e78c246a76ab438a7d4648a6326d05efcc0752d961

C:\Program Files\Java\jdk-1.8\legal\jdk\xmlresolver.md

MD5 389128191af236f9aeecba7b7f6788d8
SHA1 24b4f6d25239b87528a08bbb1bba1c71c6729b86
SHA256 36ed11c411bed82498c217e95fd1d52af3f51019ad18b8125aecf723751eaf5c
SHA512 27329bf808ff86b55df53cf594abecd1d3ac06285696256f373fd76f8c54d09229ac9cd4a001c7d8540e382f4388e1a038198edb08d3780421a92d0778802b6c

C:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md.encrypted

MD5 6a4b2661a5586e905cd75f514926d352
SHA1 92ebdde705f7601ab2c4a83045b91316aa73d8ae
SHA256 e4e34be155a42fa8feea132bdbb069f5dfef1b4d09b2601510a80595feec173b
SHA512 c56c11f55ef886e434d6e9ed25f769f6a3fe41290dfc3cdec966a22ae08063ef3841eba71f947ccccfa01d3b5a8931fe53471018d2f9ac6ded03227b6129ad52

C:\Program Files\Java\jdk-1.8\LICENSE

MD5 1c9550f3e890561f988b43374071b9c3
SHA1 786b4185dc822b3790c594e031f92a6772640c22
SHA256 fb306f92c04c0cc0754da0ff854af28e5f910d51263f3d08bc571fcdf37e4a5e
SHA512 8a41fc00c23b6bf32b169168f7f9917b2e7402daf3e320e16d654484fcd05ae72ba994598b92ea4a7f87939857e0c8d79bd1a4f29473f9857355a2cb0e89d7a2

C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

MD5 a4614811f7b12cc65efabb3e0e5e6453
SHA1 0191d7de41015fc760ca9bcb15dfb3a49f505345
SHA256 04b29287322ff36fdc92996958fc16fa2f7f69f317fb28c5d3a7d51b2696abe2
SHA512 ce62a99e11188e0fbe0c6d550e0a26181fe295900f147f0a96ca8d0b3f087ec4dca5dbd22aff0c5d34e4698f3ff725429677f58259a469ab90b5c8f85df40fcb

C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt

MD5 a495ccfe58d2d0561329003b371fa75e
SHA1 6580eb2fbd00c7865226a7dec9038bd7bf6bc21c
SHA256 0bbf22bc252d796a1e61d5c3bbe5d2b5a02d30828b52388e44492a1cdb3e0265
SHA512 5d1ee609b019bb5a7caeb3a14051bf8909d752e93f51ef404d69053b16395ff3cb08e7993e3ac94c0b0b45497ca467f6f45d0a7be0e218196f284c2e89941303

C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt

MD5 b1eec5c4078db57bf48024e7f605d97f
SHA1 576b420011879547339b76590a48d35a5b16b3b1
SHA256 33395b129a23d90f95c17fe0cd5079cfa2db7424bc0ffe2ca87784d3b4fa1d46
SHA512 48253beae9f15e211f3113ddc94828b22ab84e6ed0875e5f8d3208574d887dbbb3f3300913b6ef9ffe4c5050b3296d08f4d98cdac13208d31a03565ac4654155

C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

MD5 d55cceb45c4069f1c59b8a94744d656b
SHA1 ab02096bee568e9c7fd55b62894df942d0326783
SHA256 432964e4388f1b650ebfc3c27f0d87223fb4340dd18800686f891fab45a574e6
SHA512 8ea6ffa1e518c447b70bf8f7b8084e5ffff00e169272addcac5f0a0bd34b464a9b611a39f046249aa9befd9bc59df63ac46a16490b5e17f49020d3e779416ba1

C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

MD5 f061097b408c154dffe747822ec5ae12
SHA1 17b0cc8acd48eac3238919531445b55b3caba4eb
SHA256 08d86d5d16980f74473b1e7bd264363c9bf41d53e3ab1061c90e47f7c68f13fb
SHA512 242512980bcbd7c58ee4d7e7c599bd4a5ebf9d3bd608eebf2b99d583f107f414c1f58dbd51c678835b909cd58a471c23e5263495700bfab238ef846b2077c29e

C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

MD5 afa20a0aea01c967534e78022ddf5bc7
SHA1 11dd0e74c01bb70ecd57545b63a757ca59825bc2
SHA256 87f6dadc81a56231083539919b86d2dddbb88e948d1c940f165c9608c3fbeea0
SHA512 7d36e683733f4dc3de4e5b171deddafcd46ee3a2437cad9673e57abe43f166dd69c7000726d2f6511e341cc3533e3b60d9d999a5e31464ddc83c2b4c065bf034

C:\Program Files\Java\jre-1.8\lib\accessibility.properties.encrypted

MD5 bca9d253a7886604d52d9f1eb3c57337
SHA1 cefa86190a03efc56c83cce146fcf16d9b8c525d
SHA256 85982b780ef9ec2e2c5815945244118cd197edf9af774c77a0ce4d8ff1d167fa
SHA512 6eadc54b19741e357b5e2b8b50e4e3eb74a79424c21c02a12df436ef4a63d8e3b62b9adca09fb1b7b254e979368446ab308a0c88d5c1e420166ab6bb84b813ca

C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg

MD5 a276eb2dc34bb62b650f730d8d047898
SHA1 ce0905268f117627819642ef24caec84a7645e4d
SHA256 74f76261c2851e9ae5c793cb5d47a4b67698df13c4065331f923c2c9c6555085
SHA512 0b0f735806897bc21d5076b50f0f6af7b4af6c5045fb62d33c995c405ab727fc8170b0ad284e470905ecaf0e76647235ef84c99b18ba3c3489549a8beb57843d

C:\Program Files\Java\jre-1.8\lib\classlist.encrypted

MD5 52a2c0fb05afda8b2adb235c9f085365
SHA1 eb88627b8670cfa2cf0868d4d84b3fd3f5df8c28
SHA256 7c0acb13e917553f59fa018e85aeb6e18b80d4520bd6d73df369777e8188bf51
SHA512 e16e6d395b08dff6e2177411fc42a3cf4bd2c0ea29153407fa9502108f70719125fcf810de394c88d327b2d2a7a39b7a00d165cde8a7a840ddbd30aaded9512b

C:\Program Files\Java\jre-1.8\lib\calendars.properties

MD5 cb25bf88c8364bcef1c09aab9f4d4bd9
SHA1 512a0d196cc1c943c034d26516e4c4b87da5f623
SHA256 37287c8bbb51e6b7f58a7e2d903ba1f9b10119d4664b3c0ef740149ef3a34712
SHA512 01fc4709943166fecfb26aaf5d72b84c49ce1e3444437354b351558437c25e5d4c698953304c264caa989452d5ae12b8d83c21e0772eea4c2d4f7b3fd6e98f71

C:\Program Files\Java\jre-1.8\lib\cmm\CIEXYZ.pf

MD5 1243f8975d6f3bd498f9c5b27e9d0e99
SHA1 cae4f318159de140a07772ca3385de3a6b3595ef
SHA256 0db206d1063f87f50c150c7b665e45815897a6538f2b27d9920163cc5f28a62d
SHA512 62a3c8d20461330ca90819adf31b8149e5c34143bf7b9e087783b86ca026bd8690eb40b9d68e2987554e01b0c1d3763ce067fcca95ac56fa348a21d9c4c952d6

C:\Program Files\Java\jre-1.8\lib\cmm\sRGB.pf

MD5 1d534d350493596f6da78f49d4a32113
SHA1 75d2528787ffa9ba9357d9d54e6595f75c1b922c
SHA256 d59cd3ddfa21a9657a1d57e8edd9f11af86a44081df90a52aeaa54e1b85c6c55
SHA512 6e8e8ee9b16fa572565970f8cffd9a470b585e8b0d08eea9c912d4941f370533189e540e5313d2698acf32d2e1dfd3c66cd032689080f5f6c97165045e7881f6

C:\Program Files\Java\jre-1.8\lib\content-types.properties

MD5 27e7c91f6dfa15d059e75188e785f425
SHA1 2b1d2acf3a6a4b691762f32c157710de33a48042
SHA256 95ef5caa5b3506297d1692d7fe5588756fbed54281f217caffdbac31f5826558
SHA512 226e30df3660e56229159d617acb0badc26a2bbf7d1d666444a9302a5c0fb5ffc911657b203fc2bae4fb24fd739505236b4aeb6ddd2f34fee2d135081c764084

C:\Program Files\Java\jre-1.8\lib\deploy\messages_de.properties.encrypted

MD5 de30bff978d57bf87370d22a12548d5c
SHA1 e05f3e9bb8b1e0dd0d54a2e57e9abcf69a484a95
SHA256 04fbc222ce8cfc11a7488d48a291ef8e5417ff4c648f8ff4141fc63674d1b42b
SHA512 2f8d5fe9275cb1fabaeb46ed997dc452fdba162568b2534f92c08234119413d5630eb59b33b05a9b8ece33c71abab1407304e05cf726dff7b44fc94bdebe30b6

C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip.encrypted

MD5 395ef7b70ee996b4e6a10e46afb4efb4
SHA1 0b30dab2f29895c7e432d3383a5dd20314eac0cf
SHA256 ae6958c37c26d3e00bcd4e9b50d2ab2dcaa61eafcbdb7239edc06f89f8bae4b6
SHA512 fca419f75c1cf32704fc69748deaaf2fb04abe12e669b59fea68e2727d478cf77f46a89b0686a1b63847cb447bc8a6632d2bc1be7f671e2ec491f290b5175dff

C:\Program Files\Java\jre-1.8\lib\cmm\PYCC.pf

MD5 4a3382ec264c2f7999a9b8e73fb6d6d9
SHA1 5a73047fc48e4c621ce980e1a461616cb090dc47
SHA256 819936a480019ad32260a846a16a02149ef8c1699c9a74279f30f748ada1aff8
SHA512 5e16aeef1144be975051772719713d34faacde97979683375a34c85396bd238e6e3dafb320f656256fa18066c1c7361b0a820eacfa1baa0a925f6943ec9ec639

C:\Program Files\Java\jre-1.8\lib\cmm\LINEAR_RGB.pf

MD5 edfd8a50344602ffb69d8265bb5eddc8
SHA1 06b2f67b56c535c85520d742a2b92845c9617ee1
SHA256 de481c53f0658ca279fa555b5bb541e853167fc9af1b3cf23e68b59939320346
SHA512 d17402c19fb4dd991b92c3fb9010499bb28ce1e1a8155b1d192df4f943b64b98ac4967f8616b78791df51b0bf6f56a27b1b274ef5d28da11f60f76118f82202f

C:\Program Files\Java\jre-1.8\lib\cmm\GRAY.pf

MD5 79efe6b3d4df23111c7e2239cc9cec5a
SHA1 2d85103d8c7ec3e1becfe805ff61e159eda10b57
SHA256 ad099bab0eff2f3a586a2497e95d9f77a9e3425cfe90a997dea2674375b8f9a5
SHA512 9ce63d02988462828db1de1258cb0c5bceb8d6f3de843398e72c826c81226e36d51d39793808089027eb9a65b98a386ae596c7de672e36234aff529047aaa7cd

C:\Program Files\Java\jre-1.8\lib\deploy\messages_fr.properties

MD5 0d8b40e18c4c3f1f1ac7ed5981f65556
SHA1 cb55c3a143b57b3b079cd19d0aead6d31c248d63
SHA256 b2c3f05bfc3d6751d8ee6a7fab8c2b6523ed7435ce2cfd3bafc00fbe60fc4a62
SHA512 8fa3dfb790dae49ce84e5b9ad3702eb8a15a1f129bcf20f243fbc898c297ff4625d1ee9133e2a97d0097a95ff1a5a98f9d5ca5bd6687e1088112c22c6c6e4bb7

C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif

MD5 31f3a0accd6d0b71b8b82fa17ff18354
SHA1 702b18604d55e320b4a30932cf595aad65bbc67c
SHA256 f5bc7965acf0ca8f27966b8a2698a8985894ca9c7284cdcc76f5565614247878
SHA512 ac91227954ff7f29eb937f83d3a9e1501c277eca56d5da8b5cf63a62a1578f0cf6f9cdde28aaf2e439e9cc20e4d70627b2dff9677922d56798c94219d8348c10

C:\Program Files\Java\jre-1.8\lib\ext\access-bridge-64.jar.encrypted

MD5 4bc8e1290fdde898df7bd3d1f2cd86bc
SHA1 7ee2122ff4b798128c72958b0f2c0d40ea7158a2
SHA256 3703411a25e472c6a84038a2e6ce2392cfa382256e967fd6fb9c0c338b646aba
SHA512 312d929f155981ffece112fe92a46adb050e1eca3831b53a49050d8e2e0b66770963d5275454069125a92c0b3364ead864778b781dcd536fe3b5a53e988ad0f8

C:\Program Files\Java\jre-1.8\lib\ext\jaccess.jar.encrypted

MD5 110ec8eab44ae88040288893408782a9
SHA1 f8ec4bc943405f9c267664615c4012f546be8d8d
SHA256 eee03df7b2021505929d7fc924fface587570f5d54eaa01d49d3bc5d087de7e0
SHA512 8a86625f2251f2ea0e0b6050252f4e7b664ce5f0000838aab64c67530796b9ae2386e2c42c8c05edfe14032b19b270e30c396ecb4f6d912ecc95839b0c3421ed

C:\Program Files\Java\jre-1.8\lib\ext\jfxrt.jar

MD5 29b3e221d18d2535a85ff76525f6243b
SHA1 45e9e2838b1bcf91821bddfeb1ca6a0c83f6573b
SHA256 e03e2ea881a6c4fb38a658f8c01e50cf54b9d15d26eaf345d473566c7d43a2a3
SHA512 2d43d1bea5d62096afcc4c94956d617d396112347f5f8b9d4b8776ae6a54aa2d03554db290f8a5bf5f1aca1f6d0e6fda093f59fb658c8fa2207d70559893ada8

C:\Program Files\Java\jre-1.8\lib\ext\dnsns.jar.encrypted

MD5 73d65360c49f6b49a2c7a9ba190f441e
SHA1 75abf1667d9143c53abc7af9a2448de70dbaf990
SHA256 99406a56488ed137eb73320344c16bafc0d78bd992e1ff7e84d5850e2294f4fd
SHA512 75b400018e86fe904dc3c21c0374246a108c927fd2f2dbfb47051da2a8a3f628d2256dfd80d926ce03f68f619ed5fee576a78f6fae8f48f5789a9eff6f2eb7eb

C:\Program Files\Java\jre-1.8\lib\ext\meta-index.encrypted

MD5 e669f49e3bc90e40ec12b6dfcee3d7f3
SHA1 9e45121fd21d01b187621a58d30d338c543a4056
SHA256 a281b7a399c1c873fe628c7e31e1ab52b4d5234f900f327f9f4c3a9cbe79040f
SHA512 86232e175702ea4221bdfb01a57affa6f91262b5b572b19aaab4c3be5592f8155180a51b47439a5d9469007d4553829e9845ce6b7fa725d346c9b763e6f0066f

C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansDemiBold.ttf

MD5 4737a3e42876826385cc35bbb746dc78
SHA1 3e8afe23324fe96b362781f1a1b7b2c3d801a6b0
SHA256 264484c8a9d8016798af348588937898248bfffa3af7b36ed304db89b6e802ca
SHA512 7900308fec346a5ade5bb9bfe12b57005af14dfc2cfbeabc049c326f282e09eef96fc7378466b3549eee2a06fd9be11cd87804883bed7249477e61107346a9eb

C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterBold.ttf

MD5 99f7f4a3687e7fd66e1edcb58221eac4
SHA1 1ea7cbb34397e8a122d9dbf0adef3a55673014ef
SHA256 672b070fd5959b1d1621fc4d917d8c0cb00469560d4740bca26077837e6e3e9b
SHA512 54cb947d9860ee7bd4f88c82cfa7a30b4d3aafa3afa468fde019d4bb74cad4b9bcef6fd29b245bd72c01d48894c72c32adff3025a346f95a820f03a10d6cfc0a

C:\Program Files\Java\jre-1.8\lib\jfr\profile.jfc

MD5 40abba940cdfdeb57bea1d275ea0997f
SHA1 6e0627e13db34bfe37e82640de05ab6fcc5035e5
SHA256 ad43ed99bc825f91955611002152b549e2179aa01e511e77c797d3c4be15b436
SHA512 f9ec5526106ba84b6b4fcdecb9fabec617179bec24066b6a96789aecae33171eba17f18b750d3a597f441b4e6c9d53ecd57a90ed13bc97718a4317e3009de572

C:\Program Files\Java\jre-1.8\lib\net.properties

MD5 7856528d2791eaedb1af0509f237da56
SHA1 cecde07e1f4b072b2cd1eed9c42c03e6edb532dc
SHA256 e04623ad7b796192327bd39dfe7073e2bf5499b31404fa484c2aafa9c7f59a8a
SHA512 4df122e1d568d9a2c9520160f1f49e03f01ccbeab49bc58c097b1f456000d2c9e65bc5378c850c1abebb564f9b7d48a547012c8ca8d3c3367d7cc1e094d25824

C:\Program Files\Java\jre-1.8\lib\resources.jar

MD5 d33a83221f3abda7a50cdf3ccaab7e21
SHA1 f2659faa7092c212a7305cf9459893b45b902bb5
SHA256 d6da7825a24afcaa7d79927d1a82b532129e5f36d141b3f6af9e6083ad29b8f1
SHA512 1a6f052c75a5e91d9fa33d7e0f9f23e468a35b368b47c9f8c0b4ece27fb772ddccbc4481aca605bb29094e42c4d6352ed063fa21f3c9a7e774110a3b3d343f49

C:\Program Files\Java\jre-1.8\lib\psfontj2d.properties

MD5 af67a6704cd9953edafcaa0560af8c25
SHA1 55de7330c11d1ed98f60f3f17592bbc11004bfa6
SHA256 4b933f9e45fdde45f670a3c370c9c6dd3457f2b6609703cb7997a98285d31aae
SHA512 12545526154f4a6e5ceaaf0450ffddd7d1a7ad867ad717d7606314c777271a3fa0e6a51b2aa76deb0021addfb7295917a6bb98ffe47cd4c0d649b39e7ce42ac7

C:\Program Files\Java\jre-1.8\lib\psfont.properties.ja

MD5 10b683dbf2b5d753ffeac559ed08e2da
SHA1 4dedf9c0780bf4c49bfc5f1239c9789cfebd1e51
SHA256 9cee953a63e3128840d76da04c2f19d6bb4fbe259617d08a41da2883042eff18
SHA512 e06fa2bc7cfd71f1ce84f7dedf0053845ddabf1324a3dc6ca389a60ae9dfde9b2c05f20905f6f4ba0b077597d7c8d6d5545d55e573cb915d443062dddf9bb5ec

C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\local_policy.jar

MD5 ef9e9d8f3784c47e76b7f12ac30ad97a
SHA1 a897b55357701913326f2aca6af9fec3ddd41500
SHA256 06ae25a654a1150f2264c1686fdcb41b3e91aa2548aba6fe09054b07070bfdb3
SHA512 30f1f907de64fca5e994977eac39ca9c9f7eb2a310b36c83812cb84501f340a84cee36387932e78f0ec2d8dd20a693035b080e5770d6eb6fc4412f8e7649d29c

C:\Program Files\Java\jre-1.8\Welcome.html.encrypted

MD5 5302ad5b4dc596c8497510c7cad3c187
SHA1 98198cd60e35193d6fe08e89e0d408a11a81ba3d
SHA256 ad632c5d96134558381bbf91715ba2bd82f8b96abecc80cae1902bfe8ed18b4e
SHA512 54f7e739980ce843fdb1be1b61f429bd5777c50e606b4628905613aa6b373012677197e9f152fd3d3d6478778d10b57feef5f63fbd1ad8998f275b7ef5d7d696

C:\Program Files\Java\jre-1.8\release.encrypted

MD5 56bf52ee502349de0673bd856810ae6f
SHA1 f071ff0e855214cb4d0986534d25dace3f3df731
SHA256 8a7bf5593dc58db3380e2610d40541dce5884d3d9dffab7f0a66019d206d9da6
SHA512 b60d6aaef0c7ac211b103768ffe0ba27e74b87822259fb928532c763c24f8854130ee34e766098e02ed1f6c31861e610fe43e1ec7828bc194c53fa0df578811b

C:\Program Files\Java\jre-1.8\lib\tzmappings

MD5 1ce75c8f92057f3ffe640f2ebae56148
SHA1 0937cde6da8aecdc97b60aeebaeb9acb6c76cd7b
SHA256 b513ba20f5616e200f872dfcd2096c2569d0bf28ba8bbbf55ca90dc56980b946
SHA512 6f60fe602b82ad871dd647beb2143c8cfc9d51275ce2c207ed0131c70c8a9ca5e25f84d851a4c387aad71208263c49a16c41200f566dc14e6d3d875a58b9da54

C:\Program Files\Java\jre-1.8\lib\security\java.security.encrypted

MD5 f9db1fb9580508bce4877055372a9b7e
SHA1 2cdbc9eb47ed7a2f343bbd396307e9d76a470c38
SHA256 4dfa86efe276c80cf2358bb3377873742927aee8a0b6a4b6f328497e17c04bea
SHA512 3441eb9217de4d43b1098bceb5cfef04421275221379b76e355ac74cbed478631e95f6a40e9a561e2e5ac4292ed61b3cfeb622086e4eae9384efcd72cec1b230

C:\Program Files\Java\jre-1.8\lib\security\java.policy.encrypted

MD5 7a65fd80f2c6db2b0934d52140a8cb56
SHA1 2c7c537b96698b93d3a2e1f294aacfe1ef63bae7
SHA256 6dee14f6a316826cf70ef6f86675d589ae4bcc78ac4157948b08f5b9b2be3a5a
SHA512 a4fd3c868c20419c326252bcd8545b0308e4ff8a611a6b0d420255340debcd5ddeb0dd2dda50dc9905a487bff65f19bc69528e329bcb87fcb79d3b18cba18a4f

C:\Program Files\Java\jre-1.8\lib\security\blacklisted.certs

MD5 5e7b964a027af80da62b18f750313b9e
SHA1 19ba72c8b628191d4153f56dca8852f097c5fb13
SHA256 6cd6891d2d1928ed67d147a4638d06b1ba2194a15316a1f2ca8f35ef183c7085
SHA512 90385f9d25e604a5a9b0aa63e78b948cac02c62a945173b7ed2fefba557fd00020ccd1bcedb8920195f7858edb2ffa8a0c3c1115dd2d0c61ff17817c532bcb56

C:\Program Files\Java\jre-1.8\lib\plugin.jar

MD5 8ea5a918d02c170cbcbc9fea5cc4d160
SHA1 b2d29eb5de4fe42829c617712377005b2d0b8137
SHA256 da614d5e9bf143a530b391ab7d32bc0232ecf876db4fdd60d228068681dce63c
SHA512 d0dc5886d03989342b215b7f29d7db01187a302dde6a068fcdceb0dee6b87af96ab1877e64bc86b7dbe414ed27b5b55253a80c7c694a3089e71e9f6ddb16b012

C:\Program Files\Java\jre-1.8\lib\meta-index

MD5 73bc2fa4c1549601f9566f9cf8718cf5
SHA1 daec859d9c1b8bf3bb9db57a977768d509cb1890
SHA256 7a0299b12cf29d49aa6a79bfaea1a533b8862b8c3319d952b42a53bec9d4bae9
SHA512 25532634ee98f68c8f6d0fbf074dd4fe457f323aff4b783a6d6d129e57311e3247f3d483bbbd7160ae6fb4c0025fd5d3176049a0785b8ef741729cbf095cfb1b

C:\Program Files\Java\jre-1.8\lib\management\snmp.acl.template

MD5 f9b3f9e4f73ebcc4d29d4c6c1bb28dc9
SHA1 2fed5027869d1b1ecc8fb450da2997b7b5ac09ac
SHA256 eec9fb2eab265ec2f57ecc9e1bdf348af581ef16a7ad27e34bad4093618065f8
SHA512 38f7d2dd154ca8f23d264db369a94343bf2686d19b970ba4f82743b91eee6369f673af5ab62994ba696be494c5943fd07de00b949a13328c8b9c26382b3bf4c2

C:\Program Files\Java\jre-1.8\lib\management-agent.jar.encrypted

MD5 cb4386e937f1e89502cb14ed59884805
SHA1 e8310137b5148e73555cf7f6320ba203c0763297
SHA256 1708a8eafc399b765dbb6f2dcf63499aea24c498bf8bb109c89668b89acf8f5d
SHA512 5b880bcf754d606e47b8058652fa83d1347467d467a96704c924b1202ecd4a8aaf6a8bf1adcb54d22dcdeb827c27dc342f19159b267e626fe127858d24e92f54

C:\Program Files\Java\jre-1.8\lib\management\management.properties.encrypted

MD5 c1d89079f66e201338e8768a6020e062
SHA1 17f3babbaf4bfe5d5c7ae46c7e0a728820914d94
SHA256 8c38a0f70f58616a5295de7d29c01abf0cd76c79f33d23cb2afbac0a9e52f676
SHA512 d4187a83c5b3c33b0f8b2845cc8203d0ec6fe1221c5f640db31f36acadf3e03341f124a1ceaa019f190fd31a48a82362ace98bec195b97adfb8b7c05a2e12f61

C:\Program Files\Java\jre-1.8\lib\management\jmxremote.password.template.encrypted

MD5 933cda880e794727d0f10a1e74c2dffb
SHA1 d242e90aa75ca7e3ea3d7449d362bdcdecd7d1d1
SHA256 91ac2fc86c848d7a2f0c52aaaea4d53e26cc1be5e3360b6b6f9357104629f51a
SHA512 4f3b0843ea7d1a016f7a9423c7717e2fa0cbfb0295f61f4e9ef948c3a910d3cca93dbfead2bfbceebdfaa1a5fa5bc0bfef4713aa25acc98b98bd792477028fa4

C:\Program Files\Java\jre-1.8\lib\management\jmxremote.access

MD5 d6be4873fd70568119b6c8b79212d969
SHA1 3dc0b2eeea473ffd86c1253f6302b25ba567a2a7
SHA256 012fe1f52861d8c9f1dcfebccddc13a52fa7e9b1639f288f9f5b0ba107d9d65b
SHA512 d468012a55e00c4e2edfd2e587c16585b98fdc59f12ef9b8b7f20351a3a96ce0e7da0b6f6d03e8dc420d36dd7cd8b882cce1e327da02b350ac268620356d0fca

C:\Program Files\Java\jre-1.8\lib\logging.properties.encrypted

MD5 7992da49d34e4d69a1ea27ae205ae256
SHA1 0c2e07ec9589e7e0806cce8567bbbfd6cc668495
SHA256 552fc1b71b485fc0187aae2af50e2889301c3b2dedaf603723cde0dbe7f9181e
SHA512 1f16b2834a4614a6383da4504fcab75d41b5d76f7b356fb7d9dac4f05de987f3d8f927ad53f956b94786cb62b00b0543c24afcdfd9ca2fd0b6070ceba0b6924e

C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt.encrypted

MD5 343c3ef56ec56e1277cf3d8d8c85eefd
SHA1 cb0386d4a87d585435a499f58d94cd33f704f851
SHA256 acec8e4ad09d9e8c7fac92f2d36df1df89e96eb54df95c82c587929a326a55c7
SHA512 dc4a9ed02f13fafbcc04f80acffa690e2c4cea2b3701c3a2c16edbe1696f3aa9992afac7f96ba5c6d37538c6da7904dce7e7a27233c88f87a07c090ab115a3cb

C:\Program Files\Java\jre-1.8\lib\jfxswt.jar

MD5 09ca2f357084bfc20a37fc2013d61c42
SHA1 56dec6b0f7da76a62f9fa834b23d27cfcb5415b9
SHA256 03639e09b7fa6278a449b3c7646b8d375f9fd42e833937c152d63cf9880b9503
SHA512 8f8703bcbde653b51954b1a74d1ce0a08d2ba39e3177f28756c811d1e9c324956a2c59c8095a221bb23ed187b38254f3ab6de59f65a030966d095eafc034e702

C:\Program Files\Java\jre-1.8\lib\jfr.jar.encrypted

MD5 8a2f1a5dbefb7a7c9a1074959b38b435
SHA1 25cfa44c4ecfa38f7d05f1606e2fc6665be6b86d
SHA256 9683e593ee23c32834d0427ee3090d220d443e9858878f4474a13fe4872c2980
SHA512 da7827a99fb045c59b4e934533af06a6e8fd243faf62211f3180c66602c4832826ad6cd7b547cd3c3ff68593a2daf537caa276d0dc9ffd534fa73f422138c515

C:\Program Files\Java\jre-1.8\lib\jfr\default.jfc

MD5 69640dff64aefb3108e8c4a486000be0
SHA1 6a35c92eb639b3968ba6b8d5fd3e7f3048f48137
SHA256 7d5e116b2a9dec9c1dbdd517203c8fe132e8cb278e6d8f6c2fe7c88a703ba294
SHA512 e8627fe65caf0019c83b4abcb55972a72cb7a1e38879a336d6c96d6079b23856e4fd049da55590110aad4e6f3ffaf9bdef9c09def3adc85c9c686a4c6264f7e6

C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkDrop32x32.gif.encrypted

MD5 1960d5e6938c9c6a1d4d859e5b938c4c
SHA1 172d5d60a5bf7b184db1a0e35b35810177a1993f
SHA256 dded4ecb6272676fb28c696a283b2f544c98c76b65dfd3c5c1ce6116425c0f4f
SHA512 b94a6ef90facf1aeeb14a9fd8e4a6db73bfd48b8da00b66b93d0ac2b2c40baed0f7c93149abe2cb52a853be2449604a1bf96aab99ea72e582edc6e5e86b5d861

C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif.encrypted

MD5 945f90e886a220afd973e03410c007d5
SHA1 2f30defca8ebcb3c53d093ffdd3805606250a074
SHA256 18ecbc5644457edb6317b04101293f7f38239a3559a42e071b16785919c41b01
SHA512 1a4a74a92179b2ded5c15ab07b728f1e7a659d1459d23d32b741288521b3b829f1be8df3110081f5fd6766cc81edecd0af2cba0b46dc295266a82c9a52781792

C:\Program Files\Java\jre-1.8\lib\javaws.jar.encrypted

MD5 c2f127d27495e2e95b7238378124d9a8
SHA1 102cec9615a6ae4692ade49687cc78eb4ba65435
SHA256 e0c1b9551d3b97c76f723d1a7763c998a64ec373b912f7a5789f96eabfb3ccea
SHA512 3771ab003c4d1bbf086d25af4bc9993514d28360d54a7d1a577ccc4d0af3330ec99f0c163368d6951880bf95aecea2c11b795301b0e99c190f5fd460df31e814

C:\Program Files\Java\jre-1.8\lib\javafx.properties.encrypted

MD5 4bf1704f7ef267ba7845d5291556a005
SHA1 d608e2660e103d2f125fb19d193b8a038c526927
SHA256 130b165f2a84e3e544a02c55fe3efbe7dac8ed52fc1166aac4ee6588e7d0f9ac
SHA512 d801ac1cf9c86335fd9001a3ffe998b561cf919e020f5520092f94cf3a0cdaa525cf7c94b642888ae5d778220b8ac45920ba57c7c9d23ef303bc5a3bcc99dc4c

C:\Program Files\Java\jre-1.8\lib\images\cursors\cursors.properties.encrypted

MD5 5a6667c837fc8b3368dfae0928c8a7d6
SHA1 82cd010ab3d8e43aec0a30b5e98a1d73e24eb206
SHA256 ce355780bc1bf16bd415c85772482d5d43c473fe504095943e449e4aaeaa0dbe
SHA512 1f724d06aedbba53ec297f0e732655a33767701b24016687ef0b78b3e2402ff2307bf52a454576fd3a8f82ad4edd8c4287ebe2209e710ac42576c0312f230acc

C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansRegular.ttf

MD5 afc2c813677e97211659f9682a1cce15
SHA1 a13395c630eb447c3ce265206afd0edbb0181bfe
SHA256 a07327380ec35df28f298a72c82ee1a371bbc071e98f17d2b63dc569f49f2cef
SHA512 57ec294a236eacc16fd9e7473fa83aba4f466299ded86d7342d13fa6e33d6d54e709223a2fdf0b6ca2ccefd6f7669fd767b93923265ca650971c0b37d6688a53

C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightRegular.ttf

MD5 b9102fcc385954834cc6cde3e6c7ea74
SHA1 a494b32a6c17a4402d5a5124c1665fbe2b940c41
SHA256 be7581a90db3f17cbd04126c85c5ac0714a73b5ba58939fa6557037c0a5a89f6
SHA512 28d9f4f736b863ead48b74b1ede9f6a5a689c1b988bf6f0ebdcffcd8b05663d59749218d0fb479eee397bc007161f9884f9d259934981ff418a9864d82c6cea2

C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightItalic.ttf

MD5 d89bedba2b3762418e55322fd8d958e3
SHA1 0ce4f66a5781935a31ad2424942e1e407b8eb0f9
SHA256 e41007368870359e99a2f570bd56c96c706931690a44bdf0917a23c2bfc94c99
SHA512 14ad613b1e546aa193e039007669fd1cb03a0aa75f5aca29c6a20020f1595b5be76cdca4760f32de512460689e2ccf637b0610bb9a55462bc176e19565918431

C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiItalic.ttf

MD5 a86f926fa5ee23e210b7434532adc46a
SHA1 c04b257ac7377eac40a31cca521aeb2cf6eb60df
SHA256 8cfadd95ec51d78e1fce2da5a0d428a5a9c8334e8c6df2eff3520a00fbb006f3
SHA512 5e054ee0f1dac5468a815eec8daa3a8a53d9e49a2085678c966af1ae3370a5b1e3107982a6b53243f23c51d59e3cb1a3ec6599f9cd6c28d4f54dfb088c0e0621

C:\Program Files\Java\jre-1.8\lib\fontconfig.properties.src

MD5 4518ba532cde0088be688b3bf382ec34
SHA1 618655f9a3220d0d857f637f8fe79199a12c957f
SHA256 6f71b38dadf789bc59dc354720a8c7128a4d1ac19c0d147380ff9214f9697c47
SHA512 031d1da242fe47522c092f43299158aa2f26636c593e344724fd2a34b2cc908e71343409627db9da4b9f2deba210eec646df4c2b68de36e875bae4fd08c2994c

C:\Program Files\Java\jre-1.8\lib\flavormap.properties.encrypted

MD5 f3c60bddf4a7dcd46cb1e71d584fb541
SHA1 e9da9f96ebc100fc1329e8ab58cfabeaa74ca73e
SHA256 cfc3cf7bf4021cf4d2c81ee8e86b533fb50ec6a1640b7a866a4b2382664f76cf
SHA512 23b318b1eee84bd84531f691ebeaa15a9924642532d4b3c4446d1d9fd924139cb4e9f84a20219545c9d283dc426a2db56c306b719703c20a926a8a0f04ec8d29

C:\Program Files\Java\jre-1.8\lib\ext\sunpkcs11.jar.encrypted

MD5 d0f761919edc52035444832a40d468c7
SHA1 f5a39c7b527d41bcce6215fec4812627013597d5
SHA256 ca896c01099d31b99e8b4c278e7c26915e3c988d95082f40b8351676d50236f7
SHA512 e481c3f1a9408b15ea7e01c046739c79b44af320652122f69888ea83c77de17491e600f97aef116948d3916f8d67e29098df20a1ce06bbac0932ed24cd687b1f

C:\Program Files\Java\jre-1.8\lib\ext\sunmscapi.jar.encrypted

MD5 4bbdee56cb1c02accf83188e9824eadc
SHA1 b16d79a5dce627a5476bc528bd44eb8dd28314aa
SHA256 efc46bea4a5b1e6addeb76ef0ba5a6f145eb8b77ef70bb635534e055040c7990
SHA512 45ab5fa1b9d843b65a99d2cabc9740109ebde5ed952d4bcbf14c7d2839d25ca468ae385f9a3720ac5cb7c3e4205faf7e2313aa8be7d04e75f34df80a188c2636

C:\Program Files\Java\jre-1.8\lib\ext\sunjce_provider.jar.encrypted

MD5 0b783f2328f16c18db6fec364f257133
SHA1 7654311c1fb1f1f881b6f6c1e92a8afdac6634bb
SHA256 090bce4aea3a1c87afa6992f5f1dd75d2d95f09d5c742a18651265de12266402
SHA512 ede74cb6bf5f7f239f1277dfa648430f154575bee12bab5f1b35e5b4cc3507827f98c25dddd43dac3ccc24c2a76105b1b0f103f678b38750e252e356363bad96

C:\Program Files\Java\jre-1.8\lib\ext\sunec.jar.encrypted

MD5 3b59aa67c4c59e5c9a448f27342ea6d1
SHA1 54331e24d7f009ba503d7487e3757c7c78f31b2a
SHA256 ac7672f03305768a9af59d5481f92773dcb8a0a64174eccdba5c3c4312859a5a
SHA512 33e0973fd69c0a3faf6551bb84ae669aab2ded9d236b4dbe18f1d500ace396b061c58935063dc0aa31e81c0c9423b617224e24ec85a9d8748d28bc1505cee4bc

C:\Program Files\Java\jre-1.8\lib\ext\cldrdata.jar

MD5 6904d9c4cabbfea7b148023baa1cd328
SHA1 b87b2457a30107085825a58affbb4c899c0768b6
SHA256 f721e05b97b77768fb521d6238eaf659b5adf481b6b91f9abf08e522935386b1
SHA512 aa45fa67223725f33e90951e1766733cfc44843642b912a9e422b2d1830ddfcc529b6a945a908f57ec0463f2cf7c8c56633fc645ace993777f206f4e3821fe31

C:\Program Files\Java\jre-1.8\lib\deploy.jar

MD5 613c3d98541462f0c02f19a76e9d0dd7
SHA1 b5aacacd060391f9eb663e9812c225aece8ff02c
SHA256 cfa117a152d670dd954e56a10b65aa710a8c55c24f8997f513461a771a675961
SHA512 93f205fb247ed51a58bc071d33c07b8b961ded48d0143b22672158c0d9efd9d1cc45a7e42471b771bc4c40055906f3e89d6e7042fecd6ac1fec9de867583572d

C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]

MD5 00e1df0070a32d35a683a14b4e03188a
SHA1 376a0a5f3ebea4c7a7b13830791414d40082f399
SHA256 c1a9674bb00d678116966abdb04ad46359c74c5cf9c54c84152e75d6afe3d2ea
SHA512 ea8393a5f47a4f78ae75ff2271e76ccbac6e8ad43918feddd25ca1f8f1c855ae82e8ff9e06f9d8fed79d4e78d76ec1936d785343a0c4ae9d553f76c4fd331b1a

C:\Program Files\Java\jre-1.8\lib\deploy\splash_11-lic.gif

MD5 39915c721a3e61003d470bce1a333a4f
SHA1 6d88b8b342655cd358d240120c857a971b9a1794
SHA256 f5b0c07986592a5dc2bd5b22d34db5f1de496d2e30cde6b73d489731ffd2a419
SHA512 3681493f7cc326fb08b890a8c0d24db51dd32c9397c96cc113432e280a63aedeff19fa22b56c18c4c2b9dcfab11ed7914eb01eb0bd12d4e61238f9e1ff25b33c

C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]

MD5 c17d033106869d501f99533b6898d938
SHA1 34b1b44acdc474fdbb01dbc12a385609b6119f5a
SHA256 2f39303b5f56f53f7ebe589f9e06f37ca2170028cfe87de417022dc1cce1da74
SHA512 2b1857d875466b263af9bc57970d615ba2626f52ac38a9d16fce71dff5ad547267ae8ca3f4fc2de6c8f1fd4ceee25a4ed322ccf0e05657cf67a8ea189ef2908f

C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties

MD5 6d63bcf30808f9d333c1f9ed3e8b418f
SHA1 d0de3d5f58c347f691ecbeb82ed733f39f4ce70d
SHA256 5748243a6ea3203cada856d42e26daf1365710e209ab01d4b23490bc2dc8e335
SHA512 8119fb422c8bf27fef38ca8010853679042695ace87bd18a67204bca59b9589aee9bd4e701f71277407fd1f0b2f8f6ea836864b721629e9528feeba10b244ce4

C:\Program Files\Java\jre-1.8\lib\deploy\messages_sv.properties.encrypted

MD5 a8e1a0130b0f753f8d4d2a9a91439f08
SHA1 ce83db01cee63577697c40aff4f2727af774f731
SHA256 c6fe2b7d66fe4d0b1816938b13e085a0e145d2b66271411a8f37d7de0de0d331
SHA512 eb1b6a271c0d5e4f293c56a22ef3cf12a22acf6ac58eb33f03d263c71337c3acfc5ec7f0fcd077ba814dfa62458f0086f934254cd699cb60c593610f033887af

C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties

MD5 87d0d7f48ecc8db995de44272495b5d3
SHA1 19008435e0e5ab8909b6b6c324464838903638a4
SHA256 4e81c9c82fab97ebc42d5ca18d845b4b5290d0d1fe3b880df30d8954273b20bb
SHA512 133e0aa0f5ca0deffbd5a9dc15df7b9a63ccd90b1c79ce7c5e5d533cb0a5d13503e1844660dda5d8c07e222dd78b6109d333217968c293ef8463299851e2a441

C:\Program Files\Java\jre-1.8\lib\deploy\messages_ko.properties

MD5 38b6706c87e6cbe091032c7ef23b39aa
SHA1 08da67d454470250ae81dab7eb52de311e3cfac3
SHA256 2aa38e7719cd1e248aaeefedaac8f664fd2cb80d570793c306b3430d42c35259
SHA512 d8faf32fc0fae66cf81bb4ec7920f288a559b1bdd8f8f4e6594f29f9717f75327385175c44e0caa30e2555e15cca4e9fe677ccd9125fa57d2504c3352989fae4

C:\Program Files\Java\jre-1.8\lib\deploy\messages_ja.properties

MD5 f31d82619b9968865c21d26a0ccfd7b6
SHA1 da63cc9b5eb9e1562a1a9fc051ed32fb8532b07e
SHA256 c17770404ebde30b6064f391ab00de0bd4ec1f27d9da901ab8845057abfeb2b1
SHA512 cb13e0f5ceb5253de356b84b206280df9cdf8e791a34f15c52826baab0d830fbdcf27f8a849db1b7bf88d16ad784773509f5d661f7b213eca71903c8e79951f0

C:\Program Files\Java\jre-1.8\lib\deploy\messages_it.properties

MD5 412edca36bab4bcc114aa453ef75e4f4
SHA1 ccd7a3bb1671f2daeaf1086ee6ff3584d5bdddd0
SHA256 26564b7210d83dcb9545de7bedfe030ec0b5ccd93849a1c851ed0784d49aa838
SHA512 de006bab0ebbfbd5f96f66f3d1918fd13c6479919e200903d06b68550bf067352f2b29299abf4413cf062c9bcf24046d657340a00c7aac476cefc6b2f04832d9

C:\Program Files\Java\jre-1.8\lib\deploy\messages_es.properties.encrypted

MD5 5a4bd389f3e048363eaa6098f64bff55
SHA1 0a61c49abe536a280ab26dfb1bcb59a4f60bd1f7
SHA256 35f01d49c1af2a277fd7967057e8d53ec247c370827268908dbad6cd85581af0
SHA512 c4c4937966554a0f3a7448dff0b0a185a75225625a61c50de719b654cd3c991ce5089ac73643533e4e31229a94546137045c1add3fefcc63f3eef5a2ab81c091

C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office.xrm-ms

MD5 737ab377ffcd599b92410b9db65fd512
SHA1 d032857bb2cc68dcd1b2d51cc4fe44333349576f
SHA256 1230a4427b51c409ec3866f06a5486c2a0180d4a2f491b9870ce723f903b73f0
SHA512 d12d3d7a58da713832c708c2689b5c28fba0d781cb1c849aa45880a75a9935be88123d3d1112f2ff35a57c84df26e07877e97bd2f5ee352ef992fddfcfde49d0

C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ul-oob.xrm-ms.encrypted

MD5 2547533987fccfebddafaa39139e32de
SHA1 ee598b907eeebc93441a233844df09ff225ae8ae
SHA256 beb8a1721373d5775f1e3885d8b7fb29679ef379abeeb332e719bc1f3c6b131c
SHA512 99b820cf759c1c164ea3c6764c85bdc5d5013d8031a167e7bb044ee642d4b2813ed1d0d2c183e0a50cb74f905248dbd4d509004ddce3f7db5743a4926bda7a03

C:\Program Files\Microsoft Office\root\Office15\pkeyconfig-office.xrm-ms

MD5 24f1d5b4792784ac5f3c928f38eaceed
SHA1 8a5fc3799e1571cbbea3152d33bc653f99d9801d
SHA256 289ea318efbb660bc551d40b37719caff45025e69155dc4e50fedebd833cbf3d
SHA512 cdee346d0551465a65af6adb32c550c7b9af39f3db1630d487f037d80bcda5d5b75c0a1bfe05ad2212d850624a2574c19b4e12220b212197b0a94bd31e886595

C:\Program Files\Microsoft Office\root\loc\AppXManifestLoc.16.en-us.xml.encrypted

MD5 74b5cade98411251f726f6a57259639c
SHA1 2d69e112a3350cb809a59f40ee7a93a7e0761527
SHA256 b83e9752f40c87a12449af36b47576cbaf6c9283c69841fe48b27edb25ae9601
SHA512 8455be7f606977e4ba5bbfc97210989f8cebbeb9b8995ec5f6b2f90f9229e70e8d5919bd2befbc2c0c3d5f0538ccce4c2865e09b0cc7496c018e2c0ea32e11c2

C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt

MD5 2f0aeab7de99eec1311f09d465f0d1d8
SHA1 69fe77ac6e9c7c41eb4ba4a3e87ebf09400bcab3
SHA256 ec63c30ab722920ef7aae4c2f84401f0951b4dc6c82b335e86bea7ed9237aa2c
SHA512 7a1e9d83a9ffc2a5ffb79fa8a2df07530c30c07e62c1ac922b55304a7acb664c07b28d9452b4bdaf196cf6a3c49280dcacb0e5249756a97d2bc0182b7c365ffc

C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_F_COL.HXK

MD5 8bbaaffb07c508b15bb4373008cb887e
SHA1 ef7ea63854f9f2d4521a4d063729d7792e62e2c5
SHA256 b2bcc0f4b09d0da92048437d581932823a618b6f8647c301f97eb5f108cf5fbd
SHA512 ae2cf3414237b1f989968a6cb29a8317e580bcf07d7588100f4c14cf9b6cc3a27938a042f8b68f32d5fc6d9ba7a1add2db31c1babc6079a36c3acbef6f8fbe44

C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_K_COL.HXK.encrypted

MD5 5d3fe4b8623a736bc21f5b107d3ad49e
SHA1 3f90fcc44137cf0de145b561410b7c23ee501a36
SHA256 56c441e95971210b3b62de3ab0adf5eb472f931c9dbd84b38f770fb57b900077
SHA512 cd0ef915e1196fa1b05b13577ac8790763b7f1cc7b3df76a73603085b81f1e51e24c02e8b126ca2071c818bc97899d5ea5556a48671f14cc4add61937c95eb64

C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE2.POTX

MD5 34b24598fced6e307022e0e498014cbc
SHA1 9c792531e3aaa65a4586a34c7f64e812666f9e80
SHA256 56c6ee1232c3d3853e1f7134f389634de5215782f8b1f823133ffde6d11586e6
SHA512 e0cff7d824ea36ec708fe2d95e4d5e0002764f893d36a91d3a84958aafa725e424efb0a08fbe487939e4cf07201329995d2123126f4fbd9505a7321984915a16

C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Default.dotx.encrypted

MD5 52f68105b2ef2a8fe37904e5956a64b3
SHA1 fcf95e9b1b5bcfb47f0a11b4a23189074784bf12
SHA256 b378c88cb54ed5bd1d22ee12ce70acfc4882a96e75a85344d8b48d992b9f36f0
SHA512 6766554ee27422becb7275953e40113327b2440663f27fc98f02112d6f3aafc903dfef76c7f56d15aa5792c6d95444aa2e9b8ace6822f4bfef45f6753fdaae68

C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013bw.dotx

MD5 01d0e5a9ceb312a1afdbd574862a8dce
SHA1 f6239bfaea3f660944ccfb5ece1d2c3e496147e6
SHA256 223686adb56ea62978895181b1594cae8d3de3af773ad98ac5b089f1f3c9c61a
SHA512 a5bef858823513e3b8afc7e65c7448203230a853a5d6897ed26fc1e42894e9aff77a4f12a5b096b0f047844161cc8adb23ff53c15e046bfe44af6809d96994f0

C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\SIST02.XSL

MD5 4a391e01f2c5e6743e8d1b4cdd91c92e
SHA1 daa3718cf369ce80080cfe2d26dde286c86dce34
SHA256 a7b142aa571b1fdb8997138ff05ac2f86becd1eaf3aef811152d39f2bf36aa1b
SHA512 d05582385102af34690942de83ed017b5d0aaac7e7290b9d7b9449b2ab7908fbf5e8e78463e309539e597c73a5fa0e9a61ac2237cde866bf04a998580eef27e1

C:\Program Files\Microsoft Office\root\Office16\OFFSYMB.TTF

MD5 8ef4d47723beabe503b2fdb835dcf533
SHA1 65aa682fa11ef4e0e6e61833f29389fefb8aadb9
SHA256 718568b6c62afa7d0613ba29323da13425f0e9d354f3875c4c1916e92da14009
SHA512 8e95bcf2c8bf53c7f92b78feab28ac58e519f74238133f2bfc2904cbed49f0d9d1548cfcc63bc977ec9639886ba2fb690b291456fe4da6ec3816810830d6a5c0

C:\Program Files\Microsoft Office\root\Office16\OFFSYM.TTF

MD5 7e4196805f9d6d9b76322eccbd604b13
SHA1 127b4f0282dd97b48f10de68c120083088eaf550
SHA256 5dc892eb62abfc67496aafd027315ddacf467e4495f4832dda974f02f8fa656d
SHA512 e3701847948be4210f8ad01f007879e9cc83f89aab4ea5f03e21a5861e8ce5e1a99c5723b0be219af3067f875fbb92000ecf9039e9b0bd31963fc4c9e1402a3f

C:\Program Files\Microsoft Office\root\Office16\OFFSYMK.TTF.encrypted

MD5 019ee61aca436bf61e260314d298c2eb
SHA1 763b0d7d637bff59214fccbf0de56984d70228fd
SHA256 0023165629bb2b4f159a49b12417dc921a240fc0140717d9d209d63aa7438303
SHA512 1b0cc573b4b2587b71699c6f38ec4accc69f7ac3ea122e0cec1d0de67324e3b9f0bdcf51e5cd63f32ca75cf1f07fb40ec3bb4003002d1813fb7593e16bcc4dc7

C:\Program Files\Microsoft Office\root\Office16\OFFSYML.TTF

MD5 e723df56f7b3c18836914a955fef59ad
SHA1 b4daaa08f501bae39d849fa9a3e2e9ed41842290
SHA256 84117740cc9756cb8aeef202e43d0e3a915f40bc17e8efe986e03f4a92d82207
SHA512 6fab38b4e2310b3adaabbd32dd0c71c2b4368f27a4284e80aeeca2cfc8f776befb0fcf3067616aa44c1c996a19b379523f3bf522b7aa79abb184a200b793086e

C:\Program Files\Microsoft Office\root\Office16\OFFSYMSB.TTF

MD5 393eac0b7bdf4143a289a0d685da59f3
SHA1 fa1674981cfe2412fbb25adeab09de6fafb62877
SHA256 a6f015dd518f4fe0e7b1bf800619f7af8cfd00ea51f807b88c7180f19319aa7f
SHA512 84941a878ebd8372f9e708d9ad02e787037e92bf71ed77618e78c8ada7aecfa39882f325250aad9aa190543d8b413959499f7931025d4dac62723b6b77b3452c

C:\Program Files\Microsoft Office\root\Office16\OFFSYMSL.TTF

MD5 3f0a63fb882d7e947714ff3f9a782881
SHA1 a7c2240b6b4cc1b09496b629aa167a957f9d6746
SHA256 ebf97220bbb976f7931d841548399aaaec5986f99b31f9bc2143be193e4b124d
SHA512 1f7c384e08cb90cc9b4bcc4789a10d020da6e7cdf110addf733b4d46013d7102901eea7d420b157f1efb8cc1de89d68f2539d2f00873f35a443a8101ae8adab5

C:\Program Files\Microsoft Office\root\Office16\OFFSYMT.TTF.encrypted

MD5 792207c955222b339eda0b5cfdfd7108
SHA1 02a2e475accff4b609747365ffe24e4485a4f26a
SHA256 bf11de570d1e54d9a23a7bf474dd86e0378447b83d4b5d529dded085f9c3896a
SHA512 cd097622c86468ba8924afe2ab55f098d4b4067ad79841ddfb6308f5af139f46ca665d9055d981fd0718e4d735f310e821fa9531e6531d4afecd9c0738e5555d

C:\Program Files\Microsoft Office\root\Office16\OFFSYMXL.TTF

MD5 29214a61bfb9ad25f3ebbf2e52a06d75
SHA1 32227e3b0acdf8b457ae9d3096e594190f667a71
SHA256 b0f0acfade745dee8a37e65c978a117a296a9fdac859219ec73a79689320c944
SHA512 818e0cb86098d44ce0036670dbb06f789dad0449cebe8ed2d5a8055c08dac55aaf4cb233286dab723314ed21f7db5ff02f3647bc23951c42d4472ab21311151c

C:\Program Files\Microsoft Office\root\Office16\OFFSYMXB.TTF

MD5 0b44a95211828b9caabab5337d5517b2
SHA1 e5ce4487286ea975b91cb4a7fe25f6572145ca4c
SHA256 9a4f34a84c9edecbfaa0ff58436a7237a669573e78f41dcc925c07660a671d59
SHA512 e84d193d5b4bf5e11a414857adcb258c94277f7a7265e4b61369a4e8dbc8a7e6a90959424377e9d231cfb0288189bb03fc13d68f197db3912309add54e3fe6bd

C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL093.XML.encrypted

MD5 671cab848fd3b3b1fc69854200d0f15b
SHA1 453d2c7589b82479a4d4c8d416e09b13ae0d7aaf
SHA256 2af2041ca2545d7ab2ae7b469820649bc4aea17c87670b2356c7fe20175a8d17
SHA512 e4ce5cd198320a0eb341b9370454d7687db033ee1572d6c16d6ec67229dc16ecc6d58100bc1b3fb2b57d5085b5774250c74d4be31a2ce603b50a597556a57bd9

C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8fr.dub

MD5 8b118bbd15697ca6ed6bcd6c33d6245a
SHA1 de2949f4d3f532b8d8e0973fb92f14940187e65f
SHA256 33342d50dc3ebc5f3619ca0e4402c4ce0a4807f3772f4cfcc7a5cffe1dca2bf5
SHA512 4b07b3ed09a33d49832f0862f3a297b37423e77af6f7a5bb1d1ce1736288bc7a1553660c97b2398b37bda6b473cd982e2468b7cd419bac51717026aa84696f01

C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.dub

MD5 5ebd533d193be652d5286194cd1d87f3
SHA1 451883d25fcb012cdff6ab7ecab475d32e35ef88
SHA256 d2a83f77adeff3da0d8b9e34464c155d5256328396ea96eb45c645aff7d3ceee
SHA512 f62856c2e234f9714495f6c5b99d95cb40ebd1462cfcd9b5ddd17a7055e6abff99e2f754285584037a24534c114b821d60c30f425ec51a775a0a043a54e86f45

C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\SLINTL.DLL

MD5 635e89fefb839bcbd351d05bc2b4db4b
SHA1 28bdc15f4588821e53ac5a4c55f475e3d2a62323
SHA256 332231fc3b616f1110b365b068f2457959631c6094dbcf6550bb065254a50640
SHA512 ef2b73c1cfc749dce291bf0090fa1e7c083cbdefebc929dafc78df2fc64130d5c1acb8699765498f245f62164db8c8260ab231217c2d0d7ca5b08146c37c6fb6

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DBGCORE.DLL

MD5 099bd473d7e65da722f121d5e36b134b
SHA1 d00a0befce88c887a3c1ca4a748b9ae533fe6216
SHA256 d4e2adb218ff7af02525adbbbdfdcabd004a1f2fa33b1628b0dd58a3c30ed7af
SHA512 1ae31b21cf632789ebe1b41959f0cca56a79724a70c041fd2e5b2250ec57b0c6032270beddad252f077c82985f4c2b1068434de096a6df22805b0505a8ce09b0

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DBGHELP.DLL

MD5 148713d7d2554c072b08612788c9246b
SHA1 cfc09d0800509fa46df31fcf618cff9e67634d66
SHA256 ccf201c961f9a0ee147948210cf53d8301b9730fab196f25ec1f843a32992193
SHA512 1dca2c8a7fabaa2b2c8edd079b4cd121239efc564d5b780208ddd57c1680630468a638522431c52f27107de78cf70b4c9b4d775c079c7f0d5911adbe0abbc441

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\db2v0801.xsl

MD5 1d674f98e94eea71e45a83bdf5e35fe9
SHA1 753025f7b251076902a7a3a744331e2279787425
SHA256 a493827179e0b3305f9af6b002c737364aa33f922e186b8ca82b806c38bede6f
SHA512 9017ec1ab690d118998d2ca23651218f67da873cfadd73da8d9c1785f0e186387995a473dab0ae3f81bd5680c80b760f4be6f03608876ea0a9b6ed870d2e0125

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\informix.xsl

MD5 bf04371c2fa3262110adccca31d91f6c
SHA1 3d9f8da786ed90becbbbc0cd6d63f192ab4dfa61
SHA256 3637464855ca0d2e563da1b9b4ce9b69915c8379c5f594e28f6f957ee40f0781
SHA512 e32a43acd11279c2e2a990ec222a309a8532e3bd49966be762b23666b9b791cc5bc17fe8c7307473b4c51025b7ca55bae5a8138f110591476897e266904d413b

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\msjet.xsl.encrypted

MD5 093634928af5d2d849d46754a8d6f551
SHA1 6c87bb6174ee97061bdcf1d766d4a1a80b3ef7e6
SHA256 27a3ce53219c80d2d3c9103996f36525a153d7b5f6645ebcc7b132bc48637aab
SHA512 5657f7615ae1b24ba9e9acaabc871eb29c3c18d83320c8b3ef6ced1e7206bc24d2fbe4afd67a163232b13c2573f9d21d2eabf1b770ff54ad22078e0945a66093

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\sql2000.xsl.encrypted

MD5 639f8458b9d61520284589743acf755d
SHA1 2be63f47057243bfc584a5fa4a10f933cd7b4442
SHA256 1fb4b0d4098177c89b5e80df67354d57752c7e0e0e3ad0a7e73558fa8191c8eb
SHA512 555397c92da6c91298af78700d234a88d6eafbc8b2e80901a0fd208ff8ccebfda8d28cdab092c60953cb30a1b43207187438ea18987ac1fbb598e86b29afba77

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\orcl7.xsl.encrypted

MD5 981fa37cfa08433ce1c41530eff87b55
SHA1 ece97574f64517a2c416507aa4856438e6f5089d
SHA256 ab8f711852e457ef18238c06295466a619bf9de5faf504e88a92a29da5f5bf58
SHA512 6bd0c7363e09d10424787225ae174d00283591eb932e31e2d315ab4650e76943e7859fc6cc2aafc01238530d39f092fd1885a4dd1d0a5d59a5b3d2b5f0ede3dd

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\sql70.xsl

MD5 822125320046c6048c611a475272a94b
SHA1 10d3eb0ca758e8c3bf8eb504e38e899a51302070
SHA256 d5565c5d45dfd88118d63f70370c3ad7551b68c488228754b64c59d7ac7761d4
SHA512 141ba124ca499ca9eb099fc05ecafd224167c0b8b808397bfebe2d5ebb3759aca96df7a2233f232d6e3298e7ba0019841b0e52473beb53ccf10b3306d59aa34d

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\as80.xsl

MD5 bc363b1eee67fe9513ef93627230edba
SHA1 6c1959ec2a791e5d772683e9494288c2ff0c6a8a
SHA256 e0ee5dfba0c0575ca775642b48bed18f5544d9e85b84da7704d83978dcf13af3
SHA512 20d57d92628d3da6b4bffacf4df52b9a40bec6d744dcf349064abff188a734de66d19811272552f7bfb402389dc3b7479e48d417b30166844c68cbfebc6e6568

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\sqlpdw.xsl

MD5 c4394590a21156546a56278c7a35e5eb
SHA1 c7954c75b0f7f3308860da2c793517ac34379105
SHA256 0fd3cfc4fdebd533b118486862bf16b734eab7b7a5ee3c2125b5b62301638c10
SHA512 329e8fa8b3957c94bca953dd8c0aae4d0874395426ad2dd20a43de56a114d419d7037996b9c72ecb5191cfd5e5cb59598279ad2bd352b389ec3e2d0884934aeb

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\trdtv2r41.xsl.encrypted

MD5 8c488eb326565d10bdfa5682f119ce5e
SHA1 628047c49e83f228ae6d27d2d32eb33e3c1570ed
SHA256 dd28ec81c12e30a585881bd0f4aa1e4c125d7ee83c3274429af0eee1e88b0344
SHA512 5bc52c10f402035128c2275624f384746643c44d87fb7e119e2598a512aa680148a9f6e9e3888e9e780058ee012e0bf626247e6649ca1043264c9d2814ace80c

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\sybase.xsl

MD5 229c233eb03d39a30b67e0b5e38dbe65
SHA1 0222774fd728ed8c7efcd3d9083fa58d41213c92
SHA256 89e0210ff594768686bae096d0ee239efe9a27b3a46d22f606108d1d83cdcac2
SHA512 13049654a1119b1cb6062b0860c1c18903975a5699c7a0899565a2223d0a716111584404bfa0108bf52e5d253186d026b4b157d2a28fb0a3ec55dc1771c0c077

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\sql90.xsl

MD5 bf6f471747bdf1cbd11a168f7c0ae179
SHA1 3865178db1d8799bd6fb6cc1c9e521bcbf3bfde3
SHA256 5443a50f4eeda685172861a41c44ae9774b51eb5dc63b20a984f6e33a0ea7efb
SHA512 ce571428a1d320dd7884d52a8277e2ce05aad63fb6b326eeb8fb16aedc04bac8bbe205fdf7da6649f4f90836ac0447b4d079421dd5e2d851c00be08d096643e7

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\as90.xsl.encrypted

MD5 96c21e72d51e71141ee1741286fe6ec1
SHA1 830206dd99b9dba3889c79c847434935897a93c4
SHA256 61790fa512b5979a57059a00c6b76d0e063162b2c8296033a04d05b50f5e7a67
SHA512 ebd4edcc3f0f6e8382bd8340dddd2b8b0cb0da7bfacc0d2280cecefcbc5fb3ffb62b024e048c22f9ecad5fd44bdc46d7daa702829178c5c9d7b2b9053a82d820

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\hive.xsl

MD5 9d93cc4f7a5b1c3035a74b2fdb2c15fc
SHA1 cfe3c15c06b505e3ce89f81fe8337fdddc8ebc71
SHA256 ee94d154ac54321eef11fb3014e0faf8ead058e1b82759d118a6ba02bf11f674
SHA512 1462f0913ddd8566d9e7e5c0425cd4e75591081938f2be04874dfc662a515fa1db3912c92810be101abf0e23b7d19b7731d9385147173ea59ca3eb8c5aa0c909

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\as80.xsl

MD5 7565f330e1332915c6134934aed72a28
SHA1 11e9def290da291f40a1bbeb50d46ab9c69aac08
SHA256 85b91958f6d406074946513ccedcc3f65eb98c49a057ae5626d7b10ca8363bf1
SHA512 8a80ef8492631e80956e77cb9ce3e93db8d10f1766cfd84f7c4a7a06a41e0d2ef65798dd39d01acdf5fa1a5ce748b2c35276855faae615fba6aa33f5205b37a1

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\as90.xsl

MD5 c86d421466b58959dd0fbe51123ba2c0
SHA1 5571aa039ebdf021d3a22d4611f3bdd3c5d09b58
SHA256 10ff21ec91e5e46bb47e9bd55ec6d68998f60d408860ffdf3933747ff085c00f
SHA512 9124cf54c69c2c05cc1d1e18c26d59a34494edc0022c5ea9fe4b7c6613d96300871cab8e853c2386a006ea534a9a4891d3ea600e6785ff5b2c51b11ffa958044

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\db2v0801.xsl

MD5 af6dbb7049d134434d1c92c5c0488053
SHA1 37d426415942c3db3f9257b9000afe5e196f436c
SHA256 1296086d6bb74600bb7566c5a4cf8b7d640f50305fb99852dcce7644603c9fd0
SHA512 8c2497092ea8dc706492829504488bba20e090e5fde0bb53829cf198724578521c2fdaef77305f6a4a9cd430f6d39921a7fee6c7adafdce4d84b1210f03a6f03

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\msql.xsl

MD5 a77bd6947894ff0d95bdee2a6b1ed30a
SHA1 9efc0cbd9c2db8777253fa14dd9a0304125d3b96
SHA256 d5eee97ae03017f717841bca349a9d1811ceb4d8e4ce89fb56ee36994cf0520d
SHA512 7ed7a7784dce31f19a50c29a5d0845420585ed3aa803199e9273a3efe7a917c80c64099d98d18a379bc26ae0f65c95b422df0da2cf74556ffb9e3e6357930947

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\orcl7.xsl

MD5 be479f21ed9007ea4e701dc43bf7731f
SHA1 25e69824308a1bf30978b85b9a5606d0c2abd6a9
SHA256 9e1e9aefce436aa4bc3bbf252bd20aabdc6ea297500c5b48221f1fc0289dc2cd
SHA512 26b88e59ae702235859ec9e0472f406bf2a52a75da14f04282298bc9af9b28b5fdf22d818b1a0b7cfd34775de735ea06aa3719589da9b619dd2f31176ede7c24

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql120.xsl

MD5 ed2b925daaf09a133cbf49e41b95e7a5
SHA1 893d72315fff967fa1d9393172d436272a61687a
SHA256 13fa2aeb143244e4878aa9e80c5e391e8472ff4055780818f171d4d9d207cc02
SHA512 f86ed36dc2b6bc76dbde38cc49cdb67e54d270afb4dea8817666008c6abcb56ee9aa1300dc3432a57f43010b1d76631e04fce6f4f6238da468d942b9d4f13a34

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sqlpdw.xsl

MD5 e454285ed8e0e78f1ac9be4204517bbd
SHA1 877c965619cb458f2f8e85eac09d41d5577e9912
SHA256 06f23144d979bddefa819710a74663f7605c70e6ab2b1994ba42036eabf50ebc
SHA512 78c3e044e3c790c12f42abc96888c72fed10be208cca092c2b53a10e9413325c4a23609f404ee7d421fa03b285a0af5f16011f702faede699b33ada482c39122

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql90.xsl

MD5 4bd8b75acad5626604ed584bf71a1c12
SHA1 b60fabae407bcfb00d6e0ca20c3c2145d0cee429
SHA256 17356f6781cdcdf048f2ecbe46bfa23dc9c99f05d4edba0f315bdc7b803653a2
SHA512 9d8ca1b6708fc78053a666f634bd78e9bd1d5e3a41843c9a250d9dbae08758b7658b974fe75a5bfad0b97eb08b2f2fa9325b3498f25f6764f4e022dbf82102b6

C:\Program Files\Microsoft Office\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\13.0.0.0__89845DCD8080CC91\Microsoft.AnalysisServices.SPClient.Interfaces.DLL

MD5 266326a3676a7551c702e5657407f60c
SHA1 fea91eaad5e8744b3cbddbfb5a8207bf1d32e5ec
SHA256 91fcbb78bd2ef67aa472ef147267e1b242461a0b0c7857aaa33217c7aeda1a46
SHA512 c5756b822b224e90ba0e0a67c6905a5b1bf71c3390aff2fd54330af3f928e5b03cb44ac59cf168acb1e70887fca975f5a75dc7fc9dfbec6474497383c19d62b2

C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\graph.ico.encrypted

MD5 f234ef8916a745dfffa2087f8303c3f3
SHA1 112b5f092ecc9c4b494e1c20652c38c6081079a9
SHA256 0fbd0c06a3e37e7773085976097eb42b84080f48d9ed3dea7f9ea276865f0a15
SHA512 ef7a9c187c87c1d33090754e23dd448535a51c0bafb61a0ffebc9ee131539123812c53d221003aca7ab48a8c68ab05160e881d22d82492750d627fa3f41b82dd

C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\vlc.mo

MD5 a6b7525d32cf98b98d60b5bae5831ef3
SHA1 fe5db06afc46d3d2f63d8b163584c31192e85282
SHA256 d3decf2242bd95552d94bcd7f23b7276dd7e7d7a83656a5a3800d32acc9e4b86
SHA512 668524f53a06351aa8445664b47ad417a0457aee8c1a9f059b79b98ebdc75bded4647b213b566ef3c0a696305e5bca13f837dfe920d92a6a3c25e87e18e50074

C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo.encrypted

MD5 818aac45dc7048b988d76f4d9f3798f8
SHA1 1f4a5a01d7ab846918dab2ef4c42160a40ae3e94
SHA256 dd0086432dc49932d51964469b08435a6f9ee4fb03a29b148d517005cfe8c783
SHA512 257c0e77954b8fda1619a32b2ace545f779a33d7284c55a5b8cd865da5e55840ce7e0f633e4da8abd6cc7a44ae0330c41eb189d64e103f62a4ed3a6414f959af

C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\MSFT_PackageManagementSource.schema.mfl

MD5 74a19472f795c7ad256bb340aaaf314e
SHA1 6aac12e4e39e074f212d8aec904d6695353b3955
SHA256 03d8843b2b9e64c85b5c61b29a0f4a494cd0b48b5f2ab9cb02422d96d5cd3269
SHA512 16982605a6037730be27e20877a2a08d0345a9435897eafa894b260ef642bea1c03b9ce9fad813199d05fface009685f4fc8ff96d8808782a83f34c5ded0b5d9

C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\en-US\MSFT_PackageManagementSource.schema.mfl

MD5 0ec775726ca4816c2d327239b204e123
SHA1 a607548b073110b2dbeea88bf5c8e1bf1f0462d1
SHA256 f5d3a4153ad804841db3473e87c55d31e520e55696ecc8694a8239eab0e99d84
SHA512 7cbef9275fff54fb95aa170e8bbfddb2a4b8eefd17f40d8c5473c61e297699af7798113863411a5fa3689aecd7a8d30f37b15219182f2e83b24f02ebf26f4c32

C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\MSFT_PackageManagementSource.schema.mfl

MD5 c248535dcd78c0a9510fde629c0b1d76
SHA1 6c2d313666be371bec7be32bdecd289405e514e0
SHA256 8041f468a4340a72822f986f7fe471bd64bd8018eb8adef80f6386a3d61435dc
SHA512 5726375b3637c0304004b0a27e38f02ab04b6850db46a05d3dc2fea4331d20483be192a2d10caf2bcfb8a14b2c82f4062a01cf635c1b7c46055e9d0df14e40da

C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\MSFT_PackageManagementSource.schema.mfl

MD5 2d22679edffc9b9101e9ec5ffc94da99
SHA1 7670bfc3f588ddbca0bbeb97545e92a4c24f3221
SHA256 1244081005fd80668bf55afe296b623f3f9056ac3f188012b962e4fbc3cf009e
SHA512 7c0a9c506da3f833a8c95cbadd9f12332a289b5f9b3ffd2b023b4780131aee3236b16413515d1ea61ed89d0ae33244c6c6f7a3a61faecf777bd6d9d0da2683a9

C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\MSFT_PackageManagementSource.schema.mfl

MD5 a5b316a1960215ab10ca49ada0632e1a
SHA1 dc51223d609a6ed32cf95a7c99afc7b38319f42c
SHA256 670b68992d721e6d376784abdc41876639f38c937a58840501788f7fbbcac329
SHA512 45f6c14b56cc15c9ce1e12019b4b6681a4faf50aea4480f6ec4045aee88198cfa0302ee61a33d3228a26f617aff5f73ac6520dfb909546b707c457cb1e0e417a

C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\fr-FR\MSFT_PackageManagementSource.schema.mfl

MD5 db8c1aba71d6a7fb06a73b6a255a3a7b
SHA1 18216bc85047cd3dc062bbd5b1be054850caac60
SHA256 7480a7c8fef1ab4c9bdd1120d9643d1479fd5374f6ccbf4593768faed6acf6a6
SHA512 c1d2140da8c120b1a410de8dfc0b93625eceeb458fb6f0f65efaf8628f00224723864cc04d44eec371dff0097069d70288366050413793878bc19254fa08de80

C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\uk-UA\MSFT_PackageManagementSource.schema.mfl

MD5 cdea443635125d42e36165b899a285aa
SHA1 a2e7a23557d4bd82e818b251e0cff48d0431021a
SHA256 d07236570cc6249995158a0251dfa81e25f7764bff40814c1915bec9850c157c
SHA512 5a3cdb25e87b72cc7a85d9b85fe22f4edcabe8e1cb409f7e511e5aa01ce94074cd5615207fbc53e6f19ce8cdd627fd51bfefaa70a248839c252479fff6ab0d0b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Click on 'Change' to select default PDF handler.pdf

MD5 0c16f992e909f180f8753da12d2d0109
SHA1 b82fea7af646eace6aa17b60907534dbc6f5c2fc
SHA256 e253142b33bb07ba12326ee3e634575ff2a4a279e2cbac62436032c40e5e553f
SHA512 846ff9058335e248ba7373f3a998bb88142a49df5ce0c9f36787a56c90f22a2e4fafd6668d2a5c243166ae9ddc0fa4315da297267ba61d7ef7a1096dd9b28920

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\QuickTime.mpp.encrypted

MD5 2c73f1ddf0b6a3e7a834937de92b6d23
SHA1 a446fdee73118d6c0ade357b624931bde2baf48d
SHA256 8a4aa6d86b21d461ef74a040b2cc6b17928f66daa775067417e13fd3bce78b94
SHA512 3fa988ea5265e36ff38539db384108d290a50adb4d0e3b7b3d3dcaf8885c9b336e542965bc0d90a8e10ebadd28264065acde12cfcc235ed0d694302e9f606ef4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\SendMail.api

MD5 e746b60d4186c991ce7f7a50e11eb240
SHA1 af2aa1786ec951528e02b017d8bdcdea8d8e3db0
SHA256 9fe65725b0653cc35aa7ff9c22d82988d6107801a996f869441948f14b22a275
SHA512 61e89562a1a5abd37309426a02f0cb4c1605b24a5e5092515803175520a6745ce8e6b6fdd38611cc6c46a726d3440c03babf778c27f8b2b2d867899b82cc0b90

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\aic_file_icons_retina_thumb.png.encrypted

MD5 a5d76872c09e1a0c8f8753d3de76a4a8
SHA1 306326c5b1ffffa738c511be8e168f1078013ff7
SHA256 7020e0795bc37f467c192e7be9cad084b9fdb152babd64e173657a4f9105a58d
SHA512 fd238318179de013522f50a7fb0cb023e4589960a03c60b982e354a52ba2e81cfdbe03ac6adeffec957852e9b253ea712b789ff29c40199963ecc208b4345104

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\duplicate.svg

MD5 992216b0f2b149bda5174341e423c4a8
SHA1 9f4b8d93730ee42b5f14dc0033e5e2934cd290e0
SHA256 c2135fe21a8d9c18cbd19e12d70ca33d85d1191d0f8a8a326a7275f66206bea0
SHA512 6d99613cc00ac7f9365192f291ffbb93c087e5a2295eff343c502c1bc9e6d0aace2555e1253cff523033a3b6792754267a4e8b8a4bc4db541575c7697e8cc4f8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_retina_thumb_highContrast_wob.png

MD5 212077a5a6e29a8f6cd1db5778c98ebb
SHA1 6bff3ba1ec00bccaba98174f07beae5411fb61a3
SHA256 85681ddcb2fc58c30fcf96938105c2dca6473f67bba8faf64ffc871022b55110
SHA512 d6fad972c47d6283639f9e962f39758e90efc33d13350e2267581a30900a004d04555db85f52e0fdee0800ddaf3ac2fe1240b8c8cb56e9d1b240e2a3f6d51ec8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_retina_thumb_highContrast_bow.png

MD5 a7ed601f947ea7608024bc4450d4bc81
SHA1 4acb986a91a651a569bebe4815df360fd030bed7
SHA256 c25938f384448d57f45f12f20ead118270b8648330524898a1bed054a4212c7a
SHA512 5c529f1352306a7c830dec0633d2ca62251319db71ecb1d6a027ddd4ecad725a49ad2c1bef87d59ce94ab9a592ce73f3a276a3e499169f62b8d625247a1b34f3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_highcontrast.png

MD5 b3c29b1b479857319d52a6bb112ea7f6
SHA1 e091f9f426c734d9fe1ba0a73a2748a904002ba2
SHA256 946d6decdd24dd07a0818302c259dcc6e97199f193316decfb6fedff28595e9f
SHA512 98366a80dcdfb25c63184a29e90030777cea422612e68abc977fe3111def4ca0a1e64167023739626d1b4b6cc4c5ddbf4c3f6bd330a58a15963ea92d55c3cc78

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\s_shared_multi_filetype.svg

MD5 d4dee3732a61ff24230e10a3467ddec0
SHA1 d40259d4dacd60b28fb085b531e19d9d07a50db0
SHA256 d4aa5a38506f7e0b146104a192bf96ad7afe4b1e587f3dd0285e2213c4f0dc29
SHA512 df9396bfbf61ba980710dc48a2934a9a696b715403d90718fca2fa793fd1f93b3996e9f7a430cc55a0aec7c741c3b25fa4b902a59b44a31864e2585c8d60a2ef

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\cloud_icon.png

MD5 fa044abeb0ccf5aee50c707f921b1de8
SHA1 442739c40fddc01ee2c142a35d4cfab49862c058
SHA256 b9f3cdd5106ed2a5a8db479692dbcd243c999d4076c33432c73075a2a6c8c840
SHA512 d0d96b1f8ca8071522114ebe9cd17dd5d07401dc7eb0c4c344ca17b0dfc8b81d0dcad0c98e013af719b2529d150f337017d7c7444731ff75b4347e9f0c96eadd

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\selection-actions.png

MD5 a59ceaa24e1b8500cb573a5a480f6cf3
SHA1 5785e48ad9ab92c12b76fa09ce30aeb30ce66408
SHA256 b1e176091b8ce93c556ab8dc1f4a63a9df3cf1aa70fa399904234d85d90ee8c7
SHA512 14dde8ba887effed413c8cc69327da4c7d06216e3bee7956e6b7d2127526ea80a7146ba0e76f0c10405d5a9bd7db39f0d3b83d4e7841ba056eaf3252e4691df4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\s_filetype_psd.svg.encrypted

MD5 1a24f1373bbcf6dc99d66fd80f8b753f
SHA1 e0cbeae9f0974ea12cbfd7bb11a39acbcc8ca7a0
SHA256 013c8caa5901e6532f6a5731af99ba65f8dfb47881a558e78acf5a2cfaa6616f
SHA512 7e9bf80c36152cee50c4f8d489145f997025a40f24e78ef4feba80e0de6d9e40b80af5b3948add1f3a2bc6356b0db5ce03f968debd603dd9f1d39683fdc0c475

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\s_filetype_xd.svg

MD5 ab85c085b3759bd3e3e4c11212b29924
SHA1 6d04055b71ac9a0d092a90e8e06f5be08868309c
SHA256 189aedf58f41962c3d7d068b1a58b81c06ffe1d6739641c91392fe43b959bffa
SHA512 5a12ca43410b06049c889af1ca9c7230bc585afc638f7ddeeb516886f9f4dff891895cc9184bf0362d111afb24d619e42b44db9fb531095010edfa17fcea8b10

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\remove.svg.encrypted

MD5 4a1c2bb8b934ae1d38708ce4c842e0ca
SHA1 efa87a6ba4459c8f509d7b19d0b904bd265bd298
SHA256 8da757315f92339077f3afff121dad9d90c8d0178bf7cb9499bf4438989d33ed
SHA512 14142b1403854cec656480b1f753263d1181bf23a6b6c44add8b5fa6475bdbec34e96d99a37f45857bbfc05cbf7fc4c296cde0e5507e7ad1602d64e50deca2ff

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

MD5 78c1b40cdc565acdcd11d281debc0ed2
SHA1 6b9a73195115755451da4fd845af54b7caf8e3fd
SHA256 a08147d12fa2f4e3713c1d503d94fd60dfb4046e185088ca47d516f464431dc1
SHA512 d14cdceec85347951320b6a3e43247ea302595ec8557bc8072433cfec7124c1fc4eba2ed043fff6370f8aeb386c18fcea3dd7b28da1a726fedade29ca1b799ea

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_backarrow_default.svg.encrypted

MD5 0a894e4eb857dcf52f4b8ef4afcd838f
SHA1 9470e4c46c5f5e6859f8e4c7f1b2321cf25b5727
SHA256 22550943879b7b817d03364ac7ae59eb05dc604d83a433d8e482fd6563dcc5e7
SHA512 6febe99530c80440f2f0ed6a9991a9d22b50c4736f1c22cdccb44d5989b733b68f171d930f62d37d71b2437e1e2db7118b1a66aff4a8ef89fbd03170f9348b44

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_comment_18.svg.encrypted

MD5 5822370158786ff0d0ca1dfb2fcd53f1
SHA1 69b20c96564cbb249ca9dc36e3ef07b7f5725f69
SHA256 33beee32c42c6fb9619e48caac235e6c6621998c42ac71bb261f967c6e87fce9
SHA512 1020628a243028fd76fdd1765ddba51e7aefa9bcf75e1fb64b7dbd94489a3518b5e5613d98cb4e384967ada3bcd6e3a8cc1f671ea030d9b44c27ccae571d26f6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_delete_18.svg.encrypted

MD5 5971b16673c605b148708847b4be0ef9
SHA1 0537240e92f8ca62e3071df8cf82a24e48afb8a6
SHA256 631e523f967e73d8f2ad4739d194c4bf1e08f0346c32796eff3ad45d8b72b141
SHA512 394e79442e5bade77029d0d713323172f560cd93f530e8aee730637ed0dd65fdf756b69bb374384b5477093525af63405429f8cb82174d86a176c6ad15736e25

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_editpdf_18.svg

MD5 7489965102169cf47782626677be3004
SHA1 475c0db97c715d1fab38535c155c640aac238988
SHA256 3286455ff5ce3687e860650ef397b2de3e18f3f0750a60b1691ff896706ce5e5
SHA512 cc6584f7ea2e8f6d7978e25ab4bdbe3b6e6bd72fd4f2cdf5b0d8700ea7fac08115ab895864b9a85e01e523971801de1833258d76453a3f038eed6d82a0dc8aa5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_download_18.svg

MD5 3f4db2e3d226dc649ada998023e5477c
SHA1 62fa3106b7d78489ba51413cfd615c1a4114bffa
SHA256 a8811ebe49e327f2551e4304719c6d092de749c503022dfbae66108db1e5a37a
SHA512 e8e4b13d4b6b9cade59e3463438b6e46115069f2535d8eef4be26d8c8897a62049a10980bf38cb430410589f449d005346f360f9474bc7df67a5aac2fd07f733

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_export_18.svg

MD5 8833ee3d4172c86845292ef875ce1a64
SHA1 4988028febae0762acb33ca17fdb561a3d49f88b
SHA256 b09535641bcd16ff39bf1c1828ebd5d9fad7e4120c473a0ae7e6c611ff1bfc32
SHA512 6927ca746ae675c6ee33b55f7e85000399ad8315471e8167517e5b4fc7d67e3e6c7d2cc5da4e83e0c5e431be0caf485dd5a912e9fc6043d3213749ffac92ca49

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_fillandsign_18.svg

MD5 a56ab1ce2760119e557b02cf678cdb0e
SHA1 54fd0d8f44fde2dd3273f7a22761f848b6c5ff19
SHA256 6889826089280f70eec6755a137defa6d34fb828c9e6be1c13bbe258a984172f
SHA512 59ce19193063634e091c63929e028b73d1b77b454ae1cfa490931453377449d546fc52e2536f7b694c0b9e6433fd084906179ba426fbcffce802cea64c885fc3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_folder-hover_32.svg

MD5 803346961bd3da5f9607921f74ece629
SHA1 d809603dcd1db46d5a12a669a9eaf266fe457b89
SHA256 0c899988f4b20e3049a5782ff5a1d29041fae452288a48c7dc058a47f6fdf26f
SHA512 55fe8ade5657d8895f2256e12e3311e7ea411a51ea4fec1f17be194b7c0b1c689aa514311b4cfdaa0aaee82f2396697ab9af42190d7d23e549b493592fdb9b59

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_move_18.svg

MD5 69513453b60fe4ced773ff7ca4ccde5e
SHA1 3223f3c79d27799a2714dda05efd16d38d5b096e
SHA256 d84e514171e786c9bb25d2effbf0de412eef35953aa3ff9932a428d36ce50315
SHA512 c3c001849b3964bd11871e84b3c02cdb8584e8909134dc2217c581c350f4e3fdc48c6cda1b892d8547cc5d09a11f1b922ae385ade26bd382643101c4a96b231b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_nextarrow_default.svg

MD5 e37e1348ae57f17e810bce5e16a60ce5
SHA1 dd6d2bb762216a0df9a3aeaa494d9f1a1db3239a
SHA256 766e107dd31fce67ed071d3217f6d58fc02eaa734e2a8b7a5d39cb26685fbf36
SHA512 cd7348815d1cced6480ec37a1c00da6d82f1fb2265aed5078a2a69ee3d0c43223fa2f106078387356309c1756595f8aa6b48a531447d0559d3c4d9beaff9fe2f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_newfolder-default.svg

MD5 cc733ed1ba88efe151358d5a4b0a0696
SHA1 12328ab2f8135b51e3d891d7da069c28ff0d1e6d
SHA256 dad0b65336ce5ce688412065f24ab27a3bbbeb8a90270da1d36d323e0fdc55bf
SHA512 75d2ef3c7d18499244482e4af89d9fcaa2ec368da899ef5b63b2ece246bf01b2c81e1fc172c1dfc05cc593de073ae6926943c4b3ef436c7e6b3ea394f851ee2b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_organize_18.svg

MD5 8d59cd9dec29a1f82f618439bcd98c6a
SHA1 5cfe164bdbcae8e2ccb4e7eb6b5e74c66647e933
SHA256 bf322e905bcc2bea61614c2ea4228dc376a4a0d18a0af3d5b39e198e23350c0e
SHA512 329adeca45f22ee020cae6ce6163ee6386700b6d9f79c878fbf9d73ba89015ac1d85b98efed25f7fb6070130911f227344b7cfdfc2510004371f343c58ecdebe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_remove_18.svg

MD5 0268244742cfec4aaf48031dd46c6518
SHA1 68b252f89b58e13923231478bcd91709ce70918c
SHA256 b9b50debd624ca77ddf8d72447b55c571c0280cd3042fec0c09e32310206418e
SHA512 6351a965bded7c39ee4f36ffb75bc9b3bf02838dd86b023e5daf8fd74963b7e59c542f6f64ef5080ab0c2622c0d99ca8f597bdeb4c87a2c1d8fe19e669f2627b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_rename_18.svg

MD5 d89248277117c32538940d83b9f6551e
SHA1 ab8e4eeca3670a93eea8a29d343c8c840feaa1d3
SHA256 9cf581c4ecd781c4d1e1cacee5219d90ee62930f03970472efbc0a4853f174fd
SHA512 2b24ad5affd33a9950f031fa92c474d0b25a330317ddbea6d784a92c5c83beb75404216ea45dc31ee735259b42e0dafcc6ba33d25afbe71ffdf22034bf3cc07c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_sendforsignature_18.svg

MD5 38388536d898d70f9f3feb82d845ec8e
SHA1 58b5530fed0c83e62c36b16293433e57246f59d4
SHA256 21285e4b4c88a5cf9902ac917faffa3e3a31814d80888c0ddced5e0f60c3b64f
SHA512 3132a7c47ac06568f68d18baf0a2e802f9d6942696b40259c59a864f6d0f187ff1ce719934a320dc0f4843e472f740a09558fbb2e8463f5c6191743f34af6f8b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_share_18.svg.encrypted

MD5 7f88a2f76afcb78b882f104d6de6b143
SHA1 cb1a6594b086d9090cb83bb2a1ccc3e471e3cab4
SHA256 c66d1eefb528c85cdaea563cff16afe6aa5a8ef475ab3aa5b3f57d1cdfe4c555
SHA512 022bdb06d6ff208bfc5c3fe665ad29843a8c49cc43758ba79a670653277df3451fcc1267bbd48df115216e45acb2becd8744f5d9f847219d8cdec0c658796c2a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_sortedby_selected_18.svg

MD5 eaefba0f982ea0497c0ce42f9f9b0090
SHA1 ca305b9487a835bf3f2ff25a4497eb5889e9ef26
SHA256 1f63d9e4f03669f99eda81152e56dc77b96120c660e702bf0be6a0fe1108aa25
SHA512 d064eb2a2a8efbbfb01e8bac0c6ab1a52f58e862d6c30ae9cc4906d794ce2a5c380b97010939a76156325fde8abbf020a854ec114f8eb3ad229f79a1e1a9fbb8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_sortedby_up_selected_18.svg

MD5 cc22c708908ba2356e5a3db68f285fbe
SHA1 15899dff13a3e5753756c1758c2cf1d385e59f38
SHA256 aa02136a5d79345187ccd54810fb495665ef7430ad4cc9bb73531607c323499d
SHA512 6f67f491725586a4124197ca7186bfda4c7033cd1cb4033d0dc94e2d67fbab6b85ac9de8f394305751d83f01346bbfd9ef417deb5c4b8b75a45bbec2bfabfa27

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\A12_Spinner.gif

MD5 baa131404cdc2d4eeaac3686831c415a
SHA1 e11799fab729e6343fa2ba5333f63debde8793fe
SHA256 cb07c346b2959b8bc81fbeb5ed4d062c4cd5311e8771e1a4b76f7b363a116330
SHA512 208d2c50904bf5c8a4c483a2e8954236d1428082a4a4f599b1285a7726d9cd73d40af17db06d828746d363c96c6042ab0917fd9a78d8ef106953e09c8e9c0235

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\A12_Spinner_2x.gif

MD5 314688b322db110152daa94d261174a6
SHA1 88af798577356458db86c947d3b0ac5062fa05fe
SHA256 3908e18f66473e399e524464764b24c1f43a44fe1f8299a9cb6e09346e1ed819
SHA512 6e815606bcd1e94d3becdeb1355031de74d97879301cdd983dff61a92caad3ef054235689e3a06525cd82f855ddd1b1be61735f84072f52c1059ac15eec3214e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\A12_Spinner_int.gif

MD5 b43253fef5d335d3e7bf433499968584
SHA1 5d28c4def133e47c281123c91f49cc4f2ce51f22
SHA256 fc20ae4a9e10724b5db85d781142d6090228d0dd8f21df8a297fe33c59baa4db
SHA512 557a3492ea4e74ab7b5aa41b7f213c028f4c40980a49ecd61022703aabd0791dc1a657a8a3cd0562d88f79fb62d876f755e2c9c9207d0273e72f8726c53b3e7f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\A12_Spinner_int_2x.gif

MD5 2026cda08402e7119ec3dade9e712cda
SHA1 1f87b86c2c3d3a7343a5bb79ef11aed3db05c05c
SHA256 49ab6b5ce7403ecd3da14b78b0f88822ddb59e100aae33f9727e514817795f56
SHA512 84a176a5a1d2efc915ad91eb4fdc4198f0617995ebbd8f36b6f157d6855152daa03ae91741ec0943f81aaf8baff9d90d99b07ea0de6bce62aca160673792fcfc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\acrobat_parcel_generic_32.svg

MD5 5fc304e63238c4fbd009d3eeea0996b7
SHA1 b39cf1512452c895b6dc3f9468a6575358e49db0
SHA256 7189a404c51ccb016513e2f3120d9db529ff00a8b72e5f1c13408418f69e43af
SHA512 7e7f4dd83686188130e8f57b76385a20885999ea93e3a6d75d16da552ebfe310d30ec04a48a1ba00a7fd2741efd757abf68d5b2044cd36016e96597432886c4e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\adc_logo.png.encrypted

MD5 1821a2f2ae8d01185fe0dc31fd164b93
SHA1 a69d9ecab262d7f688aeee89359c77554d7e0a19
SHA256 d9491947911176c3d267dccef9313a16fbcde7f52c621b5bc8094fb19b59f074
SHA512 17e556fa1c62f2b7ceba0598349c633b082ab7e91bf5bd55b9b342344274c034c23a1f724ccbe8d7e45d1762e1c299edab113d64b9b4a52d9068205d1286ace1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\adobe_spinner.gif

MD5 d6783f47ee6af3bfdf7ea91620f72847
SHA1 f60ee262a81c8f3f9f0538890d5903149d1cd47b
SHA256 94f88480046daeabc48b2095bd6153b7219f186c25cb675b72ba62a93b88fc12
SHA512 0dd1f11fc2319f20584bdcfff9fe092f76e75e4770744266159ec8bec9a2ce49f736c4236d13a6e20bb5c909274537ccaf6622332c683625aa6ba3e3e9f70692

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\apple-touch-icon-114x114-precomposed.png

MD5 e4ae2ee369695c54c6a03db92ef29c77
SHA1 b2a4dc34f24d8d9ba561be778f322d1f46503c29
SHA256 f91284bde60dbe4265401c0de9fca3744b7dd72c35ea1b63f6e16127c9715c31
SHA512 0e4dd34fabc417b9977b23a689ca84fc1c9e7b0598c32142b433c244a79ff2944642c529b1c2cd59f14e7aaeca8f1fce4915f9655d53c0f4b11876395865311f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\adobe_spinner_mini.gif

MD5 460a75c33c2d255388320b588897fc5c
SHA1 52998df79ea2c67687e675eff70375cd5b3ab807
SHA256 fb566973824113fbcb5431e644a30b6f2aae246ec3d6c1fbf2e8cfccb2c9dcad
SHA512 2f76afff31893bfefa27fba44ec85f2b52629af70ec68b28307f578602e78187d8b4066284bf2a0d2eea518aae73802f7b3b24c0edaf75f308056e5b4bcb85f6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\apple-touch-icon-144x144-precomposed.png

MD5 44f1d32f17dfd90909a7a6c92a67948d
SHA1 0e484cd7c2c5e8f0fa1d1a98baf8d058de7333b5
SHA256 55ef2a9cd18b5eecd69dbbe8d5990f1254e489832f8b7df4d28069ba2ba61f42
SHA512 8c9ca12117b3f5ecf0576ae5ffbba76adab3c3d3deaceba766b398de6563cf766cf1b39bcbcf2ef27c9e5779ed858d2e424683e6619286a7fbbf4aef1ea776f4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\apple-touch-icon-57x57-precomposed.png

MD5 999c6371f9cecaee2eff574d537064b3
SHA1 9020afab0acb3568ca8747a684ce31b133a275a7
SHA256 a60e4ab4d83037f19ed55fb78470e926bb3772f694932f3be4964ad2a5b1fc4b
SHA512 04c220497f7a864818dadb645b98f94a980c1080bc2a5bfb55f50d2b326fcd2d8796a31da0ebcecaf6c8deec50bc72df7627c1e0650e4864c33c95104e87cf21

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\apple-touch-icon-72x72-precomposed.png

MD5 fa85c99e41a03c88a7ca6a5b95b8a489
SHA1 94e8501404edf3fcdbc87cfc81229ffc3dddf2f9
SHA256 3488939f88df64d25a9ad4b10d529db5067a7f97ea7305b292748a223de64f31
SHA512 7493f40c8eed85524c98b92c557191a2603b05abd087382a8651ab026971d9ebfc749160c65c656be724164b6b3e3c5c4fc7f282201e0430c807e49ecccb8312

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\ccloud_retina.png

MD5 b550d1d8c6fdc93bbe56d53001de8b5a
SHA1 5a776a6d10dc84986d850ce94fcf3761b82ef423
SHA256 4d5579d6cdb42102db46c3bc92ce249b73b637a6e24385b152a298587d108c21
SHA512 245e4918ac8aa137fd189acbd460c2cc8a5e0ad1218fab3ed5a1fb0e22c8abb8b5340ad8855f164cb549be2fac37b1108b6097bbc6204ccab2b21cb0e2db7da5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\createpdf.svg.encrypted

MD5 48527f32d5c943cb585b5f1273a45448
SHA1 18c8b2a33236af50413e34af37aeae693f0d419e
SHA256 06cb8207833a7df47190a07b7c2d2b56a5ee9cc3334ef9740b0e073f15a243b4
SHA512 4d31ce0e15aa881dfe2e9e44142d77cbb9ba5cda5a72012eaf8462e077c7b9ef509ac2dac551f5c1fbadb64a7bc81583d3329ef9734dbd6cc9fb8e2d3ba7287a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\dd_arrow_small.png

MD5 83bc0d01a993686a28966976987b3d69
SHA1 edb04122a53c02fb906cd11c8898dcbfe998a356
SHA256 04d8ca3a927306629ad76e9b9dca3972adbd0c5eb6c96508f724e34c9d18f671
SHA512 3bd45f139e22708c9cb85d4b246abd23d55c4c2cb41f3f19fa1e39423ddfcaadcc2a5c294da6dfa64924b249fed7e8960d3424e33b89f50ff460f76f3b8b8a67

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\illustrations.png

MD5 1c2da2c613f20dba7229fcfa38f9fdaa
SHA1 8b94e69a8a880a1cc3179bafe6d49a0189f3d034
SHA256 6f79c3459014b5b41c1d02564d0e6ac1fe75032592e6f54179c530334d5d54c4
SHA512 d5c45029851476d13404696fcd0d4848019932312059743e421d33446deccb26709eea80b9ef9f6cc49cdda95d4a59f682faa3a1f1ad0dde9e8912027311fa6c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\favicon.ico.encrypted

MD5 7b2c206e6d34a338dbf50f2c30e81a75
SHA1 d32b1e81575abf7378470a01b26218e84a3b629f
SHA256 3e0cf21d518613a701392835f2d434c73405f4c40ff2ba39e2d547986e788213
SHA512 b578f8324032c3fbcc425469a6537dde857f36adf6b4b1440d713ba219c417c8a7bf77fe2d64231fb86fa0e97cccc8fefbcecf766f8fd0045f653c8f42a26b6d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\illustrations_retina.png

MD5 8ecf6f147ab385ad33204e66487f27d4
SHA1 552acb5fde08b8bce19c6f84bf2ff826a8d513e4
SHA256 4f0bd1b734e722da24c11226047b10aaadf753675d6f11f18b8d2b5854f90e64
SHA512 a698242b3ea07e4980c71a652671bab9374737d4ea56242ce355e7efd04cc821b94b795d1b59e01ebd19ed891c32a659ffd7795ccd8e8fed3b43792a8395e3b6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\ind_prog.gif.encrypted

MD5 574d2fb55d11d701dd1f2e718e18324e
SHA1 5140b47aabb99a60fe496a280f1a9060466c5300
SHA256 6ae21ed4ebc0818ccf2d9944a353f92373e51483df56afe301259dc5d9a40cdc
SHA512 73c13e828ccc377395962a93b9c793b96fb59b67bc97f7156d94ca00676f0267039f9558a81307c226ebc84d01b88631b683f6cef291d514b0713a00fbbdc777

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\japanese_over.png

MD5 6a6d6b7287a971019cfda75bdad0be22
SHA1 264653806d388c79938909c3bb6dbb9d1f4079d8
SHA256 ca4bc5503789bc5d585cdcbe1d66bad3bf90da1bc639bd2553e9d6f66fb6861d
SHA512 3c616bdf41cc2c155e0016cbf955a914fd37020b13bda0d9c6c0d8b6446db0dcff3d2e4e2b5de27a3106ae024dcad55d4e997b7f8c32914199e47b3f3e89e033

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\large_trefoil.png

MD5 86955665dc9067caafcba3d333263f69
SHA1 f859bd2b7afd90e5f9b858be5ee96e36f05f65a5
SHA256 4f58cf04e6d33a510c2d9ecfdfe8576c9b1edfdd69274cae615def933efb5760
SHA512 8281d94c71f010ca1cefd75db19b9f15e87ffebac86847cf2bad166dc0f9d4a21a816d8dcc6a3287e51a56d2889b685cabb5b06858c338a0ccd92b1cefccf7e0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\logo_retina.png

MD5 c01b850e68d9cb09cbbefeed3bebd781
SHA1 48901be2d81c6e89ad19b1712fd88b7912640a8f
SHA256 6820f5f78e114de4f6ac68987849c14ac74e497cf51d46480b76f933a2353277
SHA512 5a9c4dcaab8069fac964dbc8322f1e0fa83229eb607cbb241e69e7a1c13b16a02aa84c0114b524debeaae4ad61da014160564ee1947f997bd469ba3dcbc7253a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\large_trefoil_2x.png.encrypted

MD5 604dbc34804a23895cdb1c3aa4b070d3
SHA1 06573ab3a700bfb1c8a537ce9ba7ffbceaec146a
SHA256 f8e6e53b2ead02d98517f351643a709d9c448f3ad3da4815094411b61dfb7f45
SHA512 7c8274c489c7f5781beba7c8893a7989a5e6c0361e632278cd48fafd1572269f3e587f89958e865bf67c78355d1c382013c217b47ed5e49dadc3a54acded90b8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress-indeterminate.gif

MD5 18492c180279429fbf68c1302c3ec4f9
SHA1 09ead05f1724d35ca90bcdaf2add7505130b783d
SHA256 bdc7067c462c00ca47d148ca2a25849b137491036bc799304bbf0ce81e4590df
SHA512 2dbb5d3e649659b53d5fa4aefc55323793dceda6124475ed79e18adfdc865303254ab3a3112a175111118de63907c087cfb0102a58eebfd12387ab52d37f9dd3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress_spinner2x.gif

MD5 c4eaa726050ce2ba0960f5211769673d
SHA1 09374e99773e47ea4fa16c9e4adf7cfbbe74c463
SHA256 c66a6b21dd3aa584ff17f6232d00705ee4083c370198b5d2362bafbdca38c79f
SHA512 a0863961af7cf04f8290338857299d78e4d2edc43932eef9ac5c65bace2792dabad3fee095d7a668046b11ddb740d75ae7b8e370f20f9fde6ae222e048b65bcf

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress_spinner.gif

MD5 4564f088a247d69659e4e67833c266b3
SHA1 339d13949d55d20319ee8b718c132fc670b6dcdb
SHA256 f90acfae552dd28c429d3220ebc15ccf103093e87fc852344555aeeea6f38922
SHA512 83853d07fe17707f86c174bb73f8575d2d50d745a3e00d2c9eac2402cb9c798119e3654da474ca0fdd08412e2f7bd0aef98418b0704914476476d336e1eeb913

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\RHP_icons.png

MD5 6ebbc15d6000b479134e36df28cb9f3d
SHA1 751a00918f53d6635c7912825d64d609881740f8
SHA256 c0d1427ec67eb0828407b4736f19c4009052a35d2645adcb7ef6bef71d690d69
SHA512 1b97b03ddd690942ba8eb694921ecfff65a3f86492afed22abb129cbf01d26c3789a5d1397ead5b5d70b1ce6b3121ab34b85926881cb1a2508aec6ffcb5324e8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\RHP_icons_2x.png

MD5 f12e3f8604197e5629240b21a8f51b10
SHA1 dba8cdffb2180dc67b5d90716875d73ed55ac81a
SHA256 e4596f12c7a7e5fa7b6d98d69a1e3c2fefee5729f070b4e38c0cfaa3e0730116
SHA512 063d4f313f4076f9417adf1a2b48038641359a2c42d57271295cd43f9b2bf43f952999713723e16fbd30db924271a6a3c9e3be23697ee55d099f5f7123795a70

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress_spinner_dark2x.gif

MD5 a65952ddf77b76148c6a40e40c2bdc3c
SHA1 6e0436126f2c30c7fe94e63a666b903913bf81c2
SHA256 1397d5dbdddf0a537aa545d9e40beb0794321ef38429ab365b4a7fcbd8c67e68
SHA512 bd8bee04303d72d2928bea0dbd067e88346654c5227a20c2dbacd577e511e895d3fff545ddb21d9e7f89e8a19f0a57c24d7ce90feedcf9c417d84e81fe719cc9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress_spinner_dark.gif.encrypted

MD5 2a988b7534a089e107e38f4f2498a4c7
SHA1 48e7ef20c1f16f989c3929b6f4d46cfe6734da6c
SHA256 2495adf82005bf3ce390e58e246ed91ce223dd7e52d75d9b58c4ce5646e42005
SHA512 eee3536a3009219b04d9c828a1b030d457067143a35a1722e070574e33d5ac33babdb7b00b5fb2c0cc5520bc2c6fe372436e972111dafd26e9f6951ee935d079

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\spectrum_spinner.svg

MD5 2f0de9f71d14b1d72fe2ac2671b65450
SHA1 87b19785fc254c540ee6815c39d1790793f416a4
SHA256 2ef15bea15821b12a3db94c12e6efac572dc3731d8979d5b859692878e20a293
SHA512 998be5ae0de7e4e2fc714a6ac715b549683fc304bed546d0cbba8f8bae3785900ab5c1cd0690677e423b23dade58267de2f77a1e835e677e8c8ea45719bd5f6f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\spectrum_spinner_process.svg

MD5 8ed29a61f7e38fa04d236a8dc6bfdf0a
SHA1 94263ffcbac8e387bd3b7201dc5716bdb1fdcab5
SHA256 5763028821a443fce7b345fb9090e1f066e39be2bc318ce019e443eaf472690a
SHA512 202dab2624110e0eb2b98fbf84dbb37245b04acbfcc0ed7bbeee538fe2f8b0346e0e251c9b4c685a5d93a1dc32b1d9d5bfdfad4844ecc923f3a487a3fdafe241

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\svgCheckboxSelected.svg

MD5 99a2c4725eebd4334fa963e02ce73cae
SHA1 ec7a03656140f20a26604acf2673ae5ccfeff0a8
SHA256 d3cb42dd6420bba7542afb26b9ef4e0569e45cf6ec6a64695c4b59fe60264307
SHA512 9be28bad16b0eb35b78dff62043c29debd6159555c58c5b0b79c5b284299e6ad7ed858b48f547621d939424ee181f95067f58e7f9031ba6cc9aeb2b782324149

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\svgCheckboxUnselected.svg

MD5 e905b9efa68b7170deade44e54d67e80
SHA1 03c24309aeba9938159eddb05541b4626b18749c
SHA256 ca7deabe782d9f57a75fdc494329b2f045af666590f6773f3f57c123d0dd50ec
SHA512 731f8016a97380c90c34653d732b94284b6b44df8bf94e3de81e3468904a3a293cc607cb83e5ba3a3adad99e3045a3da2958c4dbef88fb4b4bc33b94294bb341

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_anonymoususer_24.svg

MD5 e8fc6a49f8428cc8f7f1fb0863a75ac2
SHA1 77c2f375795688ffa7d5a34958dfa93a230de1ce
SHA256 68472728e1b0c5d693e0ca3af999359be7d01c954a9f4cefc6a3f4af470945d4
SHA512 f23c4ab638605ed81cc3660a87e40729568001fb41e171e9b67691581c99a8eae1b1fe39d851205c28629408371e3ba2a40b104a836a942ecd8ab30012e434ca

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_auditreport_18.svg.encrypted

MD5 c3c76f650bf27a82aeb1124ac4c32c78
SHA1 cb9287d6dc1cd198b8d913d8dd51efd1a19468b9
SHA256 5c70f14b0fd7994c0cc69f24ed72ec65d1f31808f4a99e19ca3edfe405c59a89
SHA512 6e6bd7b72f5a9b103bfb150edf3ee49f7ca6389a4f7d16ea7a0d90baec9fb31870f9c5b7f519a06df91f6850c6ccaa69349e9607e9c0346b95bbd2c3b6a6e6c3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_checkbox_unselected_18.svg

MD5 567c9806f6915106f3c77991b8aaea96
SHA1 0bfaa54ff7e9e30484d1294b5e5bad90e7479906
SHA256 92a91b7232aa774e8ab204508e53ae8b7d3731b47b1d7a1547ca73062a8a5f6b
SHA512 7166902c2995b3de310ff8e4e9ee09626ab46857c1861cb40e6310e3adbbb5e2b0b31b51177101966873fa11e4514bf39d8a9ddfd99a08604804d4d2fb07b107

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_delete_18.svg

MD5 dc784439efaad1f297266e19faae7bc6
SHA1 9ead00545a1f954a8c441f3ef6495b85dda70c96
SHA256 f31f4947cacb981983939ee87ecd08615863e960c0fd96bed923fcc395396dd2
SHA512 6268a7970e88b3c3e411939be67b21116bf29170c766efa266e92b8cc375124f670f5ceb38eab9ad5fa760039c8227ffefe96155d24344e51c1dfdd6a301f060

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_download_audit_report_18.svg

MD5 3fdbc3dbe55250de754cb1325fd47103
SHA1 9560bb7abbbed8182ec72923558ceec6e8158d7d
SHA256 27fa1e347c0a5420cfc6c2792729deb83379552e096e6066b7313bf1b523d73f
SHA512 97e650e08874d10781ae61f5abd19d365b374925480a1a4a53d91022ee6c56a5862f3c6bf2b2a813597740d9e1822981f7df08226a03f79d4fb87b1bbe26654f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_download_18.svg

MD5 1be5cbfff30fde76798bfe79aea65ce7
SHA1 cd1221753fe8f32905ac09962a92746588e9c542
SHA256 1f844c19a4c5452c179ac230269eddf0d6904c418c400cf05f97ccb8bb14d2dc
SHA512 a43d7b849b5d9cbc3148446961f1fc230e04d12864813665c128a5dc6c8e72b25ea6bb3c439621efb7d49d99b60a65252b1a1b4fd319013498b2e831ce98700b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_download_pdf_18.svg

MD5 c7459756fc79cdcae2cc147ac58eb776
SHA1 3212431066ea18641d9aeb38399ae3084d63effa
SHA256 5669f6dfdf3d325552d9017f6334ab95aee23ac420644960ee48f4212e51a3fb
SHA512 ed6b15c20a73f96768afb9b46e50cb56b84112b42b797b960080cb7bc324514f765239e57e9a3754c09b6f715c22f8c393f6b9d86882e63f8ed3483239178bf5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_duplicate_18.svg

MD5 115dbcf3d3180261385e28fec3b23410
SHA1 a657d222e9439082f2dd8caa2c8c6bb88c167233
SHA256 bcfa0b66cd21df24562212f4a07f65a90e0305371585fd16dc566ea3fc19ad41
SHA512 8b064ec1124afef05baa966f110d5507007b48893c34189e92582882c601940051ed789631652f3fdf2d105fa128aa8c54c6e40c06e525d2fc30ddb788eb336b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_ellipses.svg

MD5 943a856d5eb8030447978a792e965a5e
SHA1 e687d609f47b750b4cb4aa0558c03ebbde876c07
SHA256 370dc6f0ea4b3d38004d7cff17fe35718b72d7c3191b969ffc109d31bde83c7c
SHA512 87e1336b1c719a384e4bd3ae57f23205e37cd04a5201b5fbac2af92870ffbbe762d3ffd7b01040ead187c16361483b68a3f080acbbdec0818fc01921884a7bf5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filter-disabled_32.svg

MD5 cb7501593618c773823584e4d2253699
SHA1 351227b3099d044b231b083e37c63190e67963a9
SHA256 13e6651bce5d0a5526c0f10eb90397b260e23ae946e447ad09fb558778ae2d30
SHA512 deb9369f6c6e6cf7307e1c28e0997dbc8037c6f95ce8034de46d755e102455c3d9a5198ccef6976509e625b4d0550f1b56542835180d2b8b4dbcf3d9faa601dc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_forward_18.svg

MD5 3cc3b78a4baf281b180159d8a6065a49
SHA1 4cb0669fa83a27d5ceccefc30fb2652551793147
SHA256 89429b44245ffb60e00c89f313b24f80acf65407788d92de77d67e04a5986ceb
SHA512 9b0d6ae9e48c946db4b4fdacee6602c0b34139eed3dff6c46cc27ae71f7b511b3473fc44b3cdf5e2ae2663383d440c0923cb19ac5a0e310834ada94ad349c754

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_history_18.svg

MD5 feb02387a92aac5c15db302bad94da63
SHA1 0c2beaa7464e5ba4a7384481ee9d98e0a62be080
SHA256 6d18b82983ea9f3f4cd6f52c07e0648814d6b87557a864ce9cd4c7d386fe68d6
SHA512 b560f223b1801152132cc462082cd031641f80a005b9272e0f1d5b5fd22b36091334f6fd900c529b587b763eebc2ef742af138d1b3cd678b117b85e02bd70360

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_invite_24.svg.encrypted

MD5 42a9a81e02bc25db14d4e79f73b05fd4
SHA1 088b31ae03935de146624586f6a2ad33ebea175b
SHA256 c5bb4f6b72812ad5224a56c0cd98674d25cba7b612140f81e1b4b38687e9069b
SHA512 748edfc6888669cd7e76ffdceb65de2fddd13ac76e66c30b8cefe6ee046fdbb3ee0f3e5aed25c0b67fe38232c540aeae4d221f704a841cea784eed738ed1d693

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_newfolder_dark_18.svg

MD5 45c613f9f0f2086fddefc53f3ffff3a4
SHA1 41f79f07bcc4c2c1081e21bdc84de28462492249
SHA256 c4ae35f5456727bce8abee0e99e0205beeb1741860aeca93ba5de48ccd95353a
SHA512 6c907849ab003a75adfeabf8d3c71ce867b01f8ba6476668d636e4ebd44882d8094f26e92072a95f290daae4091486212d625f39aced68c7e0178f7f40b1832d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_nothumbnail_34.svg

MD5 3fc7056286500d287c2068ed3850c2f8
SHA1 c2f91574671d1a689c24aed889bd89b83f2b88c9
SHA256 3d2858f4e457d74d9c8f3cbdbacf080d6324b922ceafef641f40eec55c129f21
SHA512 ad1c4c51ba912b937b38f94a767a3c49355d5955b5db8e2f867bc03c4e3d183f6217107f71dd1e2e3e479e55607b13200dd83b99303e7ae471a22a0bc9bdbd1e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_opencarat_18.svg

MD5 b5892faf712e75a42e2bfc22228dde82
SHA1 74fc29aa4ea2c5c93bd09d9c03d3d30098a73e89
SHA256 27b7cb809fcdc1043ec2d2b1dc67ec3ed6ec58058e27d3497f954f2cff80b368
SHA512 b6f8e2a960345e971ba78d46fe8d96e09b9443f2e1d5a7646299c7127501d363a8a1b5e3ddb943d55472b99bb51dbd4c8fc900cf05a2bca1793e84a5e979284f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_replace_signer_18.svg

MD5 4d915912dda3d1864052d46a24e9808a
SHA1 b645dce055e4a8a26ffbbd52b8e0d2dd3b4ae523
SHA256 6a2f2b5ebb840c486ec98c4e0d20f2c633b6f4dd98b5a139fe2bfed8b8efa263
SHA512 3493dd69924313e79dc9b3b80a9a6dfb3f858c9c8e6ba6c043054cf4bcaebdf059a10feaa0704ef36b9988dd061e291aa6813f60f141c45e0f2dd5582a5f0e06

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sendforcomments_18.svg.encrypted

MD5 5942bebb17a0838fe5337c1e1e015e76
SHA1 23e5f1cbfa42cdd2800ea5c7702aec227970ffd6
SHA256 ad69895f38d09707520975a274dd00044b17439d538bccef756f0366b8eac875
SHA512 be98960dd5bee669b80033b8737a4f0e432e59c2f247727f56e9039f3313f7fdd928a6e26611e93ad4114369c03eacdcb8f0f76a9561c46e1ebc1ff08ff994c2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sortedby_selected_18.svg.encrypted

MD5 3a1fa33246fd4373a9014f6aa6d6ca15
SHA1 4d773ec692eab715786a995791335baeed4c046d
SHA256 449495a23ceddcc0fb3abd9acf309666af71dbc1578bd58d32546d28d0eed946
SHA512 454f827f379fd2b6a5a45b7dd7517ed26e52b075a1974f64381fb92b597be8053f898239945f2af91ffc0948ac21c6d6da1b2f77598f6b7e88a753c510b6d395

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sortedby_up_selected_18.svg

MD5 6e742978656a78fd8da5ddf323689b51
SHA1 c08de94d1165232381c122844f9b06d03dbb5829
SHA256 2e411035b4c3cf13d64ef46bda1619de5adf843d432e70aebcb8176972dd5160
SHA512 df6a32081bc80829ea4922427c736de097f41d993e375c74825d904802a36e9ff65db9385c0ea60a8fc54505c55933254e6b3b19dc6b27f0c74fe4836465a744

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\Toast.svg.encrypted

MD5 b98c8498699fe5ecdcd66baf6862df81
SHA1 dd5dce87a8a6de81224888825edb874a1c7578e8
SHA256 f5ec4bb2da9351bafea4314420804610d8ef6babe9ae5867050a2619f6f1e9aa
SHA512 b62f2c9483779421b22d8915423e1d1f887d626c12e57e36aeda0d9bcbff8fbd9a2ed785c3df198fd2cd6f3be4c78da86272af5a4bd0e364bf1e9c6ed1987453

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\virgo-new-folder.svg

MD5 3bbfe612b6a1952a5c5f2d48ed616ff9
SHA1 bd91e7aacb3a02504761ebbab8a7dc241d548287
SHA256 f52f480067507537f8298f2ed50f76669a3a09b68404e2fb43b18ef16a7c26d6
SHA512 b3c1435981852ecdf018ba9075d3af73e548dba88d5cafe3c2954391ed2887266858992186eec251930b88acd873dfc11d3bf365e85aa785ae26bffabe4ef212

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\arrow-down.png

MD5 9b19bf063c0456fe5eefc77060ad74ac
SHA1 132158be2c4efc49a405caee6dd52559019bb10f
SHA256 b8d76dd8cb30b87176e78a6e795f5ee93004a0ba644962c5a124deb03c4a92ba
SHA512 03c44e440f9bffd78a797984dde8b317c11ff111d2a7991a6e9da58fa922185e5b564223b119f73ac057e96bf0cadc5144a16bf49e3c39dc82bc353164c99e5e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\arrow-left.png

MD5 011b702e314d742c7a1031afb1c2de53
SHA1 316721680d29ac4ebb9dbe0cd589ade5a92b0632
SHA256 0762f5909354489ea0f2b83ffc926953c5aa752cec8b6470af98ba8f3d49a6f3
SHA512 2a6b4dd0a2b5f28289734c861db069caa437e24249f9c927cc8c1291a8b4bf19a533d38454690557e12432800dae35c0d6ca40b8ec00d38d5ebc1853842fa79a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\arrow-up.png

MD5 4ac6b0be5991f16d6bdce1dc292d8cf1
SHA1 2e9a313dc559dde6808f522e61f5d6ead7a520d8
SHA256 480049a19a8e4935fa47a1742a3fe5d0c572c161de144f94b16f9de89e114c12
SHA512 b90ce84c9e327709d56fc3dbc63c4d26b0db1835e2759f4fb3725a4a84cf3ddabb00c781e04954ecc1b037bce2813002c86373f5868fa0673ebed50094008f28

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\vscroll-thumb.png

MD5 a90a2e10cc48bf52fb1b91c2021b3450
SHA1 fa256bd6918b69c671a592b7551338d0c12257ff
SHA256 b2c4b00254cc433e8827f7c26a33cfd5847e583c43d7c19b3aaaf29ae686cc7b
SHA512 80369f11a833a519d7b8584a876f57bc5eb44f8487c108e41bda66b43a8f36ffde0549a09e654ce93aa983c85d6438fb508fbe9b3fcdc8c51d71af2c4aeaaeec

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\arrow-right.png

MD5 c70ccd471310238a039dcc338416fe39
SHA1 c580ccd6980472e6067697ccc94de670b8562d93
SHA256 59c6d43c9aa5027603ec8021f68fdc9373dfb5a9b71168a6a2f18de63d6377bb
SHA512 edc466c83dbecfd176ad63aaf7cd9788529d1bfff4802bec5affe346a175d719f51e617672a7bfc5897d6842773251d867a209876209a08e0a5ffd5e6983bb28

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\hscroll-thumb.png

MD5 a9484b21fb28f78e61ccbaef24daa29e
SHA1 54967a51c32574ee81c6cce783266351c01d1f15
SHA256 fa701765c6ee6045df79826f2b8a4ac499118543f64096c45ddb56c102b4921c
SHA512 3746d75cae8712c25ad1942c85361965daab3464f00eafcc39f6dc6ffcdfee4cd60e943b420aaa1f428ea0bc95034305c0e91c21957066db26a84064a3f517a0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-down-pressed.gif

MD5 4215df30c5252debb7be5cff2a927a97
SHA1 8b54fe57477db0ddffe0c47ae28597c012c7ce2a
SHA256 7c294852adf860d4075690f5c44e7e286f16eca4800fcdb7340e0af15af04a38
SHA512 0291771aa8da09b63c49fa2a30da85e082811836f10afa6e59ee5344d09f1af7b7cf013baf75af769d6f126dfa470b403e61621ebcc00126c26b2c22af8dbbb9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-up.gif

MD5 835b55ab30e104e92715483961c9ab77
SHA1 ed3094874a7438fb8dd08e5d5f9ccc85cd544ab4
SHA256 72a17ae7141968677ebc4e0416963deca42c2cab217c7398ad9aab9294671a1f
SHA512 a1a5585fa7a0d7940a2a005a9b81274beee599c8e41ef89d9bedfe9765485c122cd48185a40e59fdd3b073f58827121ef0c493335ab25724e899ac6b58f7e2ee

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-up-pressed.gif

MD5 3d397083615031d803d211a547b52c97
SHA1 1dab52fe2e3551b04552dcfa12cf81e43b08e490
SHA256 285ff4141fd6ad42ff6cdb9254ddea796842411ba85182b42b5eb8849f154c2b
SHA512 aac9c5cd8eb2f05e6c3d800488f07a22329a4296439dc842d4798d9601b5cae507a6411a59f0973254c93b9349065569ab142859e9b4bf6f19271ee6f5750591

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-right.gif

MD5 2a5efc07ff8ba5589a5ae8825de32bf5
SHA1 f767cac351f2528ae4555181379a00af0a3e7515
SHA256 1a6a5bdb552c2a22bf9b6263de0971200a966b3b64f535c78dcb782136579a24
SHA512 c8dc4ea2984904e1a7cc9136b60f1303234364eba4df9a51373acbf1501a67242eeb58f12530ed4f1803b490af2ec075a3125223f077ca90b0f56aa66043a180

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-right-pressed.gif.encrypted

MD5 9fbc140897ceabba178612559d3a1aed
SHA1 66943b65b75df78c84ecf9c4149458be2ab97a65
SHA256 a102d83a98b9cdc0eb39c121c35d8af829324045ac939b33ba0d4dbac183990f
SHA512 14e21f49a0d4b0bc52bdde30cb238139606241a60f19c1932094874b3c97b3ff15b9c50bdabdc02f68813c4d46694d3628b4fb2a092a1893b00a5046baa4f74f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-left.gif

MD5 70737be3c4f74a9149df0727a37f5eb4
SHA1 b469b5ac68beb8abc90b63ecaf38cc7bcb713e48
SHA256 276bfd7796ea984468fd573c3e4063018cebec508a88bbeed3e9af806d21a4f5
SHA512 9a90c514a17c7071b6c2bb144d1eb7dd22d8ccd630daa36d1261f8188a613359fcb98283c3ca2fd23ccc88605917619090b3dad89887f7f7ad723399661fc95e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-left-pressed.gif

MD5 25b8f69ec0b02fbe3362efa4d41dd221
SHA1 29edb45c492c311755a6a14ca7bb5392f9d61a62
SHA256 2827b747c1cdc84b2fd075899939d95e73bc71544da66fcba2866467f0c8557a
SHA512 632a2e3aec7f1090ea719e8002cca2a9def068f98f37f59a221fe1b4acb40ea126fbe24d7c8c7bf6dd12ef42e1aa17e6b81eef997b898d50872a9046b605d049

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-down.gif

MD5 4ff153398322f76b4d206603283ef47e
SHA1 e1c069f6d47ec5aa7a17f97fcecfee01b0939ebd
SHA256 bc214b82163f890d02f91e136bbb5797fe2b209fc1dc8bfa79d048129dd022f4
SHA512 f018f4ffe7e202017fd25fa1315b03f4cfed0a60183ac0a31fce502afe2ea5295f64fb386787e94b4ec57319b7bb0c20a706d8ea5e08c8f7b89b6da89fae4f24

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-il\ui-strings.js

MD5 d6d0c967dae897f8120160c4eda68618
SHA1 7f5b23c54e7539315a752f6618f76464ca87ff48
SHA256 6ee7286dcd61e783d8505c16aba4a52a2bbd2ce0332c7a7beb94296d66af65a4
SHA512 cf95c9096a20d7e58438bed9149626ed131a6b878a91656675bc336e8b088401a5cf27855a55800349c1bb746907b9fbdc631058c29f4e83a6bdc14cc831d87b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-ma\ui-strings.js

MD5 044f4b76b2a823427c48ae071b17f600
SHA1 8c844545946b1abfd3643bf51f7dd61f7be4e57f
SHA256 c3bda700d1ea79f7ef5e7799432b6c5b67dcd8559acd69bcf9c0b005282c9508
SHA512 c4ad18b6f08f8447e22a5b283686010ca4f5e56d6fd121ee87da13c63a3772e25f50072fb6e75f8fc26588c7d14e6c6a72c719c7af4c643b5a15e288b7032e45

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-il\ui-strings.js

MD5 260dc57f63f8f2887e4554d8dd137529
SHA1 f12914c4f6edfd25cbbaa7e0ee2867046ff71ab9
SHA256 f1633a838aab3b94dd70283a70118ec7337dca1eefc89aef4333842bd8237663
SHA512 2aa816b765b4d81a39529b8f3618b4a3999e7d8fca91c10fe6c44b6004a5e1941871116a00deb7f9af359faf26d9358d540924e798ee87512f1a556d401cdd65

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\ui-strings.js.encrypted

MD5 89d4236807541a9277dfaa51d98c0389
SHA1 6ac9f84c47a2107c6726c7cd9479f12b9b9c543d
SHA256 b6be068237fa08f9f70f0de1cc6c81e4ff3fd2f56350ba22f8099eb3e8058e74
SHA512 8af03ab3ab41a112cc3b6f6a0893406d387606ae3e39e5b56e97e1f1a1ac20df8f45618a29a96d1033f0d5ff08ecc1da6fc4fda3004626139b989f36502917e9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-il\ui-strings.js

MD5 706ad6b7c436d0984670317c6f8ec5ed
SHA1 da04484851c63902df2d73009b1b45ad64006893
SHA256 15fefa8a82babad7fd1eb7aaa78345deebef8ab2e313d26ff9729428ea48a165
SHA512 b582769bb1510fb25e8e84a94fa88471c02e089f33c293c7b64d3f38e902786cddecc5359b5f78498473e8fb520cd59e74d300679b05a251b0304260a6a9a513

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\ui-strings.js

MD5 12b67536b0141557d5f5c3a810a0fd48
SHA1 8cb1237ad40183feb0710afc8cbaebcf9077c3c0
SHA256 25b825a406d1a66465a8bf60eb774e35345695aee59840c54970e7651d537eee
SHA512 f813319f6e9cd9ef0d7be3787c49118e1a8660e5329844e6fe531e22b0a950bdd75c828b51701988de61d2308fdaacec050236af3cd8b943a82f01856fdda904

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ui-strings.js

MD5 8217a8c4d8c62886810e422232bf9187
SHA1 6a18a20ab4ba74f0026633aee50cf9b5742cfd9e
SHA256 cef9203da9dce71df8fce0ab10dfadf6dcf2575a26183d94713bc8dd39088edc
SHA512 ea65677c644db8919f6d05109ededaceab719abd8ec61ba37837be4e8b3815783e7b8cccc85e491399471419b7cd105be397e7281a7491e2d1d18a0f192146f3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-gb\ui-strings.js

MD5 72fec63a399a34bc76f667c26b6e21a4
SHA1 02e10d3971aa5c4f585da3ac40d2e1e6ea11934a
SHA256 9380593c165e96c64f3d326e8691eec975a1c716aa0d6f371c8cf0e057f128dc
SHA512 bcfad430c192d019e56f6a28282aeb8fce0657188a27482a5abca7de97baf82956080e22ab4b9e83e56f8ebb02ea60b6492c21814888f83ae0ea184559c85674

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-il\ui-strings.js.encrypted

MD5 a7b09ca5b0d96fa930d995daea4009e5
SHA1 66836187fa0e1b39b023cf6faed1ec601483b6ba
SHA256 1f4809d30c240cba069f3e60cafcb0e50401263bb12f109130feda0c27fd4c96
SHA512 37aa4a5429452f21586900278beabcf64c1f51607b47c89390fb9ec774a5d989a1a1c75dc8959224c5266b02dec08c963c4c3530f59e2cafd84edfc2c00af7ce

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-ma\ui-strings.js

MD5 a4f2a2d532305f4f9e0f4abb64e4893b
SHA1 b0972ed97c95498362f44fba39d1e809c5b8ffc7
SHA256 357fef3c9966919630049a133efd2d5aaae84130621be359493085818e424f1d
SHA512 e3ef8942b1fe8ffa61b04fd4241e152bd6955cddc6e472086433f40c5d54e5b490d9c5271f970ba4e4676406c0e9db87b41d3d62c0b675160d594e892ac7264c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\bg_pattern_RHP.png

MD5 60705805bb50e61a9423b2f37680c7e3
SHA1 ed9ceff42af01cbec7747082aac49554f9ccdeca
SHA256 e413a40313e39922bf1291ef661ff2573e80fcc2636913fa848f3f1a19f495ca
SHA512 e580fa53fffaabcd13ad660f50ec44e45ab8b61a90417c803ca8c00ca9a01e864c46cde398eaaba0d520fadd9319a9fda45e668eaf0db2ed5e143dc57858ab8a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons.png

MD5 3f3a92398178d9a9acebf434c0189dbe
SHA1 f82f65e4e8f70ac07aed20b8399cb3247104bca7
SHA256 d65ff4edb81a4fdc1d58148757d3ca17000b70a3680ef50d63d5dca043dd12b0
SHA512 cc604fe775f257ef5e4d97040fa45c9aa8de439e8442849aaf5683c2c60aef4356a4a1ad2bec0c4985e61c935270ea105fee29f230ef92c182fc086992acccf1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_ie8.gif

MD5 a2e8af209ab040ca100f963b1ebdb8c2
SHA1 0941214cfebfaa0b9b82cc27beda89e98251f814
SHA256 4626c7fe163a9a4c1aa649ea270e9749d53225cd2b3dbcc260d2bcbfaa298d8f
SHA512 c151587d13f3c3a9a3fac731bb44ea0714bd60375242691741f06efb57227de3149f8975068799f0c5598830e062015f7af13fc824884f81ea2f5cf225dac365

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_retina.png

MD5 3fcd09c0d7b48c1073670e70d43257e0
SHA1 310c7b896592b906364354368c11378d97d124a4
SHA256 599025e50093ed9f6d94881257735ab301415df8ffb87bcae0eec16edc342414
SHA512 7cff8b940864d1257b0bede20b30c13dd0e72a5e4b1baec964a596b4c2fa58ee14a2e0d80fedb6e10b7e3e87a4af56729d3345c49f96da344e14a98c2ba35a51

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\illustrations.png

MD5 733a6d0265fd2ff45325dea7f7c997f8
SHA1 f6c9bf2b07e871d8aafc087ffe3c152c06a2a2a5
SHA256 564fc05691b10b4bcb8036cd12ff3cfaff3ee13854d41dd5fe4bbefbd93840ac
SHA512 ab3da3fbd14e485326592a981b3f2a1df4ea2727f50f5642ed8277b5e67963440692382810f4d8100817a10cf8d13ef081940d9f30031abe854b235203bd8881

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\illustrations_retina.png

MD5 65ccfb3caec165ded6525f7f40cf88f1
SHA1 090f538d88c8c84368123f8624b07de9e500a5f2
SHA256 b74adac7335ad8ec41778973c13e72c869ae037589acb2c5f12d8b981dfa9937
SHA512 edb00dc37df66e861616aec408aff08245a274cd3a6d921938740328e622924c38fd58265336dab9e9cb695315bb4cc92eba903688c3b37a71ffcefd35816350

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons.png

MD5 a90397a8d812b0e95a8b59ba8afd3d88
SHA1 dfc93f3eed1443adebad85c444b83394a6d263ef
SHA256 ba87ad6342bf6a984900cf6cef62f07b7b705a7e774be7f202584b75dd52f09b
SHA512 e04b4a7014c658c8a40fa07aa3afb53704e11d139ea2981cdbdd7bac5e4ee35878120109796afa0aef45c36558a59e1603d6f4494a6dfe1e28dd432f74cf5576

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons_retina.png

MD5 4f3821468859eeedd3e84392f7ca29b4
SHA1 3da56ac6fc62c75272919ac9916d2588125b4fbc
SHA256 79882facd0ad89b743df3a21a5abd061f5ee3491af646c645b73c90b9e9502a8
SHA512 acb7fae0894a70f2d0e865e8749f2fc38826b406bfc46db55dff24bc6d80969baaa8834d7a368fab31e9a1f44ebb93292aebb6b7ee84a0104edd7988ea25be71

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-il\ui-strings.js

MD5 f4b8b03cd0217ba96988b58a3b9b3a87
SHA1 a19c2e2d20d91e091bf18c4b9e8578e5f29f5723
SHA256 0a52da06b59cec60cf4c1272607277809c93317fa9d5e26beec4d18e8dd7d7a8
SHA512 3ac570d9314b9a595370063f32ae3a95c5009c6f8326286155063ee0bdd47ab2f7c32388bca05b22f2021dc15aad5a0effe09a6f0158958ec0d9df293d891cc5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-ma\ui-strings.js

MD5 ec76e8e31b7743e421d76d436c661c82
SHA1 5dc512482ba5a8b298b951e9020bbea61d44feb2
SHA256 27a2579b1785b818aebdbad2f2adf0b2a6b0ea0b107de71aa4228ae669234f99
SHA512 793fecdb9cdd5a5b7c5dd8717904339623c2a817353be56ce4a832c709993e247eb99473ffe24b629f650d9dd1bc6f0ede125e8e684ee0562bc64b4c640684a4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\warning.png

MD5 899f9b9b131ca630eab2cd4a3cd7f35d
SHA1 6a14087cf1eb6946e34c38e8ab592816a4492137
SHA256 398b143bf033bb68cc0576ed2e64b5dddc056c143d975738971e2baf3fa645da
SHA512 092dc49c01012f5c53338e6639bb7882449c8339dcee06d334580e27ff417ffe3db5c9cf1e9265cc8169709d2cb36ec47cb8e15e66ae39e033bc7e0cd90e14cc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\exportpdf-selector.js

MD5 f92b736fc049f1cfbc95e48909b3411e
SHA1 1e63510c1629aeca60950de2f5ff2a60fff2b008
SHA256 eaf9dc69c8a9728d33f44360371c00d1cff4de66bb6077f715784f51ff2a4dcc
SHA512 3ab4eb028fe824e7618133253bae27262a581fe8b8c1bacba39b74bf6ed2c265b4556c37f023bf1cdca7b80cede532ee4386547ad4ebf5a93a2e932b9b017daa

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\exportpdf-tool-view.js

MD5 34b9b7dca94ff6f3264b962f7c3fcf72
SHA1 2297cccd38e6009978bd4776ccf6ef68a8c83592
SHA256 f501b0b49add9d5767d31f3d355d5c7ac0c57cc99538be3f5f3f143c5759a4d7
SHA512 b9d6930322ca89f509e5261db130ee2a52b4fd1ddcbfbca2d885cc13a2e945e2f54d0c8fe755f96358659a93e5e623f7fe341363155898be9776b53a63d4d99a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-il\ui-strings.js

MD5 fb8cfeda6b143d445c4f60362143ad99
SHA1 12de99fb6cbf7f5fb894f061d377176461c8f55a
SHA256 4b37f3b14675b187e210d21b14e4cba59754b15c613bce7a62803499d26462d2
SHA512 d5ae774205df9bcd7e239184b226c0458a5518646d0717cc14095ddeec183e75cd1aade397a22ea7a3ac348670324b32b3c060f845ebd095efeb1960ae6c19fe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-ma\ui-strings.js

MD5 5b6f39a6a6d9f6759f531df3a5c4716a
SHA1 d208fcf4716ef89ee8544e5b3e544e55ba22280e
SHA256 3a3493c5dada66b4cd6ff7f67281cbe33d961990251ffabbb0b172ac38564282
SHA512 7a6cd593caee3ae89e80e8bf4a5b2c69ac580fc641a23bb186e4c8108fcd3ce5357902a8d5ffd85174fb7f57c35394a4794dd5adf1fea31d88c288c93a218189

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\rhp_world_icon_2x.png

MD5 00043d8b84c23eea84390dff42f7ab19
SHA1 8374986ba245e3c2ec634ff0f94f4ce67aff800c
SHA256 8480aa08dc3ee21ef3eecd6f8ab01f6e36e9d18203ff691ef52d3a31f1069b00
SHA512 fe0b3595e84dcb41d852aa9879613eef0cbc5876cbdbef24658772b6391364e28573d5a1aa5bd088c0229c05c07593441565f6bb8d7b5e913937bcf4ed81c5d8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\rhp_world_icon.png

MD5 9f11c2e45b002d80d2b5aa3d92203ba7
SHA1 39c50e07dadd7b18529b89e6426b015d22056f2c
SHA256 bc05daa22c0924dd5e3c6b3a01fe765405eaec81ea5ef805d19480b4bf677783
SHA512 5346a06220deeeb0d625ce51a2c57dfa4f75885caf52090f2c8bff58d4ec930c61d1bffff25c07d4ad55ab3649ae6f15b7ec8e19af33054f75cbeda692a57ce1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\example_icons.png

MD5 2455022e775bfe4b962f9fe3ed44326f
SHA1 0c8f058cb27025924491c30a668c508b2ffb222c
SHA256 73135c07c4a352c72ea32f94f2f6ccb166f6892afc88486708405b7a55d8e670
SHA512 4d12cc238e8d4fac5729265956acab81abfc4d1e687dcd9e4240a3c32a57b9e24c345566d8285b72b5aa30e80fa12d894baeb3605b1e3aa46843b960478f4a35

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\rhp_world_icon_2x.png.encrypted

MD5 c35643baa3412caadb2bb8ba417ab6b5
SHA1 bf0a8de1c6fa45d9a3095b3b6eab4c4e76aa022f
SHA256 a9cf92c0d25ab6bcb455835c446a6f404f016db4554de823c4634ea18a8cd9a3
SHA512 2335da3c0c0fca52b5aba4692ca9dd3471a8b04637c91b470654e834bee7c5a478925c74391900b0ea1f960da2a10f526057c1662fb3170cb1639681657dca58

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\rhp_world_icon.png

MD5 53199e47b86fc1b98862a866aa92c812
SHA1 588c7beead392bcb255e84c37f2338a5aa0eeadd
SHA256 9742c54dca9875d8c0d19bbc475d62bea6b5dffedac5ea40663e147e601e1b40
SHA512 ffce65ee16fa2da1a3ad09665376dd7da2c8a7abd59138b39f9a5e4aa4469375059799966ac7b5d2e4236d7d3d97097b097c1dfcc58a8f4e7ece983f208e987d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\example_icons2x.png

MD5 9eefd88575027dbb09572fb6af5e57f2
SHA1 1caa1757dc3285737f14005c45ae218d7d800595
SHA256 0f02f67aa0e32f4b024d3cc3db8608a84b1b2b4f9a5dc6204340e04c753174f3
SHA512 edda10d61d4119a6953d5371541711198057cc16f5f98d0e86c022553f990ead27901ef6d7bf7991be861592baf3c76da7c03d07dda5c85401d7312bab3d5ba7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\rhp_world_icon_hover_2x.png

MD5 cab8ae2bab695a40d9f3a53a0cb97fa2
SHA1 52781adc46e4b5b7049840c88af8352b707a8fd2
SHA256 9b32431e69be2de0513c2819df9b60f3be44b09a967c53fe4d650f0ef3538828
SHA512 488ef34fc052af9015362f031b97e349f385dc636b2e70d7f48f68482a2a4752c58c1558b311a245e29c895571bf5a8ded2130f31f92ebeb0a5d67c3e13c3074

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\rhp_world_icon_hover.png

MD5 b77fbc45ce620c1795cbfb2331180e12
SHA1 8ab6e0b9cc4d6f30a9c9642d42e36b9d63931f0c
SHA256 1c53b975b98416c7d762ae57e2fdda8142dd5dba254926343788861d2b9c443d
SHA512 34088769fbe3857a4e35356fa06501500381c85c2ec71bc585f75652699bbea97266211ba774a026118aba20d9b1fc4072fa6e726f6ecd75dcba54b2c3d4ec8a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\rhp_world_icon_hover_2x.png

MD5 7cce1b1dc5ba39836a83498111b2055b
SHA1 868f3ed6cf9094b2f8727a0e9a9384c798eb0643
SHA256 91e58065cffbcffb5a6d94f57e0176b4b851a607a278eb4228405b6767f0470e
SHA512 cb2b4a15f699a784096b1be16f1a1bff2bec702782a670bbaad2889bec335c30e5679d7e687a4f42528ccee14cc91331c12774b9c542da12056cef845689dccd

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\ui-strings.js

MD5 59b5776f6d3547f4a947d41ae369fef7
SHA1 068cac2a5c1c98b2bffbfe24f39cbfc14304e11b
SHA256 95b3b12cf72453569986a4e56127733e36a866fa0c5e32fd832d823a4eb92c8c
SHA512 b2ac9760af42d62cd18893f4adbe3e99aae71f9d43b6df364826d3ea444d928e8b831b3ec511be788b560a237c5ba52bc308020db9ad522f95c23e02d0e8145d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\ui-strings.js

MD5 7d270043c8a941c8e27eba3f77975268
SHA1 e1af468e6dafa635b2d5a396613320635fe89371
SHA256 91c4ad4872700f3dd14ead808b4dd88691c703cafcef73408dadd1811474bf48
SHA512 474716db4402e60e8115ba091cc90d98810e5b2ef03c84111400a72c2f82868d8525024b61bae1ead2817ceb61479e02e50c53c39e2fbe85587e5c7d770e236f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

MD5 b518fe04aa288c798462db5facbbe171
SHA1 62b67d5b4f64765ed2cea1e8ee5517a07941e769
SHA256 b5e563be0c94979352fc77df3a25ba1e30f37c7c52586395aa9132a008050d36
SHA512 409133f52b8cbb7d817bd54dc6c030ccfd0594da747899a57448964c8a85e6d5d48ac4d494c320d8210d137878caea8ae332a373f99953a554ff5af6eb8a6631

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-il\ui-strings.js

MD5 988b0b86c2d35f427da31ab8e5f55b66
SHA1 48ad363a4a0d74da7107c4e453e6d911e7710280
SHA256 2ac91e992c2916f7dd4ccad404995e97be51d6fb1d7ee0ea78b29e8a99a9b4e0
SHA512 6250e098d6977f9fede8117b14dc403e8fc800380a312318bcede5ddba8c0b8a7e08dbc8f3eab1560daff0c737dc7971c08a5622ccd43e5058e14d763fae3060

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\css\main-selector.css

MD5 77da80b8968164b6629a5b0ef3df9a88
SHA1 cbd6bf80b08225b3cc26bb38c3edf3e4171a4157
SHA256 3bc99ba55aa2ca198adac8dd43ab93d21dfc85f976a8f1fdd87f64120766600d
SHA512 67ec3b50d5ee0c00667befd8bd78255190cdb9a87cba0de2d4dbadecbb9cba34c8a6be6a0f0ff76a7f5053886f1e5bdfc38beafffdb5bdf685856efa4ae07f70

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-il\ui-strings.js

MD5 75fe74f3fcea2c61f0dee8be45a239cd
SHA1 c8f87dbe70a060e287320acf529958a68d329ee6
SHA256 89a1ea29231709a64935f0b5ac38002643542570d4fb0ef89ac2be06f0046923
SHA512 ffd5bc3316d1bb18482cef8159087cd43371a98570eccffa69230ac305e8c57d53e55f73a40270e54a5b63c351902200d7e44b03c393297339e9bc998aeb1913

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-ma\ui-strings.js

MD5 decd3fe2bcd3edc571a04acf86f22721
SHA1 9a3577be5ea2b7bd8a7e5b6917102c0bbbbb19da
SHA256 8aaba20314036199fa7657359556d359cfd4b64c284ab54f390f753118b740d5
SHA512 aca000748c5e3548e238303fa3dcfbdac7b4d6dc13f1f6e76308ee6c018726131f43ff36fc37224851b570de0c7ae9df9cc4e2da3ed61031df01938e0ec91c47

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\s_checkbox_selected_18.svg

MD5 cc41c386b0ccc56a364fe0c445d7a886
SHA1 f2b6535a7f40df8695a0395b42850d50214adff6
SHA256 82a7456e2792a440860f983a08edb5983bd4a09bb49c378016aa4895730f71e4
SHA512 7e7d79a2e472bfa600735fd5c7e29c729a58fd1cbdb14ba28ff8de477933dea315f66bc54f213ef56ffc976a10c24b6d41d406d1afe8f757ee05c8551b0c6b8b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-ma\ui-strings.js.encrypted

MD5 bc00da810dae0098a6ae273f082ffa1a
SHA1 4cd854af8586511ee4a443d5e8378bfc7401352c
SHA256 749a39a8aef19925f9b578a9ddd56114b08b65f0e851fac35b4969cd143779c9
SHA512 07e9b6f5036c0b8fb3cf026a59630122c847913ca09abca56427d0caf0abcb1fd36ab0e58f48faac692707aebf6b108d1299ed1d5728ca2b822bcd21ff9dc0a8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\ui-strings.js

MD5 400fae704af33b422a27cc29c2fbadf0
SHA1 d62086efe33c5c8a55f9235979dfffcee018c0c8
SHA256 42bc895b653c33af50cbd795ff00036f11047e80ca38ca23c5ccc3038b6b9812
SHA512 d81b5eb8208857abe4900ffe7bbbb17d7c3b586818eee6cff6de4c7f90744cd10bc6bbea34288f305d6b01e2a0a0090b30f78db665b8cea2cb22e962f71d3a80

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-il\ui-strings.js

MD5 0333d3a621c838f815084cb54b9ee8a6
SHA1 ca3f191dc8e53f60aa11bd2ae875a8d4956279ea
SHA256 13d15c21086abacf055fd06b70b7a1a2e615a271b5353365081c8c0b5ef7fc44
SHA512 a8a348b2197d38d74acbfbc55bbb0926880762be911f3070f8f28ca18cf5ed14369264edc0d48c5f8140a8a4e687df5549fd4c446a61e50afc81c579c9a7c59b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-gb\ui-strings.js.encrypted

MD5 19fceefa61c8ec66d8ef89015a4be7e3
SHA1 ca9b5589b924a65ddfbe57ce986a792faa799a5f
SHA256 bdb917d655a82bc34695cc5d7e04a90b976d09cd670224517d84e9bd40b0d563
SHA512 b1ebce7bfcc45e3f5ccb8bb4136770a0816217634045fb4bab0fdc6294f10a7d0ce94ff8d02718c3aef4869514131c250ff307514644d5066c09e4d7707285ab

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ui-strings.js.encrypted

MD5 ffbcf6d3591b9ac0e7a281b817dec430
SHA1 a6e80dca313c47d98ab55838a7fe199ba3f540b4
SHA256 3db3f793f55a7d473ab81bf116a16a10109abcc625417a5a1ed42855c278451f
SHA512 cdca5839a5d8ff7d93dddc541b0bed5293b62cb306c99afc75eeac17c2cd94395dbab54bf3ac96dd3eb2d6eb3d1894d7cada2050b6b5a81d7318eb33a9fcd0db

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ui-strings.js

MD5 d2d94d8f63c51cc806dc3062dd29f4ae
SHA1 fe131479d1c19aaea688f15d6dcf50eee1fd5941
SHA256 0eadff28ecac42203987562a26b7ad5c2c82c1255c7053f7846b92b507903260
SHA512 d63444a46ac13f0e3527c58fa015520eb634cd9a63fda301daf69234f0af590dad0adfdbcc101f5d2ead12ba7b0567f36cdcef3f9dc899c3494e6471cdba400c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\sample-thumb.png

MD5 2d0106ab24f70d6b8ba9f907dc7b54c8
SHA1 5e9027f99ef64bd38a5e9c97efd53f9a7b1bf9f7
SHA256 792df5f02fa33b54c88a8854a141968e670584475987d023fdb86dc0eb8936b9
SHA512 72d21e65aab6d3ce448fe8ecc7a80202ca84d8960b7f246bcdaa2ac220712f38397d0e941c119367294d4bffa10389f04e1b39ac79d10db683a1f51ad3fe2b82

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected]

MD5 bdc76150fce838ee3952e9924b3304ad
SHA1 024e28ca8195621138876c56c3f42760598aee4f
SHA256 f47e64b1a24e707d69d4556a96e654970eccfaea1015d52e471cf5f53afffd6c
SHA512 fc11fd4be46a96c402cb5efcb43c7de9a11627404b6f941e7e39aef9f97a63fe51b90742381da40995d33f8314b9902e8d2da9db13bb3a36cb2c8e7efd4f276d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected]

MD5 0734a796ecc5d0e619b4cfba82b111d6
SHA1 539dcf389aae9d33da6546d5546eed074a291080
SHA256 3de3c46e06cbb0230981bcdb574480a3c3ebc73f80bb477e6bd99f12f45e1494
SHA512 4f0db98487f88ffbc4950d4733719707bb5cb8724b86dcad65882449486cd32cd7e8fecf3270188b78ec5cb857f84a47567a208a29519472ea6692f9bc54a84c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected]

MD5 bbd3f1870bd7f4d45f7405c1cb51effa
SHA1 1086edcafb5622ae3b7128f43dabfd170100a546
SHA256 ad959a04920a0089afe08b14753c9776cd22123228c503015445a73abab480ef
SHA512 9a81127a3360f286dbd99f53dd2f865d978f54ea9a5d0f1b192002a825256462c91c66bfcd5e099e7e0be6a7f53d977235986be02929c09dbf1e1ada1a27bd22

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected]

MD5 124acf0ef5464c1fd0995ed418eba922
SHA1 67b58feaa927519ab938d084d19610744ab7c4c6
SHA256 e2cf7b0bd16599cbd780dff4b266da8d7a895fcbac3dc52b245a9add90a2c981
SHA512 75f459f4106cab6c7c39bc6fbdca7b56cdc99dc8873b7e9c3ac812103d55cbbd868812376c8d9d3cd2176646375973c36e65f83a7931c643751c3516deef2e0a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\[email protected]

MD5 1096aa5dbdd54062dfb99a3436c06d89
SHA1 a33f724d9b5cda780b55eaccddd660197336d941
SHA256 1fd27908324714c699a3cd9c391e9a11a3f0dd65abbbdf227db93776b656f171
SHA512 adfe4357148d5b02cce3b7a02e3af4a1648ca6bff606feb875a4b27c59829cbbe3adf35de247316a51a42d72d405032c5f5be12da73a5a6361f18cda13aefaae

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\faf_field_grabber.png

MD5 09001ae91a34e42736f50c54f82b8c43
SHA1 e5e2df8f9bcf182084f904bb385d62e680e367ff
SHA256 f084447031caecfd65004150b3633f7941e3ef0e4f34413ca83c38e746c88c08
SHA512 339c9c8da2f5f0915cf99eb67eb36ac38d47787351e502ca30e20f6a1c96721f623713c78d7ede03fedaba67e43932bae7311daf34d9f7b367059ff780b512ef

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons_retina.png

MD5 b9ce60e10beb38d3899df08acf67db07
SHA1 22864cd2835fe65696c3b9c7804119980d6e2207
SHA256 e1da2fce0987dc01d7ad1e77d2c032433c4efac67b3d80f58b7501b71ef17067
SHA512 d633a497edc3737acc593d02c80da6d6c000cc081da85c4774f166b4d23047c721350e8dd82787918eb194118799a19877c0c0890136cc05ede679acf893b43f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons_fw.png

MD5 d773c9f07d0c963066702bf32d2dda40
SHA1 d933bfdc733586add2b56472b9153001e9146bc4
SHA256 e06f19d793234f38a6804ca65e803123b36ad49cd43a9c03200c9b4efb014968
SHA512 fb6b7b3e65990a57427d4f3fcbd5072a78710fb3ed6e37c75cb1e13b98e1a1b0698a7bf53d7688c921e6afb56c5e77e99f1c4dc201e44c66b2e483271c1dc29a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected]

MD5 d24e2ce221d4ba2a291813452ba7ab28
SHA1 ca71ba198c5bdebfabd15b7174e65e530b1618c0
SHA256 3798662630fd8fc2975d193d3c68700f8c24d2e88748e5bf7fbb1c812acd1da8
SHA512 0facb60586fc1486b0b72e32847064998d20d6bf577cf4ca2f8067a88c755ec455b2b8ae4fba59f76fd3d2a8c97fa0c0b74c200eb771b1e7dcd9abec28221e34

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected]

MD5 b831fb2a0608003d3ade08a0e95a2d48
SHA1 d005ff3f444dd360cc5127d3a04b2a7a8b5e3e19
SHA256 823685d8322c2cbf1e6fa9bd87b67dd7043e9bab525c3eeb5407c4905f72c63d
SHA512 212a5bfac598e8639ac62d99b6c0bf1ba66456c88aeb7fd95e2714eda1844f26c7bbdbbc5bc84466202e82381e893b10d94ebb5f84bb3f334c1442ca78493366

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected]

MD5 3cb069016d80789e33e2597d2aa5728b
SHA1 ce915b76b7ad4de509a86c928172fb6b323e23b8
SHA256 5a6148cfb0ac3cf8a4b59035e4ebdb9b7e97736669eb2484281cc0199ba3c4b3
SHA512 19319f3d1a189b78cce91ceba370c0f27231549e3fbe09c1deeebb3db0d2c2d0b7392c4241bf6b69317a5a68e87fa5f7a8202e767b3a42622a61e7fa76788530

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected]

MD5 3848fce7ed0bc2aa05878d910a7c18ba
SHA1 e1939294c2724ea88846a2df4c9597be4cb9882c
SHA256 13244a43af173d6bbd893924186391c41a873c73e733b30a5ef979d68f08221f
SHA512 38fc14019ff3d622b39542ea6ae94a18e4939abe4531bf1591445ae3542dbe891a5aaa8de76c6e955fa20173ea4f7fdc486222626cef720e039dad07a13ca2c0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected]

MD5 4e2ea54ee55b729316cfce0e787c1ca9
SHA1 9b3060d05b0606d064d7f09bead9b7dbd7603a88
SHA256 32b3a86210c3d77597812759c2c44c693fa22e501541f56a271a2d35d9582a41
SHA512 c8a03cf09cc969a5dcce7dde9d7dd32b68625d065bd0c3be65152f559f42bc8336ef13213b79f6dee5e9c891490f355772afd60bfc6337f1a680d75268220c1b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected]

MD5 a09eb781b07a289f1f331bf5c3679cff
SHA1 f1b55d796ac3b21e3f1bb8ef0fae4993ae118741
SHA256 b154eb2e0ec543b5535e3938f9a7e644361d212199723587236d6199cd8a9c12
SHA512 1efa2584a37a5c771af28317de0689a540b02e6b87c511ab3daf379dbf7150bc69a6ca3f05df339be625e1ce335565c8bfaa7cc44b4d2ec9fe71329f7a066aab

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons.png

MD5 ddfd5e430e893459ac6ab786bfe2f302
SHA1 b05c6801fdbda6523de9682a47ae5f33d273cf4f
SHA256 d27cb9ce8a119a4ad0946101f2607be2865959df697c9c3e6f221facbe39ad93
SHA512 1b1cf25b5e4e1e3d419769973fd4a98e825fc969abcce3aefb32d34f968864db285cca26e20b780f150abd5f9af188d9fdffda2d33f6433650be317ce4495364

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\adobe_sign_tag_retina.png

MD5 ee8c5091a9e1f3bf9a4380db659bdc4c
SHA1 494f48b669273d3dff0b655aa9c18df03fda30c4
SHA256 26e1610d3486425b4951dac8a5eb999bf6ecdf70791ce5ec1680d3222584701f
SHA512 0e03b889e0e9548a209a327b89d295f7e74d53168d5d3b49826b3abda12577dbe3ab754f0c33b983b04da8e2c4b668bb9be3932f9d1a4cccb2a3f34d5dba9cc5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\adobe_sign_tag.png

MD5 c9484f2548dffcd89cf8956d928c9b96
SHA1 569518facc2d3dd2aa9e5d94e34417d263d175cc
SHA256 ec55bb1e9271f1b076a7fae4b07eacdcda9cf5e3a86aa4276abd108ae7e9a9bb
SHA512 9bb55764c8e9b1e90828e27bb7a4f598d4d70e7e29bc3b564cf0921835626cc233e3c0001072fccfa459c6b868535ae7b6d836929584c679a594e8f2809ed637

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\ui-strings.js

MD5 bb39ae0d5c3a5530e29df2dbb78af14f
SHA1 448c226d96d2ff3f0c00ebd278b3bb91a4ec7746
SHA256 b39fb8645d97812a136a2cfe58b30532191ee7a4fc41442524658078d6d693d2
SHA512 ed9520cc5f4f7f823c078613f295e5ae3319a024ae0b1cf1a4d7a2d3eff45576100d630564054a66cefd257c902c837bcc4448e7eb17dd5fda2980c19e679962

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\x_2x.png

MD5 da96f2e328d59d316e535330285f0b46
SHA1 0008b1955b1292d3fcaa5183f6feaf1e229a05c9
SHA256 13b89888c8df2ec78d474d6f22b893ee1c0f1a000cff748de3ac36d3fd8da16b
SHA512 e454d533f3d8dc68b8c9d06855fc7b592e59632dd5ac2f6e850e603580548f3b0f7575b4fec7615e1bad996ba566ee3ea08bfd97c5be5ab79d252001918dd5ea

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\x.cur

MD5 7fa9346c572e4eb35bf0c92d7ae0c548
SHA1 fabbe5d45c951b694e1d06feb38e62bd63098595
SHA256 343f0d8e4f2d64fc95de4197fb2bbfad27fb93596fa444db175a5bfcf94c3c54
SHA512 2e7d437bc505d37b02f3c3f3a0f0305a411a2bb2d9a059671c17ff61b42bc0a3d032e05aa1ab64a5595963da5e74dbefcad5a9e6e3d80d6b821689193d839c73

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\text_2x.png

MD5 c5efa0034d057e462be3a17c842edb01
SHA1 e17fc186b35f02cbf88c7b501223dacb95204091
SHA256 1ba2be21981915f212b7d2b3231cb9d9c6b143b9395c25718d50b27c965c819a
SHA512 08ae23b93c958a0ace57523af13699d645172afd1595892ef29ec9e5eb747e2a37f0b1a4fa3f0476cdb0cc5816d55df82069d46cfb89b725535e00bee3ca88a1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\text.cur

MD5 8342fbeff70242156856e58beb057557
SHA1 95eecc65793d7443e497d99557efd9b978c9194d
SHA256 b4f53c7c32440eeac1edf34963c2efe214be90471688c0315ff26b714a064b09
SHA512 667c70e031a63262103fd2327d5429125a7c38a48c03a1081da42dfb9323181d753b92e1b23ac8e7d91bebabf83a538b47d4f5c87ea5312fe45520a9acd930d6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\line_2x.png

MD5 75eac5ddbabdcb92add06823f09717b2
SHA1 0b98ef0e74c81aa1ee16859302ffef71e229fc5a
SHA256 84f52b86c654f2546843b7d17880d935a3591088411f96579c64a205691dba1b
SHA512 9390dc8a2d4150dd46599ae16861de90910fde0901dc6637d519133c2cac7f954ec5db35df6c85805f8c9478ebd4474f1ca0afab21a2d7a23d4962b6b38ae0e9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\line.cur

MD5 97ac82a1c46fb36d0755ef36d3bfea11
SHA1 d6443a84c657b846878367b90f252df16d8de511
SHA256 44ba07687d483c18d6667cbfe9c893038dc40b3e83ff0ad67bfa627671b276f8
SHA512 aa3b23cd83ae1a34e5d9b63fa6487e903fc78bf57c6a07870945005f73f4bcf34197d255e0f3acbfab3cd615320dbc75818fc9b8e575dafb64a159d256887405

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\dot_2x.png

MD5 bd6e5a466385ee111d7b2aa0d35d542a
SHA1 2bbc72c4d3dc32b36d5ce17ff82f70985db82cb5
SHA256 b13e4ceb51872b651a0dbb6dc78c9fb225ec5e2c0c309e7b82f113fed0cbe616
SHA512 df162a92316fffc22823cdd721ae6e3161a0af9bc82e289ac41d320ba62bc32912f86c1fac1ddeca15b8db2fefdc40b48e65352102ae22bf7a1eccadfa77bae4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\dot.cur

MD5 60ce07a3f8ad7c209d42a2998db0f4a2
SHA1 1ee30fc7c08e444fe1c26eed0321f53c075b47d7
SHA256 4c1d6dc7b3711dcc89198b90a4225af12a94b254547706f2fe5dfa09a57846a5
SHA512 ac01b36f3ce11d49fb5a4d3a541f8f9452ef24f916a741e8f23a5b6e0f447046c57b0d85561461ecbb8cc5486154ecd7033c303be8b319f1506f7f8e10a7ed08

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\circle_2x.png.encrypted

MD5 10f2df07f550634c2638492d22161d60
SHA1 91a56f8d169a424a23d8023d4296d402107461d2
SHA256 2109bb9b437160ac7d9b9523b45adad1ad9e5eaa1fcf268e1438ed7f8414265c
SHA512 dd7a65f19a05e285cdb5278a8d9e72c991bfa602fdf7ba9724a1da6d23a7e73c24562d95f1c5448658b242311c3218f15f710957a41892db4d7a670c65b11c67

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\circle.cur

MD5 4d650525544b45ea15a72a75969fe0d4
SHA1 91709063a26fb600c3407634a3f04a722c855fef
SHA256 f1b22f3369b10d3ff2d0f4fe11e471647b2bfc7dc7752f3fdf4bda8c5004a8aa
SHA512 341897b206bc9485c053f90195db7f1eb8bf07a3f987748eb3612be0342f9a88798588a1d5e07476beeaa4fcf1afa4925f78f3ac31ae2031b56fdbc5ac740ade

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\check_2x.png

MD5 98ace74aca2dd896c4c671e0084da338
SHA1 d4c9755e99ac857df72265d1724d3aebeea10457
SHA256 837b905124de8997f24486d1e7d63617e6dfe28e71fd4847ae34d554028b2b56
SHA512 50b2d0bea048a8f93c702aedb60bef910d60b0374764332b87a2a63a87b5d250784b89d0a962ff2205c624a1beae180dfe592bfc4d4817c3a96c4271308d500e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\check.cur

MD5 6912ed7d230c08b20892f5dfc904833f
SHA1 b274e53221fd10104efb1ea2338e65f71ade8d21
SHA256 4f36636a6d68a366d8ef558beb82bd2842029f2cbf045a794a08135053efea0e
SHA512 0e38f720d39a7c6b8c7d5cb596a08cf8d915b4a383de4ac7ba9eb38d2b8182c9fb07338ff343211c06ffe26491d8a0fa661ee6c3bea7f6ee480615c326c5c970

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\files_icons2x.png

MD5 29087bf215171d22409a872b47458327
SHA1 c949c08bcf53ee364803116c299c8266200763e4
SHA256 ed6088ef5192f2123b9ee4cef9241dfac4423a3211fdb1fd6e4ca388df8f5bed
SHA512 00104c782cf03e577976fa98abc5a6c3fff484f7d28f8303241d55ffbe64202dd54751ba7d4b89f4f40b3ead3b56d75e958717393ec573604c7a556608825940

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\files_icons.png

MD5 af041c7cb93ddd844bf2349906a7196a
SHA1 aa8ea811f03369bddd40cb762236013ce05fc0c3
SHA256 966385c5e74ca492ea5d8f4c9e4e98514faec4aab85c8e73862f69070e2131f7
SHA512 5b3c9df234f83b78c06a89f7662f788ce40187d6f2b0d16b1c2d2b1d9a9261f3427e013947e7b3b0785e2bc63394146d6fda44cf37cef8079c15a9982fcca6a0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

MD5 9fc06bed30157a53a18f83a05fa52c6a
SHA1 0cd18e02e7de4b447d9677253b90f004f7416f09
SHA256 dedf56e72c22004685d93ab4b92e2de7ed8fe1aa1ad2d491d9b405399786ef12
SHA512 edce04e64b972308529df8d7c22eda957669b76e8a481076537a23cbb69b0cd978aef55a6cd68efb65b4aac4a9b644a8b15db71d3c0bc7a180a0af652e9abf76

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\he-il\ui-strings.js

MD5 77b51b920bdaf15f6f9d81e9075b4e52
SHA1 4856d11609b4ad91a144c7a0a68cbcca35541e5b
SHA256 250b4ed13dbe6de02772ef0c5c7e6143e547eebb9fb22f6c7df586885b310e43
SHA512 5aef4ffab4f4a0d9da11f690c0fc0f6db990ecf6b3e3fd28f7f6d5bc0c136553e3f6d8813074ef5664347ba5af62dd0b897bae0eebe7964a6d969ad909422b6e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-ma\ui-strings.js

MD5 ad9df528f68a3c0e7878669662b75366
SHA1 4961f25a94871e87ab86bd8ed596d0aebbc51a81
SHA256 17edb5d7ef517352377f4ffbf191ec94563515a367c670fa61c845c5b6abb530
SHA512 7086bc6c59e7feead2c6c8117ebd42308788624f46895eb3bd55933521503137b39720dc0ce305f21ebba0848a9d7f6462657e048b1f56b9863636d8f9d1b913

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-il\ui-strings.js.encrypted

MD5 691291a61280ed1419f920ec234cdffe
SHA1 4757ad12741c4bf81281ec07116e30ba205912f6
SHA256 420b37d16288dbb14a88fd86e78f70fa76cd87246fdafd836869ce81ac867c84
SHA512 958a94f01d51334bae613851da347a6d5bd369b0f8a6af0de872520ca9f41b713831b333eacabb60bba85d3647c9cc6b71ef980371449be5c215319f3e4ced1c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\css\main-selector.css

MD5 043714318bf4eaf8897e6ddbb5eee027
SHA1 2dad81f3cf1a798913e2808c8c80f295f1015504
SHA256 6e5efeff13d621a1aa0c736e3129ec65218527aacf146b242c9701bfa0979686
SHA512 a8e6c83c7b7560a9b017a4a75ef64387887c22a66e214eafc42425af04003072660fa0f89077613ce9368dd17790700bcd4302e0c543611abc8031b92cc7fae5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\images\file_icons.png

MD5 80cfd5c7c5ec3916889a1ae752040cb1
SHA1 60fea3b71ccfbe4cf169f6e2f64bbf26ef429a89
SHA256 a1694c06e02e3a1d3c65228edd1063eef7ff3ccca073ba985a9ef03622f978fe
SHA512 c03db61accebb0a78e198bebe77530cac5c4ab47beb9970137f85089e8dd4a693194ac251c9e306845070906940e7e45c7eae8a2f285c3f296bb720a139eab39

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\images\themes\dark\file_icons.png

MD5 2357bca5e4eaac98fea4ccfadc554086
SHA1 4f98fe7c1994f05905be0ad233921a6e79bc206f
SHA256 8d918771657f75d9b64bf8b77d5c507142a71082a6eade8a1d00bd403595434e
SHA512 960587a1a6240e14b47d2a366a69e933ee686d24f885093a7065bfb77e25d3aa9b3b85f06f80add00d2c07d54ebaeacc929dcb33d2f13ce79b648eb257e27c15

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ui-strings.js.encrypted

MD5 72d83502806d09977f056584a6aad5f9
SHA1 fb55ef64c30fe9b9a5b8b55f939ffd38c9b55323
SHA256 6d9333840f5f6acd06d5b76f2fb85628b990d4dd0690e0fee772dcfa5ce4e004
SHA512 585079d67c34ca81775c047d0da812a73e6faca1555b0329f019bf06e5f37f69d2bcf83a3478fad56dfeaf0b4a81e9400ca2b23a438332a74c3f5cba95e25dd7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\s_empty_folder_state.svg

MD5 13e90ed945a5e33c14e38d48aa84048e
SHA1 96f84ca7ee7da11fbed08059ed31fac50ac630ed
SHA256 ac1fc45d88d81e77efc74330747a61609f364ff264621e2bf74bb45cccfc7d67
SHA512 25644caae1d12fb010a39808d84eeb1e6ee037bc2b37a4f0831630ae017e57219881d3ff7093718944849ae359d0ed3bb73552c3dd09e1873f6fa5a34bc8e890

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-il\ui-strings.js.encrypted

MD5 d82aee862b43499779c50672c9a679ff
SHA1 c83bbf9f2b76b702427b5532095fb0690c735c86
SHA256 88f8f49d70413d4edac68efc0f1fd7b24d050229564291efd4de65620d7ab773
SHA512 224fb1ce61f0cf7d3aa80a8eb94a1556f1e212258abf0f42485a57b7e6c6f3921cb4ecfa7ac8ecf966faf453ab13266c66fa3260473bebf6df321297338ae406

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-ma\ui-strings.js

MD5 123485a3b2bcba7b86e0fbacb70404b9
SHA1 eb0770bfaebda289c73116359d17bdb195681c11
SHA256 9a600c7c00ca4f2053d335823416fe1b6357a7e78b1a52fd06282879c75cff6f
SHA512 cc60a03a0a5fc6731539a7ad00df5b4a1507913d3b2e128a8fa4fe4fbe8048308d182bb2d4998700ece1c5af18cef3aedd05218f839e3a2382b03332bd2014dc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-il\ui-strings.js

MD5 cef0ea3c38bcda65bb08e6367431b162
SHA1 d6fbf21dc0f5090482018d3abf0242a6d0f357a0
SHA256 7d057843f9f97b6287b6715717143c11c0c62b8432b737d78aa6375173808ab6
SHA512 4231f2efba1bb1f3b6d3799ef426f030d997b704e91f6b5da3ff5f59fd9ff9bfe0bdaa5f03dc38dcd340bcf8b387f50c7c5944d6739ed05f939215e051f0e1b5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-ma\ui-strings.js

MD5 aa6ab5849394927b14ace68ae2abd2a4
SHA1 1e0b14a258a11fc60dde237d7f2c267b60caf601
SHA256 35dc18b774239e31f186c9d747bb7353f6180d127b509582ef8742e39d29ab5a
SHA512 817dfbccf936f255e5f45f0e8a5ed59be06b2ddee2887e5635b007c1605fd1646b7545aa631444371d92624b46a90bfd5eb79cd6cb3d92b001f7e9073edc92d1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-ma\ui-strings.js

MD5 2318e9318318a233b58b9185a61d1c42
SHA1 1338166386fc8ac4000eb41c232ae7a15f05719d
SHA256 5adfdcad31e31e31310e1f382c1abdb7cb750769486775a0c14d502942ead5a5
SHA512 1141cb949067aa19873326633145e9c65e7c0c7c87c1d3f621fe13b4f7ebf5bc9e2dc00c164fbb761d2a9f962e7e892f87788dae67e7c5401a8d2b9c3e5f5e25

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-il\ui-strings.js

MD5 643456c223a1ce0a7336623cc6b315b6
SHA1 79396bd3a159b3bb7755fd8f88e260eaa2cc980a
SHA256 61f0679ca2b3159ceaaff19ef84b8a290c62777ada3e7202143f96b8a859f9e7
SHA512 605f8bc29a3f8a3d251c2c2b34b2a0b544a15232c208856be09b26b309deb4f50c7d620c350da1bd49fc7df6ce199314a8b1ddfd25c235ac8fcd7d4c5c6b6d7a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-fr\ui-strings.js.encrypted

MD5 c445ed53b7c605067125a3806e6abcf6
SHA1 9a4ed5a0fb93a399da9d68d9ef867d7791592a47
SHA256 a0549c0a96acd662cde3f2af5869467c5490208c85f322b120dec3834a92d811
SHA512 b9a30a0eb6346d813884ab9b9848fcd35f96124fe580f25a27201e122c17f75a995f2d695d51bf113c6e8751304cb3ffb2fbb00363e72373515eaa48759f7617

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\selector.js

MD5 6f4dca75477066bf57d83fe07cdd149f
SHA1 357dcb2122de2f37999ab3a03d73bfc30e2b1421
SHA256 08d5be8fa402d0594afd2bbf90c0fe300f255e54c15b9c9f7f508ecf89de44e3
SHA512 4bca90b7d59b66e6bddffc8ffe5971ea447694c356b8648bcda69493903eda6619b8af17ac987c0fc542473e346a1daae8e7856e476a7460c3ea1d42216a00ad

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\cs-cz\PlayStore_icon.svg

MD5 5945d12593f0320fe2743cc6321bb232
SHA1 113a0ceeb55f22db381061384c5cf4ce1a57a079
SHA256 ef2ee0a3f2614d1f4900eb4f1f00e9d48cbb1e2aeb9a95d121e426f1a584eb67
SHA512 92eaa5f4f3f962c517c0804046a9d5331932150ea19cbeebf8e502174be3f129c5b3398441483202d3b8e0bee8144403a369129b6b48a841d57296a468424ca6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\da-dk\AppStore_icon.svg

MD5 8887f0a1c811c2656129164cf4b34025
SHA1 3401ef7747d6005e804bc68e63eb8a94bbc2505d
SHA256 fd66784dce6c2e494c2808e92f62576d3f4f51c9d1fa1ed02edfc2d97434a514
SHA512 781b666e8927f072524cd2b0a0207e06980e1d38092e719b6d2d28adda3b61cbd1e0282a74805073564f2371158c9054aaf43a44448843009a6b6da217b19236

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\cs-cz\AppStore_icon.svg

MD5 64204f50ebf8af17410c0632b2757fba
SHA1 7b9ae6f4cda7c0e63187fecb9d382f19e842074d
SHA256 8a7beb9e07b3f6b7d669db0c4154f5f47e79f68461467cf8ffaca20b97f88d8d
SHA512 99580ed0bb9a3380b976e124927a06b2e435d43280690afb948c46b1b45a9e0d3e8616da68c9d791addf5c95249c4ff1fd88c1ebaf19eacbb9e27a7a6e2fbbe7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\de-de\AppStore_icon.svg

MD5 a01637c0a6daef7a02454440c78311d1
SHA1 4d05a729ce18036d9c2ed18a3da193ded62c225a
SHA256 3cfece312e148a18d1e5477bdbc7022cb7aa269b9a2ba311b4d5693acbd2fd39
SHA512 d30077857cf4c41caee3bd17de4b751e2c87af457a498a9eb86ad870c2b83595084fa17ace3cace16fe4e28bc94318d2fddcaddf08e93f13b26ecae31158ae99

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\da-dk\PlayStore_icon.svg.encrypted

MD5 713261a5e087406694fc97abcd21153d
SHA1 d4cf9e0369d7ed9ae73d3ecd808e92cc938497e7
SHA256 f26de6d86378757af0cea9088f0ad6dc952aca1b756f061365de36bdcbda25d6
SHA512 eca67b3c0bdaa0ab178d81152d43af02517e8209dfc5bf70703d5ddca1e29cb33292d6b0622d416c5abf94b2bf19303017a7053ce6bf30260f2b4202d94657af

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\de-de\PlayStore_icon.svg.encrypted

MD5 6b014a8df1d5afb09955079cdfc2646e
SHA1 df587d19b109fa4893a2c4ecc21bbbcbc0a82b6e
SHA256 8ff888a3f7041849e172ed4facd619642e29e8c881c43cb684bc7706f542e8cc
SHA512 c725461058684ee5b7ab09995a68c0d9b47b485a1a97b41e11e264411fe07b23946aa948e09f256cbb5587e90b6899660955c59598b07244291c904e6b235057

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\en-us\AppStore_icon.svg

MD5 e8d1478c18e8d0e8f082def6f65a0023
SHA1 8c476aa5b8ee9a6be39576c294cc8b42864f992d
SHA256 967da88fbd4f4f1995f8a221681f4d487c2f9a6c2c0a636b1434a2a71cd145da
SHA512 9165094bf4e39b18ddaa1c7da1e77f1b2441c642d926c5a81775858a4564ed160bfafc1c7d76c8f2a32cbf284b948c1c8c65970ae7c20ac3590ba1b28d4e4c28

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\es-es\AppStore_icon.svg.encrypted

MD5 ef7d08c4984e66f73278345bef6f226a
SHA1 da2f9a2ca3db6fbf2af2aaf820b1ab3210ad5223
SHA256 740ce2435ede8ae4049bd3c2ce7aa2b8f81e78a90fdab80f43ac67eaf2207080
SHA512 c304ae36992ed6779d19610761d0ecd1d27090dfe0575d50cbc01f3ca4dbfe5942b94ec36fc51b00a0a028dda6f7c8eaf763787c82d7434b0a38c3c74043f0eb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\en-us\PlayStore_icon.svg

MD5 5b20b5456b8b01ded1c674f9fa4c3e6f
SHA1 3ec488d47a5a1b93af22b214ab118bd745f2f5bd
SHA256 7454bc33592efbc4c2fc61e774ecbd90eca1bc9d0cf1248323341db848c48ce0
SHA512 379fc546a367c9b477f0395f6c48cf7fd67cfa368823c8bbaed56cf0ce3103b634969dd4230772aac6cc534536115116c21f47a41649612416f9bfe4a8235b14

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fi-fi\AppStore_icon.svg

MD5 7ba320e966b1573743fa358dfa520d0a
SHA1 d7ebb5afad0ee067c1c10addb789e92557925a3c
SHA256 424a2f54a502199deb031247ec7c7b43e1a4ea0130b7638d3529154906d36f58
SHA512 df2094c904751631821d0b5ad77106a442a3a8efd315be094ce44ce830bce1869499461bd7ff5a1b0687bf0a7b92bbf96acdf35912c7ea9d832f68eda9247ffa

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\es-es\PlayStore_icon.svg.encrypted

MD5 bbdf3ef4c4f666bfd945f4a9c83d2a0a
SHA1 00edd910deb65e039648cc73381f3428618685f8
SHA256 2bb304d2210cfae680e588e86d1ce0362d3c2473bd776ddfb88fdeb391d88dc9
SHA512 388f0f352b63c9e4f7afb3913b4accbccb220b30f1475d77ecaa5eada063ae386cce355bf008f1aa72da7e2b4b1c65b2908c4a409382cd8f5715ce826490f8da

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fi-fi\PlayStore_icon.svg.encrypted

MD5 c3fdb6a7e376ebc4893335a2fa36393a
SHA1 82747ce1eaddfe60ebef90f1e42e977178fdd9a0
SHA256 24066bddd3c1584e35383135c4c59d2abf3ca08a1517e6a3608c6618fa4301a2
SHA512 99bc807fa334022dbf76f5247224b088762eed268e01ba2b8c7a9d4034cb8134d87a24b8393e109767bd5b6dc1544173ad59e865bbeb52743af906822d13a190

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fr-fr\PlayStore_icon.svg.encrypted

MD5 ba08d6b3970490ce75cd5a8b5f6fce81
SHA1 c7e8ef78dbf1513d2fe88b551e4b1cd470a9ea93
SHA256 874e3d809f3d2045618167a8fd5dbaa936f0584f4eb2e9fdca5ed3fa2a70e5ae
SHA512 2f9748e7306888de9d32b3f247d33a4d893292b0cd1a02d6e8d711f68cdf84794e407b853fc1fbc9645e6226c2781e0f19717c29533fcafa77d91ce5ae595b1d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fr-fr\AppStore_icon.svg.encrypted

MD5 89fabb95d28261e273851dd33d99e4d5
SHA1 7a02e001cb11a3e842d5840944e616aa541c02c0
SHA256 cbaea651b24b6b9b26a6f02ddf81fc0ee83316cdf6a040c979fa35359386462d
SHA512 c2b2e238665f80ae4185a965d1ad4e53402e1f0f0d2acc57eff8032a2d6332379e182b334ec13d4ae7530ba95be952959f1d29dae2d5706de851e992536d3e80

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\it-it\AppStore_icon.svg

MD5 dac52ee5671871bfc24c63f6e32d8611
SHA1 11c0668f4682ba6d39ad0c8e97d810ef979a5d78
SHA256 f8d56aa2b0a6dc36637d13229b7c4927d1d8a6e0adc91fb5fb4a41cc75d7627b
SHA512 8b822bbbe38282f014a003794e5319c87f578ce8163fae6a5167304195cbb4effc560ed9b16162699acbc33b52d3cd8a38293572d0f07ead1d09c4dd1c2b39a7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\AppStore_icon.svg

MD5 159b314cb383c5a48dea435d79c2120c
SHA1 edaebcc39408ebf4a24d44d7867a0677231e4eba
SHA256 9f34660893e813152dd91214f54749c06abadae365e34b24f5e60067eaf94a46
SHA512 2c91707d310f5ca2e0fe8e04d0544936370314a5e83fdafe037bae82033b4364821e0936dfb44a967a2c44cd4fffb068e26e69544cb6e00b800ced1cff8bc000

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\PlayStore_icon.svg

MD5 d4090f71b029f3d45005165a35e504ab
SHA1 af80e0db45be6d859f0a451ce977722bbac4257d
SHA256 d9b03732ed92b9bdeb86ccfdcec9289aef473a3bed1b5d5f450ac49beb2c087b
SHA512 f0e0a75b89b5cc664dca28a22b8752d7a75aafc37c12f8517c40dfb6f68dca17c11b8df9c53dd4f3c5dbb3677dc77f3d96e7335801dced92093c2d7c3d4e451d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\AppStore_icon.svg.encrypted

MD5 7b74fba4f696919cf9c6a7668724e9a7
SHA1 0447e3d6e967368a0adc82c55b175f41ee7cfda5
SHA256 bbb73af221b8882c72a9d84ed3af67aa648791d924b0045691be5f709bbc4fa2
SHA512 5e93ec01de4f8910f3ad50519a0528c862022b79b3290a43e4680ccafa967e6c802fba8512127091ededca25cd7fe2d5868ece43dfcfc69f1d2dd813fd068ad0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\it-it\PlayStore_icon.svg

MD5 b4188d19a32fe607e9e12b62bf3bde51
SHA1 ae261a3e9a1b2232cc3d907770f9326b1e9989bd
SHA256 de794f63d82fb12d133136aff4c443c6e5c576464d2673eb93db326ed46be1d7
SHA512 a8dc108e4cd9dbf2b5e758f7cade71e7e171d92b7ab3fb1ea7d484c0f192fa5e9b3e5cf77f0f02429b4f02749d719e4f1116ccb4994d5f6045b1a24433597289

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\nb-no\AppStore_icon.svg

MD5 5d795e325bc7c22e15f67f79f85080c9
SHA1 72d231b7abef7eab51026bbccbe2bfcfb1105785
SHA256 bfc6836873d5cfef79813719d8b838087ec06868f05c81f50b8e3f0ae004dca7
SHA512 022f8526b6a06a97afaeb33200c92e0128eabfee2564403527968c6f882b81bb49168026deef747ac3e18d7c23a58ccc20ff448b5edac2d406a7fa3419cbd751

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\AppStore_icon.svg

MD5 9359bf445b8e9d587898d9442885f668
SHA1 44d20a38f36e381f4800392e41268f02dc63e762
SHA256 44cb6f997bc4a30ece690d92dd13593e98daf4a7a6a80f3a3c4d9d98be50d4ab
SHA512 9e2c8e4611eed7c28f4264105e15afce59be107b34cf990ff6e269882ba1cd8fe1e93637392017a947c228b96383aaaa41a385b5b84c09d549c32c7b67b5681f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pt-br\AppStore_icon.svg

MD5 9088e3f402d5809055b7d48766ea0955
SHA1 18a5dd12bdaa718ad2e4f08b134ed1fdf4d9053c
SHA256 1c927385c0f1b76a88f227e8e83f14d17321cc233f3ac32e84a6af2502ac9444
SHA512 395d2f1b6d2d707aee1652177742cb9c5d8d40baf75a1dd02b05a3c7e08fe6ba5a45779dae991640cc1a1b27243154cbf6826a14618ddc072f4427ecc4fdd382

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ru-ru\AppStore_icon.svg

MD5 00efd00ca24671bacd2ec280e9af94bd
SHA1 8d616c663d755066d110123c5c946ac81395f4e4
SHA256 ad2a53915c86a5571a2e334f39124986181b0e99423e7881ca9caff01f916009
SHA512 4c689b908634bc49a990df7245e91e2d62019e30080d200a1229c9b31a19e54a1e4e1d1c73517f9a871963f9808abbdbfa687b93d4522cd01b9bca78b903a7c0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\sv-se\AppStore_icon.svg

MD5 62c41f9856195ce835b24c190dd7c52c
SHA1 efbebfcc5f5c74577dfe63f4c5626b73a0c9622e
SHA256 f05b92b3c3fd62a514868f0f093670a4d7cbe94f98991f9498d937caf78ddb71
SHA512 b482b8ca4e0466c7670c925c9a3564c4a5583c16d0917eba5dfab5767763a9a056040e93323d5323ff3aaab6b2ee9589b8229b4f9ecdf3de7b0f4ad5db4a5c25

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\tr-tr\AppStore_icon.svg

MD5 6e3752ea82cddb4a03346c5b760602d8
SHA1 fea317b96726cd287f1c38b379cdd677a0e9c73a
SHA256 e95639714adac209fe46cfc498b3830f33ac4f698128be4e2a50011e92dd4c05
SHA512 a19566b2c447b468c7a9587868c9408f25e99219d979caa41a359162dce779c83ddddc4f0a1b75fc3a22d41674bcab4ea504bd0c41cdfc8d19b7990067c97468

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-cn\AppStore_icon.svg.encrypted

MD5 a10e3b386a1f1bbbb248d8d7daa2ec48
SHA1 039ea08df4ba5ca0f53e7356b028dbd7acc9a73f
SHA256 f884f2218be6b6ddc1c3d81b50de81949b2230cb5a7d8957949fa2a71c65af7f
SHA512 ae35d4ed00fd10a52332b38f8d3012f78b792db3dec810cfd0c0fe04df005f1adcd387882e5a46895292dd2ce5e8ca887383221a084faefe05ecb2884673ac44

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-tw\AppStore_icon.svg.encrypted

MD5 67f823a396c4a5896bc11b154765a757
SHA1 2353d48b0f2df33de8057e2fb26584e36e00851d
SHA256 177db5a73f91779112eeb86c421121f0c4ed6dbcfd86120c4637be7146135b94
SHA512 2bbd37d30c2e064e5c27ddda47f73d85ff916497017b1a900accc6dbe603b85661347d08cbb5fe6feff1a281fd8f96d3a7f88d114ff048515c6041b6115bfb80

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Light.pdf

MD5 da56d5d9090deaad9d0434cdc528bc40
SHA1 348e8523de2f39f400a24cf34aebd21c44347309
SHA256 3e197a72ea46439e52780d75dc748587c5aac555d6d84ce7d144384be5254953
SHA512 7fbdb0122ee646041a225403af7c997bfe6c827eb96fc7c1c18636ff5c96348a523ddd89a44336bafa49437c6759564cfe15ca130894c669f32fe83cf110996a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Light.pdf

MD5 e34ae5ccab2c765d213491e0bc3c4457
SHA1 180806dc15c6f131acec9f1a5a87e245d386f8eb
SHA256 e7dcea4e5c8b455c2a48ab7561434d83ab5debec17b9c32b175b3d26a5a4805e
SHA512 629044e7818c3425cf9ce45d988a9984ca4cb4d7472a84efb6171ab69bf6a3a72ca7975a782b2f63a75b5a675bd727fb819d5bf44d984a32cbffd20c73547701

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\no_get.svg

MD5 a99207147b5e9eb6829d81fb4d75dd6a
SHA1 fbeef8aa3a1e1955fa6d494b34b4bae9fccff0b1
SHA256 a0368ac4fa5fc43484f03ef7b7a65ec755d7e0d6c1091dfecaeef6b163a3216b
SHA512 66da8b395a37e0d08ce2dc602cb64826b93a19ef31431ed6647a98e669b73aa11cba131c05cf6e7ef5eca07c2238b00484deef3dd85b040eec35b64ef4b1747d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-variant2.gif

MD5 ce77f05eae8b4cfbbc5cafc8f99e9d5f
SHA1 3803011528314d14942f251aa5b797e08358b5c3
SHA256 1cb3f804db23c012f6f7bb79659d3e2c49565e2f9be301ad9b0f7da96b801a92
SHA512 8e42b03a30e30a865562cacc0ffaced4e5aaf771d1ce6ac5fdeab31d70755bebb5a9f44d3d1b22f8e1d85f4f9b7c25fd64e11a9999ad4657d823bb64319cc397

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-variant2-2x.gif

MD5 0e18763870c4ca2e74156c4da6e0116a
SHA1 b056d3fd50cd4f63a836d16902b1d84d57919ffe
SHA256 6a176da9fd6d3b76791b280d6e7cac8e630b39e111494af814819222557b7fb3
SHA512 611d5c727b5254c9eb4f1e5d37b149ee9e26ab3d20c2b0d85f07a77f902a229f798a1b68b410008be2f64aff740aaa2a05adb5d857804e992f0fe5902b20ae44

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pl_get.svg

MD5 bab5f4b0f9e75f39adc0131c3e77de28
SHA1 ea215c08aa0a469a5f1a77201d64eaa04f021bc1
SHA256 47da39c801f142b35a95107ed19fb8e87b1340f2ef164d9b613890d8fb87461f
SHA512 bf4ae3e2bb0edb7c72a3726caadc04432f5418f049cdfa1926edf04eaa89f6c829f2f257087ba17ca5e0512d714d738ea136b19e9f173877ce7003d180c89740

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pt-br_get.svg

MD5 680cca01fef7e37526bb9f364c6934af
SHA1 36208b3ad3abd132429e99a9ebdc02f78c1be96f
SHA256 162e3ed8c61a796ce0e37a2080af28f541874bc26f5871b9f09de16548710af9
SHA512 f8ef22967e7731b5f82eb3661fdca207215b2d7cdb3b9a6446885bd086c2b10abf76c3779de1a36ebcbf81bd40660ffaded263b11733f7bc27103b580505be3a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\ru_get.svg

MD5 f2927ee8d4faff2f30f64fd94863d678
SHA1 270e6c89f4984e569c159dd5931c47aad16164b2
SHA256 37556993927332da5c3c109e1f581c5963fbd92934df7bcd701569df1dc5fea9
SHA512 1c35f7e631bae0714743b4256c8fd5bf5ba901e17257f4d1380aa234bfd7ab74e53c8443898473f4cb43c93ebbd73c42824c07981272a619203d942d1445fabb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sv_get.svg

MD5 72b19c52a199fa85cb3fcc0687c50afd
SHA1 26262de5d449960476748c14d5765e137d078e99
SHA256 1ddff0ce431ed581bf440cdcaf1e82eecf8ffd8a047b5277501e636e1c8baf3f
SHA512 eae63844821f6464378bd9d3f5ad23388bd5752a83d196930af17123d25b8eb8063e174cd938250e844be330ec1d16ea2e4176431e55ae06ccb30dcb701c0705

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\tr_get.svg

MD5 789edad9ef69b8f2b191d0fffa14477d
SHA1 4834dce14c195f1bb46b0ab72e384ca787ea9fa6
SHA256 8be91d193fa842bc5b0e26c25baca952ff3b95c9bb8a8f8730db6136fdfaeba3
SHA512 22b4742690231c9defdbaeb1a15328d7e9a9756181d3f7ab40f721977acffd4617fa923631ad78abf462ef96ea57a6294177bfda089798f0cec45256425ebeeb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\zh-tw_get.svg

MD5 57c6e4d8e876a04c5775a6701182b0f5
SHA1 b73b06af998eecb404f29913510fb9ddf36d8de3
SHA256 9add0daf4e77a810379a0e1b3a10276c0d6d03c4b206146d672ff424a592a4d0
SHA512 d3497f03f007ba3220ce6d2c43e2d6e96df35542c83d13d86b309d52944e96d41d96fca0dfb87db701c1b7c18899f3ac80b798242731b31eaf6b0123ce8821e4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\zh-cn_get.svg

MD5 599f690812b4ef418c4ed8a6ca652dca
SHA1 69dd1c1f8558d49db25da2b1ac6cf8e5712dd149
SHA256 e5c937b9b3f8c255628f477197addd06040ee600799c345433d35cbc6133fff0
SHA512 da6960fd5a78c84a2b5093d5cc22758a0a3954b64f3115bb11c284336dcc045d4f3c36a10a5a83a3ca4f1e797bcf6ad9202dd1206578e6c523afb4e0866370af

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-il\ui-strings.js

MD5 8347ac7031fe650c35de8fdf6302c4ce
SHA1 cbfa395233bf14266509f043997ad13d6af78fd9
SHA256 c39a23f452e902ca40d8b2cd7fca3d1d92c0a086f05aef972434d3fa9c76771a
SHA512 8b1c60e00c7f6f3ff36c5788f20c7606233b1f16a9b7d10ed85e651dd50efd3d7406fbfaa8e820bc8c1f142e78ec7ff3b3068034f737e3aab95d4fb85c6b441a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-ma\ui-strings.js

MD5 c8e639e7bbbe74517aaa87faf98c8c05
SHA1 76e907694a88ba80e68579747cb5c2b2fff5e56f
SHA256 8acaa4c3b6a4e8c10bcd0e2ace1f7e99133d23b9f0a3fd11b2dc5c0393b3dc34
SHA512 50246562dc93afd68e5770e8d37b8bb867f9c0e0f1ce0aa9c1ccda141d4c51af8c10b21fa7bb54a17cff415859577a52643656edf099ff7d06bf32eca0228003

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ui-strings.js

MD5 a003c1e31a82653b855518fc0a7ee459
SHA1 fc492ffac0650572bb8d8b1a1a8c6b241c7227d9
SHA256 15b6c550e83e7feddfe6b41ca48e5f2a2ae132244e47634da64cccb86e47dedc
SHA512 51edd6eae4b963f1cf2b1ffc280fc17f5d4075805896a9708430c3612fd3aa2cc71d96d4c8d0047b814acf0b48f38264a52825427580796a3993b5025080658b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\cstm_brand_preview.png

MD5 3eb36a6da34ad887683cd0dba0b64f4d
SHA1 b290c281dcea124381697eb76f392f10b589518d
SHA256 53a2b00027a40413023d69cc0ea967d5b946d2808b5db2a9447f1a7f7678440a
SHA512 06865ad30414200199c07a222498804b68c93ce7a918baec42287eacacd500049fc9655d49ffb447a8d94d93ee7a42bdff33f32778a5eee4b2903f7cfae890c4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\bun.png

MD5 93b1d71e537c42e2281f3a3331007450
SHA1 9257b0e4a72284900e0edb6c44f219c1f9c61bdc
SHA256 c5508d358f5589cf7a59ec62572a978def03552aabe8ac797902c66714bd728b
SHA512 47708707f969d1cf2bd288efaf86d6b20186e9d5c143bcc23977bfac829996ce8b070b4443618ad509ec91014a3aae06e579bd9965d9920e159a22ad4c0c776b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\cstm_brand_preview2x.png

MD5 22c97c84bfc0d37613ae026bbb34067c
SHA1 896c21549e056fc3e3c00359a536a48cd9d4ea3a
SHA256 04b3940a56ac1803a66802d916ca383959474c0cf9700cc87adef92d8c4cabb7
SHA512 05be92c5a83b3fd97d2ed5cfa9a065f9db0bfcb95139a9fae43ccc7abbfeaa9805812a68a08118bd2cab5f16bdf4740527fe5f1918fa27468cd7c851900affda

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\dd_arrow_small.png

MD5 ff169ecf047b4ec72fd97172da404104
SHA1 792493846d2ce6d7a421c50cbab121918ae40cca
SHA256 48cf31014ea86ad8f10e4b8315bcf03c62a472715c867a719f1dc0a9dda4f2e7
SHA512 9dbb391ee03905cebb7f8bdc0cb7707fa255b56b0b5a415844ead3dc5a83cbf6455919a9ca780cfa3f9eb56fa48fe68f085e30752c840ac750e2174702e5491d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\dd_arrow_small2x.png.encrypted

MD5 ce98a3eb04bd84f27344d77feef55c0d
SHA1 539551063c8cbf4103e32fe902b1770701fb43ea
SHA256 f1f9dcedc60912a7de3053dcbcdd51b94c68f4cdb16e2d6b3f0064c66ff34a38
SHA512 1071b8c9d691066023b7d2f09a3c9aa407410a4c848280aad2a3e0e845b1b592015d6aac6e9bd5053ec600b74e2e6a1c82cc669dfcf656f19c7b74ae428823fe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\nub.png.encrypted

MD5 563db2f0495478c46ca0f93202d59193
SHA1 8fd5a9319cdd0abc400e5d03ada6c59a4fc5c8b3
SHA256 8d551aaed70bd05d92766063bd95ccf7b70e7240452c9ededf8d0e35f3589d9b
SHA512 f91aae57a604d50af60160863125b906fb1be049d48c36a206348e559bf2416677a335027d27665b4730604fbf21c5f09fddfa9e67d712a86edbf0c63686fc0f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\sat_logo_2x.png

MD5 bd6d5931d04c4059ec3f70547c6c7212
SHA1 4c1a41b9c56459e7749cad8d9b4702a05417a5c5
SHA256 e95c19ab7e9b213e859e93f448220b053f2602f4c9e2572b3a6df20d763750a0
SHA512 75dfb10f603ca2ebb673a0550989499c694494374a2b005983824d771014fee1671cbbb7382a4579d219102052c2705dba5bedae0caf710f61b57aba1a650c36

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\sat_logo.png

MD5 78713db8106eeec6f6e40cf00521c6d8
SHA1 66834e1e2a7360a58e2da0d5595a1759b13d85c3
SHA256 b0705bab1a4d3437c4f1e5570ac8c3057e24aa1192b7d2545122db4bf6e41f18
SHA512 45c1f765733589adf8aaefc43b9d61b156e0e27624546ab444d73b387766eb3edc0d686f8ba93f8756a64fc45642a4fc980bf2aa47da16169e0678ca4b917ae0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\share_icons.png

MD5 506f631de893c534d1853a9adaaf8eb3
SHA1 c3a6fb6577a947322193ed050f904cba555c5a4b
SHA256 1dad96dd4a249c6f21c9df9e9ffa36b881b7e60017d71e7d8fe6f18da1dde8c4
SHA512 7a4c908d4eb3e6b9b3c4dcb2b08872b40fa595f6c56061326b258a408570e09748af9980689712ec3cbcae16fe18e24ff45db635a3a3ca36c25efb09e762aa0e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\share_icons2x.png

MD5 27941f66af6592bda8ee66ddf5848623
SHA1 81c1ad001492733fee17d79d96ae831f39e6f132
SHA256 4cee7f92bf97a43111b4405ff093ed0c4a6009b979f5ae1c06499016157af185
SHA512 fcb5f869bbc58c29f5cb3d94bbd04a716d1a43312f3f86c1c131658c7c0d7996cf48356f6dc700226cb154162be41de17025ad4f651f1c84bca3f6273b38c40c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\s_thumbnailview_18.svg

MD5 5be00abeae24a4cb0b28f7193e77400d
SHA1 cdb70dbc394e7a6e38e149d3c83e44e33a3e70ec
SHA256 cd5d9bd030b72e931c707d26e31543fd2c87cc8833e7caf4ee736b1c65729d95
SHA512 f6355996c776a930976817a21d40098af263b8138875b622af0a089cf8717454e7d375119446b4605d5728fcde1ed47f8530a8ceea63a57006dd663e3b8cbd69

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\s_listview_18.svg

MD5 644fe21b69cdb3d5706d69e751bdea4a
SHA1 20eceec8d8e2a53aad2ee635e0719b5d8e38f00a
SHA256 4d4ccfc8c1794ba1d271379b5579504f71eb938e56cca65da0f4347e74491b71
SHA512 2c2cc5b5f3c0e5f5d009f48075f9ae8e19858c00e5913265a1bbebdd30fc2bb09eb0f4561462af7e55251af2b10c50b4ff2820c3d44c7670c076360a9789059c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-il\ui-strings.js

MD5 09e85c805edd4b12ba5dddb9a421db5e
SHA1 f31cb3506eaa30b63db328bc20a12d68eb425de4
SHA256 cff2723e0e40835cae4cc54db9b59f2aae0a6b04a08835cb318a584a0e18b17b
SHA512 7b7551292616005cfb0f68d5474b61698fa799405e076e13056fd4cc939580a19869c15d0f45c7a8ab20147317b5f3f17171fa3670f4cee7483078a9f99eb414

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-ma\ui-strings.js

MD5 6e94a8791db84fc3468a9de8578fb934
SHA1 742138ad01025602012dce1d6d89236b5f9fa3bd
SHA256 1cf70d8eccd786125ab1b39b202d8c611cca6ab060f8d2d044218ddda9cb57b5
SHA512 8217c57a4bf1fade9dc842659516ad0ec8ea7dae61aafac41620bf1af6793e8c94f9f923a8755f02b389bcf04d7c3e25045865f601fae9b003f1d048d5d7730a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\css\main-selector.css

MD5 50be2c8f41a8319b1387af71a1147a84
SHA1 875422ae23ec2b799bdcbee3fcb603edba967de6
SHA256 e74721bbf06d4b2a010f3fa8e7c05e979eea6021f61af340dba4f5b8e07a0e23
SHA512 dbc916dd94dabbe0fc9933063819b4da7abee0ee30f1af9c93ccb0b0f7b3899a77f93716d516067fd9ed5573ca1ebdf596b81aef388b4302d96181fa499509b2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-il\ui-strings.js.encrypted

MD5 9a14a89d78cd89ea607c490908f8701c
SHA1 5c0601ecc803f7b409f24b5ca9c2c78c469bc336
SHA256 606c7275d6e1e0e59fc8fbf3bb8c838399afdf5acf7c214f8466ef93c5f9389a
SHA512 f54114365f375d7366d7e58f515effeba14c435e6ea99f5a258030d0c45233ce0dddfffe06eb9599ea0331408d0c0caeb37f8472ffa6373d0fabfefdd81f266c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-ma\ui-strings.js.encrypted

MD5 6c262178a5585b71e5882aeff94580c0
SHA1 2ce63a1073cce7fec4e8d9e30abf5aa7d21df152
SHA256 dd7278e0242fea2ab65368447d9d2f87d16dc7471bfe50acebc21aa9400b679d
SHA512 8bb19c009c3b0517595c5a4fbcf0fdb80cc033585e4aea51092ca3167ee4c7d9ae27e0d872935ff666cb820d406a57d7f101f41479f0ef227f336e6c8249f2ab

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ui-strings.js

MD5 2df5367a8f5f5717d5cdd769180509dd
SHA1 ba1c743af0f832ca4c77c6f486033db82c0562f6
SHA256 adacca689c2f31e0ae434627a3260ed09392317dec42c1dc273725c9432c06f8
SHA512 4b5e54df56dfc21d66aede3e4ee868bc3339e33446cbaa46596ea4a67b3b32a2cd2f27f4c9dadbe6f644840832d77f51f163ab6347c22cff3c0be8b2f7308ec8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\selector.js.encrypted

MD5 7b41270400c0910c6e98839dd804e6ad
SHA1 5193016a9b06f18353a3f99728b60837bf737f11
SHA256 430720399af038ca4ab1574a37967ff587ba37881423204bb5558c7e1f905c77
SHA512 2330aa884d277655bb1f6c2727cf698c98ae9c6a51e62d80a6d0d72e808afc74d9a3744ddd8553dbd5bcd424257a8a42c506b27767d697961e32ea9ed5eca00d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_nl_135x40.svg

MD5 88567652157858611e3400ec05b61702
SHA1 9a0c02a4b2822e6fca00b90057a4996413fa27fa
SHA256 06da60fdd0726f16640a1eeac663ceb1016bbec7553c9a035fd7ba1d0a768c0e
SHA512 020c04c0ccf3155843e117995c8f6ea243acb0dcc7f3532b1e3bc63637e2ff3b3cbc02622493680034d709a6c6bf9f6bd31f4e33aa6ff4cd9a3c33097dfdd075

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\check-mark-1x.png

MD5 cdfb9ca45acc23b8bcdb8085d0eb653f
SHA1 6729384081e945e0e1477b2efb81d94bd82661aa
SHA256 fb0a300b51b3e1c292a426c6ebe8c37809f0614ea86185cb1b1b466e30c26589
SHA512 fc771348f50bfc360cb0f9e2c91ded824ccc425c7a7b3f7dc2dce08d979c1038183743a30d8e3a64a90bef8e607685f2dfc27b36e5ef18b6a21ae65fdd192a40

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\check-mark-2x.png

MD5 d557f71476887da33c9e84703fb19e91
SHA1 343bc76a6200d21ed6034c73f19b049c28e3e3e3
SHA256 ea7bce3385c4abdb52b9e6b92fcaeb00da9c62747296110dd215acfbbc43ac11
SHA512 ad81c0e87737c7855ae09f0ecbac54639bba7e3aca35f0d484e9fd100d0f2fa9e21773599025c851ce92091aeab0a9dd11108592b176fdf7bf62342c7aba638f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\inline-error-2x.png

MD5 58dc5af4e51249a876e951bd145533ba
SHA1 289fc5a1f8935baca052ec55e52defc3e31e796d
SHA256 4a45f5bdbb74dfbd1e4b5ea07e7fbceb74f323bb39de76585f3c485cc16f1446
SHA512 e823ff80f0913f36c32c7f40ab080bbea94f5187e551f993845471f0080b25592bb20b104616d279b28715bc4e0afabb2180787726cc33928fde4de717e49f4f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\inline-error-1x.png

MD5 43cd4b5c7a6cac40b7c3dfbd5807893a
SHA1 7d5add7a3bc84c59cfd3cc27de762ae44888314f
SHA256 59fd6a057d4b2f0aafaa73690ad0df0fd166237e4e289342af433b27506e89f5
SHA512 6cd07426f6a82b64e76b0754436eea96117cbcd678c2cd287fe2e801f14d5dff68f00b20cbaf99a8d99747231ed9ef512a2e8a01e59fa9b2e31ef96363297885

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\[email protected]

MD5 1a8ed05ac7a8594b01f965cff25e3bc2
SHA1 c04ec035f880ede082a64e3561140bdf7d82a7b0
SHA256 ba779d9ecc0d0e4bc7e8e10f5bdbb3be106a362b93e88397c9a0b346cbc12706
SHA512 8c828425f245509427853b4cb82ab083ec06f6435766df880aa06ec42f9291426b57d374045939214e34cdbd33924f2afecc4f85cd9aa081aa7e0794517584af

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\flags.png.encrypted

MD5 1a90db35f1a2b55f98da3b871a9bba0b
SHA1 293b7ccc7e68631ddc302d86571d94b21f7315cf
SHA256 2912a512e61d3097c0b841c76f103a3ee116a5fb7c96867879db9fbb8958dc59
SHA512 9e3b5fe2a44d39e86798e5f125d10e8183d36768f01af7793b0b2f66521b282dfe4d9a0f21f4ff44eda4b47ce6f80ed4c396530cee07ee3d3db90a2d92438910

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\am_get.svg

MD5 70bd69f049bbc127a6938b6339a97c23
SHA1 d43b45467226c2a6a8999172e5f4d3147672b89e
SHA256 3b0e421d8ba3bcf0e57fa398117cfd159bf0b06313d2e15d8eed51ac46b3b687
SHA512 281aa124431b008ed32949a36fcecd02aa995282ced09c8c76f0f34e84792992167e6f4af56a022ade53229a4ebe24ba8b561b7459581c2da70930996a38289e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\af_get.svg.encrypted

MD5 0ddc1fa4241c0efc60c10639134edeb1
SHA1 d7b92e9b60f8ecfcb574e31d82f7c2f78bdebc1c
SHA256 4569edc72b03d57e5fb514fe1206493bc2192dd756929ad917c19b370fd3aa5e
SHA512 f801591934b360e58e4c56627d11ffe88eccf9c00537607b239327feffc9259341ae8934f42cc0b24c9807d36856ece35217a828d812303b03102833a44a1313

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ar_get.svg

MD5 5a9c2417a3a43305965aaf92eabefd83
SHA1 228e993a29eee6a5aea859615da827f94897be2a
SHA256 c859dbb4f5b9f4bd4418809ceb8de7c426aa5b2cfdbbdc0f9ac5d123dff3388f
SHA512 1fa500a652b1b7dc140f8ac2960aa6efbd51c290a4aa278e3f88713be0abf062d98393165756b771c59e6cae8388481b9b6870368461d9107e802b06cc10e97f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\az_get.svg

MD5 c12030d3206a50cc013ec7c01e7c411b
SHA1 866240a261c679d89695c1e711e53f472d49ce43
SHA256 db70f78bf6e85c1d7fcbd3cbc8c4055d9657024c256132eb7035e658b6704c26
SHA512 8de7bc4ad93bbb7e05c4da9d2e3c93108327b5ae39320f831420cd70fd2ee9583e40009a06c964746b6c6c07377ecdfcbe0630440e8f82892d899c2cbad967b2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\be_get.svg

MD5 c03bfd55d9c6f8c100757ce5f1481eae
SHA1 b29e3a64b816ebded13d6db22e74441ac33897a1
SHA256 36779e310d73df4106145d074a14e46cd8f7e65ed1208f3bbb5aeef03c84bae4
SHA512 f3aada35ab6eb07e4112122fd853cee8aa141065a9a784bd08cf2cc1d35a181644c94dfd4181580ba2b5f5ecd58e4f898830df56ef258d2b2edee53501ba0740

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\bg_get.svg

MD5 577e1975497f10759d8ff832bcf51af1
SHA1 6013f2d675787c38c4b4a3631844ea4a1e03aded
SHA256 3174c827a1d32abda3980988a264e9c2f99cd4cc0d1dd329aae6bd8f8098d265
SHA512 fc1537c0e8ecdc46039b1adde20cd08e40724707e7d02c8aff9dd66f9638f77406e630428d27a2408d1db3debf7334ea750fe2cf6ee137e4c21c567f9a722575

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\el_get.svg.encrypted

MD5 b531b0b07e1c18b0dd750987b5a13e61
SHA1 b18a9bbe40425a32de3a88bbc0f58f5d32e20724
SHA256 b82475b67b8ccaeeb29c41782faafd23465c945acbb8d4baee07d86a74cd164f
SHA512 9103c68cc74b9dff3a6da68355005a2ad9a83cd5f5dd1b060472ccf10fae4bd73272bebc6c0ac6ca652bf65953830b3e7b9a66c8988819a0e11c2f2735d8c1e6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fil_get.svg.encrypted

MD5 d4014e3aa386fef7835d060f395ab7dc
SHA1 46538b995ec7df395efed0973d684591776a83f9
SHA256 73a7dcf9066d94be414a356fad82619fbc620d0f2c74db5e9610fad3eb7933cc
SHA512 cd2b393297feeaa476d4e87aaaae6d5cdfbae6cab33ffe9daefe6b76186f1c991b41fad5a534658e9c9f0fec4e734e7fcb580faa26963b6a03eba7aa25de771a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\hu_get.svg

MD5 b6135b9cb2668da52540629b59c16201
SHA1 81f2e16e114e97c29f7da22ee5d3857225a4a1d8
SHA256 8d7fa2e1cc3b8cd291b73a5556a4eeb11ef5c659365e94a3ede3de45f4732436
SHA512 ccff6897a3f4a77b12500730f5197d15230b79abbb8679b98e89ad18154a616ce02b3c8e007b04116042eb030941fa1c10ce1b69934de9a049ee7cd087a51c45

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\id_get.svg

MD5 ffb760d62e1ea253487cded35127768e
SHA1 7e59587fd9adea7e3105d4259d2c7a5b6bd3fa7a
SHA256 c62b41fc7908b254ce800082d524bc08f889587f26f64aeca377628af11dcfc6
SHA512 a863d1498c65181cb4b225e304d96e2f8c3a47140829bcc818e7c1c72f79b9aac4c88afab7698a10a34d4fe963a476dd3c6755c3bd14896196166cfb19321cff

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\iw_get.svg

MD5 9e610539e50db3e4bbb4c058dd114810
SHA1 4c1c6350b9efa40349112711965b7a642530458a
SHA256 3a46f9661ec9ae9197033b495bed596871e9d012f21d6855e5c5afa196b79966
SHA512 2d66bc4f23895120dc00a6473636bd1d775e19bb0f422b1a2b3b3b7690b31c7af8e650fab8e299252c923047927804acfacd9db4883cd14147e9368f8327e2f0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\lt_get.svg

MD5 b55ca1fca8c4453fbf7f9e6acfab4af6
SHA1 3927273310d2272ec1435d633ed0bcd4c23c8ce2
SHA256 dcbd52b25abc9fbd6faaf06266bff1a90ef83f7e930b063b888e13b6e0ab1ebc
SHA512 94e6dcc2132fb66cf0c8c498ae543f64e80f0f777398ab2e674ecabf03655d45328a0a50cd105a7d85babbb61eb1ad13dcd0c031861aa4ed8c969bc066187eee

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\lv_get.svg

MD5 0f786a41dfc228a7cdc6725009c0b903
SHA1 abfb851b06154b86517f68ea3ec0cf42c70d6c25
SHA256 13d9f5f6652dc9a97f9b65e12471110ec6b3bb1ab17969435bb4d04421c6f788
SHA512 2d368e4f56cf280ba0d138c39a5359f410d6d16947546be4eaf6a7044c43846b8c0b779440c4bbec8cd0f78e75613f9d4c671279847b3f55ba361869e1835082

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ms_get.svg

MD5 417c15fe21198a311ac9c82ce1e8b2d1
SHA1 c40b897ee300e0a8029e0be5ccb482f0a8b6d432
SHA256 5822e5afda08363a95c5d2942f7da350385ce6d18a9242e6cd47ec2b3555b831
SHA512 cf0fdd86cece923797ea6e0f4ebbf7ec6bcab9b1d1b8c61d00340bc4d002a31fd2ab81fd1326b9d2db53c190ce22eb33a6ce7d09e6afafddcb93c9a6bce737b5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\nl_get.svg

MD5 e2c1dc98549b208a9c9ed624c2fee5e3
SHA1 833b6f44c2ff340e7486f2a039abd2a076e17956
SHA256 1c41cefdac578870f046cb1b891897f6e1dad8e01fb045f877590ef2fb2e9476
SHA512 8a48f72057d55bee0a37179c91a21c9b1f20ca1a168f5fbd5743fee1cbeb0ce600cec7443e8b4b97c50c5879140e206e1813308e8fcf03dc59bfd0801d097b43

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pt_get.svg.encrypted

MD5 5d9a525cfb3a1fff5d88eba6cf5591e7
SHA1 04add0bdee98b22fbd9bd0620664a866d07af846
SHA256 1ce9d35dec00257416e76c2adb827ed182e47b80cf6c445cc30a63de773fbbb5
SHA512 bd580f4a767a454497221e3e24e12c183d25bad652fbd04dc253ce3259d232dcb76a70e0970b305f1955c41d4d2cf1bc0fa703f0f26bef201f6beb0ba4e771ed

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ro_get.svg

MD5 2ad2391ef9f30b40d36b5e06f43f4778
SHA1 b3f87325910cf9de2a93a85d9f6ef45dd77f7038
SHA256 799160b9ec8e30c91a86150e6772eca26050f3ffa673fd5e0a0aa73788d73da9
SHA512 0d2b229dc91575efb18d4250e082d84799f37060e5733fee5a654e2dd3f80b42b552bfade6ee6281e806da9066ad3f511c1960e735b116985ea0c0972f538bc4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\sk_get.svg

MD5 1f46dc9714639a5cc33889833c6597ec
SHA1 cad950fb397e4f2ec1a2114673f60222bb206614
SHA256 e1d6b379acaf046f07b2ea0962e82aa3a854922ed9eb0c0b8e2f75e9cee15aaf
SHA512 650d5ce6577cda5c09e074f4c0807eb09808bdead8185fdcfaa53b3a77a9c7c1115a179dc0821a850c4bfd36367e34742bd313122d44b5b6acc138f71565c064

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\sl_get.svg

MD5 a6ce2a1e801ffcfca2ffd85eaa2933fe
SHA1 a9aa75307addaa6cf6f056397e1070a1bdeddfa7
SHA256 ecd13c74da4212cc1eb643340e2dc72621d782893a0f422e62868f84a35a7df1
SHA512 80aa17ac3321e15b200f11e13b5b56ca328c086c676bdccf17b42d6cd5a396470fe2c744f6484fcaa1fa269942c53c2b1e6b1987a324905e721438233ac8605a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\th_get.svg.encrypted

MD5 93de7a8fafe3ada0694d77398c35ea1a
SHA1 6d1e5d8133f93217e61348e4d0c4ca6bf8784cc5
SHA256 494e7381ad00be7b518c9ed8aad000adc30fbcd5853a7023fccffd9e47bbd2a1
SHA512 93110f768a1ff907cdc6341a4b139590675895f564a020f55e44dd1f80084094147eeac90d0b86cf2786b7f2a6173599254209f83e65a70fed394a328e21a777

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\vi_get.svg

MD5 ded7742f14a649faf331d14c2213fd98
SHA1 856de84025aed793890581f4b8a9f3c908bfe204
SHA256 2aebe9a6e096842398687d4059c0104121c1e86dee405f10ea11dd6c6de4d3c0
SHA512 18ee5f4dc353da0d2c290f4d6cad0acff5543e80a39d3e018c02c05c985ae4b294c1e43c5f395af89fab68a6dc0276bd67cf41daf080083c5057177c67d6c6ca

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\[email protected]

MD5 bf42b351281c005491d4ab5912d5895b
SHA1 f7ce266f6fba765289db22f7297a7145942d4aab
SHA256 1fd970b66a20cf184731f21cbade0f855633fbf8210e58da96a21e4e991307f7
SHA512 1ce562dcf10dc0dd9d6fb6f6fe9dff5c9438cc638b07de5ce90732108b95baa8e77391fa196ddb977b3ea4b3ae441c276c4002051ab5b77a01441d3838f30373

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\scanAppLogo.png

MD5 351185bff2d2dd7d594ba7093b822b1d
SHA1 59c2b7ac5b33526b0dbf3d6912ffdc9e2ca13983
SHA256 4796e4f737f0aa68f46e4a9bbfed74ede1effc30974513886dba57cbba590af6
SHA512 fbe3792f0aaf15aad7b4cc092cc25d5a82154f51095192b76cc40c88b8b855aad1d47d6d9e49a4f728d6de330b14c38208e4f380076385d023b520dab9a90318

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\zh-hk_get.svg.encrypted

MD5 0dd9fef832bb9aad286d920c22db3f8d
SHA1 4399f275c7a0b5fbb3f335756895ebbfd1d87388
SHA256 5976007aaffa6d535612cb2150a376ad1f86431009ca48f12521b355d2b7abec
SHA512 67a05b6d7410947c3c553c994c6de986e23b9dac61c8efbf404f89ae6abfcaeacac8d99d837bc8f7d3a342b1d60e303e07ccfd8e25c558651fd183e21653faae

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-il\ui-strings.js

MD5 af7c2e69fc13feabc509452c217f4123
SHA1 35f3a31552ac657090367ca6b5b6e2c2ed8d11d6
SHA256 b847a5403cdce5fe0341afb34c66ed43beecb8b78c7cf87d51409acaa498586f
SHA512 72b5c611069dc34f780afb39603588c0197a9a45258480a7892a8d5c87ae3dacd2bbc9abf91eb10a925eb1fbe495cfb7ba29d10a05ff8f11d6fbed2bbdbf2b6a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fr-ma\ui-strings.js.encrypted

MD5 933db545a2350261c2896f970a9adc59
SHA1 d99547a296190fa0eced6c871139d145f45e53ad
SHA256 7a86078411020be4863a44f84a8370935c502b7234dcf34835eaf10d450a944b
SHA512 fff077e78775047d53352ad4cadc9f0eea4124460bf279165a42ced9ae9f67f4a56f08a7bd31320e685fe3bc8f355ba382c1a4df7b22a0b178e7484e067559a9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\css\main.css

MD5 90cad83ae673db56281d2c5789a8bc5b
SHA1 7a5411ba73f86b1b25a34fd1c140aae3b60c89a9
SHA256 5b7c2a78262ab465edda5dda6493e77e873f64546b6fd63c8bc98d70d80e0cf4
SHA512 d2d0ead798507bf5bee5a616d1e41ac04c2d17c30e0a8fb654d8f883b0ad54a8e990abf2f4d14f0de53ec861a2a451d3ef77166db3392857f45a202f7f63a56b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\de-de\ui-strings.js

MD5 1da3b87d13c1fb1261cacf9f3d0c44bc
SHA1 618a707320d6813b1f525316028ece0e6dc45eac
SHA256 bacd635db3661febcd7a1d721b7de8f23bd78a0dc46bf629ad8638f07c439542
SHA512 ec33d1f41bbf6bd59e0d34fe653d80b681cf223e60191697889bf5b65cab4b4655acf269c17fa2b0055c02be57a8a5c7542a5677c66c467e0ad67dba43e4747c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-gb\ui-strings.js

MD5 8be67b4570a8262bd4041f0c186d00b4
SHA1 129022761eed3df103495aab045356fde48fc287
SHA256 9dcf29078c1ab572a5eb1b3d8c481c1fcc1061bb525ec1afb0fee363b534df59
SHA512 d01867cd6588cad06098e4d4ac0dc10e06db6d0e5760fad7ed389ec7e88c49ca9266a1539ac795d291a0509ff65759c4bc51fb034a1af5133295226f44d8162f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-il\ui-strings.js.encrypted

MD5 c5ad4b454a3461717c6062ae0467241e
SHA1 df70dbc93cfa56eae054a31bce8fd19ec6aeb990
SHA256 54348d6b9281cfcd89964f97169be16e2eb170acd1b7a97bc9ab18c1d029bfad
SHA512 65b41e0b8f579635218729b67bc89fb0ac4002e93652e0cdf11cd018d97b6b50cb37c97914844aed2051beed0bca21aeb705853f07213f05ff792f1194502920

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\faf_icons.png

MD5 223e300a2984e3b49b8286f712e64bb9
SHA1 b6ebfd0bb00d4f1c9d4d10cee7bfb516fefebb47
SHA256 2236436895d35b4ed97369eb50a69838fcb7babeed243ce7c03a3868886e1048
SHA512 fafb43f521af0fc06d9d9b6ff2cafb0dcf98b1a5c7e82eaba945096b468331ef07b987909f8ed88a7a750f0454e672d134dde569c6e9c68296d36d4530d918f7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\cloud_secured.png

MD5 a8ff5213cfd9c17344a9a1ecd74016f9
SHA1 85df7829ff6df467a417f0d637c0b818b39fd8eb
SHA256 f078504c07e8d9bdb51e6b5aa1cc2ab45f216ca9f6ed17041055296f0bd8b7f1
SHA512 cb78f498a2f77af1b0c8a332dce4371d631a83f42ae27269d992216a88deddcb12700dfbfd86e4d3c363fc21205e1b0988f547c155cd570cfdaed20762a56e73

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\cloud_secured_lg.png

MD5 1628dfe29f1053165331ca387984f295
SHA1 fed80c6b04174e885d361524d0154e68bf3417cf
SHA256 b0a5b407f13a946ae34e4a03aa1416f0f3ca9f5a65d9e36a03f5746141ce70e3
SHA512 4bec395fd09848caf03ac8183cf74d1fc1fc190dd5f151c846c9d7d53d19ca004520d7f660ba27e31148bbec88844b7959e150b236d521cff4f69f3716651ce4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\core_icons.png

MD5 dce917b291ab8f0323c9677105bfc74e
SHA1 07fe3710cf59b18e7a2aa21836a86398b05b90f6
SHA256 6a0a953860b1516cd969665a60062058da3c16508559273ff665635b094ce917
SHA512 1e996f8e138af8a2d0ca36e9fb742c34c30638dfbf8c9deae325cf9cd3ee6062288e38a3f0c81269902d0e034435255cbbfbfb0362a32cae884e983a79f16c8b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\sfs_icons.png.encrypted

MD5 a7b708871bd745eab5e3941148fce507
SHA1 30f95513b392769b8a5abb3053bffb00b7362dcc
SHA256 a6b28173b70a218603568c5a5fdcf54dfcc4abaf3eb28dc519e4b16d530fa5a2
SHA512 cc2c780b653688be8125dc717d22a9b695c5995c1e409c60f401a510db81a6adecf7e5af6019b0d7c433162f4e229701debda9bf3da25781497f5be14a9a0ca0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-il\ui-strings.js

MD5 8d5382d2ad42cf4a1befe39b7dcbb9b4
SHA1 ef34108615c662fe210e88d2951f3450696d5b6b
SHA256 2240ea8c32221210d777d8af654966eb6dcfe25bf64fa5d119977e35b1ba7ce3
SHA512 30282ca1cbb32656fd56b91609ec30eb75be4a350e9600b694ee68648c3561baac10c64461fb5815eec96479ee9481db6bf75bac11a4f8986087b4ab5de5b495

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\he-il\ui-strings.js

MD5 7fcf258f7ed18e15ea687b866c134e61
SHA1 76559048312f94be9cd12bc35df9e4975525fd1f
SHA256 870532410f4ca5964e403f3f81556383e8662800652123095c3ce83036898a02
SHA512 efd3458edfe2627e7bc6bc988ec3fadc0b2fec3079327e3da7df6fb43c944114e2a775c6da0c60f1889894783b0d5c7688622292a6463ca2ed458889cb40308b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-ma\ui-strings.js

MD5 48e07358a79a2b712ad1e0fe8363bd55
SHA1 4e6b4d9ed21bdcaec6694918ee2d4f664fe04e9d
SHA256 935a1c94668140de7bd000d67f7d8f36204728a3f104e1a398796ecce3ee5999
SHA512 19ddaedd4ce40efe3d7e3215567cb78168a2381926b73a9a1396e0bae62f53e038a911bfa4818e135f2200ac4554d3ac04e5bc5c2ed677c59d08f68f61eadccd

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-il\ui-strings.js

MD5 f1fde273ef88e8bec606360dcd5d1eb6
SHA1 8ab03339bbe1b27cf789862aeba3badea912e60e
SHA256 9685f943e3f770c7164b3b3f6c5c4b4bc60e9ab18012bcd9d380537af9123a40
SHA512 3d5b850dc239aa646389a81c316dc62bc0476bc26b3ae3f3b3112c8b14f3a73091c762d8020da05b6a5ce0f5110b5571f5e133f4179952610d6269545bddcd17

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fr-ma\ui-strings.js.encrypted

MD5 a65b4bc7ae4762961be8d7aed0d9773e
SHA1 a668e8ba1fb6d660cb698090a4188771f63a062a
SHA256 33593d7942544508068b2b1f5c05432b5bbeec0bcf8a43470ae7e9ffcf702205
SHA512 2fed19260e4c6bf317f15dac3136acb32fab0c30cebd00d7b3d8f5615a8c74cc7bbe7fa9220cca2bae241563b1ca23e613e5f200650603b09122c47441f07b7f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ui-strings.js

MD5 ffe2a4f33c976ce6d0ca54b56a8e8d47
SHA1 4944494662ed9c2e24eed02cfdef226c9bedd881
SHA256 11e64fc23ddba0fe8a54d4fae2961bcffc2b493cf6ff8aed1b099fb42f0d2491
SHA512 5049392137a7c78ee8d7a49b1f50a8559c96319b240befa9395f787f097038ba7484a8607a16f7470d8bc7423a46794d04cbd7154c7f958b045982ee809e6390

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\css\main.css

MD5 afb7e2858f8c2fc8195825995b649f5a
SHA1 9fa61e52762df2b4d0a2f9ed9675618a7539118b
SHA256 72c1436824aec56f8bc6a3b13e641cfede8a909ed044425ebb96968e8c910433
SHA512 5f9e8ece3354b3d7cec92af203c0ca239ebba3f35748db19c6c7422bd46106e06d88cd0810db39b558646f38480d8349ee43632971e9b3df925c7fc135f07a6c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\s_filter_18.svg

MD5 80150395242fbfe04b866d9ae459b4cd
SHA1 e3ca69d2d20050be58dadaa3b582a4e377fed0f1
SHA256 96b75fd4a233eb6b1f85a4aab1d4dcc8f109bb9ea232d6da6c9b30a8a390eee0
SHA512 0dcbcd5c6f766d6b0be3f6314dc0cd67a867b530dcaf0d8bd7f76e414c3f4d3af948bdda65dd14ce3b33e8773ab3778f35050ae759eaed965d7de0016ae4e313

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-il\ui-strings.js

MD5 d5725a79cd78512aed5e865675d3ab6f
SHA1 144b187247c3e7599a84eac7344779f5e7ccf83d
SHA256 563416973cde4004ad057041f868783e1fa60eb5269f8f69002b5b907a94fb57
SHA512 5e22a6165da8f133269f4227959bda14a057544543ae7423148ce3f1813e8959868a606dc72a67bfc0be52acbc57351ef6e6de1bc804565769572b5833b2497f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-gb\ui-strings.js.encrypted

MD5 a2d15debae4832ad31039844651d7f58
SHA1 7340f632b9031f8b1a147387a735069a370fc97a
SHA256 a47d97d4e51905c4ab031bb89b2666c73aa52912a0adb46bbeb47f38027d7574
SHA512 9ae852bbc04a1f31a984c5e8b53697713aacc2a06fd6769e90d7bd858014c6f7f32e7a9875233da2c0516629a50f24a16a652096983212fa7f9ffc6d0f99b199

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fr-ma\ui-strings.js

MD5 606bbbd98789093980f0ae5c50c6be86
SHA1 4a44aeb734a20094a7779ef93543415bb6e9af31
SHA256 904c85c11925830cff05823b185e958426e75a6682ca3fadc17eef1ca5973ca2
SHA512 60a25d65d8fa89d53c3d9226086d673dcacc6df881948306fed6f45d38a2ab0f695b138ba59c2038f81fdfa29628d5ae00da64470a5cbb9f0988f0cbb2f4b71f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\images\example_icons.png

MD5 e5d5eeaa8a019e6374adb20899dad2e6
SHA1 4e696dffc78cfaa24d3ec0e801a230bd689648f2
SHA256 c1002a2bc905f263e9f874bb008b1af0869d60c8477177d62434ecb8d17a6137
SHA512 ded5aabfab0170d81c5405d607cf1a46ce780584277031a9221f261d425469489437022d75ef794072504c72713b27a9bb1f650ffa0a434f8cd804c5277b8dc6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\images\example_icons2x.png

MD5 a2e029201cfdd755ef3f3242763a5720
SHA1 73f0ad83007dede22ab6747a0507b61810b23f20
SHA256 0937c8727a8ee615e89fb84010650b020cc7cc6f6931bddc0c1322af60632014
SHA512 4cd334c8dc4a6522bd4e33500b6a8b3cf3052bae5d18b01d4046bd8d489c707744a8bd57427bbb8da6ef4569364cda565ef9f384d9f5a6b985f0fc38a7b92756

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\ui-strings.js

MD5 bdae8b480504fc96076f2d28bbc7972f
SHA1 e748ee7db9d2680f7395c03a9532aaa4a3742887
SHA256 d08b5e1300d198b2113f91a30a116fb8fe77dbdaabad08542fa24793a9b40875
SHA512 bf6d72d08f6489dd8daa5f5d6b25d4d40bb78472b6bc0e0944c109cb5a13099aadfaf9380ad4ff0857e82b5ed00a9934cda4bbef201cc69e57d3d9af419f92cf

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\core_icons.png

MD5 66923a1b0ae8efb0f12fc7601b28550f
SHA1 98ecd83000a15e5b78296ae167804f89a6baf095
SHA256 914e9cfbe5a4769d0268df8c7c14ad1d5e02d0765b208900c667276575706731
SHA512 9ee3fce477054c2ae46587c9418178c3885248872478ec12deaa0860e4bf3efd4cf6027d4bf033d994aa7d1310c67b02e115720f660fb4c2ce4ed9352392fe25

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\core_icons_retina.png

MD5 5f10a016d94a4e6d0f45d59e18045840
SHA1 063b4bad1c83532333f80928e53b9bf402624824
SHA256 60049beb44da845389f133b6ef83f53b9a6d11a3b03b9de3101590fc234aad72
SHA512 2c7c2dcfa5a4e69985bb93b1dfcf45b919202355bf927737aea68f0cdc1bff5eecc7b9b520d0dce4dce69bdc1630e14d7d174771054748522432d78ffd189a06

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\dark\adc_logo.png

MD5 1346046812552ad457466209abd7b455
SHA1 c980215ca414df528dfe49d852a40dbd837235b5
SHA256 10a414d29c8cf503039b5f91857a461d7e3031d631dcd90e6c025f6967f37077
SHA512 5bcd24bda48c09510f3913485c5e6b44864925f28d4c53107c4c5375b3b4b9b7439e4429965e2d1bc17ab7429961b35a32dca942ee65be641ae9342f6b52e374

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\dark\adobe_logo.png

MD5 00cfff14b699fa504cada8f66947edd4
SHA1 9201be61b1fa7ce628c54bd21acc1d0d9c5f0c87
SHA256 fe1237368d87f090084cf8ec380b97ae27b081accb35c8daea8d6d5e0f8a1c22
SHA512 7a0b1f29b71a90fc4711f8db38d1f712cefddd24ee4cb164ce1199d9ecedc8ae196881c24d3ce40bc2c1c83b1f1512273c4209875580292c70230822d1de8b78

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\core_icons.png

MD5 dfeea2840d5849ae9e8f3f501413446e
SHA1 ce8e6766f761d37ff6f726f102fdb0b8845a637f
SHA256 2bee98c79377b7b48bba4025b3c3af8ce0c2d96f3040d14136dbd380a2cac087
SHA512 d76a54b6626c1eaf016fa982b84f642c5903c2586cc7c8a1a9d4f2a5ef202a7b04c289321c0733fdda428ea0c9b2167ead15021c472e0ab3d278cff18e3f849d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\new_icons.png

MD5 cda543c02a006f453eef2af1386c76e5
SHA1 fd2cafc697c0da0f9d70ebc2b779324f3076e1f8
SHA256 6557ffcb86f841c2a897b4d9c53b36f676e9fae6635ab7e0094ccd65190261e5
SHA512 2dfa5190745fcc196436de8fed0f9e35ce435b90754060259145e7852a00d946550463eeb2ede86dd488c77d54ed75b8141a5522a97606e9ae6e946bf50d2da7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\illustrations_retina.png

MD5 e98b3157a7b58a747e8d3df12c6c4ab1
SHA1 d750502fe4c435b11537a5100005f1b31b8baab5
SHA256 f9043e4fc141492b210673d360a7a0715465524ae47c7b75257759d252b01f3a
SHA512 6308625057f6ef9c1fc7838913af2da8eb642a9c81e7a62aa531418d2aad95e5d4d42f6f666650f1376c98fd6b60fce77bfe9cf323dc893a1ca0a250516aefb9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\illustrations.png

MD5 32759d2aa5d08b974b88ddc90943f3bc
SHA1 ecf8fbf7aa844868882c5e61a1a0122cd4a97093
SHA256 aa5de61da41dc432c99ea9a484b6015303b563014eb8a985ab89bdade85ee101
SHA512 986074ee58238829e808fb7abe1f02054041f2814f8617db27f24878d7f60282d753a0ebfe65bfb6dccd877aa9c532f89ae82650e5cf6a893557dd32b95834cc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\file_info2x.png

MD5 1943361b6c40b370af73b2fad12dd6a7
SHA1 a843667e20df08cda77110f405a06f83ac44f073
SHA256 981e549c95c97ffc34129412d122eac28a0cfa0a3390fd5e9a64bdb886b28e07
SHA512 037cbb5d67c68e1cf9ce3fa0fc6ad15ac1ea13d1f5a159b91c4edd20228d32f189d7eac496550912b1b51e7676340a3d21914a4bffcfba4c0cf51c28acc8389c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\file_info.png

MD5 ff58860f8f38f3c4a6d5c72f6f3b000f
SHA1 bd1dc32d578a069ae133e21602ecd13431586d33
SHA256 772c041fb900e4185d9b712b26289370bec7334111ab05e0d3f0ecf48e7fdfcd
SHA512 221a5605584047c277d025e18354bf6c2e217f2126a5e138e2c52fa09923069e6e67f7010f49de75ef7ebd5095affd1f58db55d389a97bb359e8d74b6f3ec360

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\download-btn.png

MD5 4efa031d0aeef3ccc1aa6525a144e98b
SHA1 ac2b153ae03b67f5cb637b230ff037c254c75494
SHA256 d36f09a129e9902dafb4a273e23317ae572173954620e109ba9bf7df16af1851
SHA512 669c35dd0dde04b89483135045fb6978175007c4da6ed591d2db91103cd6815f52e89192d2811288e33c2b150cf2da9eef35bfe1f82a0e8949116fa5496ba9bf

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\home-view\plugin.js

MD5 3e39464e4cda15ee19d35372ac4b703b
SHA1 8f6b10f63427e05d5ef4584f08e58c21c770f52f
SHA256 88d4535da72be63490ab5a0bf68911c7ab96fcbe2697a09722f8bc4d772bbc65
SHA512 9dbd16d2ee185dd0dda44a908a4ee02c6db5d9dc82c6f48ef3f7c4ac1fc1668891e66fc56cdf7acbb05541293073e46a20b292a2122daee8ac741ff6a7398f44

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-il\ui-strings.js

MD5 9afa3fc01147437222e2549a4b144674
SHA1 59822282df6447352a6a2c7863da7639bc3fced1
SHA256 fc0964750e255245146124fbfb51c982fead3e6c0f0025cdd779cca8ca75c792
SHA512 3c2a62f4f4992f1d85a8ed4e465019d54f59142bd31bbf76b7f91234118024b5d1e2b6de3d4da8282eee2cbfc854beb9cedb447986e2ef4b3253a7e51694922a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-ma\ui-strings.js

MD5 1066e8ab353323e75d31928f90c6fff8
SHA1 03a06367bc55a0dead2b179f526f7b748d58be5c
SHA256 ceba2702cc23a0597c4922a4b986f962aafc98b2f390363b928f4641bb7f0e89
SHA512 50e4db21894b4945a5ef6e5254e44a077e30c5e459e050320eda6765fd541ed746ea0b3012754ea83a245010434d3978839a06ae32e3b749647163783b1c3ee7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\en-gb\ui-strings.js

MD5 0247df7bfecccd54d651e1d4ddedae82
SHA1 33fdf8324196490a359f781ae43f46383dcf5352
SHA256 957d3cca7e3548bb687db2f6805a4930f4ea30412bb4e88ba9a7c93e931c1406
SHA512 8996198e2937127b68263b261a7267c92c2b1d0f443316af7805ccca0b0e54af34ccda0c640fdfac713a6242703ffead0248c361ab46b1b32b02add04106cb47

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\AddressBook.png

MD5 4aa73fa5a71aabae0a16f04ef90ce4b8
SHA1 23a9f8aac83bbede25bd9c433c34ec35409d28c9
SHA256 fde675f4e3e7a610601d144865e5027490e0ebc3579b4aa529adc639f3e620c9
SHA512 b8587ed3f07bd4a923ad7cb51f527075234c176cec4ddabb992c855cbe98e513b3b0cf38ce2ffca154981734dfd9e8f8e801e21ff52e26631f99eac42cf8e744

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\AddressBook2x.png

MD5 406930a3ebe2bcbad27dac9c9dc171fe
SHA1 e300adafe89df2fdc55a2392ae2672b5d71752a4
SHA256 e077580a42f3a976b1ea632926be94308a39e6b52cfaa46bd9aec8e6e534df87
SHA512 b92969d626f61343e46490f64d37aeb87b506c05ebaf69d1c9f6de7c8be716155e93d936f463d478eed56074b45fff4ee2e8ac553f02585fa53e10db8e3c7df5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\Close.png

MD5 98234bb0f9664d0a5d03e0141284fbfe
SHA1 ec6ca7736b1d4c6c0556010ff7b835d843fbf2b7
SHA256 fca4709e49ffa13f6060335ccc97e8e333ea971a25d8bb4cdd4add794b841017
SHA512 3ac951a6f838489ab0df2408601b36d0b9ea3cb6dc5d768e472640877e43d6bfb3a6b60dcf180e77bb9a31a5013b72a87a2983daca602b20f4a96f9e1e86c65c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\Close2x.png

MD5 d88743f6a492e99e213c3d1bf8887b8f
SHA1 6d26ef1f8d84bc0e1f0d6a35164ffa0a8ab17842
SHA256 86a8c89e2a54b14f6d38b4d42eabb6d479c8fa3c825b88d81dd7f33addd16d94
SHA512 a7b31cc680166f5bf56111ec7cefec174898ec0089d87a5502abdaf0d1dd34f6b88f50979cd59444bd8edcbfb82a171805d364f5e69345489d7da3c7d5900a4e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\SearchEmail.png

MD5 d7e480310b98d1eb2b5f1f9d312fb271
SHA1 06161c9569dfa3324f5151a6302d5eaf2f6e89b8
SHA256 b6f0a2db035967f45550a1e0182c0077935494ab75f2bc43b4ee72631bbe6a51
SHA512 2c798120e2a95e65be650cbfbc4958ababe74ec152b295f67e8a653cfeeb3b78520ae4117ebdbe8f2b189b616a5a4eaa9eefb84f454090d692eccc5473382076

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\AddressBook.png

MD5 8b08b6acf62bef2c5af313a314cb62e5
SHA1 d8e2bcab36d2b5a0d341134915a0e200d59210ed
SHA256 a9d7a17bdc7d27633bd6de898d6f1c31bfc9f4ba3b45a1ba4840d81d481b0fbf
SHA512 a0e8f261725148d0bf15d6ad8d415039702e9dd0aba1433fb7aa5dca19a95092876ae1681841aac47627fa49fe53cb9ce9924dfd74cbea69789746e9337b679d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\AddressBook2x.png

MD5 ddf792d09adf5c51386e721f9806f405
SHA1 d84f0401547b1cf53d0af62b5169a44cf70b104c
SHA256 3c9ca2d59808d37d9d196b354bef2fc6f1397cbad86ba3de2585077c4735641b
SHA512 bed44b9e4b70a417f9118c93fa2ce32f21b919cdab9d2775d673f3f848fa5c7cee8dbe4ef27ca41823a48bd13e440db6f416bf1f14faca76a70b07e5bb7c5406

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\Close.png

MD5 e2e0eb2ed1e1e6ba9f9ba300f678a203
SHA1 e82df694e46dfb453107ea7a87fe6548fc4167b1
SHA256 ca6e922134668250b399f35d5e06c6548de504db19855fe68100ed775e3b8037
SHA512 6a222788f372c1a8816795e2469cbfb167bbd8c263a20237bcde90537cf19eb6cd69b56725d10b514cde885676ac09852dc5f63780171bc2ef495023e145d7fb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\Close2x.png

MD5 0d9c37e40b4ae812f176986c6fb619bb
SHA1 5b3d2eee0775ba83c2cc35795a4c965a240de2c8
SHA256 ee4e061bd695dadaaa79cc929899d42505be7279393ae7e675405f2910f9fef7
SHA512 6db7e9281d1f899f2f093f70931dadf5616c23d15567a0e6cefe85cf35d89948a83993b948ab58b15978420f72f1a5e87c8362d95b0c8665c6d8fd9efbbf21f5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\CompleteCheckmark.png

MD5 121963c2fe95b1a7f22879fe776eb2e9
SHA1 5bfc8f1cac7659c0d6a8c59eb65f953ebbd3c3de
SHA256 f42db6a98895d3bc05dbdbd17d6cc5e65079e6a6a1d18920a3f04195185c49f8
SHA512 4d92378edc14bcd67a77ffd83354e6c5fc6661ead353fae635fe7323377acb3b0d8a05e7cfc3a0ca2bc882c39e96930cbb3fe7d8f36822ac2a9338fbfc309446

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\CompleteCheckmark2x.png

MD5 70bf60531432c47a05a387972f1c326f
SHA1 808235fcf9f4d4ade83f51d6dbbd6d3c75e3eb86
SHA256 087ea04d85e505a572905341c2ca423a37cf96704ab991e17392e97d4ca1ce8a
SHA512 e702fd92943436ecf42a26ab3eca3170fe625a18838794637970811ea772e6536b870a230e77f6f73f5d06b96c330ebfe1bf7ec5d6a0c2b5406bbe20638114a3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\SearchEmail.png

MD5 92680a81f1361af6e68ae036671cc290
SHA1 c741f85cc30d4a49ff66a5c29f4eac93d1af5ad5
SHA256 83e65600084bfd5ccf3af31d4c3925dd187aed65cd9e729bbdab1ff23b147234
SHA512 9ba6b6c73e3dba7e63207f7fc4799dabec2e709e54746c961bf42cb6bbfd8bea176f987f9cc2059d0fb69625adce8ad4c1399b1d327d7f5cde46b1aa28212267

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\SearchEmail2x.png

MD5 349fc9ac0626d90dd791906517942c6e
SHA1 15b2384822959bf28e5687996f3c6685d28f944d
SHA256 1ff166cb64799658aa05d02df8a296617ac0da3411ebb18f4ef6bd9265fe3f53
SHA512 27e2d4fd30ef424be49daabb90debff7c1488780dd36aad76205521e30f63c8164063fe014f53af3f190d74904d22bf2f5b14aecfbfab8455c5daa49e968523e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-il\ui-strings.js

MD5 024cb7e21bb8471c43408ef96ebb2122
SHA1 a081acd08983e48110c38dd3c5e19286f5dc7287
SHA256 20892ed1d1d280811b228183d4ead3f70d43381ad09c9042c8fcfb9704cdfff4
SHA512 6376d34732cf9f9c9f851859ba31c3d750d6e0c4fdc4e4d2937d24321ec8680fb5d201ae7c2feadcc3b88ade5e03e96dc3499c2b197441034662f2ec708b863b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fr-ma\ui-strings.js

MD5 a05d99eafabff42cda34bade2fc1aae5
SHA1 0dc2f060957127720a985ac634898b251ec02b97
SHA256 eabb39dd677b30ee408ed095d8be10d21519c41d10b950a96a0b25990d59d427
SHA512 2f01fa2147a58e268f662a8448a1b923ebd5d73cef7e692ee30901328ec6245c7aee6372c867f03caa7d755c9ae7a37d7983dad610f6f59fa3cb9ed38ba0aff1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-gb\ui-strings.js

MD5 9bb1939073214a5541ef7038c7f1654c
SHA1 e65869bbe661649daa0e002f98810cb0e3728192
SHA256 7f512ae46d58336fe5466c9f7be2f63bf846dc921c1fb348d9675f12a392f4ba
SHA512 0882841f6d045d39b74ff385a3e4ba1c371ccd269d9a1bf4b4aeb6fa66b516ec07e31172ec7e05219d682eccd85efa20a42df2e26abb8962a42cd6d959e9b94f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-il\ui-strings.js

MD5 76a47c1f50c50f2f2a9a5caf8be4f7a9
SHA1 7ce6c2cfbf412fd6250e0ecd87e447c728a5ffaf
SHA256 a31dcfe5cd7b70e077703a73c35b3d7677b561fc621ba46f7c2fcfb262b6e00e
SHA512 764cb654cbc55bc5e5ddbcc7204c13638f0fddc14766bc6be5af2e42c004ecc05082f9404f40d533bdb3148944a002c52c65567c63ed3a4c5b37599f8ca4be38

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fr-ma\ui-strings.js

MD5 3fd0887e1c2ac54fc6a2b30a7011c2a0
SHA1 b95edde30932bfce4d35b0f19e9a32a86fcdbdaf
SHA256 62de7beabef2fce170a9c82ab50493d49f27ac9fb3d23a864c9502866859cb30
SHA512 4ea96efa6c57142d9397f5774eabe8845c372d4b875659e479350b35ccbd21a1902170857ceb313d814cb0f9c821650d2862a4d30a3fc70505a2abfb238cf6b1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themeless\close.svg

MD5 390265256a916dbec5289e8fe136337b
SHA1 8a527ee39e80f641945bcf919c8e9c7dcb60395b
SHA256 39dc70f0799c558af6e8df1254d76aef2d8d89553462869c24027af36a9b4a8f
SHA512 2af02b3a295253cbf8dd70ed51d40597dd773d0eb41c2348a1aa750c19114004cada6e8fb7518562bf7ede3ebef5ddaaad076b1ab9f816bb99334af6df9d63a2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\checkmark-2x.png

MD5 ebd9c44fcab49ecfd7cfa06ece272d43
SHA1 08a4aa4632f3da855b17c656a535d4b38e7ad7bf
SHA256 5d77bb9df1d633cc6db8a7dabd60a7ab93becad40f219ece5ec98e2d8874dcb9
SHA512 c5815cd660a5af2df4b045eda3ed99259a96dcdbe124f8f8c197382d419efaf7dfb2b716f5f474ead621952a19188d5000a2131333e3c8b3ccf12611a4b61f0e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\checkmark.png

MD5 2d3bcd4d19ec748116b26b57e3b4b598
SHA1 349b6cde4046def0cc6a9fc02f1147b6b41e35e6
SHA256 0c56728b9fbcccaa0ecbb0489c2ad0cf97aad545205674505f8013be8d1ffb39
SHA512 649e52c90a27484f8647efd848e4cf14ff1ff9a6ac9c8d7c16850636e4397f2e8ab64bc56a9b8d134d68636ef039acbf8d03caf41a30c1a4524422454aea7427

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\help.svg.encrypted

MD5 cb50076d7b275b30326bcea05464dcc8
SHA1 baaf8e035ddc1afcb7c7945ceea3a933b93b7875
SHA256 1957fef88405ba4b19c0abada3de1463471aa74706ed59cb5f34c0d786aead2e
SHA512 1272adca9f181ce206f827e01edbb9a2d61dee48e20fe90e9d26a545ca4a515c711edefd5b4a3d0730fb2af1c052e84bb54cc97e78cfa597f3d2a6a9d8d36094

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\close.svg

MD5 e4233f640a9cf4c1eb2da707e6ed523d
SHA1 972e0476cd9111449567f260c43acd546ecdc975
SHA256 2a0acf9aa24f175e8b6385ca9b95b70d2deab6730969588fadae645f76f2803e
SHA512 63698d22dedf91ba17441e8f73caac95574998974624e076b11aea6f570707d7d9a528bd088863571634513522cc534191e60cdba009885cffe7908ff32a43ef

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\close-2.svg

MD5 0001abd7cb251e49896879404329c589
SHA1 a0fc30e760e05031be8512a0ab345730dc794f88
SHA256 3c5f2652fca73eca4b332faa5b89bc08b56c572ba55a88d3dc685e53024dc9e7
SHA512 968da86913a3620e849e09bda47af06d8c2d8bb5e01abdea9c079ea37eaf10e24921bb2386be9a105a05284232dffa06ba3239e04aed9150477cc206fe4ea8a9

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_CA.txt.encrypted

MD5 eb72d67bf4a880e8226185acdee2cc40
SHA1 34095a39e78f42c3d7c381b881195188ffd30885
SHA256 9431014259f29d8115afecefe2f35d3e409ec932da8c8ac58a21df30e36d3af6
SHA512 8d0856d5051a11a68868faf4774891863bcca46eaa1aee9825fcc2187689ba64c66d74e6652fd16f93c5168ad0cefec45fa8031a819dcfaceb5f2eb875ddd85b

C:\Program Files (x86)\Internet Explorer\SIGNUP\install.ins

MD5 a2f913662e97886438cdb0c37c5bff49
SHA1 4a59f323338771f85edb53cb7b5a2cb794bbaf92
SHA256 8e3a1b644e006b614a69e9fe5e8e48e1d5c03d0f865d85b235708e7bee06c185
SHA512 82785e2c5d97c15d0188a91d1aa5eb2b00b80a03fd39af5c827fc431501308e9a09f97f40ad2653aed40dd333b8bc9060ee921ce8c246a6acf099a5dcef592d1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Extensions\external_extensions.json

MD5 74736c86330a26209bf90ee2ac63d8df
SHA1 3431c55b6571a33539f844f8d1437149432230d5
SHA256 eb8f228271064f83970b8a95b66e5239da30e82cc642aa3ca605ae8178563d03
SHA512 501629e044d46f1841f5134642fbf81144ae2b923c328587a19a07aca6e361286558a91b26c588eb734af41696b09bf678db6737995ab7e89371105b3c6f4c58

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\resources.pri.DATA

MD5 1035266d7478f162242430b3ac4c4eca
SHA1 8a9b6c974d82916580c3a608d100bb6c090122b6
SHA256 2cb859019169a97c682608fb686fc49029ce2f3b55e8beed1e410c6979ad4ba3
SHA512 64755e6e6b1e9044445e085bfa1558d94dd79bc3b246a123af22347ef70b08d6932b86a2a60f43fbf026d5203d4295088483d4bcac2a6a83770a6ed15de2e327

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\af.pak.DATA

MD5 4d44ff0bab9a221b7cc765df5e5e3c53
SHA1 29f39512663f29d913279f16dfecf8911d783a96
SHA256 41dead7b4fcca43b28f56d35f4a0dd32b721c466f9c14ee60d50ec0dd0d9d16a
SHA512 dda14f71216714829bf7ead544cd2baa84a7b77dede622051862892c6459343861683d04df73da682bd75c31a7b85cee0c7d81df36d16fa963f60d5cba6adf53

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\am.pak.DATA

MD5 0d467848f50a3dad59e7837454fdd96e
SHA1 26fc0f895352a03b3c4699dbdcb798a9c3789a41
SHA256 a4426b8cabbdf811aa78e22257dbeddb9cb8caff6e7f6f09797664ccbbcf435a
SHA512 d85aa2f6d13a37392305472433a7be1fb4c512b4ecc00de5e3407c5026289a6e0ec9edd902965a150c9742a231dc8f55debc4b6dc35c3464ce9ff9aea65af177

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\ar.pak.DATA

MD5 832fbf2891c3239ccbee30741415713a
SHA1 a0eed5c91a9d2929b06465c2ede7e9061114ada4
SHA256 73845c455836a2ccc0d4d18fe1416412b101d8fd49ba0950d826fb4edc863773
SHA512 9e60561859e7318a07a24be1bf1993dc2ca2273e1c7a5652b433a96be47e7e0bf07b3ad485ac6ed5f32505b13487826fb58a58756d256189166346f2faf0ac7a

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\az.pak.DATA

MD5 1f8ea2bf5d4e7c08625d92edbda84dc6
SHA1 9672c60899a7bff653d09d3a46455354c7a514b4
SHA256 54c02805140af8fd93ca9362270db3448d284fe21fce5e6a02e400e81002a215
SHA512 3eb2b17cdf0ee18d4be779129591e51a40f95e72cc7eb89dbd31437babe59a4c469d58f491e77e25d352c519472e73965217c9e969bdcdeb004b97e63374a209

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\as.pak.DATA

MD5 4c6453ad26e36d52be0c29b50352db96
SHA1 5a74b7bee1df85ace71826e879b2a9832c69f7ad
SHA256 6d880de761b315712229b3ff53cd15eee94646539a3778c61a916eea8a9aee7e
SHA512 7edf236d0bb02addb0c8fe7671821ae6d00b098571df13cf9e059edbf4a56f64964c8474b0c49dac2b46fcc5dd67644e9d709d279b4413ac876014bc52b91ede

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\bn-IN.pak.DATA

MD5 5043093649f2ad5e70b0472bdf26d28a
SHA1 669ea4f1711db60896457f060c1df43ba79b73e3
SHA256 cda4bd8810ce994351973affefa71ae2c5b92cce04c8431ae0ff2fb78c1b2b96
SHA512 89ac7031db1a850a379cec91c22f7b1a3f39b8624b40e70b31f99bbb0f1905ce7725da870a46e678049882c9f0a06b283c50d1482131aaf4e3cd8b578d7efe93

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\cs.pak.DATA

MD5 7e27f157159018a782f972ac307bf821
SHA1 5531ea9e30769877762e7150992c75c42ba11c40
SHA256 4ea49d1745da848defac88c55eb32efe4aba1a34b998d10743cdeca6c2fd9d38
SHA512 d8c35b71e318dd4b606591805870c46df2084d1fbae79d4a6f947e711c5ee194aebf37e5a6962d0f7be28b5b9d1b06f96b74cd0fd3902fcf549ac270bc464880

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\ca.pak.DATA

MD5 00f53e9a30691515e787375521cccda8
SHA1 e66eb9d4acb907e67dc42c5613dc4f6e0c58f0c2
SHA256 1edccc7c4f9931b40d72fc6236ff1eb7b0c1edde3a6cca7dd70c528c31b515b4
SHA512 ea1bd9dfd96d1b240b6a96c71abd539dc2f133f289a7d09a98b7c57fb170c6a9777018d89094f46f0b33fb2604024912e0f2cbdaa6e28ca53bf8631eb24ac2fd

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\ca-Es-VALENCIA.pak.DATA

MD5 feade878ce5813371b3283bd17fb2715
SHA1 818d99190134d436b0b5e2f3a3ba55877a51f9af
SHA256 b7393530fdc171372ee51ced410aee20bf6cea515ba40cd7b24cffffde6fb2e8
SHA512 966c0276e1779581554e9a9d5bdf1df0646fc210270d44521f3d1241e8d3b71a10dd0edfffe3240a78706508e5fb3961c6b8958b806ef9ffde9488b1e2471e89

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\bs.pak.DATA

MD5 464f545af0c33e345b21af827ef2e2de
SHA1 161e70e74e08e568d6e9c956b1b39fb982ffcfc6
SHA256 6b7ccb2cc8891e4fa3b7b2163d3acd3a91c1c491080b6c38a34ec6da2b2bd4b3
SHA512 f03874f7f1cf5b0797942fd3fa393420bbea66efd3e0bffbd92559c6d390864e33d2b23569bd768e49329a378109b9574a7c6db3e537ffb345a20678fd19b231

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\el.pak.DATA

MD5 badeb0e1b51a873e4fcec81b012cf9c5
SHA1 696d40129bb518abedf8302f0d4fb8e4027f250a
SHA256 9dc8db1b98199fdf519c47af99b87e99051d68ab2da0e3c324d771b4560245bd
SHA512 0ccc3099117d23defa5e9080f1d6f0da5143f348b19e2f28626bef6fca24e2ef8055279795670b9c5143744fa3706032e47b45d499f1f22afe892194e29f106e

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\de.pak.DATA

MD5 75e45ce1c6ede5451305affe11b3ed5d
SHA1 9afa04b8dd9f176ca28502d70456b83084e09115
SHA256 86f87a6d7183b39a65592a0693f6350984855e819735a108f2d9fdbdf484fe85
SHA512 b9040773befc23f93744e5cc019941968b1abc65d62b5590f54951002da1fef84df749950c824bdc9b7698f62e16041d742345039c54cba7ce780f3a54412942

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\da.pak.DATA

MD5 6f4cafbda73af245c1944582de06942e
SHA1 363f3fdcd6997154eff90dba8edca94f7bce31be
SHA256 0a0c97ec0c8d301192094a1f98ea9818753e80b69696b796279ce82b3fd53baa
SHA512 4e91be75d368db377b6114dce6439616f281804400d51a0fd169962b65b24e0c4bc7cd6bf1ae4a53cf5e513865016cb40099422f5962e5e0b5112836c8e5f894

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\cy.pak.DATA

MD5 a5cd5835fb49b5d0d69d45c03ddd3191
SHA1 3b17f7092cec1da0565e60219852ce700f6030a4
SHA256 f130db7f9ec76edcf05de99b2d2191323788700990be5a1ed15b5ef010250955
SHA512 4ff48a53d38a461c066b710b5b874cbab0082d18c14838a16ac657422f07b352a4297355979845b135237356a94587d718d2bb0ed9357686168ba478d7c00ae4

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\en-GB.pak.DATA

MD5 258b76b4f2a6aee1a8995e20fc2b55fb
SHA1 0491428b4d9836937af7309625792bdce37e4e3a
SHA256 b592268876117f5de2c3c339914244e8fddf959c6560fff88e6be4c32f1df0ea
SHA512 3a6ca3fa9383438526d474252b074bf4447057285f97cd9e9076a3db5356bc9dca003f4445a4c0ecde6d782cfd5748b1b6a3eb98aa67f7882a64a33d2b6c9441

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\en-US.pak.DATA

MD5 12af1ba612caf047b1a42c180a5ebfb8
SHA1 5a6b99b528468ec1bc3f9b25f1fd71f65ab09b42
SHA256 a4510356b2d3371d9b153c5c08ab936f0ff326b55682178f76b837b27305b52c
SHA512 6472731288adc6229e42bc65fd34e1c176eefed5a5e27bc96cfdee597a0417447d885ca1524be6afea50a767d787253f03c40583ecc4ef202b6008c56874b833

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\fi.pak.DATA

MD5 16c4762d62937eef5bb5b5f3fc7eca1f
SHA1 a41384b61408e7218be2d7cd3c3667729bc93b07
SHA256 0779fb428ed16ea94d4453b361c408344a7105dc0609c9c8f03a2282388f4f0a
SHA512 9d7cf0c03251a4e8704d537262a66f50f0e9ca1651b9ec486ac7e7ef8cac1ca556e860b7042758e946b8fae8dedccb724bffbef06559c42174a431e37327f69d

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\fa.pak.DATA

MD5 a9dd63e3eb5c187be4e7011644641630
SHA1 5fbbdcffe037e67be94e07706ffc4bdb596670c4
SHA256 4533961d4f0f59b0c9744c38def209c057a78fbc78ab543862f4a3eeaddb0cdd
SHA512 b51b1ede5f63c4666781795fa06b2fa777bc219d8c2c0a629e5cecf4ed9482dd61bdf0a15c82087c1fd664eff2c0fc27a26a974a9108b0d4084ddc637a383a1e

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\hi.pak.DATA

MD5 d87a24a1431217b98397d74cdcf50031
SHA1 87fc94f834b47565055c5fc1d1cf396d3979df1e
SHA256 4d47db65e55d0510faa00358b403e05def2940a9656f843b15de65e2ef60da07
SHA512 33c3b282d190e98229c2f8eeda285ef9ad05a6384351ea8a076b66e7ce813ccf6b5906b5a24e1decdce83527e36081927edd63d864f59375de7a4fc4b5b8bc13

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\he.pak.DATA

MD5 fa4f9a84294d471637220430e98623b1
SHA1 abb1c5f93887dd033a836fafc11f85c2f4eef980
SHA256 9a8fef03958f9be5786f585f9661186dc8edf608feae49e2281bc0898ce521c2
SHA512 735ac770d4602d5c87c5cc7a443d79c6e4c94e6a888cc3a984e7b2585c8dd998395628a6be5e5b7aa65f9a3fab2bb20675e4e5567e44c429e7718a53028a6a26

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\gu.pak.DATA

MD5 8fd3fe3178249d1c8b758ccd48542086
SHA1 b338cedcc5c1696d709c5bdae9d4aee864b0f6ed
SHA256 3d70f37192bc85e4b0555f9a7abea72f9938c1f28620690045468d7064bfdd1b
SHA512 893a6eb777b93cf37abf039e3599ac24df2029d38bd7467f27af8f5c00468d408ff115f72ed01de3b69131e0709b7afadf5ddafca4d3961c5d5fdd2da5b7d2e7

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\gl.pak.DATA

MD5 4c2a62c79d4bf82bf9fcb0016a9ceb8b
SHA1 73c49163de311cb6fd2f78fb7e2f56b109be2720
SHA256 d725447bb9f8cf860d592e0710980ff593bea60c48ca5cd9642c35da60b9e7b1
SHA512 fd43f0338541e7e71bdbab15922223437d10d3aec19818a6b6cdc187015d3f61eaa133e23faa094b0c256bb38eb0c1f19c28f9ecb2510aab0a167c88eafdaca7

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\gd.pak.DATA

MD5 930529e89080d6e1f290e5ce05d393bf
SHA1 5f82f9f1965af6a011879aa119f0b72a9646d25e
SHA256 76fcc33a72fc82fe55d9a5c8b3646f075c1cb3447dabedd63d21f8c5b4378974
SHA512 c8ea8761f7ec153f404f5964c5d363ea8d3563ef0175c6f67fdb1da1c3c7244dd9b2a80594e030258614fd5efb4be133377bd681f298204428a359a147a4e77f

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\ga.pak.DATA

MD5 77a1ae7f5356ba7bfa4f335fa53901fc
SHA1 60988d88d5809ec6111069e183c258b378ef004f
SHA256 3d97f5bb47ba347c103c19950a36127b204a447e8ba7a3d66398386ce27e9224
SHA512 b73b68113182621db0781ba1ea66e8d4316c71ee4965a02ea3fb214dcfa0f2e6a68a3e814ce7243bba49f7673dd35e9090810dbb2a4c2b92fc4e3be341103eeb

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\fr.pak.DATA

MD5 b142b8ebee98c185c698e6843321f477
SHA1 3d211037a3e6b942eeb9d41710d1dfd38fd9a580
SHA256 83d2a2a5de181048cc3456b5219686f267cea2e9b76df0f51c5e8508cbe8c155
SHA512 87e913b4bc909af4f4562f45131892d809e8a336f5abdf4590f2c4ef44f70f0ac97e4f4b5bddf1389edb13e26257da3bf59065c7efa48b2feb511c70c8c76471

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\eu.pak.DATA

MD5 385559b4fd43c8492e42c3dbe4912e21
SHA1 f964b2c0b0d61c1bf3f322e1d64055dba8a68dfb
SHA256 a9665f371b5d396d8b9204c98a1eea712c0e550f74a150c7327429af7690ee9f
SHA512 c9cef31039a1f18abbe51cca8a6b83dd5ad98f4e5980b392cea95b5273667320a38637756e3aaea9495eb9261679db06677b265385c321f2acedd11d7a6f7f2b

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\fr-CA.pak.DATA

MD5 f1412038a92b78acbd42390022b3608d
SHA1 84b633112a075895bc34f4fb0b2785b8e19e279c
SHA256 741b1c0e29568f31d2dade3a303f52ad3434868f3a036552773c083cc609e87a
SHA512 738a25aec1861449400bedc866486f9eb4bebd2bba7f3dc2732b65fcf39e83865676b82fcc72bb04e74966386dadc8369c6fce2fa3f5f949001d52759842c703

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\et.pak.DATA

MD5 a65c33420136c970a82d80d93cc46d97
SHA1 175be3726a7cea6bcd6329e65e18045ea7f5390f
SHA256 3579fd2518b73eb81b2d22d83cb0129eda7a5c710d33753c18be000af4fc9a81
SHA512 41fc8507032da321641fdb45900621268987b620d2f7f8d50053b3c30b09afc2b3be8740efdef9440af80e629b5f3837c6481e6a59ea96154c0a6e8a622c58f0

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\is.pak.DATA

MD5 bd9b5dfebbdf94ad8d41f7da61a23449
SHA1 146d294363e3c5344f7ae85db7b4f5667b616cc9
SHA256 3f912804194152cada2c76e2e5b52bcd47b54e6fbf0673761e40681e5b5b609e
SHA512 b229bab89f48ce48a673071ad84757c32e50e969c113ac5af0d616b3d014487c60cce3e3d165a9e9e6e9f38deb7f73f7d3b661087552fb3b2f00c606585ed3a3

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\it.pak.DATA

MD5 336ed3da9f517171af353d884c5600de
SHA1 eee435ac4c2458f877eda149894fbc8e7ecb9088
SHA256 a39c2fd107ed5d77de23da3edcc36b410acc262cfebe3ce428f92baeac75a667
SHA512 76943bd6846d3a85694b301414884c84bff0429f8ef052343d478e6e3f5a2d26d38559fe28c7f1d9bef45cf34f6a02ffa7dcefb559ec7647a04ab4ccd1f8842e

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\kk.pak.DATA

MD5 94b76c4093cb2a0b6297916a36e7fd26
SHA1 c870b142f697b5446e9ebc650458b3ac3117043c
SHA256 01796815e6cfa6f2bbd74f315c2e4d0e98f3677fa4c200e0ca043ae7be3e0cc7
SHA512 7589a6f50ad32f355dc10ff9e33662055f9e301c44caba02e54a3ffa83a29b368ab92dad3545854aea66eb9fb8859f0cd0fb231966d08bc0cc75089180d5fae8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\ka.pak.DATA

MD5 c1c61f7c55b97881fc954c6c59e8e0ae
SHA1 8ae20370bd00db3f35842922daa044cb3745f526
SHA256 c39b58e1cca50d0533b51368d40dba34283ac0c3e65f95274af078ba1ff2487d
SHA512 38eb6c73c27a6d4a272e441cd1f124bacb5696e9a5e5a01fa9c14273f5f61c975a980a07abcc625c596515f8d884f1611416e3f1aaa41cc28b8ec47d5969e989

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\ja.pak.DATA

MD5 ad47db232a482880e8a0c5637372b80c
SHA1 0ab320fd84aa8a804b38b697acbb346591e3ae5f
SHA256 8aab27d6fa7342691f8aae3f542ffbfcab40232ab7051256e64a80ecdcaff124
SHA512 fdc144daa56e9f8787fb71e78232b694f48712f3d868ae036669d410bef1630fd61a962c2884cd4e9b941087e878847cd77cd23f9236287a2e92425a33ac2e81

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\id.pak.DATA

MD5 ee72c635475a5e2539e1102769d3993b
SHA1 0a5e541092d8bc1c29726c220c75210e6abbc8d1
SHA256 3a9318b2d6ebb1db04ba878ebb15e55fc703445783c70371935c83801e1bd69b
SHA512 5981dbff6804def2b6aae7ac4e9451f941ebe4f77e89620672d79199c93c55df65c203a4df847783de5639015655cee23b1d2e4fd5611aa23ce4a0e977cc698e

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\hu.pak.DATA

MD5 2183e47fc4e11738710a33d3bafb0f4c
SHA1 f4d5e58b45e0da1ab585d66b541ab2d3a47f89a6
SHA256 e19b36c24d9f3f6c59048da562e57dc790a527cdb42d60b3f827327d9f766667
SHA512 205ac26981e42ad063f3ddf4eee4a195633fccddb73f58e34c9a46af2eef2e2b13cfc47412491108087d6f66a9ce93f08717039751cfe1c1c60699c8be929f76

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\hr.pak.DATA

MD5 827b7d1f29dfdb5cc1a3f35299010591
SHA1 849a88a0de0764c9a0f27e6788807e4ef954fbd8
SHA256 245e391d7f0e9a69e60824521fcca3034fec61759256cc3d2013de355512672b
SHA512 bb6ce0cfded77f675bdf190272f1b9de63f97576d13feb220e9169ac31361451ca635835d688938e00d57afe0a3b0733e6f56d9e80006dc33f1cf2faf73aa54e

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\km.pak.DATA

MD5 8886dc0d68fdc2ce9b7e22abd08d3035
SHA1 a3809ee04c424c1a7f6059e8365a4eb9a43b34f1
SHA256 0706dff555d5de008051e71019a08f843de7e4045319033693323c82ddedfae2
SHA512 dd3fd0678cf45d66bd21739f039360328b6a55621bf04cdc1688d7f3991f164531145b8ba0b825f50b6b73a84214ac76b91710d50a2560178c66f0cd016edbe7

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\kok.pak.DATA

MD5 5accd002aeac769d341e1fc05992dfcf
SHA1 72547575dc476b937dcf91f5647dced61d9c8554
SHA256 7c9389055a5b1e2a408733459982296ae1ada4584ca63fe4cb7e55a5597a8abf
SHA512 8155f27e9e6622ccf7155eb7222cb9841c8ada04498a39af816250fe4d920403242d67c0f49f1349faefee89d74524c841e713f5e1bcc3750e74ad94030cf061

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\lb.pak.DATA

MD5 f113e07fc35093dd099508a9c967edab
SHA1 f5de1d7ccc958b3bf0059ab700a3d3cc7f513291
SHA256 998dce71e38bf57d39a87cc72f594e98f1c831ae0f566d58149a155891b6204f
SHA512 69f0a49a014151db08f80924df22326b7d361b2842856fed9b5da03688b35a9d3c7c3bb519fca9e152be1edcd8b5012b042a0bb44e3192b46d1b36d79f10b98e

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\lt.pak.DATA

MD5 8b42073f5e050af628e045f05a3ae3a2
SHA1 33efc50f568e3c5d86a1a42f41fe0f272db68e36
SHA256 cfb44cafa6885d2e5a9b3a22000b3313170170cffc0fda429516ff055cbe4de4
SHA512 1605c6da0e962bcd203873a60a63ecb2f4514e6676b3bd180d9cb8157c4845a2a01505518ed083cb678418f575c51d14101c41c88a4965435a9aa748c906eb96

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\lo.pak.DATA

MD5 8baa02283503a2b1dd0341e27088518c
SHA1 999ff52b6c68ff7dbeff0df710d7dea50de9eb16
SHA256 a5119e58fb872914d16f54fc2d82a19ed35d9a485ade1fbbb8338f06a949f6bd
SHA512 0563a7869d0043aeb7d326c8fa4ddd73758bdb4cdef32ede4f124ea6e77064ae95c32a5c44f31374bb40d51b2aedb2041cf8b3ada3509820eb9f46a94b780963

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\ko.pak.DATA

MD5 4f22fc0a5fe4c156417186df1e1e2a0a
SHA1 b5cd8a0b7d272cb2346461027d142864abf65987
SHA256 45de07f45b4ce573633d71fc4104ff318f455767ccedf4d66961300d1a443660
SHA512 d44eb885cc8e16da4376b0146a78d746a9cca38e3f12994d910df6b1ffa608bf8057b95c1bf1146d71b762c08234b029936877f0bceb947e088509e34b78e6f4

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\mr.pak.DATA

MD5 bd180b153f0ac89ab4bac796130fec08
SHA1 c65845204659b26923ceaaf98f2847cd42875647
SHA256 13fe01d9cb617c06a3d284d157348fdce9eab185a538dce8ad1fd2db92f1b5cb
SHA512 40c25247861640380a00b2ec330f13c0b3baa8fcee274e30f5d998cd4b2a39ca7e4c2ea6bbb0ae52deb8b4da01bbe79b17eed6866d04ec916b8b4f71609cb0da

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\or.pak.DATA

MD5 27580fcb2c339a19848a2ee06a492553
SHA1 fde77adbae665bb86854baa24885e69c43dd323f
SHA256 a6295b5505e8b69a5974321b79025a09bf5fe55cb64d94a63f0cb87c3ed43460
SHA512 b4810bf82b397d020b30d843065104dc46f721d9b295a91aa34a27811cdacdafc34bc520b557b56940c2c253818120cde1d7a9cc2d013a9c4dfdca75d7679a4d

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\nn.pak.DATA

MD5 9872337528869a3dfff0c3f97a3dd680
SHA1 b784f783a7475743bdc877e19880e26bd2029165
SHA256 66193aea2a3b2ce1800ed5fed6eec08d3e014a2aade46e5f4d863e793978441c
SHA512 47ef2e0ed390548fd13bc72dbffded381a2da90b9aa7107ffaa3aba3e6aca0e056b2297ef02d3003b3d920da93fc436374d72b34bb57d9e5bd1ca91360bc1f0f

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\nl.pak.DATA

MD5 4a634a50161790b88ccee38517f17210
SHA1 10538621751d7f423119eced5444601a572076f0
SHA256 2cc0661aa073654166d33dcdb48870a528a6591740e33b162d094df638dd3550
SHA512 920cec3d249e3abb50653d95bfe4489454a03e07c4171bc319a730571140c0d268c1655ffb57744b9ffafae377738920cc6d298f6f5bb1647e4f100ed710c48d

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\ne.pak.DATA

MD5 3a457c1ed3fddec81728d6f773e69c25
SHA1 100313a8c024205cb273c1c298d8f63c0ea4cd20
SHA256 2309d82c7365b982618fc93afa38dff2258c8de305f2198e3c4835920d710664
SHA512 632be68cfa7c629977ea17c99dddf9c4feb644c732e0f51ac25c80e9a74e2260af884ebd17d930960b73e3f7c60c62732358caca72ad663a71aaef25199ffa10

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\nb.pak.DATA

MD5 ffd5342991bab06688c747f98d7bc6d9
SHA1 6ba4b9b712cc36d52c8fc06cdbee9c7d3789b453
SHA256 213454c77fd71e523b965211d96eec57d9e4d40890bc86ba1113eaca25c7fff4
SHA512 70db8dd03029107c06b6bc685681aad9b83bee461ba34476a002371a1c5b8473852711fc9bb8a7506b03537631c5777ae892172f7ec9a5b4811aa8d45e6dcc77

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\mt.pak.DATA

MD5 fc6ed38ad8d84c3e283f5f81491b3daa
SHA1 68ad56da417bbe593d36899b90e3d58425885023
SHA256 9227b5c20aaa07daf7288c714668dbb4b465ab7cb32aebdf5aa499769aa5768d
SHA512 ed8c10d17992c5095cb0366c822dc3d98863a474d15e39d01796ffce1f921c43f5f85b3945ed8ec95345a6e84869ceec5c544dfdb7cd00ebb715f4dd1c6232fa

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\ml.pak.DATA

MD5 e3a9c5eadbc0b5d27c0888edcefc5fc8
SHA1 ec6af369c2992f43307687e6cbb44b2eed28109c
SHA256 bd7a3e51872cfd34b4360b9eed090e0c063c94ab803051203186994a8e9cc141
SHA512 0a4cee1c092c9d9a7546e1cdc3fb05fb90afdd8151952427bd5af27100367fffeab56af5dc067ab8a5185d5712fb43f1dd55ca139aa9d4dfffd86479172dbd17

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\mi.pak.DATA.encrypted

MD5 2aa5c44f322e1163f4e4769330fa74ab
SHA1 79718ed3308b547086be9d5e8f3b411b6ec006f8
SHA256 f8da7d83bc5d08e17e79026cdc5334d92ec6e4eaf1a640ca2d8bb07d9e0aa788
SHA512 64d7254c48c2c1578ec6ebe0bbc16851b100a7206619bfeb9480809d334b333dd3e93ebca1e8facdb6efa4b3ab0f582bdca2dc4c17256f16de691710f91ba34c

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\lv.pak.DATA

MD5 c95aff37cdf15d8a58a7f081180a7b9b
SHA1 3fa992fee5462a3f7b91946641e942510b3ea742
SHA256 863d2c5f76d3ac1e297dfd70258a06b45b2fb063442f61ffa59f70ddf860779c
SHA512 261d0f1a9165a4745c5ed3bb5acfb779bcf0e25af919697b6e62938181a1557f4ae420af09c4cbc431a9cdb20ac06f93e037ecb8d0fb5f3a16b231ff1cef96ef

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\pa.pak.DATA

MD5 0ac7f294101f2e931cddcf0d9a0a3755
SHA1 0e52a0969bec473861f425777d544170c8fcbc34
SHA256 6c3167c51d4897384d43c74223a1f2c5451e342bbad1c258b01a56060492bb84
SHA512 457d46176a8d593740801f95c72c2b0c1527664dc07cf4d20dfb7426418070e636d8caf9c184a40453ab3815b96a90e50465ac3f3f81a96b0a107cfae4185c28

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\pt-BR.pak.DATA

MD5 75716ddecfba13b7ef366b0bee424d2e
SHA1 3fcb87624c096aca5a1ff51aa88b570ccd12cf55
SHA256 0053e1d634f5ea96b1543e8be0ccba411bbd6557ea6c9263a8eb4d60b0aa7fd5
SHA512 7588f441e945c2cf11b0459eda645854444cf76511f9ef3cbdbb72d5c7631a7e3e30b4f39987329ad108e1054ef122591270abbabaf724de02769632a463f435

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\sk.pak.DATA

MD5 6f42eed19e0c988812c89069703cade5
SHA1 49a965a36f4eb2452a2fadfb3b131ca643e8a198
SHA256 37725694c1b180ab34a4ae1bd562246a39613f43cf98e3cd44148df5df0030bb
SHA512 ef3c7d4e3ea0ef73f88005dee3cd0fd7e5a892fde64c6865d036b013c0f7471d0502db09a5fa2a6edd9b0aeecc7c0192d95073f5720062e957cca0d7a2e32b8d

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\uk.pak.DATA

MD5 84d5291afc3efca78c35c3f623d8189b
SHA1 a30d7f356ac263059ccf6d879e320397a55f10f3
SHA256 47fa229bf3a4e81b290c43fa0926e41bbb4bf2e54ef239aaa21e4b01a6795e58
SHA512 fc83c7351181644ef329f3f96f176d7c9f1169fb721f1ec9b67ff7b43bcba9bd53787ff5888583aed0b28eb12f8180d0ea9c7ccdd2204789fd21841e64177d2b

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\ug.pak.DATA.encrypted

MD5 77861bbe54b47a247364873ce0b5a530
SHA1 ceeab4f4474b6fd2cf997cac76d728ab50275dae
SHA256 044b9d828e9c0bcb8539849b9fe21e4ef6fdf989a46cefd9e1686632884c4e87
SHA512 53f994ba9e1378390adffa5880b633e09c6876b2ce5e3827d034f7c2912c38309b5fa99b1cd1606752859ea4e4a9e657b97ecc31242251cac2445b7472827a77

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\tt.pak.DATA

MD5 202f46ba7b7e427c114b89fe5f0ec5e4
SHA1 65e58546081c414c1959bc2eea9f4851209e72f9
SHA256 4342908a3ec58087c881d6a65fe59187e5cc68ccef171aa7ebe9857c43893385
SHA512 e8c3d85625a79008a10bc104cfda697f629d153d2c2842fde0c87fda2b189c555f76fc3e9527eea25b71f8e39d271e7defee89524e0dc87dcdfb230f0414aabc

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MEIPreload\manifest.json.DATA

MD5 901d2f25debc63cc5c71ebde4ab3a5a6
SHA1 478cf55affdaa7bfbc39c4386d138fb80b802d1d
SHA256 4a5676aa7724f6712c1e7ea2bde1961c16dad302438baf2e2a5dd76b0fcdb8f8
SHA512 b6472cca190922b26144c093c2b3a1296bbcb81e82be0c631ad78ab1b907129b9c140104bb2987b8c64e77e06d6a722926ca784962e606d605ba4e987acd2e35

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Notifications\SoftLandingAssetLight.gif.DATA.encrypted

MD5 fee9815bbeb07af2d3153e742f5fd50b
SHA1 b70f1e9e595e307b864f35f93f9855b0c04cf440
SHA256 67607e2d07b93dd9c2c3308093d487db81a768176d4d9667f43d6b433bb8cc83
SHA512 28e38775ce0d31e1eac9ff013914497046c0b18968506e3a4ad9f81fcf88e423ffcc3736288689e14c8140faf1626bbbfecb385c6a25da54a6d424d18eab6ed4

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Notifications\SoftLandingAssetDark.gif.DATA

MD5 989921e9b86eed97032600e2a3360ae0
SHA1 6783553613d40da32c81e3903f929338a9276b44
SHA256 98b09328fff3b01bda6096e7fa0c0977d69a46d0f184e617c7a03bbc9990a4bc
SHA512 a22c01ccdf3919b930f1bbebf6158e7941b6b32215d0361ca94c3409045b87dd01d6d1a89e17fbaddc0caf796f3698898536832461189f1e1156bf6d10c5049c

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\nacl_irt_x86_64.nexe.DATA.encrypted

MD5 04caf0cb8defa5ce77dd73f088feff71
SHA1 5f4c0bcff7fabfe092cb4a0a5ab60c45119fd852
SHA256 5cfdd3be9fde00c2d3eb1c5b9c8f1de422f424ff8345c13a0725e7e372093fa4
SHA512 96a344c562668f992d47d9c591eccc874b635910857266deb4ef66a4c1d01b311da9684100f216aaa1ed51aed8667cddf76275e19fe62ec8564edee7242f236d

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\msedge_200_percent.pak.DATA.encrypted

MD5 27227a7950cb5b7e2d88b6968935ea7c
SHA1 4939654749cc441d15e6ba3f34b64db73a652c42
SHA256 1a2237b55b314a66e60a5ecf53832963267823a986a4ee2a683369ea36ba1b14
SHA512 42572ab6e8c6221fd391328bac883f110b47198b50491faa577e149be442952f4cdc827723963797a97f29ec178f10e1d01261a113d6fd58e6cb232fd3b4c74d

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\msedge_100_percent.pak.DATA.encrypted

MD5 f05b2067c4d43062a968237f873a37ed
SHA1 11d060740c23f606d353f49ef7dd0658052f25f2
SHA256 2be23a5910f0cd2ba16911c431eabcd2772c2622f45ac00ecf62e21ff247c85e
SHA512 8ad5695a092f8da18d999f0c9fe4e97f6eea5d074cc51eb222d0ae9ba0fa807df42061210464b04e97359bf9e3774fe4ed0cbf86ff88e40e771c9c6b0803e944

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MLModels\nexturl.ort.DATA.encrypted

MD5 1c1751300a4ef7f8b2f65ac1834f2860
SHA1 8b926250abce1990ffec95ae707e27db0b4ef7ed
SHA256 456720274ad41a0f2b5676c51da350d633f6f8f93d1c8d9d3507dc9eedeb951e
SHA512 d8cdc0268231aa0ff4fa184ef0eed61313178a37ee5809269c1171b34a4f24fc5d899ae14cfc129f73739c67b96da279183463b9ae0d38108dd964d61c813881

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MLModels\autofill_labeling_features_email.txt.DATA.encrypted

MD5 27890e362da4e4feb6edfaf7611cc8a6
SHA1 afc319c541235323dde7d5832585122c1d13b8cc
SHA256 c26ec4cd457f132dc1fc32d4865de852ede2a6d2e684bd7d5d45eedd9566cb4b
SHA512 ab5804fc34adc67be7fe763b437420e1782c235d2dc73b6ef4f932640f39ab2c2732b6df74056406febd0a1061df9364be515348a9a28d11a3cc6ddef5a08475

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MLModels\autofill_labeling_features.txt.DATA.encrypted

MD5 355ecbac2672bbeb6d8ddf8b7021e611
SHA1 fa76be661f6ad122b342d15b47340639900c47f9
SHA256 2cf60956c47e26496ccaef7f4f68c1878417995b4fce0ddf8c70f3801689f506
SHA512 f4eea00654ea23e9f7b4ef566a1f1753a608154e27fc2a87a8e98d46224e92297818ee1cd9d9c260dc9fd2c7c5814db55b62ab6ff90e0506880bdb65d426eb61

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MLModels\autofill_labeling_email.ort.DATA.encrypted

MD5 a5fd9d8926cd7579df74b3940b86d06f
SHA1 d28673946db041acab9bc015a2e56b7ab7e973c3
SHA256 8008c21379a20cf9083354c957fd57024b3fbd1f0a63deeae5c075b65f26a90f
SHA512 5d38034e34d1b5c451cacc2a0a0a4254187aa2d6f9ddc5126a6484132dc08c4db2495f0f25d2a307eda871c9dd855a658b9752dcb1ea06822689af0561aec58f

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MEIPreload\preloaded_data.pb.DATA

MD5 1ebf868e37c568a1e08aa43e1064d186
SHA1 b56b854de674049bdd7a2d15b37e6b3a3e4bde75
SHA256 17c8d9900532443fee022dc813836492215f846e9e2e90e628a85062d9fbafea
SHA512 4a0d4a9436273d3326fc660ddadd2e383a9792c4040271d67386cf5afd46876d3e58e2404d17fca608b9ba971374d1f9723e38ea5552ffba39aaddb9a3002fc2

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\zh-TW.pak.DATA

MD5 7109c089fa1e2abe3e8064aea4d87b39
SHA1 b7bcf28d0d3535c0b4a4a0916ec28d03b0dc6304
SHA256 19f22be8b01d775bc05c912f6181a169658c78ad52d989dff2e33fcc71a4e7e9
SHA512 7a40fc6d11151f1ba1560daf61fedc6d634973c89d0c44ac6ba3ea191f234ebf3920f720d136ea7dec14c57523b52dfd7afa8d9500b3d5c99b9b85de97c0c6d3

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\zh-CN.pak.DATA

MD5 4e6e524dc2b6fb29848c49bdddc29d66
SHA1 649e0ccdd61d198ebdd06752f98bf98b84b9cc5c
SHA256 e2082cc64e1771c2d960dda4bbd8888776168854d1283cec90ef15ef54f926a8
SHA512 70c8e9797c58ec48e0a8cb6b99ede623c2b6f3e60649cb1260f9f3d85e56e4384c48806a2167cdf6be4e23c6ae6cda04eeb38644a2f5c4f925c60fa67c2b8ad6

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\vi.pak.DATA

MD5 01cae0ee5c477c8ffc21d4a30f570f40
SHA1 a1e0e18be5c7ce9bbf930df30b8e14abd9b647ff
SHA256 efad62e27bcd9a650a010687c74b388f4428226f5875a7408c570582a2e172f3
SHA512 a7141d68c745bbc23f6c80f0c251679e01518cdb20189a67f7508b9fe746f326f79857adb9545fbb598b02d1805af92a2232df516a842fd476af2ac2a7561289

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\ur.pak.DATA

MD5 a62affa9e3cbaf582c97802ba3bd7f7a
SHA1 b6f9aba1bd51110b5557d94171558a35fd9adca8
SHA256 8ed5c5767b149c7a0ba5a8c0e708e2884bab7248b0bf0d2293bb7caadc710691
SHA512 b2513957ada2da88b06b63526b7f6ff0295eddc38607c63f1ce128fb4c41b1e33dd81f9a9232337faeb23b51fa6fa769350c8d969eb6b52c40ed0ec80e11f2f3

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\tr.pak.DATA

MD5 89b186fbd77ebeabf2ee828684f19781
SHA1 d2e8a8199ff9eafb571c97b3db8b5d7ddf4fa95f
SHA256 998e42bbc9821512893e3fe4ec70ad61e4687674e2ce36e6623d34d695c0b138
SHA512 c8cf5dd6034da969533d3e70b91168c0abfb294fc11b2c4c37bf250d5cbd32363cd08977ebe1222b8a13fe7f6507b424faf7db1cd26c730b8a33dfda47e3c305

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\th.pak.DATA

MD5 94804c9231c18f1320d385ed8a3b20e1
SHA1 e03824e04d0f1dc3731cdbe6cd54896a887abf5d
SHA256 32257d6a754926850c98c6a044a33117737a74f3b8f1feb4673b456b1ceecb0c
SHA512 a29d86151c236349b75fd0f41d80fdbd8eee1842f7eb2587f1625d0eceeeacc0c4d3ba06f4567ba3aa777607d31389ccb9643e2dd3f3d8599380beea239e163e

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\te.pak.DATA

MD5 797a9a6e9d75628ae53610b443cefa1e
SHA1 4165134696f3104757208063f585b15cff8ae170
SHA256 6c949181e26e28d14a411f8c40188b260ca3302aa749de7302048defa94c4eb6
SHA512 f7758007dc7ddd515dbbfcd29f28212b15c1903efda41c19f49b00a702c1ac16664404b3dafbfaa3c11f1cde68aeeffb99bbf0fc81e34a20e80fad9bd383fd6d

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\ta.pak.DATA

MD5 97681c36d204b08e86faa6602d75fa1c
SHA1 09dd83c31dc12760184010e5a8b2632ae05d6acd
SHA256 2b994f56dba1b6e543963514f3c2a7621580e9b5cb5d26667c13b9cc77a283c8
SHA512 cb960f705d0271cbfa75f439ebda809e7eb796f2628092ae6222d72b1973399f969aa7578c579f85989d5a3bda90b2d7629387561d3c7bf1e54cd229e3dd8d80

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\sv.pak.DATA

MD5 abcc36f01f7c9daef661a824eb4559c9
SHA1 5aa9d3aee92795fd936b053cfbca9b2eb6330b29
SHA256 dd58c5b1e140ce6b5e32ce118f93a299daf2e752ab9e041ed850ac616eabbb5c
SHA512 68e944b0c548c94dca1b44fb8daf01e486b8a1ac322690460b017b813db54569ed23e885675855038ef8ceee5483342e9bfe893c68a8200827a53bb6177c5298

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\sr.pak.DATA

MD5 69042c49a0181780495547d09ea3a1b8
SHA1 68c5bd9f2083a8547c7e5d42527d89089316d442
SHA256 d30c0a2d8ad9313fe51e066f6d4e1664d4b6d83797a1ede0d4f861e2b8214c39
SHA512 fb2e88f514ebd3c9d026b08d957d8022d327746ceead99f09265f150fb1c757ee8bde887dafa7c0a4302fe2002ee979163342d21391839404092384c0eced24d

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\sr-Latn-RS.pak.DATA

MD5 ab5192811f2a28a17c3f3cf6dfe8cef7
SHA1 2396b3249c9cad568e540e153dfb1f402dee4328
SHA256 a6e8f12217ab039295950579df0fb7d23208be496decd376d59af0460e14e262
SHA512 87e8ceb91728f9f9027ad91f14ce689a864aac05b526d2e8466ef77dbd2bb13da6c510738d99404b4905f8e524638bfb9a632e3b32a391e2158d4e8f7373391c

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\sr-Cyrl-BA.pak.DATA

MD5 9cb1af6cf674815d5751a09c4f8f4c4e
SHA1 ce6e2331fffd9f0849f890825a0197dc50950ff9
SHA256 2cf1c2076bff3868cd6a9379ee2ac36eac473330473374fc2087fe83711a7dad
SHA512 ee2cb664f0949f4fd56a655d09013a51f8dfd7389b4a657c13cc777c17415676a4b5089c2b34a1d776663a2bb5dc92ae05eeece19aa01638284dbc3378b62513

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\sq.pak.DATA.encrypted

MD5 cebe66350b705207f7cabf24d3e4dad7
SHA1 e264130bc6895b749fb5c7c034915df7f666e398
SHA256 f988655fe0768028b46b4af4d1e940765bfedfdd40371de474f232d4d57e74f8
SHA512 bd31da95641cf7c53e267f12dae422384f81537c08beda1f072c09f0117feed15da6ff6792ee6783036d42d7f0eda3d7c85633f81581c65749c857beb9d810a3

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\sl.pak.DATA.encrypted

MD5 b596ee3932ebe828aee8b71b6304a170
SHA1 2e87540c7bec306224fe5e5cf9753d527839e481
SHA256 35ca1a614022f4fab6e01c5900ebe165db7bb8fb601bfb2b3bc881e454c66cf5
SHA512 4e10884a35a3c8d88c97b24602c302b2a3a218bbb5125651ab674003313edd03b4eedf037033d85bb6867313cc175bbe5a38daed53e50696f5d1442077feee64

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\ru.pak.DATA

MD5 a25c6e37d5e2f9f9cef0c1fddf4b31d2
SHA1 981e53bf69132cf24fd55eff79e9ef4bac1490b2
SHA256 532f9aeba9fc656ea460cc946fcf60f10a4e201b395d84a95017b501bacfc385
SHA512 c00f61ec3b7f740514e85f8544cd0fbcb38d964f26910c230bb60abf0d4be056e4e177d007e56238add351fd26dda66120914ab3226b5d17ce5489b9818344cc

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\ro.pak.DATA

MD5 e27df0c199c70b4f8b12a4a1eade5122
SHA1 66ac9c582cc21dc04b232c68ae1d7ab10744a660
SHA256 01cc0af2a7783cdb6ec93ae196a11b16ae6d6668751fc5f42b270083e8f59cba
SHA512 b29ef19d9347b8079a57c35936375118827a275821414ccda3f8a9dbdb1cb5321e0f681c46135df46570e67aef600878e19529e59c86cffabc412bfae1a2c8a7

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\qu.pak.DATA

MD5 8d770834c05989531e8f7adce894940f
SHA1 1205afd972b162293accecae997a30e57e46b411
SHA256 7a688dcaffebb8e47a9b8a19c9137499c122f52c8821396aadfe417839cdfaea
SHA512 0d9c57fd7c2fd7bee173038bc697f05d4254e35cde534385541aeb630603714a50e91bd69d8edffaad13c02868d6fe04bb98072a70bb563e17d036cd49e53d16

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\pt-PT.pak.DATA

MD5 4dfbe26fb28c89490ca66b3d8d7736cf
SHA1 f46bf4df23b9a8bb5962a514ceaa99e343428502
SHA256 634fa7c627753839e690fe31f2c92558fbac9b9dd6bbf15abda40181cd7bcd5f
SHA512 308aa618320263280b7c689ba9ac1616f2384f00d1cafc5a1abe43b14bffd087f6b1280917689950446de3c6fbf483baf77c5809577fa482d26aecde64681c23

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\pl.pak.DATA

MD5 e63da236d9cee1b19d4e37087cfffd2e
SHA1 61a1fef1016d243b64ae0176de7b1ce5dbd52ee1
SHA256 f1f803c92c41d7d14017382e911fa7a1edb8ecb00244c2edaa93c95d0e71b0a7
SHA512 04b1ef80fbd7c2183b4b539c8a5da00d185089fed538303f6b990437c77b9617fae80a2c8d932cc874809eeea3abcdf58133fb0367d4fe981b3ef8d64590d520

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\ms.pak.DATA

MD5 7bf852fecbb9c7414665b7782f3983d8
SHA1 4fd7c5dfba751b0f8924b3543f1747e30b9ba578
SHA256 3132f8228652fdc1f6e01b33a51abb403d3df68983d85f6d503bdc76a0b3b50b
SHA512 7828ab8b17de698ce039c55a0019f71d7e9c0c61d4cf733720885585af5da6cad8c3e065270a985e7bf525ea1b5bbde605dbe8eb986e5671ed67c663c4f2e795

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\vk_swiftshader_icd.json.DATA

MD5 41bf833cca8968a4fffd913bac6d2004
SHA1 3dd4a9118bec48010ee0a56328014a339c99210a
SHA256 e6de71180b91ebbf877f1d1eb42a8b2275e388592817db5746f522052d3944f2
SHA512 90e6c3b3b25ce09ee7eb82bbc569080588057334d622c41ef5c31cd8d6d17dc4a5ff7a24adcdd92b3cbc444e93c8174417387c590c7392b2040fd4d4aaff4595

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\resources.pak

MD5 3884174060f38944c783f79697d2da11
SHA1 1cf73edf4033f9792bd27e67b3a9b59cb4fef136
SHA256 1df82d76039a4e5e5324fc61c4fbb5a1493d835a90243f3dcee8f01e01e2e4df
SHA512 0a88696c6b271d2594cec02336e4c8956e0adfc527953ce124a78e94ad8cf7be90e8ae463da6935641c3b83e97e9ae64b6e5de78d92a7c9b3b6351bd1a5eb40e

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\Social.encrypted

MD5 6ef8d462807e916eca46e7d5c9019be3
SHA1 9f0fa9d630b906441423ac2a5b8c80d04e429f83
SHA256 d6cc2ac922ae1dfb20d466e8ed16a06ee9b6b262c49268b2d2ef7020ea5f3b52
SHA512 524d4eefd2d7f376bd2eceaee0b2629ef4e95022b95d56d1f75dbed0c4a18bb076c96b9d3e980e1c0aa6620c5618572a47e0ffb33c72e5ddf2d8a3c5a349265e

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\Other

MD5 52a5828cf1257261ba85a6aae9b59c28
SHA1 0b44a366b64d779cdca1247a19a0c6fc2cd402c8
SHA256 62ae4d428732404214afca7d3865732dc1fb2224b842b5ded9f87abe09053920
SHA512 d66bb27cfd26fddecd907becd53dc5deb8a8e915b6a159441a9185f1e3c2b288700c2492566c178ed869de18e827d56398c369abf161327bd31418250413eb23

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\LICENSE.encrypted

MD5 d3189c3741b46263a1b0c854ce87f96d
SHA1 bedd0b2573b86e8febfad6e3a151d964804f755f
SHA256 1a92398d7c5c83880cf0af10135ade50f0900e38d33551b98957691bb35ab374
SHA512 25eeccfb003541e64bd6022b38512731eec6ab610715222f0eec7488aaeda9910535f72226a1685f839ce3f3f31b52bf37b2c09e660ef8fb03a976a737ed51f1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\Fingerprinting.encrypted

MD5 6fd3ea377c4e1923eedc86c70cae3e72
SHA1 b3bcdb653ae9f19bb4d25324a1c9338754680428
SHA256 c838a43cc49eb2b54ecb8b207b8d0b441c67ece51e051459afe9890c5851c5d5
SHA512 9a37516a346bd4c16858dda51787d5bb722bfb18c00f60ad7920ada0e8ce2e81fa738196ca03084a9e0fd5506951f1fe49f21fc1a746f5ec82a10f87984fc887

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\Entities.encrypted

MD5 2f0a50cf9cfd502c1378a52dc4253c59
SHA1 1f486f6efbfff164b2fa7e58e596ae53619cc9de
SHA256 26da09124b67b3ab0a34128ea7a8b1dd566acaf0f061cedf5be85f6795e62b77
SHA512 94541658187e2338618f2144d728d10a3b12e3994360845a12639377a99e54ea406ab12ae01f348d1391f0d1be7ecfe48f6c82241a6d90e5d43c69b3c333e787

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\Cryptomining.encrypted

MD5 3d055eaf6c00c6ca58d1790cbed2fa70
SHA1 1ac6606cde565a722b29ab16b9a4ab4d8b7bdcf0
SHA256 8a00629b8539c99b51ca9cec805dc04b7a82263e5e7a551c36d87952f07a49de
SHA512 9818d8c18817cf5c171eb341f40e6c96503051755bcf21c8d7c3268651d3d2e302cc91ddc5a64030379017fe445e6eecfe03eb4f4d81cbe619df491841501a01

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\Content.encrypted

MD5 7e8c43a0e3d285b57633dca3d9727858
SHA1 e16a54e98c83721b58decdc2f632f83e79b7ac23
SHA256 60d10743702174e493705032ee50f7c0e3f359d4a09e69e318b3638d1c4986c9
SHA512 190c3b2ecb7a7858cbc93503a5a4381ffa5ba809b675626076763a23cc689e478ff732131eeeb5135e10ed063a7a46cbbd457973b40818a5e9c5c109a6f4e29a

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\CompatExceptions.encrypted

MD5 8eba1084e1ee9d0077e167f9bb86c1b3
SHA1 8e3fc21cf0f9550d91453a2297c2fca8885fb445
SHA256 f9a42699dd16e3e628332d25c552932aa5815a7aa88110ae3fcac3077cb35ec4
SHA512 f37f36c0afc27f7f3ff87896a0505892eb408cc0b5596d273d2c5eed690e6c31858301527b8f0a675ad24c814bb1d23a95a344ed68d78cd66c4d18a379953b24

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\manifest.json.encrypted

MD5 92528b81afc3c2e5ff51d602470c092f
SHA1 4d12851a1f9b46bcad4880249b0c620cf4c38ee6
SHA256 2a67f003519bfbc0471070112bdaec46058a7e7ef96ce16146910d506b9f664e
SHA512 35c485df593e38ec101a2f662be5142cbcadb88b08646a6ef28de58f0b3813fba4ee72f318bc756c0671343e2a985a4b90b6c0fea8d6d7413d22fa58562235a1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Sigma\Analytics

MD5 f13f385eece32fbf12bbdf06e0aae4da
SHA1 c3291392afe510f4a0de42e3ba852aaf2f45416b
SHA256 c6c07c35cc3954f68acff737815f73e7714f59041b19030edb41c285502f087e
SHA512 61742229e56d8ca02b74c4a1805de1a59394c4eb10e8d2fe6115ca16c18755ac42425110281a7960cb486165f9e0a4601bdf151b376c124b535b794bf602fcbd

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\TransparentAdvertisers.encrypted

MD5 e90f90dc80bc3170a4da9e422c31f6ab
SHA1 0ce125d2bdddfcf2f75a4e9661ed07e9b07a2101
SHA256 1ba7d4dafd9dc076005a915cf40fe091535bd42f3bd46e44c7c7da77e13b78fc
SHA512 406400bfe1fd6dfdeeaf3c493e0768f1a2bea72996231246f2c488a93ceb9f2845bcbc79f1907532c7725b054e185a25302e3db28961b96c539925b88defe4f2

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Sigma\Entities

MD5 a29f0e9153a636af586f63ad504f94e8
SHA1 733f40a840d494d008db39af9a0a1959237aa7d0
SHA256 a462a03e2acc4411cc434f4bd411910160e4bc171cb5887cf27381a166bf70cf
SHA512 18cf9423eb6d9bea1eba4b8820ca16f98dbf9a58c8f89a7fec0f433c6c42bd44a7e25733560acd004fdc756b5bbc75fd09d1b7a2a85a4dbaea5b0e961b1f854c

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Sigma\LICENSE.encrypted

MD5 86383b0426cb8e525631bd35c30140c4
SHA1 50898a2bbb1b7de95075c979293db020a43ff781
SHA256 5135ec5594fc49a37328b941bd3226335268cc43823d274f02056f54065cd9da
SHA512 5eef3ad1c4754e9729453c82ae84b87c36cf00cf23f75b3445e8d3f737b8f65964fefd611f85ca4264224bb3d4cd046fa7213566dd61edae47c0f1aa87a4b45b

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Sigma\Content.encrypted

MD5 216569c205df75caf1d9b11aa79681c4
SHA1 24bfc9ac5655ccc370ef1ea0d5b6e20c8229bcde
SHA256 d6804b838385c178a744f5b0cceb18dedf7003a353c75fd683737120845ae0fe
SHA512 423ad73d497083957823f341df391acaa38613f6c6aea3512c29e7036f10bdbab18be732d23877edf3e205cb3cb0381cf71149178342ab24645b01ecddc40bab

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Sigma\Advertising.encrypted

MD5 eb80e3da7b0116a27cccb33bd6950e4f
SHA1 42a814a9f901eb6c6b02c50b7d5f0a06fe077ab3
SHA256 66a752dfa000d0e45df11b879496b3430c4e57b7c560878e09dbc08dd06b4527
SHA512 5b7d6e2bcf54e3ce739ead2180b8b5e85fc14643cf64d501e9527dddd43d40e107bfe00f606361ae4fb9ce380403fb9f793b4db1930da2e8f9396ce324885fa7

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Sigma\Other.encrypted

MD5 1ac3ba7dc6a170e8dcd75a177329e76c
SHA1 742c8d658b16bc02a82fc8c20dab107423de7eb4
SHA256 be567dcc0ae225c2d00be54c72dfebc5af2e5536d36ccc965c266ed88d34e598
SHA512 74f5655de5cbc79273a5a9ac2b46316fcdec4b4dea29089813f5a9e692c6620c3b9fe88c8eb069c966970766a6df011278f298a750a5bbb844d630cb30effe61

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Sigma\Social

MD5 b48903d10c8148b80a74582eabb8ef04
SHA1 1b56c6186a67fc14e3d6dd27e34335becf95294d
SHA256 910769259ca000c2df0df8f5f5284902f77c0ecfd4a55da335ef3b16ad522008
SHA512 3f9b22d7491aaefdaadff7a53783d13eef7ab4e0f122a0f164fb06c75d60140442db0c95e5c8f4004494db60d4f93c9a35f74c820eda52fa7f11f182b0f77d83

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Sigma\Staging

MD5 30a62f79c1947cfc99c4d78191d1154d
SHA1 dd1882019584ae722a17dc99f3cd6d94ba78bcab
SHA256 526cf7b28248ef41615717c4084f7bbc232464eeb50dc6ef24d02ed93da3ebd8
SHA512 deb17771e3399bd1f71276639b222fb70710bff05a6293b26f03fdcf9d5ab89987532eb4b36ac49371e40532aa93e4099e06e0e8eac6a83b639fe309efcea2cd

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\Logo.png.encrypted

MD5 37507b3105279f2c61a62b28e3b03627
SHA1 cf8059595a6d658e96d27aa5f1945a0b034b7312
SHA256 0538ffada2ca8855bfd029d9b02e6801b31ca6479c5056399b0e5b19449a3b21
SHA512 04e5debce93cad76a1475cc656e20cb59acb659c72244105e02a131f3e7391593b3dca67661e3c7625782316c1e2a0434130bd2ef7f7814d7bcaf14f69e9c551

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\LogoBeta.png

MD5 685eadc0c1a425eecac07a8f751e18fc
SHA1 ef731fea62edb98ba723d450dfad0559e52f487f
SHA256 f8c88455b42c30fcfcc8b1e177478471116a0d08b40c9b4f71727dc1333dbfd6
SHA512 9c6e6306a7d3d669ad1d2c86e2dd00b13615ba0e547abb4d9279bc208b024034f64cbf7d578b27dfa3b33e67004236c15f14c1a507601d3a1e6c64306f404792

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\LogoCanary.png.encrypted

MD5 469a0c98389a1557887a94510f31fb61
SHA1 b4313c0aea53bbf2dd0d6ed1cfbafd73cb97c3d7
SHA256 c14aff5972b6af885675dc53e88f42e17ede2d039ba1bc81037ecb9dbee99947
SHA512 7fdf28e36a6a3134719684816f24f665f5f6ae4d0513a7beb62610953d4505f3c68423028a36e3cee8d4bce77c70d559cc9de2874302aed7d1a9747281b35c59

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\SmallLogo.png

MD5 d6c6435b7abc08d0d44cd067ec37d32c
SHA1 df6f27d421416dae7c87515c60f922cbfda39aed
SHA256 946e32a2ddbbc1d9643fad9e01caf887a6ac03579857c7cfeb52124df996b305
SHA512 9ec2f574fa317c1a114ecc67ff2e4ba3b76a5cab021fc5691387031b84f3dc516cec4452cb0ee898d511808b44f63bfc1cb717ff306a2eed19372a621b6c193b

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\LogoDev.png

MD5 c85768a6b38374e40f60519451bd9fed
SHA1 46e9ffa578383ba973a3c0809fff4f2ca31d6a12
SHA256 47289bb7c420974c80ccfa10650751233721599ffed305b2ba8068018941cd14
SHA512 1016175f7d1db92ed5eecf9b971d6d83e84588777a67912649d1ac8fccd42880ecd904af9d2ac33ce60b0646ce8dcfe79e9d06321aff209738c894a85de37cf3

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\manifest.json

MD5 ca111008f5bcfe0ce87282a4876cec0e
SHA1 dba27edbd6445866361d5ccfeb8e9552da1e3a67
SHA256 d139dba0055f28fb57e95f0821a98b7a806574b53f43d354654921fc7ae2c525
SHA512 6c735157d39fff40fc7feed9bb9c1156bbfe99e91f5f126a0f9b4f1b103451843dd5a55f95428f77d878aca7fce4672ded96d26f97d028a02838708b2d1bfdbd

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\SmallLogoDev.png.encrypted

MD5 40f0b6d2d855bc15f832be03bc302835
SHA1 adca118493bf15154155313db96b07ed5e05a565
SHA256 0c53d4d5a05215c45d563db1727806cfd43a4beae86d5d100a11651165f47b53
SHA512 769c8aa1ecefb3d2ff3f355dcd5793c98e7cf2b75d7b57364427b8b2e783a286b13ecc970e0ec327f67ea27d31e4a7e8ce6d0fb6d93c5739555d3a2585e722b4

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\SmallLogoCanary.png

MD5 99b548a29a726eab631751a76d43a2f4
SHA1 67d16adaa15b598862dece7d00a0b1ea3d969a57
SHA256 70f5370bd70d8a6552f444c297e6c6d83f6d6b09a85275c0ddef8cafe1a54203
SHA512 8535ca3875492ad8a60e7cf58b852b5a1196e39a69a50bd03af2822f71a571466d43f5c3daaa73491747e169b205a45b301bf788771646c65fecc9e236a2251f

C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets.encrypted

MD5 226ca220a2423f6f0a10ff5b933898eb
SHA1 7212dadfe815e1200702614bd140ed382b9d2d8c
SHA256 5e1facf0f082d86ee5b4d999ed8460007ef1dc05841a64c240d6987f6ba8685c
SHA512 874b954d09de42c9337dadd2651d9e06c3431ee281c65b14e3e0c4b24f114ae5dbc087925040559e7c4a7fed9d08d7aa27ce8cb3263f4a7a88937e9a6f411e4c

C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets.encrypted

MD5 037081891df288ab34e6ff3dc8e0e4e0
SHA1 4244208bac98536c9dcc103cdce7c3f2ae284ac6
SHA256 d6247300f9eac1c2440f214842312f4e09e8a20d3fed38d42d21968bd87f614f
SHA512 7509ee2ee290341615b58f55803c9ccba4eeb838605e79384b788ffb4e1fc6716d8156477389b6f9bff7bb9451df75c3ee8639817aad316543d478a611d25314

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml

MD5 9d0e1f927a8e0064e98084dc26b10b71
SHA1 28130a818ff06e78417052ce3142342cea7cb08b
SHA256 88ef8e5b8d75ff4910fb029dfa1bd5eca6a1252ddac66b3c9c51d9b65f042e23
SHA512 47653247303a066d74f8bb94a8e787c3e8f0df556e3d5c784278c2cd22086d32b4689a6620b515a633b8da1a7947b96661fe63fc2974c74fc7f6f3608959bdb7

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\MSFT_PackageManagement.psm1

MD5 44aafeaafbc6ba572f60f8e8969dca3e
SHA1 923a09e58bde1aea256ca2f154103ff96a35f27d
SHA256 1ec1d691ae85eccc789d498b23f6fea036752465d445f3101eae6f5f5d0cee86
SHA512 3a777b85a35d19759f027eb30ab2af31581a0902f0f67a50664e1f08509923331134188341c4d7c3bb7fc096bae3c40cdb7bc9b934b52701da9a7331efc679f3

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\MSFT_PackageManagement.schema.mof

MD5 7e45e90d51635be00426d9d3913ab8c5
SHA1 2ff2f48fbe6241c34ee288c16f836402d2869881
SHA256 829bd9ca2cc73ac0afe4be8b5a43c4d64986d58e79dc47119b1c9deaf9f0cb70
SHA512 57ceb1d703e28180967626a2dddf1d8cc010e967e1b9663ae2fa9fc3d1b6d8edb6948c1b6a16f6b76e983d78c34703370d311041d7e00963dfc9a8306e6833b9

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\MSFT_PackageManagementSource.schema.mof

MD5 68977dfabf0668f337ef3bfe84d2581b
SHA1 a8131f583a7df4bcdeb4d0351b2e98fe809aa7cf
SHA256 3dd045e0dc4b1bf89eafd5e080a63d902af6c191196e2b34daee913e8180030a
SHA512 825dc441f7a43ee8c8b0c04d66a09e8cc78712c7088931e4f77ab13ceecff43f90634a8adb3f2042d544cca4a101fbe5f220d72e972511f1131978b1b41e85b9

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\PackageManagementDscUtilities.psm1

MD5 1e535326db9dd7e8e3e5991314e55271
SHA1 ae320c9c3c65fc4b43957942a9b84a68975901e7
SHA256 fb5f01dc2713ca288d7c754b3141cc120c0e6a2d59707229c9644e5fab00a675
SHA512 12f65cc83abe70b06a69fcceefdc6194b9b15eca08bb882e4637ffc645283182975898759a10f671634621cbbf644c98efc2e88161aa9033c1f9fa675467a0cc

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.format.ps1xml

MD5 b13558ea8f6c0239b39050976e757cde
SHA1 165d52db1a34af18a36484ccb072f6e11b6cd02d
SHA256 be260afc6858f24be80ccf8208d1b0e72c0580a4b4f199845d36f24f0328cff6
SHA512 7f64c611247b562dca149cd765b6aee22b731326ed43495d6b26d5992c7b99f5fbcdab7d9558327bdaff6d0a2d0c367b24fa3225065b0ad420742b54a8d37038

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageProviderFunctions.psm1

MD5 00b27ab5bfd740873a0e1f8466d8c6de
SHA1 e74440dd8006e51379d37efacc28bd26967bbf89
SHA256 838d35c5592f75e1d6e0267cc017e828401b9579e28bdccd663641968d0b4823
SHA512 fe3ed2ab61878c3207ff922e86921765d8e7cb7b9ccd9d4c4f58cb370f2a92d7297c28bf1dc67c14c7688609a4d94130c94ff63fe037be53825f01a874539b55

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.psd1.encrypted

MD5 1fb9bd6c1b6425b2297b68726b45c323
SHA1 4ca4363b2aaaf623df145c4ccd6041f26ce6276a
SHA256 0c217e685b755eb80bdf4d94e542f5293adf08cb7e4f43df159e15ae887b92e1
SHA512 4e4ce918dc5ecc37ffae88a720245ad16e9e4229bf1a34c226a5e54f3e0bc48fe037937d656a91671ab80347726a98f2a12209dc09078bbb62cc2e61a6f937be

C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1

MD5 6d1df04c79d1d527c5a6c3551f6713ee
SHA1 7a5fe3f853b6ac53d1158b9a54f3dfc1ec2a9e36
SHA256 c276a0ae17dad846f850630af76bd050a840f483e8d1b5eaace2605f3b445746
SHA512 a6e809b435618236f8bf38eba46985468298a601bf4fcea3fe1143dfa3c0333606f98ace8415419642484ed24a31e9128a2a1fc04296638b23ea5070ff59176c

C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSGet.Format.ps1xml

MD5 8f18752a6365ca04dccf9475564bf7d9
SHA1 e106da3e4c14ee7e9178af1bb4e20321f3bd07a7
SHA256 2ce332280e083bcb643b79c555b902454923e6f14c5b5f8d9d49b1e5879047c7
SHA512 0d44586e9f338160b49e1d68cec8749d461ffa99159a58145aa8dcb4a7dcf7924c0c36874582a0cfdc277237f9bb8f5499bcfb726b3e41c8729616543f0928e0

C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSGet.Resource.psd1

MD5 03eecce1a1628fe55d8fc9d09317e41c
SHA1 3e17c0ed3c8dfc9c99b87e5f6b4340e24aa212f4
SHA256 0b3695e68ebc8378393b3825ef9aa7d691d08e8e4f149eab66dccdb0ba2841cc
SHA512 ec1f67f4e772ca5db9b0692b1d7ff6ef15794a00a562d0e08e94b9939ecb3932bdff1145c9443c0c203ea5c05b2e385e4eb9f42d14c0f54e77130b3465ea618b

C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1

MD5 ca93921a26a955d22f1d74461858f47e
SHA1 1ee863fb092864edae01182c041d551e7ac891a2
SHA256 913f32d81989c7c749d9f47d61d5d4c3db953403ce6a3276e013b06fad07468f
SHA512 30a66f54f3adf666fe3360fdfaf774754c32fef84bffa6d4532f7ae4530aab57e0bafa29fd882843e2f73eba0b810ea1b1cc211f3b00378779b0f69c1233339d

C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\Manifest.xml

MD5 5b37db94b98fc056be275e4ba387908e
SHA1 a159d7a54381c6c51b3d745ef60accc81d4b8763
SHA256 6c2f1a78f1389b2f7987222566827d01704ecf66f2fb5f62c0822b66c805984d
SHA512 e204f393740b839d8190167bb625e0eb6c6e1a10f431fb8dca34597dc2075fd57f45e3ed97e389e85b9d597f233a08ca3f47f941804b5f8eec0e5e31080cf41c

C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\UserDeploymentConfiguration.xml

MD5 9e74b5822f61be0a97392e1ee92f9c12
SHA1 9032c72f7ac1848215db140f5d239df15cfec9a1
SHA256 feb7e2c9a3469511f9075b582a0138d8067ea9f59f0371612e621a7368a64304
SHA512 357aeb3b4aa20d81b672f1bb2efe425d828d37c4a2d6489478629fdffbeec982f8d04232bb06122be1cb3da1ae51cb589179babb4cb2a5b7cc5af04e9ec573de

C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\AirSpace.Etw.man

MD5 e571683c28fabaaca0d6aff127ab334e
SHA1 6417750f0e1d5fd468d7b289a4d0de4801663b44
SHA256 50070bcade39083009caa32bf20b32a150ad2e0fe595b3cd23058efce9af069f
SHA512 29a94f0c3b7ce379d559108c10017dceabe15fd8a8e116124e42d58b01302e9cf9a307b91354bbc53a902cd6e4a259124f8cf9795c2c6636fa472f995fd19a2b

C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\wordEtw.man

MD5 340f5bd0c4663e0d5fafb1ebddd8bd06
SHA1 1f5afe879a555ed9c39381b45ce5256b79be39d4
SHA256 0e15d5eb5da53b87eb947dc6cbd7441f4f91a8efe97087ab9bbe94438739cacf
SHA512 a6794a7eb6296253d5eb131e68596b30238dcb0065aa31a0c29625e0b46c5df67ff8758107bf209bcdc0fda4032664c45ca8b7b33af58092dedf8e3e26e0a3eb

C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\msoutilstat.etw.man.encrypted

MD5 aa42a74bd64a8a341dea003778fc343e
SHA1 01e4ce860f0bf3d88d56612a02c3b5fb044c8f05
SHA256 27c3695b265f1dfa3ab20cb0f035aacde4cf36c4b3c24757881723d725ed789c
SHA512 928ad4cd25c0e877bf6660e762039473a3dfd8c2f71ed874ef1ca1912f6c449301d46d84f95e110ff97f8df10486ab3c33f5ed9732d975fec93b5771e3de7e49

C:\ProgramData\Microsoft\MF\Pending.GRL

MD5 983baee4e74762436d3e75988b27bcee
SHA1 858b210c2abd756a1923eec8a735117cff3a8070
SHA256 657888ccb905cdf6bb527767c7a0f4781fb1c1089a918473837059bd2de6c982
SHA512 05ecbfae2fa27514e622b0d8088a4230ef6ac5d935e5b950edd0a6b3b380972f83fa22e1ba436c12afc9259256be5bd6acbbddfd867a7d35bfe61bbd0b4ef16e

C:\ProgramData\Microsoft\Network\Downloader\edbres00002.jrs

MD5 62fcc45017e46cce8f6b0736885c15c7
SHA1 037022656fd96a3a5744341d102a15cb5112ac5a
SHA256 7a8d293f1060ae280f592a697c233cbb89cd82227ff314d36da1469f3dc307c7
SHA512 7daee5e93aa819ff6434ced5292924e74bc31dd521fd3e592006d21e8af5e7bd3eafb09cbee01b78476e0d09f24ef45d8a7f8a90361d1a623a141b0754a096d3

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\CiPT0000.002

MD5 2274a9e87eca78df8708e121c23382c6
SHA1 4120316dac9398f59a34d932dc8ce6cd905575a9
SHA256 71ea5233d620736f5d11670e1abefdc23abc77c14b752d89c7ea449fb69c41ec
SHA512 5efe5b517cbe1e1857c96deae43826f3b024c9ef326d5710691ac583980a2e5e4415007230b29cf311ae54d2ef7bf9d581fa9704aed9ded8bfd36ee885a20c8f

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\CiST0000.002

MD5 8dc4c79abacf96ff36356329a8161489
SHA1 2854ccd5cca705a718863623f3ccda483aafcb5d
SHA256 203cfd0c0461b5446faefd1bc9f89090cd431aa49a41a16ceecf0737b3013164
SHA512 7d0d075713bbe7e5420240af8d5d4d9d168b0951ad3657e9f755693044f1c967b33c3c6a62d59bb3ee3912d3fbb79f717a445f2ee2ec2f25257c1d07ffef0850

C:\ProgramData\Microsoft\User Account Pictures\user.bmp

MD5 fde1540aec486c314994e328d0314f8b
SHA1 fb39ff905e0d2229a9168b64a69dc0728724a64f
SHA256 4150e2c0ab7084a211ed4c6e967edaea08b19718b9e90f5b00f52d3ed4ad4d06
SHA512 64fc7e4d04104f62a8dc8a2635516b835c0899ca5995aa7b4a7b3aa5e00c32735545de39ad9433fbcf06ee531fbe75e2cccb49fe03c3268407a342b04aa9a23b

C:\ProgramData\Microsoft\User Account Pictures\user.png

MD5 b3855e86427e028adc62f746af267177
SHA1 660d9d63c1e650d2b1d374550861dad1003128ab
SHA256 7623c6a9addc83efa218f259f72da4f582dc1fd5d7886b3d9d8afc218dff2baa
SHA512 be8f5a75d9662be415752310f97502334c5048b2957d6a315c3b4cf4d618dc701e5809a5825bf6285e57178c18ecb3be76d07ababdc4098ccdc996ad26526d16

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index.encrypted

MD5 0569fb0caa31a80a89525a7d6eab9a58
SHA1 ee606ca5d636d385052e36ae25aee18f10d7c035
SHA256 6025bb4b281740e8bea1af71f0022db63d15e21b9605b23ed571295de7f6c99b
SHA512 66314f8e509961c63429760e14b4175a222eb73f34213476b29d39a7c8d9c36257c450111c341684f931869150292f33724929f12b0ec9d3d7372f16964c5212

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\000003.log.encrypted

MD5 5acb239b2808047c66ebf77351351d3a
SHA1 f0648f538ae4ab87fe3d075f09c184d3981bccea
SHA256 3766fc923cf9c6d5501a2af7725e5aae38c87e04498b0d90926d33b43a79059a
SHA512 158663a4eb5edc51a01b29a267ccaa43b64e807cd9fd1d6d4767b62da924dfc376ca93c2bceba21d04c91f0bcf2bcab3f1a30e3ae97ed6f99a7e286a735a204a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\CURRENT

MD5 8aa4c18e2c8b242ae57cc49f8b0cc372
SHA1 80c5f2fc746f316a5cbccc781af47582868d1bc0
SHA256 9582c5227c0c91524d2516a7976bbea07538e2c7ca292fb2aeab8b7b2f3e55ae
SHA512 2244deb5447b65c2af6d4386a281786330ee4b199ce94c3f58dd95bd98d609bd1493849d58d081882c38422358d59f21a0a19f967652db5ae236d0c874d0b957

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\MANIFEST-000001

MD5 f6a282eec300994314993d5195db444d
SHA1 b8855467c5c857682f5665328dfcaad84294f248
SHA256 8ea4d1fd0be2c3c02d77e65d4268d95b89f56b1a23e8171d177de93efec56261
SHA512 40866eeb304be5659a663048e9a2f37cd661ba6dbf2200b85aa7a5045460e65992f5659f93070533fc2ae63054e881f56db63612142ce4deaf10d0fd309057fe

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.82.1_0\_locales\en_CA\messages.json

MD5 557356d41b5d702f9f4567c4e43f1821
SHA1 d02e49d71ca4d2a538566447115fd778bb390c76
SHA256 b2e967ca01794b1bc52c70cd36bb2f63eb87a723eebe89110ae1f2d269c6d7d0
SHA512 a65f8b8be57483b042c594608bc9747bea9378011b5d084b442b4d9589e8767ef38ccf445387665d99221cd60f0c6e0e2473edf26967aae1a625160ee18258b7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0.encrypted

MD5 ef9138e3f6a78357b0199eb57ca2e7a2
SHA1 530f98c9084b630018473cff689acb7cc638e148
SHA256 0c0d44a6cb284fbf4a956076b46199849a2f004bdca7a70c36ca688830a28095
SHA512 f472aedc6d0fe721c2a13d89928446a12ab8d3ca188158d3e48fb0141b6e94d3fc61e0957a4d0984583ffc36c719c03720fbb5c6f0cb8efd418ac88afd7b2d26

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_2

MD5 d3511a436b360b4f98ee36ae261cf34a
SHA1 5911498e9287e9e7eb4b869fbcf979bd19118083
SHA256 3cb7667891b0c90fa92ebf6d1905eb2b50882046cc59c33ed7e96ebb7bf08174
SHA512 148317cac60c0a84d86efae79e6ffb0edf33d4a9e6c5cf84068f2879ca1d96e4da451bafb0a864be55cc8dd3942ea80699bf24a85a269223cc12bd3866087b60

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_3

MD5 178b9d0a5725af833c523a2527e3e077
SHA1 a183d546959136221117bc361a36461c443465b9
SHA256 f348a7084617ef33da6ad1c28700457ceb03f8dbd6641f25be373aa48bf2b2d9
SHA512 7cf6daf43366adaf73a3dac7b295bf4fb6ffb2908b34c269df01eddeaa101b831f95004d5f4fa8655a55cfce2e944d7ce10209e1f2e262f6116ad1a0d166b90d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\index

MD5 9fd00c297b08510cd4320023f2c1dfc5
SHA1 4824305360667968f32ac26e372b652cd7e39328
SHA256 d56398013a24ac9c97c54987ba4208d337c0dc1f5f40bf9f6b4ee5de82473778
SHA512 eabef482cc8946d86e78666851413e495f30bbceec33d1ae42cd60c9dd08102e7a3a924ef686095dac39a5f935d979f3446334d71d05334da713b9f100ccdfc8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account

MD5 a1544de8cbf5a232dab0bf3085669f5e
SHA1 3b869bd0792da2b7b277f00f35dd4033a8e33fab
SHA256 e167ead5278e096bbe0a6b05a7c9c568135bd4657f15bf63a619ab110bbccb1d
SHA512 0bc441f9730d183d035efa9eb7979faec05a7529f3d08b69ae734e6921123183860c4c555a1b01fbeabaa250f94490ea32fd4bd085e1934e92ec68f37588893b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_1

MD5 b2db488e3c60a9d204d2e6adec8766f4
SHA1 7b5a2c56bb9ff91cb977b4eccf6e526043642d85
SHA256 817756dfc74e129f47f03fa0825387183aea2a24f0cd3af9197a814f2aea3aed
SHA512 543d29534b3be0770d79b196145a36d4f6f0f20e95765a0e0c5b2a5e742b73f6fd3b214b3470e08b0587cfe5e499462058634995a6f24714c64a74944029c949

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\index

MD5 7f651a14e98bb26e3f13b7be141f97dc
SHA1 5474aed45e19643566a7c285b4e5183728e11990
SHA256 8d94c8070cd87d11245c83667da690421b9219df55fa83a0a9d3d5397d55ef9e
SHA512 ed10d2268996771e0e740bb896ac772eff84b4eecd7f56b55fe4fa00a6d1ce3ab7f569463a49da53aa9c3250a722a04b238047ff2179e19cc8ba665f6c5c914e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\SCT Auditing Pending Reports

MD5 a4779cc41548e9b64854a9a3575c9544
SHA1 dbe1aeaef24f40ac02ee0e2fb6ce6b0171a8cc40
SHA256 b7cc134d5ce26a14d3c215391e8c66ee1268ecf43d1318f1a36704612a13c168
SHA512 2b9693a6e971059e84f231836e7cd1f6be39a8300871b2fd12a047aea3379b7cfc51f6f3a08ad458d27663afab748354cac8b764fec29936caca05531ec60d68

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Shared Dictionary\db

MD5 16409ab04a2cbcd692c594ba3a2c06af
SHA1 581269b8b81bef6eb19efbcb9d445048ee8a4e68
SHA256 e55a75ea963f87231a6a2a86a36c2d9146bc900dbcb3676ba94f24740f9a40ec
SHA512 081549ce4097d33e513b5b7592111efc9b1cb25da10c1f30117e9f9510161d5fa213ed058c4cd4877a3048b8897746614aea440b58b9e549e21c498935977a13

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index

MD5 172c537c75d8c63b33d8fcddb228dee8
SHA1 88a38f7b2e7b2d6e8460d13ab41d4c6dcf7c4e20
SHA256 cced4f63cdf86cfedaf1351bea8abc3727000c781786676c6b8181b254149723
SHA512 82cadfa65da01e076772722976d0baffb5c50d5dcdab82130d0eeb93b3c931e499d49ddecaa80fcba437d89279945c3cf5c398e02868b5fac78235af0ae3399a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 59844d1a93132752fceb00ed397ca70e
SHA1 5c2756616498f3bb9bb7b0f726199c1fb1d5e0ed
SHA256 9de3e534cd93fb75b4df33bdf3fa2cfff11b10e35a40950b83affd30467a517a
SHA512 380e1ab886b273afc33b63fc39f4e816fede881bbc0f6a8230f53209b5d75cda4f05b5404f9e55e5bd0ed40e22ad74f996e19f9f6bbe4fe998cb437e7f92c32f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log.encrypted

MD5 3f1bf847c50c89a6a25f70d4344e0de4
SHA1 fc8aee800eb25396eecfdd377929339ec78a370c
SHA256 80dbe50b25c7d8cb9236e071846b1f9c0f17816327c49481c30185092bd93f3a
SHA512 188b0a4a6c0ac82b31456fbd515fc2fb1b5c8b6040e2ee7d3550c8755627780e2f8c86343e3614f22d6c9b75c05782668ecf99abf586f3b571edb0e093856f1c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\download_cache

MD5 ccd333dc8900fbb6390960c945831959
SHA1 4ef76efe58bd5d747166c1f288ffb9eb9f1a0e24
SHA256 56b5f4ffef2f28d20baa0d9548db3fad4d670d7b2370994879d4fd79d6338e6a
SHA512 8521c26edb00e1effbe72e7e88561b3d2e4d08cc7d76ffeeb584421c786e2565bc26b026d4820e68c0011fe94eb0becf77e0f07f1628051a3c69a39a46a8656e

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-100.png

MD5 35a2d0ba0c23b2c858c751d8293f4d72
SHA1 757aa3f7ca85c945228bca281377482ce0d796fa
SHA256 69fa93b5244b31451ea48a1b9edd23efd6555297bc5ebee9dfaf7096f51ca017
SHA512 3d6723e80d1d70b7b43811d4ae6ea22f28f74205073309ba7a30d06fd094a87d849cca8ab4ca281f7e451bfd6f107d4fb22114a0632abdc60b2f4ffb56c76b0c

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-200.png

MD5 9185f3314537150d6b39179c4b231bc2
SHA1 14d155e73d29db7d8f1d46c5680a69dc22fce34a
SHA256 633ad4064339ef34dac31d8a90dff094041e89d98ee47733e2689aebf651be96
SHA512 61c396a11af85f1759894937e9b796d5b2210e4f7a88bce223985853619d75ee50d614f60b1d113cba22d0a4c07bc7465d9eeb7b294456f4efd4c54df9ecd1f4

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-150.png

MD5 f8aa81f87e0d0d137bb4a27d3114d5c2
SHA1 c9d818ed1bac76300af10f6cb6c102d74be9136c
SHA256 fea84879b6689c02031eb6a95bc97bfd5fc6df15c128b4103c95afb35908ed51
SHA512 2fe369e2b9ec14876b652ca1de78c5a5d2abbc3e65a3ebd78550fa0ef1af6b074654492c2508610aa62b46d994b07ef1a3945423fa8ae550fa78a4fc7e2753b9

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png.encrypted

MD5 493f51a4b8e707d913aaeeeec3fef40b
SHA1 43f4f9bcbc6f876dbe77146161ee1b6279370e92
SHA256 e241b6e042b5bab244f7b7a0ca0d2b4efb9aac50bd6db9afe3753bcfeb7aa89b
SHA512 66eef5381d4bfad095617845243b500cfab74b94a7d6c6e2712b3bcbb7ca7a842754a3388e6342a18b9c8765521c2c6f3ba9daca13f676dbea6d108729e7b3e9

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-200.png

MD5 26a2adf835e05e0ed10c83c73ff4be1f
SHA1 e24ad721c12306e85b023a1016d36d57a8e84f0d
SHA256 7ffa5adf7f6c7b7ce3bd8bc477a01c6a08a115c32d0822599593c730974667d0
SHA512 7e71b01fe18c40a69fc457bc8cdc1de7363a04a076997a3f87c14fa03d7b9290cf25dc7da5ba583ee22deaeba1743ea82e077cc6891121ee7c4f8b1b9ecb4cf5

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-150.png

MD5 8dea497077e07bbc863bdfd939e1702f
SHA1 fa08bd8e401feee9f595ef076c09a191440e8763
SHA256 e74ac3bb93e246968709ab4c433da0eb1c48bd7bc2bc586f1290dd45aeeb66f9
SHA512 aa43cc0d6c7791154f8a80f120c42cbff2ed9c236dc2d2f593464cf2a31a4e88b368b06c26b3b73536e2ebb69865ce84f969a046723bad4d1fe836b72afe4b36

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-125.png

MD5 77e6a09f3649a30d4fb57aa1b75332ed
SHA1 a325d3794b2b5d9a5349336a597c36d70df9b58e
SHA256 40074f554873fcb611b60ee354e8745ffe811b0202c08ebd5149cde91d8bb596
SHA512 faecbf9232e17aa4d33cc78f2d65e8d121270481ae1180420415b5ce90ff8620d79b5b4a69dfeae3d2a78f8b0b5874d617ca2d27b4510104fab99b30b982e27b

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-100.png.encrypted

MD5 b31e81b37b11cc370731b86667f85e89
SHA1 7de231bceb954c3f34928f95645c08c0c84afbf1
SHA256 1062f487f06447282d91c539cbb7e70685be78a6bb5bbca818d0a1bc73a95b01
SHA512 a246da5ea47d769fdc641ff8acc65f02b8810b23a1d39c2f80159ae313423e4e60217a48bf4a12b023e37dc1370f9d2a1c5dfc5d0a76d2582d982d52b16cb4ba

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-400.png

MD5 1a02d609a931dda2777ce8a904888b22
SHA1 576a50468ca60f105b94e49ef8c4b8fb3ef25323
SHA256 2928b92b997c2bb0ef7d234918675723d418979c005e960f9fa2858747ea1519
SHA512 5ba479d70fab9e4b96a373574bf79637baf068dc31511f98cedf183a1069d5dbb06c9ba1a3729964a692f63c0e096333b00911c308025ec372d21d68e8fe2a1c

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\setup\userTelemetryCache.otc.session

MD5 b07bf1380610e6c63f24311fd0758058
SHA1 bbf8974d686c6c64f324481aed217e1f100bc4ca
SHA256 ddc5c725c3d04dcd4f10c2e550837c2a360b6f680973121e010ae2a3bc619560
SHA512 a110f80d5fb0f5aacb43ad10524b908453b4b778a7256089e92ecc5325657caf96d58a4fac56965218702d67e7655530654297dacde7a5b512ee2afce1ab0018

C:\Users\Admin\AppData\Local\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch.encrypted

MD5 157fc50953e6f2d89fbe9038d89c7fae
SHA1 178d831f0cf9d1816294dc42dac4b834e3ad5ea9
SHA256 c417de294de57f419988afad7bb7f301830ca549676cf8db7779e0251942eecf
SHA512 12d888137216b8afb66f6fdf600059329c8a97d0994102c9fa16bb3d0d2a8a0b359f04ea77ed8ca41adb7259e57548b43da45139af78884d7393ca95ae496d71

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1280.db

MD5 1751307cf24fe70ee06f30e4b6e22f00
SHA1 12336cd92d6fb7f46f49dcf7471d3540278cc715
SHA256 09fbffb157888a13846724e87af9e450d62efe64402eb0465b476a3d90e7d6b1
SHA512 2b0ed001113a0577761e75e0e867dbbf810fa88cfdf59ced8b57ce1a9766a302334db36cfffb1c1f91ca624835bb877c5c11985cc0699662521fce7b3cc0d68d

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_768.db

MD5 f7312a572d1dd4959604ff7b2aacea4a
SHA1 138eac25cac2cd9feec74eb146051d3bd53295d5
SHA256 c77dcb788fbc038a0552bb0fda2b7e38868a8f50dafa90b5cae8b7b120e172a1
SHA512 9ef7e8927e911db57f8ee5d0a47ca50657e15fbf4f54599722111b72e13c184d35ad973e9a7e3f45538c3681b2ef034ae4adf3b9a7626dff40ce62a512f3733c

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_exif.db

MD5 276be2d4f1eee9e7db695e4289a49515
SHA1 0ed39479c11d175d6c6245d1204d246bca45344c
SHA256 fe64981e1f08ea5573c401bb46de42aa3de61b7cb5938f38378178aad2ef124d
SHA512 ac79dd59860d2d2b0249f48725b82db491a4d291e74c7bd74af1f64e4c32d1be6355268dd0198481c98a98b4821b2e11d47ac867ecd52e0c8569edddb90c6dd7

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_custom_stream.db

MD5 f71b3652de580e1624f99425de16c459
SHA1 d68c103242aa62f48b45a9cd4bb332d181636d52
SHA256 152147ed48aea259c8b6915d583ddce40f02f47644c728de3997ebe0ca1b98cc
SHA512 e5487b6175f4a454e0da9617a2532ee94313d8ea2d74a4c92353ddb254bc5d3d3c4aa0cc5f3c55b6e95fad2f5b4fad2d15417b5c6281203d326bd410c2af94ad

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_2560.db

MD5 26058aeb964ce5b72f792a182b07384e
SHA1 8eae751ce9c9e9147334abf35372ab8424b14056
SHA256 014e33f78e0bd7e0129f67e8545657a8109b88d7d0ad63bd1209a25572cd885e
SHA512 e157962f421e3d1568781022d72022eb8a1adc044b500a76a635496e1c2b9e62184873c45a4ced74e755bc03ce8635ba83bcc43122f29406cbda313652db754e

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1920.db

MD5 7e0f8a41a4f774a64bb7d24658fef113
SHA1 b88d601a01a9da355fe6e42eaf3e3a15543b85ff
SHA256 c1c278bbef27e337fc9773467f31b62840fe345ea9fecb63597d2a02e80700cb
SHA512 6e27b70a6384041e93c1a00b53615405cd6f819e435118a89248e32b9b184e8b48ce20d62a6ad9d63954ebe00a4a659e240f8ed6b20bd827c4251db4c57ce054

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide.db

MD5 eb5d618170f4f553dbcdb47bc35291de
SHA1 b787514634566605486d2c17aa45d7726c430f9f
SHA256 68d6ab6e43dc2a03d0512a9b1ef800c1758b27977970fe2c5302c0214daf83b0
SHA512 f998721dd0ee039e005bd12e4350d2a66a09579fe7ae44457906ebaadd24a9bcaa8227c43024ef7ffd684996d4702f9bc187a0810349b63b6294b3c29cd9fd8f

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db

MD5 5fdc406c42db6999e7ac3443a0b05e3e
SHA1 565147a5347175c5e468ca029754eb5d686eb832
SHA256 7b1fc3297267fa49d530a56ffc9b6eca51110a0f391954344fdc539e516eb607
SHA512 a2cb2d49ba86e197b5cb0d27c50d9ebcdcddb724fb7ac3b37232e03ee7fc7dd5de9e147b9e6541390106d41fa776e7adc06b3c5264258ad60c865bb829d6b48a

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qgf82dd5.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

MD5 dd6b52192e0e31777646002f28912c60
SHA1 15562fc275ccc25f5a83cc30e531135cb78a6cc6
SHA256 b3b674763238b96dd54b3f676a94ef1709adc35b24efebc4a15e9223e58af0fe
SHA512 60a45956716afd5b5ec5bde4c981ef45814b37cfe61abd4a2c643c2d8819aebe29dc057bf9978fe3c9bdaeae188f2aff7248244ae2a30d7c22afe29a2e1f2af8

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\T0DA5XE3\3\mYNAUHKnw_IAw7UROXeTpd_BMZ8.gz[1].js.encrypted

MD5 8309c8508ea55e21cc010d9b5b49d05a
SHA1 1416ff2d69bd964a34abef89d67abe1f8cdd1756
SHA256 e3700fcc672759e4b98d8f065abe77ad3d77e83960e74ca37c6add4ad6422523
SHA512 75afa3f610a65f7d4f1bbf50af669135f9bc5dd25de4de455b7b9e3f8045b605126b13ba495c786e6fb06062d983d25c3e1411a1d401fa600c2e6c030f33a746

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\https___java_com_.encrypted

MD5 2167a31ba6e5b5c4809aeb4b3cb31a18
SHA1 6807672bf8108333b9b2a0a4ceaced83864658f3
SHA256 402f4252ceb3a44f6020c32355296261899224ba577ac7bb2421a4ce2257fd0b
SHA512 fc5235d5a43c2ae58e34f161636ad3584c250615fdd33bc3b1c7f925e840d34e3c82d5535a1f7f8084ace1a62c0455850676ddd83c18a92f5360cc326f758284

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{51325390-AE6A-68FC-A315-0950CC83A166}.encrypted

MD5 fea55aa182deaece97a6c3ae50080ee2
SHA1 499c538d5dd9b2a5b9f2dac207fce29fe01270cc
SHA256 e9c97aab10fb56093470ac7e1f8dcbe9828388e5a4a3cb9342c9bc720d56cc1f
SHA512 557989ecb9164f84f40fd417830c7dd3889cbafbf7ab23151572ce517a94b807bd1d10b1049dabb3c4a9c2c1917ff1dc9df75e3fe1f753a0a06271489a1ed7ef

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{C804BBA7-FA5F-CBF7-8B55-2096E5F972CB}

MD5 a30185f13b4fdd34b5ea621f45273160
SHA1 d615489ce604b8a7f8485a6ada784d0030476ad8
SHA256 fa1228a3271f20077426cb856a75ae6a4af1574d52e4e1ca23c539effa4b0a30
SHA512 f7b63ceba865c660c28ecf496e972d28bdc18ee08d1c7d197551e88a51036af3547d6e87757959f669f758fbe3d2ecdb3d4c38c6e7e39c908e6dcf74928cc6a3

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer

MD5 3d95cc98396cdbf8a4636ec355194cf4
SHA1 43a109cafe27d37cbc37cddffa9066dff20004d9
SHA256 8c34db2067429ed224628dce9ac2441dca083ca95ab480306270cb35b7e8bad1
SHA512 f47d49ca73e7e26a7610c8eec1e3d79ded49972278d96008d45f4d3552d13473a25e98ff3a085e735bcc5989c8c0d8764f6250bdb7f6a282f52f4c080d771100

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_MdSched_exe

MD5 854c63b21aa4b00d90c3eaa2cf507f37
SHA1 dd1322d184c525b4bbc65304c6ff8abe8462d7fb
SHA256 454f6f25c35e022c379bd857d69fc409f3c84e4453a4fc0c7c4df1424fd805f5
SHA512 d0d8aca0790255015f9051d809da37e74d3ba853ed7c625cc951a407faea5329b8dd94b0e305f26aa467d154b3bc4dd2920d1b087da18258755548da2cf026ea

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_quickassist_exe

MD5 5697b81ad6a97ce00cffbc18d9581b20
SHA1 cf7f046978e42e37a6c5766b6e34215dda922a2b
SHA256 9940324047ea0d615b41726930c2c10f0ca0cfa417a594c5fbeebd431628eebd
SHA512 115895d275a8c0da1bbe488cdf881d3238b0bb95f23f432181a893a088b0e1ce88462e4f29088abc9b017bb10375be7cb76b760b500b2980a3d1608ccd126120

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_VideoLAN_VLC_NEWS_txt

MD5 0cb66b67ee0d21de1ef913b4fa4163dc
SHA1 5d7b010bbe06b8de6724a24bd69f2c9c1748031b
SHA256 9a53dffab53e8f06e8ff84d5520560a7b039b4be1badc53c07d78607bbc97862
SHA512 c789b33df3ee1fd00274a83131a23c7e2ef8d9dee8eefb075000f057c3bbc4222a468ed67598b6f0432457e370613c7ab77e951bd636c5ed947cd93eff906b8d

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}_odbcad32_exe

MD5 bb44b33d49d4f8bd070495373af8492e
SHA1 050591d99e481d7e91f0f63d3e915c18b08e8a9d
SHA256 0b953f851f0ca11c07481ab1bc760065b354913a63be5c2ed43a90059d1dbcdf
SHA512 425dfcda18971f78dc9e2805f5079b0a941bded3c4d634d446961f50715793dd8a92a8e5c82bedc7f625e5f2425443324f5e8877f8da429d21fd1e8628fd248e

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{86adf6ab-7c6a-4a39-b307-46b5e082d68b}\0.1.filtertrie.intermediate.txt

MD5 3f799682cd06fa8df407f8fe88f096f3
SHA1 9e1e93992e303a749bd01ca72c0a04d074777276
SHA256 ec18a66196dfaca3174b5b23cfb7d7a7a121c8cf6f60e077679f6980a76e9fc2
SHA512 3bf3ff21ae00fe870db7c12afa6dc57f6678897d2eae38d6d1860c7becc7cbf1b9baf51ff145200db717e45ec83a4b49d07478342d6efea82e0a9e71b186c0f0

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{86adf6ab-7c6a-4a39-b307-46b5e082d68b}\0.2.filtertrie.intermediate.txt

MD5 b3d9a22c6e44f005ac791cd3d3573809
SHA1 148144ec265c079005f3676f6f065931b8e6f27f
SHA256 eb6220324966c7086c053adb066916f0987557a535f6ba3c61bde02b6bfbcac1
SHA512 68395839188563ceec0d8916f9245f90aa653b0aee6a0ebe0ce4e0bb39ab91a36b9fb35e02eebedd202a3a62dccd7ac4f90496b7998a07b2e3221e69bd647a12

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{86adf6ab-7c6a-4a39-b307-46b5e082d68b}\Apps.index

MD5 1b3d133f99ad361aa7ae1d68472918d9
SHA1 1c5ff3032ce87ebe4c499aec08b9299ab351be4e
SHA256 5db79fd5458e7898bdb5a007aabc84fdbfb320fe483e511c3932f43e57b8c679
SHA512 d690f57ff7fa30dd8ba3f21e7a8cb84c757a34ce1c45c1a579e7061a7c8ede88f1d9d2157ee0065e38a844402f7f0b5c213f4172dbcea63491ceba16e827e5bf

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c373d1ca-b18b-4b3e-a9e0-75d84620edd1}\0.0.filtertrie.intermediate.txt

MD5 bf9f3f7522cdb1743cb006004e7b59d7
SHA1 907b83a6c4a6ff76c9e3b712eafa691e65ab1e00
SHA256 faeb1c1c54dace5ed309c844566de18cd6db303994288c8dd88fe665acee6e87
SHA512 595711bfe06e1f3509e53ab4244ee3ae368589b94511b735488b514cf3ad034ac9efbd9a4d40bde3703eef7f1a81384e92a6c8d825752a7959205603a3846cda

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c373d1ca-b18b-4b3e-a9e0-75d84620edd1}\Apps.ft

MD5 9c1bfa24d99b7bc7d06d1ef46313a89e
SHA1 c79bc6276db4b10d20e23c21045d12de8729a190
SHA256 2d8828b59c549604276c8c9391b99f9b62effc139f35bd41fcd067e5c97c42fe
SHA512 9514c8d426e258a2706cf240be203a1055abac9627361023d42736bea954f94070befa450e7229ef709f9cbc58b6b98b8fa2376c0410f983a1729f254ce27838

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727658132914733.txt.encrypted

MD5 e09c8de753e6ee3e96e94eae6547778a
SHA1 f66a19f807bd297ce02a6f9264a445444e481488
SHA256 4d887c14e27194359ab9980515ef3a3c1bcb14c0a74ae53d0a04defe1766a4a0
SHA512 ed641c447f5713246701bf09ea7f2d4078ced4ca9f9cab3b2a0bce3b17df47998efdc2850b718ef24e97ea6919fe450196fa44d52bafd6c74500391e74586b14

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727659102300439.txt.encrypted

MD5 31075a95c77930a5056b7404cbf90b34
SHA1 422e28d3264d1794b84559c2452842adf47fee36
SHA256 265d65a97e90b50b6c129d8ed2ad9216a7ef85ca3e8eb01ae239b367c76bb930
SHA512 e19ad88bdebd7ad4db06ef45fce8da58350a12a3b04ae4b2b5f02cdc0e54a8277179ce5605ae5367e0bb61f36929592be5f4696a111f4ab2ca70757b83c1a7ed

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727664793474336.txt

MD5 b4af9fb046d47c5388d8876de181bf84
SHA1 db7363152aa5a52509b1b492de16ec76276bfdda
SHA256 fa7c995f67bf0ceff670b0446d451a51385a8f329a596ec9271fe071acf69dcf
SHA512 5d6ad44f290b53ece3b21cc5be0d306485699cef3a34e3c5c55f5c67f7c810ac81ec41fb8e34c22c9fe034003eef792c9b76b5ba2cef95d6a093896ac4127a02

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727667861810871.txt

MD5 990545db2059d10442f6bbfa262c2f9a
SHA1 20825cbf1889fdebc5b44833c79bfe32852bd244
SHA256 7e576cce304f4ebf8c31254eeefaa7340bc5cc3ed978419378136e9454b669f5
SHA512 7d3f07216359025b0bc76e653e3c8c0a11849099a3afdc27ac105b6deb7a7866863715b4c0bb0f373868291247ca9393875758468f27fce84bce80bc7a81b1aa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D.encrypted

MD5 bcaf0d10d4823ad30f935db5bb4554bc
SHA1 f594b19d9e9b8cae99cef8ba2f5ffe77fef43ee0
SHA256 d0fef92800ce65f3dbee637ae7864925f5cff93f0db17bae9801da1062b8eb0e
SHA512 be902282db699bb57249288826acad9209228c256dcd8cd53647542b5c51701e287ceade38e9026a8f4f4af1c4cc3c53467204d09e86f9fce44c9119207b6c9e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8

MD5 a17df18b112a5cd2255ae6aa50aa06e3
SHA1 51a066c41d18702502fb8316dd1896ec82b883be
SHA256 ce309a6a3f074b69dab3797dde63e6a05a4a92e101d46eecc4be7da18bd57133
SHA512 b6b8a2a1fbacaf690450e2dee74dcbd4d092cc76999e3264993f024ccf64779a65a8d48e427f71e7259a11d0d97c9faeab990ec3abcb85c70cb6523cc34df4c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

MD5 03d5a4f9c5a4e8da974175f5e5f55b43
SHA1 e8afca35fa6c21bb1121a0836a6fb7d9a745d1c9
SHA256 3776b7028e484d01deadb9d269501a3cfbe0da9b016090efd9e512e974b196af
SHA512 f4bdc6fa9f58304a43680f0246119289c36578e7b3b374f6a2f711f57d78c3bed2bffeb19bc3fbb6b9dddb8c2d6c2eb3a4e222073f2405824eaf9f31718256a3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FB0D848F74F70BB2EAA93746D24D9749

MD5 f849ecfa41c90737170e397379359184
SHA1 6ed0729d690a3db39d9dcc97e6ee79544269022f
SHA256 1512a571271c5c90f762ea207c173d1eeb58145c58115d476a6de3e6bee27311
SHA512 012d22fe32c07648386dc28047c765aee502888443b22a544fb33de6487dca84c0d1a78c8c67f6cd74a9339842643c7d451f100861d4f72bdfcc6d67f5423ce4

C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

MD5 ecf0ece8a911c096e2990de47b9d9a24
SHA1 308b047d593fb6b59c0424b6b2ae57b45854cb47
SHA256 10cc31282262ba9146c85e689b10c85623f58047610ce04bd089fad12c9eeb0a
SHA512 3e727d5c375696ab99a2a21b48d746c900f2d8e375503a2affa248cbeb6d734249e517b4576ebc47d20934faa4f200c5ed03b8a029e02d252f329fd658821d99

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851221[[fn=harvardanglia2008officeonline]].xsl

MD5 2235e24eca90b0de3e2ab12ee5280013
SHA1 b6c854e63ab1b3083b427acba9159633e27d8e07
SHA256 966108fc4aa58612a96ed9d911beb6f558b9e157b824cc4e84fd45de4a0e7763
SHA512 16e15e2f6b4543669dc5d6d3c9a4e35a553e67757cdf4a90886dfcc4a16556c02bf08ea882412923e347a0587dde09329bee61ec2b0deac6d8c21851624d37af

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851225[[fn=mlaseventheditionofficeonline]].xsl

MD5 c9217b680605c15d4fda57b005837f9d
SHA1 bae8ecf590a902e10bcd59ad66a1f3b8e2830946
SHA256 90a11878a050a141524e2a24379f55b4f66ef8fe2733768547379ef700f0f873
SHA512 f3463719fb868917437f9ddfd11382c0e16043e85ef6d32741c8b92ee97a534aa3f2788d534e2c343a5fc672d88aa3b77c85d68d151c61ac91e67d36790352f2

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851226[[fn=turabian]].xsl

MD5 5636de45e0caf03c86740c79f1de12d5
SHA1 7ad477b28e2955c4cdbda56b048588405696033a
SHA256 3b77755929f69e2252a3f3d956df25c6f11e8a90f7638b65f8218fcbe0b13257
SHA512 ac871511d3caaf30ebc0a7fb0a0f7884d782447f7044851cb9922a6909620304126d041a244377109e2d8c1e19233da31a9a7d7a6a7e2c40e658d960049e6877

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851224[[fn=iso690nmerical]].xsl

MD5 1d9b5f626a4c163ebec889e66b3f150c
SHA1 f523b098f037475ed688807c4a3a67339afec4c6
SHA256 4787e36cb575b58dd73d27d9af8e6469f9f344165831353f92b2d0087c75ab65
SHA512 9c857b54eb8f76f754336fc08e5741d0342efd9e88d63a3652b9cde7f4f6ed19de256f74b3342bb47f86fcb8b3b09d5aa10144a8a30fe705f71b8c4b3853cc8d

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851222[[fn=ieee2006officeonline]].xsl

MD5 61fd2ad58b597f6e9bf365dbe466deaf
SHA1 133f44ebfd3b9378cdc8fe59f67de5d84f3fe2fc
SHA256 d653c05cf0fa9604ada939f19fc401eabbc3113dbaa385cfc8532b3526081e65
SHA512 e3bdc2531f0990c7f16545d51ac9001ad77eb46f330ddf4454ebd8451afab5a4ca40acf297a8825ebf916a303c6329dff5de1ffd633901ced1aa8562f980ffd7

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851220[[fn=gosttitle]].xsl

MD5 d0799b040bc23e0e147c7bdbaf4194f6
SHA1 24a85b80e52f64f908efd728b031e39ca926ac49
SHA256 64e79c1a6d8c0d9ea39c74a94dcc276846f94bff418bd7a58b19cca5d2ed8a66
SHA512 d6f10dc11337ec8de760314f131cc90e441f6c594bc97a26cd3622d8a46216e5cc0c30e46da9a05c3b61abc1f0e58e7314ae38012d8a27d63d33c06e2ad75081

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851216[[fn=apasixtheditionofficeonline]].xsl

MD5 36e7397b0695fc5dda0e1f889707425c
SHA1 9de5992f66ab62683524efb7ac973d9c2022fddf
SHA256 2b7fef57d2572b6af24846323cd891c0b05e5c918eb81186942d0dc99494769f
SHA512 c3529fcff8eb4e0473d3062f4d9a2e84576b3ef275a20dc9a1a1a8dc1f42d7e91d68ecdc46f564069c4765bb886eec84d052cd5d1469c269680f138b79d7daf9

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\favicons.sqlite-shm.encrypted

MD5 d8b0dd12a08ff63b24420ecc0d067024
SHA1 bc59dbec3992df35500b1d9348cb82ade6f8cdbb
SHA256 6f84cda228e9e6aa681969ca0f9bc59b48db103f5d633fd7198a4b9673096f21
SHA512 60013a00d3c60c18f277abe70792403bb02d13aaacf72e937b9ca5d8c635a86a0e89e24849cb1346be69f89c21ab400d025c2a6ed4c542ab9d75dbac00e1747b

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\sessionstore-backups\upgrade.jsonlz4-20240401114208

MD5 a0c74ae67a64d4b5b57b019cd4587aad
SHA1 e7c51ea88f48ddd6dbca2911b1d3ad78c8eae9ff
SHA256 603728c756e6732c84d03773a5622788763d56cb1df5ed9d94f242a6198e6592
SHA512 2da32f6af490003a779a42935e4b7d796c2312f84af600a7431b9826b063cebc96c7e165e9aadac6a35e4f2193303b365006080a051c347df55751e85e8f5fdb

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite

MD5 222af33b0ef4a4f8360f8fa31a2df874
SHA1 64d32c1cb64408aa07b9fa9895c5332544198a47
SHA256 59fb6183fd21e15cd567b8b28cac390a115ff99482439861d784dc4ae68f6b8a
SHA512 6bf7fba8c3ba3acd9d11b50edce727df9941211b36234b2916456702ce0c707954d76bb2baf960d189696fad3cbdf8fd33710caa0ae85afa4acd09fe0d14cf2a

C:\Users\Default\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml

MD5 98f3d85f40f5c9f5e715bf0a4921bfe6
SHA1 559413355c9ae95ec8fb7fab7c646d1447f5b6be
SHA256 8af6cde9828c49d1c8f08d8af728448f56bf73db91bb0334546b099828eaad32
SHA512 5e64f88c141d612689c7abd02b82321cd3bce9a538a89684df60e72a2e0c67eb1f06221962e2fe88035c83f3de22cf212e4b842c455b686c7ce515f4479e6d22

C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Compressed (zipped) Folder.ZFSendToTarget

MD5 e0e2016f8054ef79734c94298ec4f2cf
SHA1 31c598df08967ac8b125b2e3f21330928fb5b490
SHA256 0e2b5dadd089268230e24cb2bcd842e789f1177709ece151cd72616107f461d6
SHA512 dffbc15671547cbfdc05769e66237c36936f6656d599942b3a1455678056ba6b93d0636f0fb8ef26ad99375d4a4d2c0ea2348aae5a394713606b770e66a02368

C:\vcredist2010_x64.log.html

MD5 52ab16d27f331d993d3d19e2f698d0fc
SHA1 ef4b77bb6968280e5d86f2758668f2cddd390c7e
SHA256 0e8440239724b2c88f5c67ea94bc36ece1871cc866250b29c8f08b66f4bc8355
SHA512 ded7088997d9870a81be64debf7bdba614a9411aa900c79daf5538b6429832e9b22dc426f17286a0f98b43a9f7ffff11e9a819de7646202519f0fe39ed8aff74

C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Mail Recipient.MAPIMail

MD5 6c9fd231ec12e132161103a74045f94c
SHA1 8d4fbfd78d12462d320a8aa94e1f43910c8c4dac
SHA256 8d161db9ca9f45a1d6e2313d43939564bab4a1e4dbb58c021ff043aeff07580c
SHA512 c59d9752e487e155f2f94eb2810294ee2147fd3e890f2b03f8acd1f4c8bd8bf83bdf446dac931d6593c7fbc755abdbbfef3811c8207dfefd60007b0114933151

C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop (create shortcut).DeskLink.encrypted

MD5 39ab49d10da9ffe7af0e95401d6f05e0
SHA1 c020cda65a1e9980674ea1bc0436d20c83ee2d54
SHA256 8ab8227def3c1a9cfeec807d47e8d6cfc4ed83f2837c55b7342def599f00b796
SHA512 424b32797cbdd7e7b9d783babc31587ba682275ba6e350f7a95c4da6309f240d0a6278dc381b49009697456c84d6a7d591c5eb92178629d5bba37514fdb4864e