buran | 38bc13ef112b2f17d4d1a80243fac6a521b5d58228984aae0752d79487fa3b66

Resubmissions

04-12-2024 19:31

241204-x8wmhaxmcv 10

04-12-2024 11:47

04-12-2024 11:40

04-12-2024 11:35

03-12-2024 19:23

03-12-2024 16:27

Analysis

max time kernel
215s
max time network
272s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
04-12-2024 11:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

default.exe
Size

211KB
MD5

f42abb7569dbc2ff5faa7e078cb71476
SHA1

04530a6165fc29ab536bab1be16f6b87c46288e6
SHA256

516475caf3fbd1f0c0283572550528f1f9e7b502dce5fb6b89d40f366a150bfd
SHA512

3277534a02435538e144dea3476416e1d9117fcddef3dcb4379b82f33516c3e87767c3b0d2b880e61a3d803b583c96d772a0bdeecbfc109fe66444e9b29216af
SSDEEP

6144:zia1vcaEaA+HPsISAzG44DQFu/U3buRKlemZ9DnGAeWBES+:zHctWvVSAx4DQFu/U3buRKlemZ9DnGAn

Score

10^/10

buran zeppelin defense_evasion discovery execution impact persistence ransomware

Malware Config

Extracted

Path

C:\Program Files\dotnet\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note

!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] or [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] Your personal ID: 17C-324-D93 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Signatures

Buran
Ransomware-as-a-service based on the VegaLocker family first identified in 2019.
ransomware buran
Buran family
buran

Detects Zeppelin payload 17 IoCs

Processes:

resource	yara_rule
behavioral14/files/0x0007000000025b53-19.dat	family_zeppelin
behavioral14/memory/3188-42-0x00000000004F0000-0x0000000000630000-memory.dmp	family_zeppelin
behavioral14/memory/4456-43-0x0000000000590000-0x00000000006D0000-memory.dmp	family_zeppelin
behavioral14/memory/3184-44-0x00000000004F0000-0x0000000000630000-memory.dmp	family_zeppelin
behavioral14/memory/3188-625-0x00000000004F0000-0x0000000000630000-memory.dmp	family_zeppelin
behavioral14/memory/3188-7110-0x00000000004F0000-0x0000000000630000-memory.dmp	family_zeppelin
behavioral14/memory/2500-7846-0x00000000004F0000-0x0000000000630000-memory.dmp	family_zeppelin
behavioral14/memory/2696-8490-0x0000000000590000-0x00000000006D0000-memory.dmp	family_zeppelin
behavioral14/memory/4456-10138-0x0000000000590000-0x00000000006D0000-memory.dmp	family_zeppelin
behavioral14/memory/2500-12806-0x00000000004F0000-0x0000000000630000-memory.dmp	family_zeppelin
behavioral14/memory/4160-12807-0x0000000000590000-0x00000000006D0000-memory.dmp	family_zeppelin
behavioral14/memory/4456-14126-0x0000000000590000-0x00000000006D0000-memory.dmp	family_zeppelin
behavioral14/memory/2500-20471-0x00000000004F0000-0x0000000000630000-memory.dmp	family_zeppelin
behavioral14/memory/2500-21103-0x00000000004F0000-0x0000000000630000-memory.dmp	family_zeppelin
behavioral14/memory/4160-21104-0x0000000000590000-0x00000000006D0000-memory.dmp	family_zeppelin
behavioral14/memory/3188-21107-0x00000000004F0000-0x0000000000630000-memory.dmp	family_zeppelin
behavioral14/memory/4456-21108-0x0000000000590000-0x00000000006D0000-memory.dmp	family_zeppelin

Zeppelin Ransomware
Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.
ransomware zeppelin
Zeppelin family
zeppelin
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (6065) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes itself 1 IoCs

Processes:

notepad.exe

pid	Process
5028	notepad.exe

Executes dropped EXE 3 IoCs

Processes:

svchost.exesvchost.exesvchost.exe

pid	Process
4456	svchost.exe
4160	svchost.exe
2696	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

default.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\svchost.exe\" -start"	default.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

default.exesvchost.exe

description	ioc	Process
File opened (read-only)	\??\E:	default.exe
File opened (read-only)	\??\P:	svchost.exe
File opened (read-only)	\??\L:	svchost.exe
File opened (read-only)	\??\S:	svchost.exe
File opened (read-only)	\??\R:	svchost.exe
File opened (read-only)	\??\U:	default.exe
File opened (read-only)	\??\T:	default.exe
File opened (read-only)	\??\O:	default.exe
File opened (read-only)	\??\L:	default.exe
File opened (read-only)	\??\B:	default.exe
File opened (read-only)	\??\U:	svchost.exe
File opened (read-only)	\??\O:	svchost.exe
File opened (read-only)	\??\G:	svchost.exe
File opened (read-only)	\??\B:	svchost.exe
File opened (read-only)	\??\A:	svchost.exe
File opened (read-only)	\??\W:	default.exe
File opened (read-only)	\??\R:	default.exe
File opened (read-only)	\??\N:	default.exe
File opened (read-only)	\??\H:	default.exe
File opened (read-only)	\??\G:	default.exe
File opened (read-only)	\??\J:	svchost.exe
File opened (read-only)	\??\Z:	default.exe
File opened (read-only)	\??\X:	default.exe
File opened (read-only)	\??\S:	default.exe
File opened (read-only)	\??\K:	default.exe
File opened (read-only)	\??\I:	default.exe
File opened (read-only)	\??\T:	svchost.exe
File opened (read-only)	\??\P:	default.exe
File opened (read-only)	\??\A:	default.exe
File opened (read-only)	\??\E:	svchost.exe
File opened (read-only)	\??\Q:	default.exe
File opened (read-only)	\??\M:	default.exe
File opened (read-only)	\??\Q:	svchost.exe
File opened (read-only)	\??\I:	svchost.exe
File opened (read-only)	\??\Y:	svchost.exe
File opened (read-only)	\??\X:	svchost.exe
File opened (read-only)	\??\N:	svchost.exe
File opened (read-only)	\??\M:	svchost.exe
File opened (read-only)	\??\H:	svchost.exe
File opened (read-only)	\??\K:	svchost.exe
File opened (read-only)	\??\Y:	default.exe
File opened (read-only)	\??\V:	default.exe
File opened (read-only)	\??\J:	default.exe
File opened (read-only)	\??\Z:	svchost.exe
File opened (read-only)	\??\W:	svchost.exe
File opened (read-only)	\??\V:	svchost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

Processes:

flow	ioc
11	iplogger.org
1	iplogger.org

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
1	geoiptool.com

Drops file in Program Files directory 64 IoCs

Processes:

svchost.exedefault.exe

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\de-de\ui-strings.js	svchost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\WeatherAppList.targetsize-40_altform-lightunplated_contrast-white.png	svchost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.29512.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\JSByteCodeCache_64	default.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-60_altform-lightunplated_contrast-white.png	svchost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\Assets\Icons\StickyNotesAppList.targetsize-16_altform-unplated.png	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sk-sk\ui-strings.js	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Dark.pdf.17C-324-D93	default.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-140.png	default.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GetHelpLargeTile.scale-100.png	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\vlc.mo	default.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\Classic\Klondike.Large.png	default.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\Assets\contrast-black\CameraAppList.targetsize-30.png	default.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glossy.eftx.17C-324-D93	default.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\osmmui.msi.16.en-us.tree.dat	default.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hr-hr\ui-strings.js	default.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\merge-styles\lib\styleToClassName.js	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_closereview_18.svg	svchost.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_21.21030.25003.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosSmallTile.contrast-white_scale-125.png	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_fillandsign_18.svg	svchost.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.17C-324-D93	default.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul.xrm-ms.17C-324-D93	svchost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreWideTile.scale-200.png	default.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\merge-styles\lib-amd\styleToClassName.js	default.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\US_export_policy.jar.17C-324-D93	svchost.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxA-Outlook.scale-100.png	svchost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\AppxSignature.p7x	svchost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-oob.xrm-ms.17C-324-D93	svchost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	default.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\TXP_3color_CarRental_378_Dark.png	default.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\EmptyView.scale-150.png	default.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Assets\AppTiles\MapsAppList.targetsize-80.png	default.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\GeometryShader.cso	default.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\ui-strings.js	default.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-phn.xrm-ms	default.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	svchost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\WidescreenPresentation.potx.17C-324-D93	svchost.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\NETWORK\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT	svchost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\NotepadAppList.targetsize-20.png	svchost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-black\NotepadAppList.targetsize-72_altform-unplated.png	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\pl-pl\ui-strings.js	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\uk-ua\ui-strings.js.17C-324-D93	svchost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-pl.xrm-ms.17C-324-D93	default.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ppd.xrm-ms.17C-324-D93	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt	default.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-amd\setFocusVisibility.js	default.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\rhp_world_icon_hover_2x.png	svchost.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-72_altform-unplated.png	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filterselected-focus_32.svg	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\adobe_sign_tag.png	svchost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-pl.xrm-ms.17C-324-D93	svchost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallTile.scale-200_contrast-black.png	svchost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsSmallTile.scale-100.png	default.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxAccounts.exe	default.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarMediumTile.scale-400.png	default.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreMedTile.scale-200_altform-colorful_theme-light.png	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\illustrations_retina.png	svchost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\AppPackageBadgeLogo.scale-200.png	default.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\contrast-white\PowerAutomateAppIcon.targetsize-16.png	svchost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\MapsStub.winmd	svchost.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\Spinner.js	default.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef.css	default.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\css\main.css.17C-324-D93	default.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\Assets\Icons\StickyNotesAppList.targetsize-256_contrast-black.png	default.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.execmd.execmd.execmd.exedefault.exesvchost.execmd.execmd.execmd.execmd.execmd.execmd.exeWMIC.execmd.exenotepad.exenotepad.execmd.execmd.execmd.execmd.execmd.exeWMIC.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	default.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

default.exeWMIC.exevssvc.exesvchost.exeWMIC.exe

description	pid	Process
Token: SeDebugPrivilege	3188	default.exe
Token: SeDebugPrivilege	3188	default.exe
Token: SeDebugPrivilege	3188	default.exe
Token: SeIncreaseQuotaPrivilege	2940	WMIC.exe
Token: SeSecurityPrivilege	2940	WMIC.exe
Token: SeTakeOwnershipPrivilege	2940	WMIC.exe
Token: SeLoadDriverPrivilege	2940	WMIC.exe
Token: SeSystemProfilePrivilege	2940	WMIC.exe
Token: SeSystemtimePrivilege	2940	WMIC.exe
Token: SeProfSingleProcessPrivilege	2940	WMIC.exe
Token: SeIncBasePriorityPrivilege	2940	WMIC.exe
Token: SeCreatePagefilePrivilege	2940	WMIC.exe
Token: SeBackupPrivilege	2940	WMIC.exe
Token: SeRestorePrivilege	2940	WMIC.exe
Token: SeShutdownPrivilege	2940	WMIC.exe
Token: SeDebugPrivilege	2940	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2940	WMIC.exe
Token: SeRemoteShutdownPrivilege	2940	WMIC.exe
Token: SeUndockPrivilege	2940	WMIC.exe
Token: SeManageVolumePrivilege	2940	WMIC.exe
Token: 33	2940	WMIC.exe
Token: 34	2940	WMIC.exe
Token: 35	2940	WMIC.exe
Token: 36	2940	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2940	WMIC.exe
Token: SeSecurityPrivilege	2940	WMIC.exe
Token: SeTakeOwnershipPrivilege	2940	WMIC.exe
Token: SeLoadDriverPrivilege	2940	WMIC.exe
Token: SeSystemProfilePrivilege	2940	WMIC.exe
Token: SeSystemtimePrivilege	2940	WMIC.exe
Token: SeProfSingleProcessPrivilege	2940	WMIC.exe
Token: SeIncBasePriorityPrivilege	2940	WMIC.exe
Token: SeCreatePagefilePrivilege	2940	WMIC.exe
Token: SeBackupPrivilege	2940	WMIC.exe
Token: SeRestorePrivilege	2940	WMIC.exe
Token: SeShutdownPrivilege	2940	WMIC.exe
Token: SeDebugPrivilege	2940	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2940	WMIC.exe
Token: SeRemoteShutdownPrivilege	2940	WMIC.exe
Token: SeUndockPrivilege	2940	WMIC.exe
Token: SeManageVolumePrivilege	2940	WMIC.exe
Token: 33	2940	WMIC.exe
Token: 34	2940	WMIC.exe
Token: 35	2940	WMIC.exe
Token: 36	2940	WMIC.exe
Token: SeBackupPrivilege	1424	vssvc.exe
Token: SeRestorePrivilege	1424	vssvc.exe
Token: SeAuditPrivilege	1424	vssvc.exe
Token: SeDebugPrivilege	4456	svchost.exe
Token: SeIncreaseQuotaPrivilege	3760	WMIC.exe
Token: SeSecurityPrivilege	3760	WMIC.exe
Token: SeTakeOwnershipPrivilege	3760	WMIC.exe
Token: SeLoadDriverPrivilege	3760	WMIC.exe
Token: SeSystemProfilePrivilege	3760	WMIC.exe
Token: SeSystemtimePrivilege	3760	WMIC.exe
Token: SeProfSingleProcessPrivilege	3760	WMIC.exe
Token: SeIncBasePriorityPrivilege	3760	WMIC.exe
Token: SeCreatePagefilePrivilege	3760	WMIC.exe
Token: SeBackupPrivilege	3760	WMIC.exe
Token: SeRestorePrivilege	3760	WMIC.exe
Token: SeShutdownPrivilege	3760	WMIC.exe
Token: SeDebugPrivilege	3760	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3760	WMIC.exe
Token: SeRemoteShutdownPrivilege	3760	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

default.execmd.exesvchost.execmd.exe

description	pid	Process	procid_target
PID 3188 wrote to memory of 4456	3188	default.exe	77
PID 3188 wrote to memory of 4456	3188	default.exe	77
PID 3188 wrote to memory of 4456	3188	default.exe	77
PID 3188 wrote to memory of 2500	3188	default.exe	79
PID 3188 wrote to memory of 2500	3188	default.exe	79
PID 3188 wrote to memory of 2500	3188	default.exe	79
PID 3188 wrote to memory of 3184	3188	default.exe	80
PID 3188 wrote to memory of 3184	3188	default.exe	80
PID 3188 wrote to memory of 3184	3188	default.exe	80
PID 3188 wrote to memory of 2012	3188	default.exe	81
PID 3188 wrote to memory of 2012	3188	default.exe	81
PID 3188 wrote to memory of 2012	3188	default.exe	81
PID 3188 wrote to memory of 2348	3188	default.exe	83
PID 3188 wrote to memory of 2348	3188	default.exe	83
PID 3188 wrote to memory of 2348	3188	default.exe	83
PID 3188 wrote to memory of 3080	3188	default.exe	85
PID 3188 wrote to memory of 3080	3188	default.exe	85
PID 3188 wrote to memory of 3080	3188	default.exe	85
PID 3188 wrote to memory of 2124	3188	default.exe	87
PID 3188 wrote to memory of 2124	3188	default.exe	87
PID 3188 wrote to memory of 2124	3188	default.exe	87
PID 3188 wrote to memory of 1172	3188	default.exe	89
PID 3188 wrote to memory of 1172	3188	default.exe	89
PID 3188 wrote to memory of 1172	3188	default.exe	89
PID 3188 wrote to memory of 4844	3188	default.exe	91
PID 3188 wrote to memory of 4844	3188	default.exe	91
PID 3188 wrote to memory of 4844	3188	default.exe	91
PID 3188 wrote to memory of 2928	3188	default.exe	93
PID 3188 wrote to memory of 2928	3188	default.exe	93
PID 3188 wrote to memory of 2928	3188	default.exe	93
PID 2928 wrote to memory of 2940	2928	cmd.exe	95
PID 2928 wrote to memory of 2940	2928	cmd.exe	95
PID 2928 wrote to memory of 2940	2928	cmd.exe	95
PID 3188 wrote to memory of 5012	3188	default.exe	98
PID 3188 wrote to memory of 5012	3188	default.exe	98
PID 3188 wrote to memory of 5012	3188	default.exe	98
PID 4456 wrote to memory of 4160	4456	svchost.exe	100
PID 4456 wrote to memory of 4160	4456	svchost.exe	100
PID 4456 wrote to memory of 4160	4456	svchost.exe	100
PID 4456 wrote to memory of 2696	4456	svchost.exe	101
PID 4456 wrote to memory of 2696	4456	svchost.exe	101
PID 4456 wrote to memory of 2696	4456	svchost.exe	101
PID 4456 wrote to memory of 2108	4456	svchost.exe	102
PID 4456 wrote to memory of 2108	4456	svchost.exe	102
PID 4456 wrote to memory of 2108	4456	svchost.exe	102
PID 4456 wrote to memory of 4964	4456	svchost.exe	104
PID 4456 wrote to memory of 4964	4456	svchost.exe	104
PID 4456 wrote to memory of 4964	4456	svchost.exe	104
PID 4456 wrote to memory of 4992	4456	svchost.exe	106
PID 4456 wrote to memory of 4992	4456	svchost.exe	106
PID 4456 wrote to memory of 4992	4456	svchost.exe	106
PID 4456 wrote to memory of 1196	4456	svchost.exe	108
PID 4456 wrote to memory of 1196	4456	svchost.exe	108
PID 4456 wrote to memory of 1196	4456	svchost.exe	108
PID 4456 wrote to memory of 3752	4456	svchost.exe	110
PID 4456 wrote to memory of 3752	4456	svchost.exe	110
PID 4456 wrote to memory of 3752	4456	svchost.exe	110
PID 4456 wrote to memory of 3840	4456	svchost.exe	112
PID 4456 wrote to memory of 3840	4456	svchost.exe	112
PID 4456 wrote to memory of 3840	4456	svchost.exe	112
PID 4456 wrote to memory of 3168	4456	svchost.exe	114
PID 4456 wrote to memory of 3168	4456	svchost.exe	114
PID 4456 wrote to memory of 3168	4456	svchost.exe	114
PID 3168 wrote to memory of 3760	3168	cmd.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\default.exe
"C:\Users\Admin\AppData\Local\Temp\default.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe" -start
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4456
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe" -agent 0
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:4160
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe" -agent 1
    3⤵
    - Executes dropped EXE
    PID:2696
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2108
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4964
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4992
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1196
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup -keepversions:0
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3752
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C wbadmin delete backup
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3840
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3168
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3760
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2300
- - C:\Windows\SysWOW64\notepad.exe
    notepad.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3604
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:3208
- C:\Users\Admin\AppData\Local\Temp\default.exe
  "C:\Users\Admin\AppData\Local\Temp\default.exe" -agent 0
  2⤵
  - Drops file in Program Files directory
  PID:2500
- C:\Users\Admin\AppData\Local\Temp\default.exe
  "C:\Users\Admin\AppData\Local\Temp\default.exe" -agent 1
  2⤵
  PID:3184
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2012
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2348
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3080
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2124
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup -keepversions:0
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1172
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C wbadmin delete backup
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4844
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2940
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5012
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:5028

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_retina_thumb_highContrast_wob.png

Filesize
52KB

MD5
1be440821a07bc65b80b79e4b6f82bfb

SHA1
bf7d086897fe02f62988ceb1845013edf4a75e24

SHA256
2bec9dae9a19427b0b82e1299dcecb3f8196098406ba357281703f664f60e8fb

SHA512
5ec109eb23206fb55ff6ae13a2358fe9ef12c67d5864036a8d2af2be8a0086b23fc5bfba913a1f5960fadc4775c32006122fcd7beb5d50fc052fd2a5fb1152e4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-il\ui-strings.js

Filesize
29KB

MD5
9d0361afefa15dc4de9340feafab09f2

SHA1
bb6ad6c7390545582e05211ec10598b5eab4da15

SHA256
5ccba7810560352a54605176584f525bf5ba26f9735f2f5c3e54437b4ce69bb8

SHA512
f3ca566037039d87e275ac0400d98e6e0fc4a56b438e8bc576dc6946a0e6633571ece4a5691bbcf60d0607ebdc45f958c79ca890d116ab83b38f2b603de176e9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-il\ui-strings.js.17C-324-D93

Filesize
9KB

MD5
0ce75aa955932379d6e8363465fd46b1

SHA1
2b48a7fd52d36261ad09d409e7c837bc8b8a0d99

SHA256
3019b77057ff86499213da797e2f5b2b96dc0f91ad6b5526efdde576e753eca4

SHA512
88e505179fb2a2acdf6952e6558fea0faff6a2b0fdc04dbadd4678a707ce83e778617ef302687f1516a47bb83c69999d1be8b26e03d1838e5991fbb1026b959d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-il\ui-strings.js.17C-324-D93

Filesize
5KB

MD5
8b72ac906262ea838dfb9d4fcbd37858

SHA1
5606aeb9d4a395cd4b76219aa3fae41eaac2b40d

SHA256
a2f1670539e0c693ad6253fcc4f644d9eca89330d38138a4efb06d10ee1c15a0

SHA512
42b1ec5d85b6cde9a36ba94b16045b0fa1ae5b8c90cbd8125a0fe9ee76f12fe45e3a9fad599ab9a6222ae4ee44ba1eac3206dc85569d1f6a920f74f8e57a258b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-ma\ui-strings.js

Filesize
6KB

MD5
e62788905909cffb93359b55ef964042

SHA1
24eaede63f15d3d536c4892bde41f9ee1106ef71

SHA256
33fc1796ff28af096eb4c562b1508a8d2252066ea896a7f539477750c0c57631

SHA512
a6452afafc697263cdb9e79be1f0d70ca628541cd3c7b1dad701be59b6cd294f5ee89d987b0c1c1fc3e459fadea58b72920ef726249f33d854c3555d1e67e620

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_ie8.gif

Filesize
9KB

MD5
5d0b86088bdfaf1cdb73c97aa99495ee

SHA1
bf4b28cac75352777dd605d68d72906580d06cb8

SHA256
f682ad089d7b455b5f82878424d3ba2d78ac66ed9e1beb5c2c27ea6cab4867f0

SHA512
c4553e0b5b9e159bf98f809b1b287f8477d5cc01af077e0017686de7757375a927946f2eabb518710b269bbb4b7471a79b0f07c094ac9cfedc23792fa5e6488a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\exportpdf-selector.js.17C-324-D93

Filesize
175KB

MD5
b1664705d6d88abe22e75e6cc5b13516

SHA1
1dfd8025a55ef52a971a7565a380ee57d6e65f9c

SHA256
1d6d89bfd32e41f8345f135bc90a63d448bd6b9008f51d9a1b48234b3b41cec2

SHA512
b330681cece2871a64b0d905bc1c5bf7fac3e17d38ef402cc7272eb4bb016bc9ef4626858a93847472d5ac30c0ca5b66edef07455cd5998e50b480f1c8fc5dcc

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-il\ui-strings.js

Filesize
10KB

MD5
b36adbea38ba847e2fe8bf73e4f9134b

SHA1
7164835381771976244448904952169f319a53b0

SHA256
bc2df05bcaff1a28e05200e14bc8a80aaf16a6f0f698703460bdac4632756d18

SHA512
765eb5bd99db0fbf6f4fa65a0e0011c6edf76ff776aea33f7b7d2ebd232853bf80fc13373e72800f27e4cbdd8bdb34cd56f7d6c0653e82f314c369f4586e0d94

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons_retina.png.17C-324-D93

Filesize
16KB

MD5
868bfeba94ca098630b8c244cae400eb

SHA1
c2899c6fcd55203f69b7cd4905af4a3fbb78b7a5

SHA256
112819950738a5d0a914b9de9c207a7864c87f31f5bbc92dbf7008003cfaaff0

SHA512
1a4738708ac6ac858751b107699cbb2dc8641e376e80953cdb16b1234b368ae27cd195c73c5a6f8b4814cc62cc5c2450c8de84695740dfefcba8c1deb3236aa9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\icons_ie8.gif

Filesize
9KB

MD5
c0b255b1edf0bad12d3348733eb47fc2

SHA1
a297f25f3b6c6f219e59393c8b63a89d5cb105b9

SHA256
b19779af97ad5a71cfb1a3b7616c23b23706c71afb525deb2aef3d8330e3c903

SHA512
a3b7cbc1b07a451a995771c4ecc6b3d4aa1c68d49df787c90b121071d99948db6372584128cf1247d6ee9f8b57bad5b13de4a971259a21cd620ca92d276527dc

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\selector.js

Filesize
48KB

MD5
5dcbe897df3fe54137a8d99a8fc70765

SHA1
c6151720bca51f4f144ba0d995f1aaaaba597f24

SHA256
b92faa35ff6efaa589da964bd95048a6a0eef5000da74fbf70666a3bc77bc445

SHA512
4f207931225421e36e6ee280bf9799186bb6f64440d30afc8bc8c7f6ff90aa4d88af0e4b742a523a935bf08a2566ec28f5e991edebab077d9dc3da48f26c44e8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\cstm_brand_preview2x.png

Filesize
6KB

MD5
b6956badcf8708eae45e419e7715ce0b

SHA1
6baf49cd841ccf35f3498707a51e69fe159abb23

SHA256
9c6fc681edb9761c1a727afc2f21737f3b683effc5be02ab25cb8a64157c4e0f

SHA512
8a52bf8e7be1cfa3e0b193185059e166bf179bd7401f0996541dd3932ed907dabafb828e945aaa05210f34f311c4ee598507f59cd8f3e694fda511f27a4cac2b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-ma\ui-strings.js

Filesize
11KB

MD5
5059cff552e0df87f3b953c60f983c14

SHA1
26be564b8b48bdb57fe7220d1af555708d34eab5

SHA256
1769f0b377a668e457563f9551252e56018432804d23de43fdfc6ec02af62464

SHA512
98df548e3f2307b73ff84cbbc21e997e5139851ccac12835c481dfb7859042a98073f2ef86fae2f0ae5e05ddd57d67088679fe912edbb1237e74cfd789615b1d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\cstm_brand_preview2x.png.17C-324-D93

Filesize
6KB

MD5
9f9f3da8f4b526c859c583c747252f20

SHA1
bffc3d5f927c019b8e18d6e7b03fe43cac110e7e

SHA256
23f114b06feab5e879f149253708770bf63606a50b05c506b0aa821b4490868e

SHA512
c125dca685a85acaa734f84eb3658f0a01859ae3a6f6fb93ef12b33e1ca763badd871bd6e1e41fbe5f1d63ea8d15a04e8acaaf8aa31d4a4cebc2ac93b992d6ea

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-il\ui-strings.js.17C-324-D93

Filesize
15KB

MD5
3854f1a79f0898425f0b5adfb9d54d49

SHA1
c3db47172b3da7bc52c4750acaca9f4e524df026

SHA256
001d9350504b050264e12491ad1cdfb88bd58087220cde7120eda19fda1a26ad

SHA512
9b1c707a342e9cc6a9b83699fe213b7e51b6284d3abf8409993fbba9dcd06cd4db9c0b61287c65d7613aa1da4bbcbcf248a3ae16be4a1b62bb8587147d1bd3b4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fr-ma\ui-strings.js.17C-324-D93

Filesize
23KB

MD5
1bc1ed25f3c52472d295b8dd552bd293

SHA1
5bc3648a1eb1fcc311cfef539c5c1335cdc84ac9

SHA256
a9d4ffae8a4e6322a109cae1b097d291bd592cf91a4b19fd5af9b4f1c2755c13

SHA512
836fd4ee8bab8300f0cdf11f5e858ba4bee1f6f89c1d2887415813ffb2d894852bf9a85cd27086a211033f8566c9d374a613bea5bf816941014525cb0bb9847c

Download Submit
C:\Program Files\7-Zip\7-zip.chm.17C-324-D93

Filesize
114KB

MD5
a4fe93d20bf49285f9ea904dc2ce0861

SHA1
a027d7a2d3f425d5d8bbcc1b3ee89a03c0fde466

SHA256
d70e36b9f132c0ee76c7794ccb2af14661ce5b0c2c0b360fe1a996cc1e3c6126

SHA512
bd2fe931b5bcebc822559f7efbcaaf003755530fc006afd70d518d1889421f70204f09d0b0e68bd32f13463f833c9f4116c518180cbc1728749c94c865add692

Download Submit
C:\Program Files\7-Zip\7z.exe.17C-324-D93

Filesize
545KB

MD5
cfe630931b66a6c05f4106d55df7bc7d

SHA1
00dd0fb3b953ac4846a298145a4185f0e1949b74

SHA256
47f8dda67bfd58f6a68023d360709927c60e8488898cb6ed036619b702469ecb

SHA512
f607cf56488a3be7eb3ece3c1281900f4ae3ce5d2b76f2f60ecaffa17796280ffc0b93c87ae489ae7b83484c8e9052fbfbc70b3179d5dbf884bd762ae9864325

Download Submit
C:\Program Files\7-Zip\7z.sfx.17C-324-D93

Filesize
211KB

MD5
16102269973a3c710ae860b8e04759f6

SHA1
4560c693826e086e6dc4b72361ac919c8fdeb201

SHA256
1837ba2393101678e371d93573a7c3671b97d9eff5b1fcff9cd5fec9c4ec8ebb

SHA512
0874c433ff8f56b25ddef100034d88ba3a493e0fc0cdd2680273f8a8e4929a90b57ad0e8745b2ea8461612619220e0e9fe0a9d9e422290c53eee5a3ffa37db5a

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.17C-324-D93

Filesize
190KB

MD5
15d0235d23a61cdc60e2b99e0a506c7e

SHA1
309e4d5be3469fdbbf60c2f9ad415cb5374f6df5

SHA256
124085b70859c2ece117f129518dc875d612dab801ae2567c8e7184b219ddb11

SHA512
cb833aa868c2df75a6dcea485905a41c93984f4cf4681ce63342c03e6218b77df22b234b486816730bf6ca6fbfd0364434dd26d46abe4e673d41f8af1db9717c

Download Submit
C:\Program Files\7-Zip\7zFM.exe.17C-324-D93

Filesize
932KB

MD5
a36ebdc670c79fa0c52b7128a53a84d6

SHA1
a024e6275e5cb85e5b972226c27f91b5fd74b02a

SHA256
2cc32cf4c234318536bc56ade50757211b5deac709f237e8cc76ab657eed1653

SHA512
09f9044a470ae591f2f9489b215aadf1f687e362af1d9d17c246f47a245695ccf3b7aab7b8e1dafbbe7ee61668a0d25e4bc6fe7e8754671511faeb07b1419d2f

Download Submit
C:\Program Files\7-Zip\7zG.exe.17C-324-D93

Filesize
685KB

MD5
46443aa8e0fae6a000c38ad4a8d77d34

SHA1
c31ea56fe8f2aaebe09d4fb86c2963a60c713c10

SHA256
620b06539e60ecf3a739b8dd81f0e314a12daa9984538b715996ccdd2133e996

SHA512
0b3641bd522820e00539b2bed80d70d3d2f9e70c143890eec7375a1b7bf7dcc44caa8d901afc81bffecd49ee1cb349b6ab09f0bb836a61fc2c9acb69bc74fa25

Download Submit
C:\Program Files\7-Zip\History.txt.17C-324-D93

Filesize
58KB

MD5
ec6baf3ea1b964d1ce74c98ec9bc9cd0

SHA1
264b77b5ee8ffaff794fd5d31be2276bb5afabf3

SHA256
c2544c7db2c463a68ddf55231fffcd030524c6a829df4d9462ff3171fca1a15b

SHA512
6a269ccd5002a9afb5ee2811e7bd17503ef885144e8d24d10071f5ee47d296be849a3bedbe421f4fe1dfee8698c8709c1a009fbb64a196f27d90219da65fdf26

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.17C-324-D93

Filesize
6KB

MD5
d9da1ae7cf81ae80497b4cd03505e0e2

SHA1
0ba7d8577cb721b0957b070dc641e112b7b3c2f1

SHA256
0012bc45ea45c67fb6bb909f2f60da3b772ffda20175a37c463b8f08f46df2eb

SHA512
86553fc49f64408cf1441c88964e10d52f12d79c0df8a9eb98c4526d053da43350b6e46fcd2b5e326f856e342668e461fd2041984cfd84a9b35ed4e760f81095

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.17C-324-D93

Filesize
9KB

MD5
d0048e368e65da7947271cc7e0393dd7

SHA1
32d91a73d77e6fbaa937a8658d355ee8ff82389d

SHA256
8426d1b422eda805369d51994aa2be56445257c632057e9661f80dd666507a1a

SHA512
ffa6d4dbe2c7164cc405bdd479fc5248f9606032313d56e6e2959a615f232a2a4b10fdc106ba982f49c27514e8d030ef81fb53434e0033bbbbfbfb078200c910

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.17C-324-D93

Filesize
14KB

MD5
833f1f1b9cf252cc5012262770769a99

SHA1
e91db715171a73a00bf5239c2c9a701c32b8c26a

SHA256
51b6c9cd5c5e2ee757c7ea4ab0c2749167774a2cac48656574bc0b44590af313

SHA512
ab625b462b6c488defd2c3f950f1f404f4a2402f3e3b805912284bc33d15b4bdb0cff3f8f9651fae21c1014ffc9872baac117da9e782872c5e34c0f6df167e07

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.17C-324-D93

Filesize
6KB

MD5
ae6a3d3426ade9316d26fb33aed072e7

SHA1
47291530022b3352013f24af61f435d96f063d79

SHA256
a4ee38cd7bdd53c62903a002a867d61561721a0d2ffdefce183a0bfc342a5306

SHA512
479b1a64c4b353fc00eaba0574248872f62f396392397c92e07e560d60afad75e9b005f77561ab5edd13b5ec7575e71794fe4d25025b91e1c394d94217fcebfb

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.17C-324-D93

Filesize
10KB

MD5
c85a2372ef8059f1f44e8a6c4465909d

SHA1
263a5697e9cedc5caec4d97d38e37090df79c464

SHA256
1e9d7080b3ff10437258c044d94da7a89246749e0601947ad7095b8703875100

SHA512
2268f30a24f2a789f39b522be4923d598ac3978060c4e1ba92ad84cfccd13e3820a178b837f8d86d69447c0da2da547900001c70d2788c0060b85928c8ad043f

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.17C-324-D93

Filesize
12KB

MD5
625f79ff218f38917b23558c880ad6a4

SHA1
d0552f9666d1acfbb3fd4f5daab320ec01935fa9

SHA256
fab25683e7a7cdf2c3b333411e68bd06a01fbf69324f4d2c728fa7d03a53f281

SHA512
1711668da1ea4827c393b51d23d95e46534e640fe3fe2e8e686c368eec70e22020d889ad9028cbfe5e622147dc6abffe097bcb08773a685991f0781aace6c479

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.17C-324-D93

Filesize
13KB

MD5
247d50b4a02227a11d075da06a90f36a

SHA1
6f4322f7e2f2f24ca2157e0a09d46dc521f92cfc

SHA256
1fe7915f3be64d4ea083e7877d588c1d7e0c81e6011d43153f4fae9151998ed0

SHA512
5bb9527fcdf596e503c961da8c15a6bc47bc27e514187dd98d0230b72cf3c1db471aedbebcd615aa2040ae643950458f5c69de967cdc36a5c7c53ab7fc51fe3c

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.17C-324-D93

Filesize
14KB

MD5
842b6ffc960b20cd8e21805ac9c9dcbc

SHA1
36a2fc7145ebb3e1250296113557d1bc1535af92

SHA256
67871ad888897ef17683529ed5340fb315cc2ad26cf08e70777ad2ca21b0ce3e

SHA512
ccba5d423f2a0af099b2a5df3b4d2f73f77da2b47113dc684173b40e331fc034643a6f2a927e7002a5b07c329a71cba7866bc90d7c5f44e9ffd69161d249540c

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.17C-324-D93

Filesize
16KB

MD5
b393cbe6cbf96f830de5b00fed9b2493

SHA1
45887654a6057a28a7c5ffb14c2dc4e70fffa7c6

SHA256
a1f27a0bda24eb7471c4c943234487420b9c4ed0f7670303de34a5c26f621609

SHA512
32adbc2426b64b1cc9ab8e5c0d1f4a64911cb76ac8945138ad3bfa7f1bd80b13074782e6400aaac95b54650d79b65a491347ddce933ff6be54710545bb3db9ff

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.17C-324-D93

Filesize
6KB

MD5
8c94a7b0e13ea36998edf43d7d0bce8a

SHA1
6b65c1e4a4b8c4be0f2d9aaa570c73f755f3e214

SHA256
38380d94898d582c42d53667588853b8c3c5a685714334221e0ece6f880c58e5

SHA512
87470a97b67498fc376ee52f3f258410065522ea7475434318a56202c339b465402376f4c5771f0dc4efa852955134d3d1fc4d27c5a5bd78be6cf66da91895b3

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.17C-324-D93

Filesize
10KB

MD5
a30b3a676516a41fe6f2c9265f9e0031

SHA1
cf2985393f0e153686f67ec7338bd367c53f42ba

SHA256
1ed6e908f86db8c7f6f4ec4768782e0dd1218a7e4597c4f984ccd40bdce2bf4e

SHA512
2131050324d20dbdf5ac9cfaa9e07bd46522b85e8038bd59d3abb9551a0ae1dd871cfd61ec4359d6fac75878fefd1db586f1277ba7eb1b659c0d0b3b399b8f01

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.17C-324-D93

Filesize
12KB

MD5
da6e5e1be46cb140a4ed94114c93cf76

SHA1
b404cc06456eef39a5c6db5331b017bce3b99e56

SHA256
db074ab4ac1478bd55c7dd0e093a2da74284baf860dbfbc5522be39f05781351

SHA512
db532e42e6bd1478fe1d9d7ab0f2f739e7950e1016641e856b76e1c0bd1e7f5088b628a33334ab7019f2eaf2d8c187577ed3273b264bed1b8fa2c59bb8565122

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.17C-324-D93

Filesize
10KB

MD5
d3c6b1ed7e44b3fdc70f358bbc1046e5

SHA1
ca325540e7bc04e4967e61ae871cf73c992d888a

SHA256
bec1c6e38b2b55158a0b811e73a3f08031b18e31b61fff24e929b759842f80dd

SHA512
035023c428e42248d0152ec5fbddbcbed692fc8d0315d16cf173cda6b75f1401cb742955694105f5d99762869e1bd10f2cbe29b479c7d508dc3d130c3bcc8577

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.17C-324-D93

Filesize
6KB

MD5
769fb1ae6a76a9422ea7d75db9d2ec2e

SHA1
a3fdab3fb81b6fbeb3819fb71326d2f984366eb4

SHA256
5a34c206df0ed581db45024d6782a9a4b1d5e78d9f29dfff6debc77e5b0b3d69

SHA512
56e409d86b0ab9aa989ca81c179a3542c045e840ab093f53460b8cd699e49d48a18c9ac8a666bf3a178e6534ac2cc0ae99dd635844b2abd12f018cfbd121057d

Download Submit
C:\Program Files\7-Zip\License.txt.17C-324-D93

Filesize
5KB

MD5
e2fc0307068c3f0140754bed6feb4bba

SHA1
abffa5e84d5a689c5043f4a95435a33aee920271

SHA256
c4a30f31ce9fbadbe9eb71bbe5fa2e747fc8b3fe86675714c7b4235c106ded2d

SHA512
bc5d397ce10e6427e540604d90d64dcac123bc0ae49d8b91a244d020491c7d8e6515224089cd1035594c9b224be5a6164d3460451dac78b1e712cd5db06e6ca1

Download Submit
C:\Program Files\7-Zip\Uninstall.exe.17C-324-D93

Filesize
16KB

MD5
2307c3c625b41ef44c253c59d203d0cb

SHA1
470752c2a7fcaa62bd23e4963d4ed6b7bfe08f5f

SHA256
5800604469df7fff2201846beb4407c4c2b8a517a0425793371962ca81232c8d

SHA512
96d21ee6a68584636b4f70765e9d2fadb40bbb9fa41fbd05cc8ba4718d234c9506232262dadf998cbaf0d62e928f5ae911b6384482c74a95d49840dc17d2cc83

Download Submit
C:\Program Files\7-Zip\descript.ion.17C-324-D93

Filesize
1KB

MD5
cef0b9924933b75c6e87ea1751b7b141

SHA1
a65ca63947e3d3385c14f65f9a4877a81071460b

SHA256
fb7ca0ad681d3ac9508205744f9ec5d63a4063e4aa3ed2584f39c211084a5a5f

SHA512
8d12872d1850c9a80c2297d4e2ea4e58fd19c7d6f444941ace370bf896aa9ab19e0ab038e9727b96139ea7fb88e0cf882f7c18eb5b69eaca78087eb789788cd9

Download Submit
C:\Program Files\7-Zip\readme.txt.17C-324-D93

Filesize
3KB

MD5
375c8c4d75d4be90d6fdc4898daffb38

SHA1
d27758ba13e9c063939bb9a32ff0afc3089c479d

SHA256
5533e79a06a82e1a343a676671c9c8ce73d587303b8a796c71e3ca8e779f8b5b

SHA512
4d05947892d53347c7e2051d0903524ed540afe055d904e76bdaffdff6f02361bdd81fdb0a90dd9575781717247b115b26adafd18de72e80ac300035f701924f

Download Submit
C:\Program Files\ApproveSend.lock.17C-324-D93

Filesize
333KB

MD5
98c79ad8340a5319752f42954a795987

SHA1
f5f6e48229509ec3a1b8d1d14cc0bcb68ac18341

SHA256
13bedd659ac5d5ea31472ec87cd90e63f8a8741d5b9fcfab9c0174791fd600f6

SHA512
452e8e8d02f356d97bc2597d14a07992078c4f563799402a445c31dd762cd167ee718f96444c087291dc671fe6c8db21630c4d48e0e416da0f05522f40cb7b5b

Download Submit
C:\Program Files\AssertUnblock.asp.17C-324-D93

Filesize
428KB

MD5
00f436929ab88e8f5d4afc882570ff17

SHA1
92da44bb5bb7354b12738e5906cec03b714c3503

SHA256
efe51819802ba257ebf33e0056eafec8b800b750e299b1fd3ffe366807e056d7

SHA512
74122929990eb74ca7c0bb14f217bc7ffbbbad9fdfb4b6344c30ef7336298b1e9e930f1908d8b316538ad434ba9fb51d1230cf9c5cf3c2d362a3bd363040d09b

Download Submit
C:\Program Files\ClearSend.mov.17C-324-D93

Filesize
320KB

MD5
d2a81cf67ab40e176fdaa375425449a4

SHA1
bee20966de379fb7f97dacf477a5ed399bb58994

SHA256
a9f319676669b2d7f22675d1b52d5d131f4eb8ca04e879f7e6b8011f00556ba8

SHA512
11f7c8c0fa401f351c44266499fb76e7bf2769016e5a0c2b6e64b3122a564554eefa66035c041b4c8a52e9fc2e1de9ced72dfc5f1f2460ab30f99ff7d1237fa3

Download Submit
C:\Program Files\ConvertToFind.mov.17C-324-D93

Filesize
279KB

MD5
150baf0a73a85ce6691a7c435c40a631

SHA1
1b4411333ca51be94378089ad85eee4224a75f98

SHA256
d46c03c5c877ab139c6228d401b11ffa82b6ece6c14f5d318e0f9fa5efd0abcf

SHA512
60ca67e081bd7277eed738fc2d931a6a9d0023f9eee95f182fd969d5136c165e0a0f998a6def529c7afe7ebdc323d8a092479da6a4faffb6e2cffb7187cb177f

Download Submit
C:\Program Files\DebugPublish.dib.17C-324-D93

Filesize
374KB

MD5
48eb4f3daab47dbcb3da18a4b210a32a

SHA1
d6577553609722d9a2f1e7c927c13c6396563912

SHA256
ad326fedbfe9b1512c7faf60f30249fe01de8acf9487a5820d996899ebb1fbb5

SHA512
bc748b142ca3d3eedc4d6ec43d13101c640f04798bfea52d08fa56e893b95f8bbcbad42c4d2959c60a49e8d9124e70f64a1c6d5c871da0a91e3817326786d861

Download Submit
C:\Program Files\EditConvertFrom.edrwx.17C-324-D93

Filesize
401KB

MD5
ac37ede8063881a79153f49f3beaf778

SHA1
4fd0424443a28287644693a3fde883c06fe2e796

SHA256
feb1fc41e4c8416e3fda55f57c2dd58e699f70fe49eef2fb50ee953346912fa8

SHA512
1b1b4248c0a2e9c8dfed66b942e272370e36de346a1aca527c9db8bcaa490359e1cabf7c51943d953a5437ab9a0823f8c8f907e5de5fd981f9a24a7d2feece1d

Download Submit
C:\Program Files\EnableWrite.ods.17C-324-D93

Filesize
252KB

MD5
0f387893868fad94ef26321142881847

SHA1
a8c650ebcf899d30b11c69b7e1088382a92d6708

SHA256
2e59f37684b19d172fe3bb69c7187618d67ef2ea5d9e89df9bd804aa4a7843c0

SHA512
f1e143777c3745026d7f84819722f96f4ca98ea88bf2c50cccc96793c48522cde418281e84ed9c3f63836b7cf25385a3b2843c6b4e315c285236cce8d445929d

Download Submit
C:\Program Files\ExportHide.jpg.17C-324-D93

Filesize
414KB

MD5
94223c8e903323054cd2d68b8f696fed

SHA1
8e969a3e81f163b5cfeec9594905ee324d57f3d9

SHA256
9aabaed2840bf28e960c73339ea2c700e51d06bfc5973d72494db94e5517266a

SHA512
8011d0c437ee93780e55ca27f5c9e8bde1c5b936a209889243418e6fc4a140003d0d0ac6626a4c0d310d16fc180d580f31e9a7669e7ba86a987e5d7a2608a362

Download Submit
C:\Program Files\FormatUse.asp.17C-324-D93

Filesize
292KB

MD5
30c68a371fb7e8b6bc3fa9b866674f61

SHA1
266677509a683e90357a245241929904b691a303

SHA256
952e3e5b37f6459e845e5c9fb6eb9b7d0393b60d604e11be15fb67ab678186ea

SHA512
b7d0649d460dbd72b0d8f0043c765ce8f2e01e308ade66e9bb5f9e312a963e736efc84bc0ecbfb279ac0ee715922c33740e90a3334ceab3754269bf84f2e4c0b

Download Submit
C:\Program Files\GetConvertFrom.zip.17C-324-D93

Filesize
442KB

MD5
572cf625ad22aa4ef95b432da5963b38

SHA1
da9870d3bfad5fd0fc76bb9b168a1a5f855e681c

SHA256
e5ab0ea2dd6c524c85b389e6dd2398e4dcb0ee65417238ad9913367fd488e88f

SHA512
998cd23301fbe6dccb3b2ae2a593934188766dca55c332dc30b38038fe9d16248d0d8158e07f93d0712e30f7c078d7501fb7d4e76ef655c76455b5e4d9eba719

Download Submit
C:\Program Files\GrantGet.rtf.17C-324-D93

Filesize
306KB

MD5
3c7c095887d32f8bd854ba88313ad137

SHA1
482118d7b7e5f71deb69d98f01fc1dd73fd6d0ba

SHA256
d039b09d4b4ff33e9c8478ca58dc317352e1783d4c5c0f701e8adaa3e24d64d2

SHA512
702372106e29d0db511554a257261efd06d160aea6f13d4c063bde6ac5a48f210f71119fab16d706c2c6fac655933eee39016f665c5e16c30849aab16fd20120

Download Submit
C:\Program Files\HideSelect.docx.17C-324-D93

Filesize
198KB

MD5
f32f22bc6508fcdbb4b90d11098b8f25

SHA1
826a1ff32245d5e6655d426b0c3ef03bde7c5916

SHA256
2136ab9c386b69d4636c6f6c3980ae2847d371b77c235a94757bd304658e0e8a

SHA512
0b871c5d0a5960cac1edea518e141060abeeafce46bb6f82c72739a83d06e11c86061e9b419a80c9140224ea1abbb1d7763908e02e7b5fee6a37a8a8c482c7e4

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE2.POTX

Filesize
292KB

MD5
ada7ac30f0c12110eabfd0395f345f07

SHA1
00a655feded6bfc1d2952c688e217dda57d1b787

SHA256
5ef479c7fd677b59d308439af90b968b7ce3ca5ba2cd0063537e4a25baad8abf

SHA512
8c2fb045b28b15ebf12fa8e2f7bf26bfafab41e8cf85e309b2288110ee5e133ecdb1ebad9c8627550e12dc1e6d027f3ec82b488868467d07cc37d7dbd55897c8

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\osmia32.msi

Filesize
3.0MB

MD5
a7cfcd924e6391a3d255767ba73495a5

SHA1
90226e3800139dff41eb80fe6338f60b6f4c1ff9

SHA256
4f11ae9378befdf91f3da4422ac65dc023d0e5e58fd022701d82539e5f9cf15e

SHA512
bc835c32955643bae651638ca145cb071690b37fab23c993f6e07ff1042e421c005ceeb6b9f6213c9ce77feebaa7fb13b3f69bf86f00466b4bfe74e6c8ba49c5

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\msjet.xsl.17C-324-D93

Filesize
31KB

MD5
68b4a0b798555243ee3137326b2b12e0

SHA1
6118ab61ce9eae0772241d93417de623d7a5d8c9

SHA256
794c760b29b8ac0c0aa4827228f7f406fe99626988ecc151fb069db46427196c

SHA512
664139a9fb73ea865c3abbed7c790477233856bc1a7ae98863479f9639f4a4527b8a7910487592a7bb516e95249a5ac5a9396f30cc6bc78f51de6099734d0672

Download Submit
C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe

Filesize
1015KB

MD5
1e950f0beabba0736dbc80eba3529a15

SHA1
bffd91b7fb2ad418dc92cba9dab0a217ac8c77ef

SHA256
ebb0e3cc2e0da04c6b46aa52c894d9e75c0402a1da9596c8c9660873eb6ed786

SHA512
2f11f7dd75c941ed024c1f8d6582cd17e0d67246728b3698be1bfab1478d41b9d3aeaa7e2f215a0317be0543583f7e77666b850bb402d3e0e605a689a9808358

Download Submit
C:\Program Files\ReadGet.xlsm.17C-324-D93

Filesize
265KB

MD5
719c1a56e82a52edcffdadc23b388e4e

SHA1
d3d8835e0a174d7d999b9099872fdc45155142b7

SHA256
e15c3692ddb1d65b6f5a1cda48b349815233c396b4ad2063e85149cd349caac1

SHA512
a86dc14cffdeeb9e2938776be2504c59ae9e4e0e7c992d76d6ddf7ef7c24ef6caa78113afc1e1f5c5a023d98ff23afa664c74cec2ec8b5808281c0277592ef48

Download Submit
C:\Program Files\ReceiveImport.au.17C-324-D93

Filesize
184KB

MD5
bced432134f4a114fb71aff18107cd7f

SHA1
3887fd6488710447ece154194bf21e0509e64fc9

SHA256
16c6a52778d56260db311581aed5dd3e0f397ce712e219b6a343ad1e07adc754

SHA512
66720f9fe266d0afb8e44d7023b96512d19607189bd261c677793b97cb6e34a9acc1c6e1a660eebabe4214468c60a753ba5e89bbf50ca51f0463c3c94f851246

Download Submit
C:\Program Files\RenameCompress.pps.17C-324-D93

Filesize
225KB

MD5
1997e137e30c279a7782641a9f899b7c

SHA1
b8250da61e9fa5597e4f8f26164d8104e45cbcc0

SHA256
f559f3c11d7eeeba0dfca1c3642400c5036c9ea8b2072411fed8e1f4bc5523e8

SHA512
74c689856d4c24a4899f79c7bea7f27c738ee05b68d99b05a10368620048a933f79297e2f6c5f166b0f029b4b1019d6dd45f44215b495289a740d5f2ffe2ed42

Download Submit
C:\Program Files\RenameSync.zip.17C-324-D93

Filesize
387KB

MD5
2f54cf16e46801e825e33a5be35ed394

SHA1
fa773bcdcbd72a0a0b81d7c9e0d3e816e9efcbf2

SHA256
69f0449337ac989add013bbb2da304a0787e8901b0cadfb4681bf18fa93813f9

SHA512
5b8c1003b3ad0b4d2bf320fd48ac210a8255f81e2663fb3c6e05c6aa4c70e19fa7cac72de6b59bd1b0225005bac15bea1024bf6aa3fd72498823c40e1d0413d0

Download Submit
C:\Program Files\RestartSwitch.rmi.17C-324-D93

Filesize
238KB

MD5
6cda696cad9f46c05baa74edb7329896

SHA1
2b4aa403e6c2f5022ff965cc189280615d494db1

SHA256
b2e415f50245a8e522316ffdf50231d350040dba2d4be6aeccee637444355d0d

SHA512
2ffefbd479fb05d7f2b7144b89d01fe43e369e91637063091624efb87a4dbff5b6641edf39020208eef7a0563e9c1cd859cde47eb02e77cedcb3310b9fa28f07

Download Submit
C:\Program Files\RevokeTest.pot.17C-324-D93

Filesize
170KB

MD5
661df6dc147bc1ec44248b8f53db45d9

SHA1
3309bb6dd124c48787431fb9089955db86083e6d

SHA256
cbc901262918eb085048d91aa6b5370336941194fe5bf9790228b88993ce1265

SHA512
b5ebd0abbeffefd94e331222d99f2900af02690b8bfcac21047919f7c70346ab49d05880e74742e9603ea699bf11cab953e3f7f821f7a7f1032c03878ad142c3

Download Submit
C:\Program Files\SaveSuspend.mp3.17C-324-D93

Filesize
157KB

MD5
83cf341655d4832ed2548d7ff49fca76

SHA1
81ef6442181062b48485ed8f79a016aaa1373b41

SHA256
1259d0461e5a5a3f63ccc75de7fcb3ebf6ca69b190b90254cee6dfe4cfed9e25

SHA512
8270bc7a017b5f946fb1cbe37f0001d78a16119778dc026546f0b4ada28ef5351d7ffbe3416320d810c111029d4d774a8fd0e98424931f9f2ea37c4b283b9b25

Download Submit
C:\Program Files\UnblockWatch.asp.17C-324-D93

Filesize
360KB

MD5
2005a8ac82edbee599821aa9ae009266

SHA1
53db3e5a9ba9d4e43c059b5aff10497e498ac131

SHA256
c34982f66386969519d2aeebbeea187460bde558b1711feae8a88e82bed01869

SHA512
bdd3a8713acac5fd69f30dd04bb30f249964a764cb997d26fe3b6ebb0fb420785e0c4529afb61aa83042fdf58fcc411aee224b63c14c4dcb17257582fda7dee0

Download Submit
C:\Program Files\UnpublishDisable.vssx.17C-324-D93

Filesize
611KB

MD5
77868431f32b2b1716fbab5987b4f09f

SHA1
85740004de19bd79584361a968ae76182e32150e

SHA256
d52a9637d4ef4dbbac2795b7d64c85155ea85d17d18ac6c8bbe4be5f39a717e4

SHA512
6536011fd45afaffa118a2a9ee49a8f001433706d5c008b53ae1514e7e26069d3a06122b9bd9c143f37e1466bd78adcfeb67cc486717414451020759268d0b8b

Download Submit
C:\Program Files\UpdateUse.ogg.17C-324-D93

Filesize
347KB

MD5
55f25ad8987cd6ff0f6af1c5395e0fb9

SHA1
8338fd9de1b2c8ace6f50400d11b62a7715d4044

SHA256
37ad0c4c22726f6287eafe6af832d273c4ce3ba9c7c196b410f84d05b85566a3

SHA512
67229e25aa4d06150bb3a1e52bc546349ae5a193ca25a3a4a8bdb2e2cf613d42da6bee66adacbde4dabe9aeb0f9c645cd20106c81b1ef946192141ab3a54b9c5

Download Submit
C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\vlc.mo

Filesize
833KB

MD5
5f2d64bfc4e459985ac72af995b80a67

SHA1
e80e4260c54644afe1ccdc8cc00ea34eb3457e63

SHA256
b7e402c74931d181cd1d6ba23a825eeafcc617916e49ec4574ef9e099c3155c6

SHA512
31963537b22860784339eaf23763e59a5aa6a72cf540e803bfcd8e6e2bf1e2589f47906cea1886440903c6004f4bf814f4db5ecb525a090c68c6028a9153cad2

Download Submit
C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\vlc.mo

Filesize
595KB

MD5
790c93f2a9a60b52f9afb3698fa8c68a

SHA1
085c28788c411e058765e8126dce2a6e542296ed

SHA256
c305c67ddb4c623d014c4bd6c0fcacd2d6739e6cb267659021388d5d566dface

SHA512
f263a730df9b95006d9f33a4348e3f51dc0b5bb79676d97f2cd49d8f08a6aa58967030e4321733a8a0f0224c701df4539e969896acab22c75a7b46c85e59ade4

Download Submit
C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\vlc.mo

Filesize
615KB

MD5
6f855bd3bf82dd70c30963c9eb6cd037

SHA1
80072bf86d4c68a532a6cdd9481c3adbbddd7796

SHA256
6c4c196c0ba4f9a86ac64c88135c357b6d76faca4f9fef775c08c9edaa6f681d

SHA512
ff318ff909ba13fb0b69a29229d397b3973fc508c89038d679d3966d3c6ca4669b026421a13aaffb734d65c3cb3deb92669f06ecd007ea202542874252588465

Download Submit
C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\vlc.mo

Filesize
773KB

MD5
7dab94985bc7ffae93f325751df5e40d

SHA1
4e8039dad4cb9c847e5e70c3a589f4b9bcc79b2e

SHA256
191c2ac5375663b34d8d0dde365b591007f8923b6b6d04b193d1ef8500f576e9

SHA512
9ef73ee55e4ccdccf4519f4edb5e0d562e1c2146bdb22990982cc51c16203942a08d4dbdff2c62624743f2e4cff76e4cef218737727cfd2ccaf878a2d5fdb455

Download Submit
C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\vlc.mo.17C-324-D93

Filesize
552KB

MD5
851da2f23715f0eceeaabc069bfd7a3d

SHA1
32891afccfa395210f55c81ba9a4d371a63ac12e

SHA256
769ab4d0a942102c9ccad6ec3b76c748e1cfcbbec24e3adf4d9f637ddde16d4c

SHA512
2d381763d9912346e3aa1fd7dee07f36f0fbb025d5193bdc0aa745f701cbb3c7f38469915ded726b68f93f4f87e5d108f4cc3000c4b00db3a9813b41a7b6904b

Download Submit
C:\Program Files\WriteConfirm.vdx.17C-324-D93

Filesize
211KB

MD5
ab60f31df00077fadd0f41c21de8a633

SHA1
05516d5f277f2c072389c26ff6c159f80202af95

SHA256
64aca1ce7f0943e2dfcd5dae73a61201a0ffcf33ee36252f45be6c423e1da125

SHA512
bdc142783ff85de9b4b27c92fbd8cc7e5531966b819922f84e6b216ebeb7d767168c35444fa30e6418c792fd42f45ce28dbf82dfc849d574a99ebeee79fcf134

Download Submit
C:\Program Files\dotnet\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Filesize
985B

MD5
6c5fb45232471e5c2c90d07cbbec5bbe

SHA1
86acac3eeb8dbd8d7f0cfe9947ad3c9a5ff50f28

SHA256
4a2e9d4fba81c8cc0fce96c471843cbf651c4f1ab3616db28315d352bd466d3d

SHA512
63973a55e6aa3d97c881f45b658b6c73e744b7acf4749676cd9927a3877d6dc54991a87c369d40ba5d2342cb8bf17df6f97d7a598c6690bb1d9303e2678097a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB

Filesize
2KB

MD5
5aa7e3f405cec88c854569c8b565de07

SHA1
d758d5bae4f5dd67c2d84c4c35c4d2d23a1dd3c5

SHA256
f132ed0157e78fb86e8f2412443aa8443df2b3b6c8c6ea6f2244e60703dacd5d

SHA512
a15ecd951ada9ead689666f9eacbfc6590c945dbf4a99c879144ddb73dcace5123da65739f0a545237d5372d9dd1875ec067c421f571c9c66eda20cb91ce1d4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\204C1AA6F6114E6A513754A2AB5760FA_268232F9B7ADFD0751C3D83F667CFB78

Filesize
472B

MD5
5ca03431c032a7096ddca13349743586

SHA1
1e0c52d86ab00f9d222db23376c4c5b19714164a

SHA256
20bfb2933cb8156974391895b2590640b02f039975bd0e4553a2850428dbdd37

SHA512
7acc865322c8d375eeffe8d1159d9e63dafcde8c539eae5947f19d98ae745a9cf4afd966e2e30bf7b3b389558850e1c72bda5c37fca76f713c4e417aa70fed77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
1KB

MD5
f33dd0f163647ec937a9a53ecaf7cfd0

SHA1
8808fd00c4fba4a605e4a6416f6a5e3086640227

SHA256
a9a86a188c7584dd5883f2f9644b505933c9189d5c35ea754922481f8ec58557

SHA512
53552ba088aad341ed6aecbd091ac8f630ef2d25dc1cb1a930cfafd13c69f361cca6c7ef520731b10b339c20f3de65c3010a093e4b565aebe7ebd45c88604856

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB

Filesize
484B

MD5
e2012c75eed3192a32535bb345badc0c

SHA1
d1d2bc44022903fd08aa1644e2719ed2ff76ee99

SHA256
6c46246fe433f40525ac955c410955292a3e347d5e7ef23fbce49ee9fe533888

SHA512
975c07b13a70f335261d3e3dfa4de2f1708af18e81263a229298b744fd2ecb6de96336cb8715a7375c158573ad04f916a79cde336a569b0768fad85ee81a1019

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\204C1AA6F6114E6A513754A2AB5760FA_268232F9B7ADFD0751C3D83F667CFB78

Filesize
488B

MD5
6a46ca7a8ab18065a34efa6b929fa706

SHA1
5c9ac32f135edc06bcd174e219d91495e35e62a1

SHA256
e300c654973a9cd2b979aa497b65fa52ccb5c9f07fb647d9d5242dab8b937522

SHA512
9a45c22a5090a78b90a11db2c5f6435fc90bbe9830ac08b1542f8063c8406fae6703cab827ce9fdf39aee172e047f1e1c2154bfdf86fcfd89e497ce61bf71cee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
482B

MD5
00bbe1b3d1f1ebc8e4f226695c279b22

SHA1
aea9281f7cac6004767adef917e239b6f3268505

SHA256
172c046adfcca5a94d4c02b800d097c1cc7e5b72f8aae10bfc91ae3112ec15b4

SHA512
e58df43d8420bad1de1fa8d27f1efc7212af786064320b3620e9f77ca9fce1c95da9e3f1abbd4ce104d4ff19e90238dcaaa3e93fb3c013a439a0ca74f7e929c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3MWDO42T\9C9EJZO6.htm

Filesize
18KB

MD5
99a5ced9dfb5824225a0fab4c74a7b46

SHA1
f0ebed42f94fabe0c10dcf1eb3eb084a904e144a

SHA256
44b3cbfb57079b2570e5ae94942d8e00ce0291c26317c2649a41101018bab25a

SHA512
2966164e08f60aaa0078dbfee9f4d5521b5c02525dbbad4ac14df0d6be948ba98ae1da33e05ceec07abd6d8a18278c399629621803acdccc91019372fa3152ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FZW7MNDS\M0S4597R.htm

Filesize
190B

MD5
6ebbeb8c70d5f8ffc3fb501950468594

SHA1
c06e60a316e48f5c35d39bcf7ed7e6254957ac9e

SHA256
a563426e24d132cd87b70d9cb5cd3d57c2e1428873a3f3eb94649cf42e37b6a1

SHA512
75cfab1c9f5a05c892cf3b564aed06d351c6dc40048faea03ae163154ff7635252817d66b72a6ef51c4f895eebf7728f302df51148acce2a0c285502bf13652c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe

Filesize
211KB

MD5
f42abb7569dbc2ff5faa7e078cb71476

SHA1
04530a6165fc29ab536bab1be16f6b87c46288e6

SHA256
516475caf3fbd1f0c0283572550528f1f9e7b502dce5fb6b89d40f366a150bfd

SHA512
3277534a02435538e144dea3476416e1d9117fcddef3dcb4379b82f33516c3e87767c3b0d2b880e61a3d803b583c96d772a0bdeecbfc109fe66444e9b29216af

Download Submit
C:\vcredist2010_x64.log-MSI_vc_red.msi.txt.17C-324-D93

Filesize
381KB

MD5
7a32eec85eabbc18e79a576d0d270bb0

SHA1
e5db5ca902537154f6339cba1c3f427dce22d636

SHA256
847e2d1a4600611ef8a081995c082ecd1e66eb5f34b1b7aca46b73b718dc795f

SHA512
7ae09fc37ecc602b5fbf5c43c99e033d48906157487c5b5a378c365a074cb1054e5f46871f85ca7bfc0191e46f79b2d7006fb11cc2e9ddff30b91623ca548003

Download Submit
C:\vcredist2010_x64.log.html.17C-324-D93

Filesize
87KB

MD5
b9ad40d0dd3ea38007081d078632312f

SHA1
992c3d7079c3e38f2dcbb24fb6c46389f7970892

SHA256
5a7e0eaa8e8d4037a28993344669dc60dc14e3e284c58ba476fa4dc6d880bf12

SHA512
28e37f0599563debd95a1110a64ea615ff2b61c78a7c12c9a312af99d6adebe79b856433ac7ba90c4f6f8d2d146d397b91e9bf3768de92cbac58791de2142c32

Download Submit
C:\vcredist2010_x86.log-MSI_vc_red.msi.txt.17C-324-D93

Filesize
397KB

MD5
9f76335f0c4d3029e9b0e10e0685dfd9

SHA1
4c57480d11e4bc4be18db8f54d9d7086ac5e273c

SHA256
bf80277ed344b3ceffec8099c5c055f8ef37ecf2bf5b505fb92f77186ec94cda

SHA512
fe9b7ce9cd256325c40d28c7ba50c96bc1a3f232f2ac8a463b958446c84fd51369e93c39a70a7ceb02f9762e54ff49383333095870b97c0740c9699db697a615

Download Submit
C:\vcredist2010_x86.log.html

Filesize
82KB

MD5
4984eb52c1d63977b6466d09d0a73bf1

SHA1
517c04dbf8d34f009ae67596549b1e6123d1f63d

SHA256
541a791280b5536f2d5b4f33825e6a6975b942272debf571047f835d25890934

SHA512
02a48ea954ca47a3c53a11e3f30f96ed609484805c7f40428040131d2c27f9be47512d015a96a94391aa7167ee291e4872c6e91bfa8083bb92e7e11f4d4b460a

Download Submit
memory/2500-7846-0x00000000004F0000-0x0000000000630000-memory.dmp

Filesize
1.2MB

Download
memory/2500-12806-0x00000000004F0000-0x0000000000630000-memory.dmp

Filesize
1.2MB

Download
memory/2500-21103-0x00000000004F0000-0x0000000000630000-memory.dmp

Filesize
1.2MB

Download
memory/2500-20471-0x00000000004F0000-0x0000000000630000-memory.dmp

Filesize
1.2MB

Download
memory/2696-8490-0x0000000000590000-0x00000000006D0000-memory.dmp

Filesize
1.2MB

Download
memory/3184-44-0x00000000004F0000-0x0000000000630000-memory.dmp

Filesize
1.2MB

Download
memory/3188-7110-0x00000000004F0000-0x0000000000630000-memory.dmp

Filesize
1.2MB

Download
memory/3188-625-0x00000000004F0000-0x0000000000630000-memory.dmp

Filesize
1.2MB

Download
memory/3188-42-0x00000000004F0000-0x0000000000630000-memory.dmp

Filesize
1.2MB

Download
memory/3188-21107-0x00000000004F0000-0x0000000000630000-memory.dmp

Filesize
1.2MB

Download
memory/3604-21106-0x0000000000F40000-0x0000000000F41000-memory.dmp

Filesize
4KB

Download
memory/4160-12807-0x0000000000590000-0x00000000006D0000-memory.dmp

Filesize
1.2MB

Download
memory/4160-21104-0x0000000000590000-0x00000000006D0000-memory.dmp

Filesize
1.2MB

Download
memory/4456-14126-0x0000000000590000-0x00000000006D0000-memory.dmp

Filesize
1.2MB

Download
memory/4456-43-0x0000000000590000-0x00000000006D0000-memory.dmp

Filesize
1.2MB

Download
memory/4456-10138-0x0000000000590000-0x00000000006D0000-memory.dmp

Filesize
1.2MB

Download
memory/4456-21108-0x0000000000590000-0x00000000006D0000-memory.dmp

Filesize
1.2MB

Download
memory/5028-21105-0x0000000001300000-0x0000000001301000-memory.dmp

Filesize
4KB

Download