Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

80f45f70d6...93.exe

windows7-x64

10

80f45f70d6...93.exe

windows10-2004-x64

10

Resubmissions

26/02/2025, 07:01

250226-htjbasxjv8 10

25/02/2025, 04:05

250225-enxd7atjy7 3

25/02/2025, 04:00

250225-ekttwssqy6 10

25/02/2025, 03:40

250225-d79cessjs5 10

25/02/2025, 03:10

250225-dpfmdszpw9 10

25/02/2025, 02:49

250225-dazrqaym19 10

25/02/2025, 02:42

250225-c61hfsyj15 10

Analysis

  • max time kernel
    627s
  • max time network
    634s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/02/2025, 03:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    80f45f70d66652a814a2784f3e3da3d304a2e3466bda889791a5de0117862593.exe

  • Size

    767KB

  • MD5

    d7b952b18e2fba388e8ae076488af9e2

  • SHA1

    20a1a5c98e93b87d58d8c6ddbe2450f657e59113

  • SHA256

    80f45f70d66652a814a2784f3e3da3d304a2e3466bda889791a5de0117862593

  • SHA512

    5777c6ff439a89d1571b3104b3fc9b43e5392cecdcd2c8100019582bfb383328648ef86735dbda8e15270f0853bff3ea9864f26a7f9c40d016269e417aa2f04f

  • SSDEEP

    12288:7GqN/XdctpVtkMtsyDqBQ0tA3nyF0Fh0zJmViYV5yvQX05oWI:lNcBtkUqBQ0tknx5yIXgoWI

Score
10/10
jigsawbootkitdefense_evasiondiscoverypersistenceransomwarespywarestealer

Malware Config

Signatures

  • Jigsaw Ransomware

    Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

    ransomwarejigsaw
  • Jigsaw family
    jigsaw
  • Renames multiple (3744) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Disables Task Manager via registry modification
    defense_evasion
  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Sets desktop wallpaper using registry 2 TTPs 20 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\80f45f70d66652a814a2784f3e3da3d304a2e3466bda889791a5de0117862593.exe
    "C:\Users\Admin\AppData\Local\Temp\80f45f70d66652a814a2784f3e3da3d304a2e3466bda889791a5de0117862593.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Users\Admin\AppData\Roaming\mtrmbr.exe
      "C:\Users\Admin\AppData\Roaming\mtrmbr.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1004
      • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\mtr.exe
        "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\mtr.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        PID:5088
        • C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
          "C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\ProgramData\Microsoft\Windows\Start?Menu\Programs\StartUp\mtr.exe
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of FindShellTrayWindow
          PID:4940
      • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\mbr.exe
        "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\mbr.exe"
        3⤵
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        • System Location Discovery: System Language Discovery
        PID:2908
    • C:\Users\Admin\AppData\Roaming\dt.exe
      "C:\Users\Admin\AppData\Roaming\dt.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2004
      • C:\Users\Admin\AppData\Local\Temp\dt.exe
        "C:\Users\Admin\AppData\Local\Temp\dt.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1984
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ED0F.tmp\disable_taskmgr.bat""
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1664
          • C:\Windows\SysWOW64\reg.exe
            REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
            5⤵
            • System Location Discovery: System Language Discovery
            • Modifies registry key
            PID:64
    • C:\Users\Admin\AppData\Roaming\bg.exe
      "C:\Users\Admin\AppData\Roaming\bg.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2336
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\run.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2528
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3448
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
            5⤵
            • Sets desktop wallpaper using registry
            • System Location Discovery: System Language Discovery
            PID:2756
          • C:\Windows\SysWOW64\rundll32.exe
            RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
            5⤵
              PID:2472
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
            4⤵
            • System Location Discovery: System Language Discovery
            PID:3112
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
              5⤵
              • Sets desktop wallpaper using registry
              • System Location Discovery: System Language Discovery
              PID:4768
            • C:\Windows\SysWOW64\rundll32.exe
              RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
              5⤵
              • System Location Discovery: System Language Discovery
              PID:812
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
            4⤵
            • System Location Discovery: System Language Discovery
            PID:3532
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
              5⤵
              • Sets desktop wallpaper using registry
              • System Location Discovery: System Language Discovery
              PID:4388
            • C:\Windows\SysWOW64\rundll32.exe
              RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1696
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
            4⤵
            • System Location Discovery: System Language Discovery
            PID:5040
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
              5⤵
              • Sets desktop wallpaper using registry
              • System Location Discovery: System Language Discovery
              PID:4064
            • C:\Windows\SysWOW64\rundll32.exe
              RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
              5⤵
              • System Location Discovery: System Language Discovery
              PID:4688
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1084
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
              5⤵
              • Sets desktop wallpaper using registry
              PID:3456
            • C:\Windows\SysWOW64\rundll32.exe
              RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
              5⤵
                PID:1332
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
              4⤵
              • System Location Discovery: System Language Discovery
              PID:4496
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
                5⤵
                • Sets desktop wallpaper using registry
                • System Location Discovery: System Language Discovery
                PID:2348
              • C:\Windows\SysWOW64\rundll32.exe
                RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                5⤵
                • System Location Discovery: System Language Discovery
                PID:2616
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
              4⤵
              • System Location Discovery: System Language Discovery
              PID:4552
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
                5⤵
                • Sets desktop wallpaper using registry
                • System Location Discovery: System Language Discovery
                PID:1984
              • C:\Windows\SysWOW64\rundll32.exe
                RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                5⤵
                  PID:2664
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
                4⤵
                • System Location Discovery: System Language Discovery
                PID:3800
                • C:\Windows\SysWOW64\reg.exe
                  reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
                  5⤵
                  • Sets desktop wallpaper using registry
                  • System Location Discovery: System Language Discovery
                  PID:1616
                • C:\Windows\SysWOW64\rundll32.exe
                  RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:748
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2128
                • C:\Windows\SysWOW64\reg.exe
                  reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
                  5⤵
                  • Sets desktop wallpaper using registry
                  • System Location Discovery: System Language Discovery
                  PID:2664
                • C:\Windows\SysWOW64\rundll32.exe
                  RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:3984
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
                4⤵
                • System Location Discovery: System Language Discovery
                PID:3752
                • C:\Windows\SysWOW64\reg.exe
                  reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
                  5⤵
                  • Sets desktop wallpaper using registry
                  • System Location Discovery: System Language Discovery
                  PID:1504
                • C:\Windows\SysWOW64\rundll32.exe
                  RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:1712
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2540
                • C:\Windows\SysWOW64\reg.exe
                  reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
                  5⤵
                  • Sets desktop wallpaper using registry
                  • System Location Discovery: System Language Discovery
                  PID:1996
                • C:\Windows\SysWOW64\rundll32.exe
                  RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:2860
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
                4⤵
                • System Location Discovery: System Language Discovery
                PID:4248
                • C:\Windows\SysWOW64\reg.exe
                  reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
                  5⤵
                  • Sets desktop wallpaper using registry
                  • System Location Discovery: System Language Discovery
                  PID:2368
                • C:\Windows\SysWOW64\rundll32.exe
                  RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:4064
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1456
                • C:\Windows\SysWOW64\reg.exe
                  reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
                  5⤵
                  • Sets desktop wallpaper using registry
                  PID:2860
                • C:\Windows\SysWOW64\rundll32.exe
                  RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                  5⤵
                    PID:640
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:3436
                  • C:\Windows\SysWOW64\reg.exe
                    reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
                    5⤵
                    • Sets desktop wallpaper using registry
                    • System Location Discovery: System Language Discovery
                    PID:2088
                  • C:\Windows\SysWOW64\rundll32.exe
                    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:3496
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:2280
                  • C:\Windows\SysWOW64\reg.exe
                    reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
                    5⤵
                    • Sets desktop wallpaper using registry
                    • System Location Discovery: System Language Discovery
                    PID:3828
                  • C:\Windows\SysWOW64\rundll32.exe
                    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:3396
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:2748
                  • C:\Windows\SysWOW64\reg.exe
                    reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
                    5⤵
                    • Sets desktop wallpaper using registry
                    • System Location Discovery: System Language Discovery
                    PID:4044
                  • C:\Windows\SysWOW64\rundll32.exe
                    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:1452
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:4344
                  • C:\Windows\SysWOW64\reg.exe
                    reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
                    5⤵
                    • Sets desktop wallpaper using registry
                    • System Location Discovery: System Language Discovery
                    PID:2884
                  • C:\Windows\SysWOW64\rundll32.exe
                    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:1972
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:4328
                  • C:\Windows\SysWOW64\reg.exe
                    reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
                    5⤵
                    • Sets desktop wallpaper using registry
                    • System Location Discovery: System Language Discovery
                    PID:4708
                  • C:\Windows\SysWOW64\rundll32.exe
                    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:3416
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:2052
                  • C:\Windows\SysWOW64\reg.exe
                    reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
                    5⤵
                    • Sets desktop wallpaper using registry
                    PID:208
                  • C:\Windows\SysWOW64\rundll32.exe
                    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:1572
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp/bg.bat
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:4800
                  • C:\Windows\SysWOW64\reg.exe
                    reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp/bg.bmp /f
                    5⤵
                    • Sets desktop wallpaper using registry
                    • System Location Discovery: System Language Discovery
                    PID:1076
                  • C:\Windows\SysWOW64\rundll32.exe
                    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:5088
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\restart.bat" "
              2⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1072
              • C:\Windows\SysWOW64\shutdown.exe
                shutdown /f /r /t 1200
                3⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:2444
          • C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
            "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
            1⤵
              PID:3396
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
              1⤵
              • Enumerates system info in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:660
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe7bfe46f8,0x7ffe7bfe4708,0x7ffe7bfe4718
                2⤵
                  PID:2544
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,1881251294719637731,4946506466290151971,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1900 /prefetch:2
                  2⤵
                    PID:3564
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,1881251294719637731,4946506466290151971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1156
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,1881251294719637731,4946506466290151971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
                    2⤵
                      PID:4628
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1881251294719637731,4946506466290151971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
                      2⤵
                        PID:5280
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1881251294719637731,4946506466290151971,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
                        2⤵
                          PID:5272
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1881251294719637731,4946506466290151971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
                          2⤵
                            PID:5836
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1881251294719637731,4946506466290151971,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4320 /prefetch:1
                            2⤵
                              PID:5844
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,1881251294719637731,4946506466290151971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 /prefetch:8
                              2⤵
                                PID:2908
                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,1881251294719637731,4946506466290151971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 /prefetch:8
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2396
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1881251294719637731,4946506466290151971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
                                2⤵
                                  PID:3408
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1881251294719637731,4946506466290151971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
                                  2⤵
                                    PID:5324
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1881251294719637731,4946506466290151971,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
                                    2⤵
                                      PID:5380
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1881251294719637731,4946506466290151971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
                                      2⤵
                                        PID:2612
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1881251294719637731,4946506466290151971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
                                        2⤵
                                          PID:1660
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1881251294719637731,4946506466290151971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4396 /prefetch:1
                                          2⤵
                                            PID:5436
                                        • C:\Windows\System32\CompPkgSrv.exe
                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                          1⤵
                                            PID:5320
                                          • C:\Windows\System32\CompPkgSrv.exe
                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                            1⤵
                                              PID:5396
                                            • C:\Windows\system32\taskmgr.exe
                                              "C:\Windows\system32\taskmgr.exe" /7
                                              1⤵
                                                PID:5412
                                              • C:\Windows\System32\rundll32.exe
                                                C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
                                                1⤵
                                                  PID:4984
                                                • C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
                                                  "C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe"
                                                  1⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Adds Run key to start application
                                                  PID:4256
                                                  • C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
                                                    "C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
                                                    2⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Program Files directory
                                                    • Suspicious use of FindShellTrayWindow
                                                    PID:6020
                                                • C:\Windows\System32\rundll32.exe
                                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                  1⤵
                                                    PID:1260
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
                                                    1⤵
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:5720
                                                    • C:\Windows\system32\dashost.exe
                                                      dashost.exe {6e2be749-4de4-41d9-aea303adf8226b88}
                                                      2⤵
                                                        PID:2108

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Reconnaissance

                                                    Resource Development

                                                    Initial Access

                                                    Execution

                                                    Persistence

                                                    Boot or Logon Autostart Execution

                                                    1
                                                    T1547

                                                    Registry Run Keys / Startup Folder

                                                    1
                                                    T1547.001

                                                    Pre-OS Boot

                                                    1
                                                    T1542

                                                    Bootkit

                                                    1
                                                    T1542.003

                                                    Privilege Escalation

                                                    Boot or Logon Autostart Execution

                                                    1
                                                    T1547

                                                    Registry Run Keys / Startup Folder

                                                    1
                                                    T1547.001

                                                    Defense Evasion

                                                    Modify Registry

                                                    3
                                                    T1112

                                                    Pre-OS Boot

                                                    1
                                                    T1542

                                                    Bootkit

                                                    1
                                                    T1542.003

                                                    Credential Access

                                                    Credentials from Password Stores

                                                    1
                                                    T1555

                                                    Credentials from Web Browsers

                                                    1
                                                    T1555.003

                                                    Unsecured Credentials

                                                    1
                                                    T1552

                                                    Credentials In Files

                                                    1
                                                    T1552.001

                                                    Discovery

                                                    Browser Information Discovery

                                                    1
                                                    T1217

                                                    Query Registry

                                                    2
                                                    T1012

                                                    System Information Discovery

                                                    3
                                                    T1082

                                                    System Location Discovery

                                                    1
                                                    T1614

                                                    System Language Discovery

                                                    1
                                                    T1614.001

                                                    Lateral Movement

                                                    Collection

                                                    Data from Local System

                                                    1
                                                    T1005

                                                    Command and Control

                                                    Exfiltration

                                                    Impact

                                                    Defacement

                                                    1
                                                    T1491

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_remove_18.svg.rubly
                                                      Filesize

                                                      720B

                                                      MD5

                                                      75a585c1b60bd6c75d496d3b042738d5

                                                      SHA1

                                                      02c310d7bf79b32a43acd367d031b6a88c7e95ed

                                                      SHA256

                                                      5ebbfc6df60e21044486a5df3cb47ccdcd7a4d5f197804555715ffd9bf6c5834

                                                      SHA512

                                                      663a302e651b9167f4c4e6ae30028307b4d8da0dda3a0e5fd414104951d50419862fc9396c5b39fe5c4b696efd3efbf0b575688983b1d341f3ef38becf500505

                                                      Download Submit

                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons.png.rubly
                                                      Filesize

                                                      7KB

                                                      MD5

                                                      72269cd78515bde3812a44fa4c1c028c

                                                      SHA1

                                                      87cada599a01acf0a43692f07a58f62f5d90d22c

                                                      SHA256

                                                      7c78b3da50c1135a9e1ecace9aea4ea7ac8622d2a87b952fc917c81010c953f7

                                                      SHA512

                                                      3834b7a8866e8656bbdbf711fc400956e9b7a14e192758f26ccf31d8f6ab8e34f7b1983c1845dc84e45ff70555e423d54a475f6a668511d3bcbdd1d460eeb4b0

                                                      Download Submit

                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_ie8.gif.rubly
                                                      Filesize

                                                      7KB

                                                      MD5

                                                      eda4add7a17cc3d53920dd85d5987a5f

                                                      SHA1

                                                      863dcc28a16e16f66f607790807299b4578e6319

                                                      SHA256

                                                      97f6348eaa48800e603d11fa22c62e10682ad919e7af2b2e59d6bd53937618f2

                                                      SHA512

                                                      d59fa9648dc7cb76a5163014f91b6d65d33aaa86fc9d9c73bf147943a3254b4c4f77f06b2e95bb8f94246a982ea466eb33dac9573dd62f40953fd23de1c1b498

                                                      Download Submit

                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_retina.png.rubly
                                                      Filesize

                                                      15KB

                                                      MD5

                                                      7dbb12df8a1a7faae12a7df93b48a7aa

                                                      SHA1

                                                      07800ce598bee0825598ad6f5513e2ba60d56645

                                                      SHA256

                                                      aecde4eb94a19095495d76ef3189a9abd45bcfd41acbed7705d22b4c7d00aa77

                                                      SHA512

                                                      96e454ebb4c96573e8edc6822290c22d425f4c7f7adbab35e6dc4b3ce04a5916ae9254c2c312c98299835ecbf3c5aa95da2939b8408ac25fbae44ba87a3795dc

                                                      Download Submit

                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons.png.rubly
                                                      Filesize

                                                      8KB

                                                      MD5

                                                      82a2e835674d50f1a9388aaf1b935002

                                                      SHA1

                                                      e09d0577da42a15ec1b71a887ff3e48cfbfeff1a

                                                      SHA256

                                                      904372666ca3c40f92b20317d92ca531678958affbc34591401e338146fe0ecb

                                                      SHA512

                                                      b10a8e384d0bd088443a5085f5c22a296f6f4d295a053d4526690ba65846e887daec47d01cf18fdf1160db98061a8b7c4040de56e6e604451a821fadccf32698

                                                      Download Submit

                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons_retina.png.rubly
                                                      Filesize

                                                      17KB

                                                      MD5

                                                      150c9a9ed69b12d54ada958fcdbb1d8a

                                                      SHA1

                                                      804c540a51a8d14c6019d3886ece68f32f1631d5

                                                      SHA256

                                                      2dee41184747742fbdc527b2023d67fecec1ccdfdf258439a06cd75d4fd33f43

                                                      SHA512

                                                      70193ee6f0919eb14311f43b5a5da041deacb568db55fc43290ee76e17af902ac468435b37a150630ea3b7871c724073915ae5dcba3c301ac42f2d68dd598e2f

                                                      Download Submit

                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png.rubly
                                                      Filesize

                                                      448B

                                                      MD5

                                                      880833ad1399589728c877f0ebf9dce0

                                                      SHA1

                                                      0a98c8a78b48c4b1b4165a2c6b612084d9d26dce

                                                      SHA256

                                                      7a27d891097df183fbf0031e3894bdac0ce77aef15d666ddd9f6a04e9836fb27

                                                      SHA512

                                                      0ddf247892a72a390437390d535debf6e41d12e51b31eb4f0353b710ec380c5fbc531a48e76935088063a41aca843287d3def9c1cd46be05b8dcb69f5017a464

                                                      Download Submit

                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png.rubly
                                                      Filesize

                                                      624B

                                                      MD5

                                                      409a8070b50ad164eda5691adf5a2345

                                                      SHA1

                                                      e84e10471f3775d5d706a3b7e361100c9fbfaf74

                                                      SHA256

                                                      a91790b778026db625c9dedfe1c6d94b884818b33d7977e86b2f9c2f3c500796

                                                      SHA512

                                                      767a75edd37d29b3433040ce21cda849cd11ba549f27581f7edc6416c433ba7047c56908d40956422393ab0f35ede61617d4bd2aad0bde3d1ebd276584c858c7

                                                      Download Submit

                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover.png.rubly
                                                      Filesize

                                                      400B

                                                      MD5

                                                      2884524604c89632ebbf595e1d905df9

                                                      SHA1

                                                      b6053c85110b0364766e18daab579ac048b36545

                                                      SHA256

                                                      ae2facd997527426fc4def82e0db68be29b44499bfff86a28c36f7c31b177d4f

                                                      SHA512

                                                      0b506397627823a1768796129c6b37d146821471b89338b5f2d0fd3aea707fd46a8e197ee0e298ddfb3b50eef0a0b064946006346b060f733ef19cbd5d24fc90

                                                      Download Submit

                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover_2x.png.rubly
                                                      Filesize

                                                      560B

                                                      MD5

                                                      e092d14d26938d98728ce4698ee49bc3

                                                      SHA1

                                                      9f8ee037664b4871ec02ed6bba11a5317b9e784a

                                                      SHA256

                                                      5e8ec278a273be22199884d519a79f748801baa3a45b76e57569fdfffe96e7fb

                                                      SHA512

                                                      b2fcb5d46339cdf6b5a954f2a083cf913779e57cb6e8699bc5da1fba1c370c41117b7ddefb50075622067eb7b02a20268bc047171bd883bcda4a497c2ec64ea4

                                                      Download Submit

                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png.rubly
                                                      Filesize

                                                      400B

                                                      MD5

                                                      0c680b0b1e428ebc7bff87da2553d512

                                                      SHA1

                                                      f801dedfc3796d7ec52ee8ba85f26f24bbd2627c

                                                      SHA256

                                                      9433084e61062d2b709c1390e298ddaf3fb0226656662c04c0b7026a44dee750

                                                      SHA512

                                                      2d1399a6bf225b048d2b12656e941ad912636acae2dec387f92f33ac80629a1e504bca63580ba73a8ed073788f697274d5eb76ea1b089f0555fd397a8f5cbbff

                                                      Download Submit

                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png.rubly
                                                      Filesize

                                                      560B

                                                      MD5

                                                      be26a499465cfbb09a281f34012eada0

                                                      SHA1

                                                      b8544b9f569724a863e85209f81cd952acdea561

                                                      SHA256

                                                      9095e9b4759e823e96984981af41b7a9915a5ecaa6be769f89c13484cef9e0f5

                                                      SHA512

                                                      28196e5de9670e9f63adcf648368bd3ea5926a03e28a13adc2fb69c567fba2f84e4f162637c487acb64eda2e30993f849806f2313820ba693c7e70303542d04f

                                                      Download Submit

                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png.rubly
                                                      Filesize

                                                      400B

                                                      MD5

                                                      2de4e157bf747db92c978efce8754951

                                                      SHA1

                                                      c8d31effbb9621aefac55cf3d4ecf8db5e77f53d

                                                      SHA256

                                                      341976b4fe312824d02512d74770a6df9e1c37123781655532bd9cd97ea65fa9

                                                      SHA512

                                                      3042a742c38434ae3ee4fe10f7137462cdebad5cae0f9a85fb61063d15a30e1b54ac878b1af65f699c6ca1a9d2c3e58d245e54bdebfadc460cbd060836734e11

                                                      Download Submit

                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png.rubly
                                                      Filesize

                                                      560B

                                                      MD5

                                                      ad091690b979144c795c59933373ea3f

                                                      SHA1

                                                      5d9e481bc96e6f53b6ff148b0da8417f63962ada

                                                      SHA256

                                                      7805ac9d0e05d560023e5aabed960d842e4f3ec2aa3db45a9cfb541688e2edb1

                                                      SHA512

                                                      23b4c799a7b25f70962e8dd0ec7286ba7150053cab7c88f5fb1efc1095c2987bd6f3572e7fb3ee4b2238958e52a763de2c84a74615df7a6d3a19a034584fd687

                                                      Download Submit

                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons.png.rubly
                                                      Filesize

                                                      688B

                                                      MD5

                                                      65368c6dd915332ad36d061e55d02d6f

                                                      SHA1

                                                      fb4bc0862b192ad322fcb8215a33bd06c4077c6b

                                                      SHA256

                                                      6f9c7ebec5a707de439e3fd2e278fdfa07a39465d56157b70b24f091509bf76f

                                                      SHA512

                                                      8bb9a7690aeb3c0b9e14e1a6ebc5741536d354cf2324fd74ee0c3e4ef511718f7795039a94c8d2df94b6e6d0fb1762191cb649089d1def12abdf34003f0cdd0f

                                                      Download Submit

                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons2x.png.rubly
                                                      Filesize

                                                      1KB

                                                      MD5

                                                      0d35b2591dc256d3575b38c748338021

                                                      SHA1

                                                      313f42a267f483e16e9dd223202c6679f243f02d

                                                      SHA256

                                                      1ca0cfc2df0354c8d886285ae5e743d9c7cc030e1afd68ac113c0f2ce43ad5fa

                                                      SHA512

                                                      f6c58c27bbde7508a866bd0e7fabadb13a4f020378cd8b8cfc0c9fa23f645d811d6cdea04b81afdf30c064c6248152e74b3e6a78ec7a3d1d19037a0db8897d7e

                                                      Download Submit

                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_pattern_RHP.png.rubly
                                                      Filesize

                                                      192B

                                                      MD5

                                                      b8454390c3402747f7c5e46c69bea782

                                                      SHA1

                                                      e922c30891ff05939441d839bfe8e71ad9805ec0

                                                      SHA256

                                                      76f8ed1dd50e50c7d62b804a0d6901a93e5534787d7b38467933d4c12ce98a0d

                                                      SHA512

                                                      22b26c62473e80d17c1f78df14757ccfb6c7175faa541705edc153c02baa7ab0982b5daabe8dd2c8c9efb92af81f55ccaeeecffe8ed9a0b3c26e89135ca50923

                                                      Download Submit

                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_patterns_header.png.rubly
                                                      Filesize

                                                      704B

                                                      MD5

                                                      6e333be79ea4454e2ae4a0649edc420d

                                                      SHA1

                                                      95a545127e10daea20fd38b29dcc66029bd3b8bc

                                                      SHA256

                                                      112f72ef2bc57de697b82b731775fba3f518d1ae072120cd11b732bf4a782e36

                                                      SHA512

                                                      bed5906c7373814acc8a54c1631428a17f0aa69282920447a1575d8db826afd5dab262301dc6da610ff8bb81d24ec6babd3d9fb99fd6945f1aca9cb9c76ec2c9

                                                      Download Submit

                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations.png.rubly
                                                      Filesize

                                                      8KB

                                                      MD5

                                                      3ae8789eb89621255cfd5708f5658dea

                                                      SHA1

                                                      6c3b530412474f62b91fd4393b636012c29217df

                                                      SHA256

                                                      7c5b1d8469e232a58359ccbcb89e619c81c20e6d2c7579e4292eb9a19849bc5a

                                                      SHA512

                                                      f6998dbae1a2fa56f962045261a11a50b8e03573d9d4cf39083da3be341cc104e0ecf5908076f03961bcdb1356d05a7450d69940ec3aaab73623a6fe180e7051

                                                      Download Submit

                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations_retina.png.rubly
                                                      Filesize

                                                      19KB

                                                      MD5

                                                      b7c62677ce78fbd3fb9c047665223fea

                                                      SHA1

                                                      3218c7b6fd8be5e0a8b67d3953d37d5dbd0c71d8

                                                      SHA256

                                                      aa638be6e1107ed1f14e8430abedd6f6d0a837a31b1b63e6a7741d6d417eddc2

                                                      SHA512

                                                      9e0cc29835845f2a0260a6989c1b362bac22a8e0c2825bc18f1dde812ce7868503881d2deaf951429a80b5017b6ce31e785ff524883e08d730aa38b36a2fb074

                                                      Download Submit

                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\ui-strings.js.rubly
                                                      Filesize

                                                      832B

                                                      MD5

                                                      117d6f863b5406cd4f2ac4ceaa4ba2c6

                                                      SHA1

                                                      5cac25f217399ea050182d28b08301fd819f2b2e

                                                      SHA256

                                                      73acdc730d8a9ec8f340c724b4db96fc222bb1eaf836cec69dfe3fab8d6ac362

                                                      SHA512

                                                      e10883029c1e0fbc64bec9aac0a6957a8499af255e1790843717212077926474e02b2870c5dd04b057c956b97ad4bb1747fe73e731ea61b891f4b38dd80494d7

                                                      Download Submit

                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ui-strings.js.rubly
                                                      Filesize

                                                      1KB

                                                      MD5

                                                      433755fcc2552446eb1345dd28c924eb

                                                      SHA1

                                                      23863f5257bdc268015f31ab22434728e5982019

                                                      SHA256

                                                      d6c290e942ee665d71e288229423a1f1866842988eac01f886910b0ec383aa9b

                                                      SHA512

                                                      de83b580ce27012a7677e1da867c91e2a42dbc6b5872dcf756ace51c2862801814665ecca997171f2e550e8b9a3de19994d2516a4e5d4d57e16c7b4b823236c0

                                                      Download Submit

                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ui-strings.js.rubly
                                                      Filesize

                                                      1KB

                                                      MD5

                                                      781ed8cdd7186821383d43d770d2e357

                                                      SHA1

                                                      99638b49b4cfec881688b025467df9f6f15371e8

                                                      SHA256

                                                      a955039cd9e53674395f4b758218e4d59c89e99a0c4d2a909e49f6008b8f5dd4

                                                      SHA512

                                                      87cb9c4288586df232200f7bbacee3dee04f31c9444902dd369ad5c392d71e9837ebf8b3bb0fcb4a5db8a879cf757e97ce248939e3316c6bf3a3fe7cbe579534

                                                      Download Submit

                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png.rubly
                                                      Filesize

                                                      2KB

                                                      MD5

                                                      51da980061401d9a49494b58225b2753

                                                      SHA1

                                                      3445ffbf33f012ff638c1435f0834db9858f16d3

                                                      SHA256

                                                      3fb25ddd378ab756ec9faa56f16b76691cf6d9c7405bb9a09ce542a6f5b94e44

                                                      SHA512

                                                      ecc5eb2a045ce2508d461b999f16caba6cce55aa0c00b34bd73a33e0458795f93a77caff5026212912684164057be016f51dc57ec83821c2a1f2e27417c47b2c

                                                      Download Submit

                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png.rubly
                                                      Filesize

                                                      2KB

                                                      MD5

                                                      2863e8df6fbbe35b81b590817dd42a04

                                                      SHA1

                                                      562824deb05e2bfe1b57cd0abd3fc7fbec141b7c

                                                      SHA256

                                                      7f1238332901b740cde70db622abcfb533fc02f71e93101340073552f4820dad

                                                      SHA512

                                                      7b2d95465ea66951ea05c341549535a0a939d26dbde365b212e3983e4047fa6912c37d737cb8054c41bb1a7d92586d968a0154c666572a70ebc59a4776897f38

                                                      Download Submit

                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png.rubly
                                                      Filesize

                                                      4KB

                                                      MD5

                                                      79f6f006c95a4eb4141d6cedc7b2ebeb

                                                      SHA1

                                                      012ca3de08fb304f022f4ea9565ae465f53ab9e8

                                                      SHA256

                                                      e9847d0839d3cf1039bebdc49820ee7813d70941347ce420990592e5e3bd998e

                                                      SHA512

                                                      c143a4cf1ccfa98039b73214978722408188535ee4aa3dac08a34760b94bdf6d36ad0ff0de893da5b17fd69c96a6dfb25098ab7fec219fad1a77532113d0353e

                                                      Download Submit

                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png.rubly
                                                      Filesize

                                                      304B

                                                      MD5

                                                      b88e3983f77632fa21f1d11ac7e27a64

                                                      SHA1

                                                      03a2b008cc3fe914910b0250ed4d49bd6b021393

                                                      SHA256

                                                      8469b8a64e80d662eec71c50513f6d295ef4a3a9992763dbcac9d81253cef9d5

                                                      SHA512

                                                      5bf93d4f4250ca96169f3d27d4e648cc5d6e00b7558a3ef32e07edcbae36dadb8008d7ba5f83ac3ed812b72c9d52730e866191b4de7a339df57b5697e00df50d

                                                      Download Submit

                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png.rubly
                                                      Filesize

                                                      400B

                                                      MD5

                                                      f77086a1d20bca6ba75b8f2fef2f0247

                                                      SHA1

                                                      db7c58faaecd10e4b3473b74c1277603a75d6624

                                                      SHA256

                                                      cf10d2a22b638cf0978cf30ecaf39ecb5bb0e3ad78cd920afa433ad60cc1290d

                                                      SHA512

                                                      a77a897c0b41f4052cb9546d4cfd6e0856b288b6b8583a86d6c7e79059a05b19cc2593599251581e79107235e9d5cd589c392bf490452be04ff57e944cd19df3

                                                      Download Submit

                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png.rubly
                                                      Filesize

                                                      1008B

                                                      MD5

                                                      e03c9cd255f1d8d6c03b52fee7273894

                                                      SHA1

                                                      d0e9a9e6efd1746bc9ccb4eb8e7701c1cd707e2e

                                                      SHA256

                                                      22a34c8321384fc7682102e40d082e7812232a9109e4d4e8fa2152fda3f260f6

                                                      SHA512

                                                      d4bd002197b725316e1f1f2dd0a70ee44a82a53ac0dafa8c6b1166343adc406e147d0c4cca30d65a32aa545f1b327c6b69c0ec1d15330af48a6faa234dc4b5ac

                                                      Download Submit

                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png.rubly
                                                      Filesize

                                                      1KB

                                                      MD5

                                                      62b1443d82968878c773a1414de23c82

                                                      SHA1

                                                      192bbf788c31bc7e6fe840c0ea113992a8d8621c

                                                      SHA256

                                                      4e96529c023168df8dde241a9acdbf4788ea65bc35605e18febff2b2071f1e24

                                                      SHA512

                                                      75c8604ea65e0cdd9ea74b4802930444dd16a945da1e7f0af4a9a3762259ee9eb41ea96973555d06f4814ee2f6b73ab662c6b314b97876e9628fa5d4536e771c

                                                      Download Submit

                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png.rubly
                                                      Filesize

                                                      2KB

                                                      MD5

                                                      bca915870ae4ad0d86fcaba08a10f1fa

                                                      SHA1

                                                      7531259f5edae780e684a25635292bf4b2bb1aac

                                                      SHA256

                                                      d153ed6c5ea8c2c2f1839f8dadcc730f61bd8cd86ad732bab002a258dea1d037

                                                      SHA512

                                                      03f23de6b0ae10e63c41e73308b3844d49379c55d2df75fa1dc00771b26253d832c21081d8289f04260369df996e31273b7c0788cf3b5c78a27ec909f14a283a

                                                      Download Submit

                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\ui-strings.js.rubly
                                                      Filesize

                                                      848B

                                                      MD5

                                                      14145467d1e7bd96f1ffe21e0ae79199

                                                      SHA1

                                                      5db5fbd88779a088fd1c4319ff26beb284ad0ff3

                                                      SHA256

                                                      7a75b8ec8809c460301f30e1960b13c518680792e5c743ce7e9a7f691cfafc38

                                                      SHA512

                                                      762d499c54c5a25aba4357a50bb4e6b47451babeda84fa62cfbd649f8350bca55204ad002883b9147e78dda3dbabaae8da1dc94b716204226bb53326030772b7

                                                      Download Submit

                                                    • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.rubly
                                                      Filesize

                                                      32KB

                                                      MD5

                                                      829165ca0fd145de3c2c8051b321734f

                                                      SHA1

                                                      f5cc3af85ab27c3ea2c2f7cbb8295b28a76a459e

                                                      SHA256

                                                      a193ee2673e0ba5ebc5ea6e65665b8a28bd7611f06d2b0174ec2076e22d94356

                                                      SHA512

                                                      7d380cda12b342a770def9d4e9c078c97874f3a30cd9f531355e3744a8fef2308f79878ffeb12ce26953325cb6a17bc7e54237dfdc2ee72b140ec295676adbcb

                                                      Download Submit

                                                    • C:\Program Files\AddEnable.rar.rubly
                                                      Filesize

                                                      120KB

                                                      MD5

                                                      6645cee2064a513105b7392133346f86

                                                      SHA1

                                                      a48bf73453886c08d9d4859f890629b5d91104c3

                                                      SHA256

                                                      8b04a17d988064a33f536b710a41821e3ef3d7f0204538d0f6f0bbfaaf869328

                                                      SHA512

                                                      275856baadb60fe1aa7f6e3c6c73ba1e78a7040f1f27cbf9eb5b383287eb5c21f9703fc023adf3bb976f256fc6398564458fe2160dc149f710720f962daee298

                                                      Download Submit

                                                    • C:\Program Files\ApproveBackup.jpeg.rubly
                                                      Filesize

                                                      266KB

                                                      MD5

                                                      d209014fd5ed315fc22e86e9334ff076

                                                      SHA1

                                                      b0ec3750fefd0f164c779338a4c2cd4e776e8a7e

                                                      SHA256

                                                      4ca1dd2be6f350e27f9eb109bf737ad5eed677afcb0548aeab4502464f2846c7

                                                      SHA512

                                                      207277b95211ae16f1ebd82322b674217e953e210d11e71e15e646d037be48ea08339759b2ae1fb16899fae262d5be34bf6545333e36e0d7750a225e4dbcff2e

                                                      Download Submit

                                                    • C:\Program Files\ClearInitialize.ppsm.rubly
                                                      Filesize

                                                      435KB

                                                      MD5

                                                      0d8d7ef502df9230b9d5c92ae95a8b30

                                                      SHA1

                                                      28ba306db029f3a4578258fcaa0ef8336c20d481

                                                      SHA256

                                                      7e534736eadd8508bbf2332545c36ffd96a52bad6137db799a026f67fa53a33e

                                                      SHA512

                                                      e6e769e30f3efa387d1609155d89260e63150722ad1d46f62ee38540e8ca4fce80a5d1cffad5e6790b5e35b4c29c51f2dd0f26020b1d53db9f5a3571e47905ca

                                                      Download Submit

                                                    • C:\Program Files\CompressComplete.wma.rubly
                                                      Filesize

                                                      314KB

                                                      MD5

                                                      4ce95fa1859a4f4f776db7cac8fe18d7

                                                      SHA1

                                                      a3ba1dd986e1e3cb5b890f6e7922874db9ef4677

                                                      SHA256

                                                      ba13181f083db59684c035d61e9f2b6284ad3883d53b457b4bd79412e222da45

                                                      SHA512

                                                      e16f63da4e4d7bfc6f42ddab677781ea2fa84158b9bbb30fd1ebcdbef9590d74bd9c4b850345f31866ed9395f61a36ccf3958c862f6d4cbcfb603f2ac102ccb3

                                                      Download Submit

                                                    • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.rubly
                                                      Filesize

                                                      160B

                                                      MD5

                                                      580ee0344b7da2786da6a433a1e84893

                                                      SHA1

                                                      60f8c4dd5457e9834f5402cb326b1a2d3ca0ba7e

                                                      SHA256

                                                      98b6c2ddfefc628d03ceaef9d69688674a6bc32eb707f9ed86bc8c75675c4513

                                                      SHA512

                                                      356d2cdea3321e894b5b46ad1ea24c0e3c8be8e3c454b5bd300b7340cbb454e71fc89ca09ea0785b373b483e67c2f6f6bb408e489b0de4ff82d5ed69a75613ba

                                                      Download Submit

                                                    • C:\ProgramData\Microsoft\Windows\Caches\cversions.2.db.rubly
                                                      Filesize

                                                      16KB

                                                      MD5

                                                      c8c5a336c00af082e385e3dce20edb6f

                                                      SHA1

                                                      0b425430b33be2504f9a59e52ded358a3f1a5255

                                                      SHA256

                                                      31ad616f44f125f9374f77ab9b72c8dc8f5d0ba197d048b5ed93be3df2002ab8

                                                      SHA512

                                                      6338ccf77f5dc554efd616ac9d2e6b44556c3f214a513ed153274b40fdcbf7635784074295259e3c8a65616aee62bc85867464299ebbe9817ba62df13ab3e2dd

                                                      Download Submit

                                                    • C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db.rubly
                                                      Filesize

                                                      289KB

                                                      MD5

                                                      5d9f16104c82958837964ac889f8e343

                                                      SHA1

                                                      cd55c0b704355edd335698c86d5df35d1fa0d880

                                                      SHA256

                                                      172c23ff1b7a3b00836c4e1100a182107a46b827f8d715fc918e6d4907a85469

                                                      SHA512

                                                      eee547bc9b80165caefdcd7602f1a5d85e477a87f5fe761e59bcc1bb5873c78bd1deea7bcfe19621dbb5a9f498f420ed5710cc6d188a3455e889fb88a587a163

                                                      Download Submit

                                                    • C:\ProgramData\Microsoft\Windows\Caches\{A2FC9A41-ABFE-4FAD-BF91-30B0A34EE0BC}.2.ver0x0000000000000001.db.rubly
                                                      Filesize

                                                      1KB

                                                      MD5

                                                      daf5303935fdf65355585ea89ead7158

                                                      SHA1

                                                      37ee5ea4cf6225fe5812d138f533c1020afc9a40

                                                      SHA256

                                                      53943af0594df48dfa5d0dde4d94026428ea02bdf196987f78b71cab44830b16

                                                      SHA512

                                                      d8b2e16b052a8714ef403c2f5fa8cf7a152cf1c8e822eb2ba0b9fb6bd3d801a6f0ad9e0af59185b5f35e0d9017395b0642aa454c935c6d2a7129fb9e0c151ab3

                                                      Download Submit

                                                    • C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.rubly
                                                      Filesize

                                                      622KB

                                                      MD5

                                                      18d44378006a78a1674e1aafedcb7bba

                                                      SHA1

                                                      0bf067c35d561d347ec7bf54c368aab7bfe88857

                                                      SHA256

                                                      015da7dfe0378066d19b85c6e0e66d024bcee9a2e0dbc66912e4c2a7619269ba

                                                      SHA512

                                                      0df25430eec968c37cd12a4a39e1430de17ad4cd9fe7503aac61ce748edf43f029869aaf0fdda5ae2b5355928eb83b23f577ced0825eb37aaedcde4a162393e7

                                                      Download Submit

                                                    • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\mbr.exe
                                                      Filesize

                                                      47KB

                                                      MD5

                                                      e5717d5aa01c544162c615e3f2c41453

                                                      SHA1

                                                      e6179b61da625f17ee0f3aa24e89180812118893

                                                      SHA256

                                                      a1daae6000b449a8a5364dd281cd5c1bc91f31feb7ec6879eff510707eda7e67

                                                      SHA512

                                                      9c104f6f0624088e82475a215a62445bedf4b8440a3e56965714297642f4fccf9ce5d5e6d43e389d050de47cd32597783c2e0690ff7ce80c8c604ead21b7b806

                                                      Download Submit

                                                    • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\mtr.exe
                                                      Filesize

                                                      105KB

                                                      MD5

                                                      d124bb6a1419c81a887317e08745147c

                                                      SHA1

                                                      f23ed76aa5abae4216d9eb1b09ba7adc1e5f5a24

                                                      SHA256

                                                      8ee82ce37b327e425d74018dc6451ea2a3a52df86559e3f45ac7b8bbaf552326

                                                      SHA512

                                                      c1a1ba64836e356959f27c1e82aa142b29aece359c6a4125a049c17edd5d73b5221bc6a2db8f9e4115da58b0e647e54e08d2b01da393b8aedc91602f53aeabe0

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\drpbx.exe.log
                                                      Filesize

                                                      430B

                                                      MD5

                                                      de04f2e81c0501dee6d2f449fb6f3885

                                                      SHA1

                                                      761a51e13b7958c5ec2e51de258428eedec0ae51

                                                      SHA256

                                                      92e5dd3c966959c5a39d98226668f5a2745e16db2ebf034eb5ee5d5f160ed8bb

                                                      SHA512

                                                      65e64986ec8b0681d72b7ec9590abe4ed443be492a4085dc4d9a6428e8f2e92d9bf46733f95bdf6de8e9efc97f035ab66d4400e83ac75d359dacecd7870161a8

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                      Filesize

                                                      152B

                                                      MD5

                                                      1bed6483de34dd709e03fd3af839a76b

                                                      SHA1

                                                      3724a38c9e51fcce7955a59955d16bf68c083b92

                                                      SHA256

                                                      37a42554c291f46995b2487d08d80d94cefe6c7fb3cb4ae9c7c5e515d6b5e596

                                                      SHA512

                                                      264f6687ea8a8726b0000de1511b7b764b3d5a6f64946bb83a58effda42839e593de43865dafeeb89f5b78cc00d16f3979b417357fa2799ca0533bdf72f07fda

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                      Filesize

                                                      152B

                                                      MD5

                                                      fe6fb7ffeb0894d21284b11538e93bb4

                                                      SHA1

                                                      80c71bf18f3798129931b1781115bbef677f58f0

                                                      SHA256

                                                      e36c911b7dbea599da8ed437b46e86270ce5e0ac34af28ac343e22ecff991189

                                                      SHA512

                                                      3a8bd7b31352edd02202a7a8225973c10e3d10f924712bb3fffab3d8eea2d3d132f137518b5b5ad7ea1c03af20a7ab3ff96bd99ec460a16839330a5d2797753b

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1
                                                      Filesize

                                                      264KB

                                                      MD5

                                                      f50f89a0a91564d0b8a211f8921aa7de

                                                      SHA1

                                                      112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                      SHA256

                                                      b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                      SHA512

                                                      bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                      Filesize

                                                      6KB

                                                      MD5

                                                      2ca08d4a4b3b682e2dfaf3c8a7e41b75

                                                      SHA1

                                                      c206825a441ffd881c2a6b139cb12a98f3f76ab1

                                                      SHA256

                                                      a415237cc1222114de391b6dc23582e290f5e4a6f843aefb5befa77af391e847

                                                      SHA512

                                                      1cc5180e86a4c5b9fa2a03e507027cb43eb58491d60ef54f6bcc78f96b4927f8c6892e6531fe3001835ab8654a70fb9ac83bd493b3c643985e1bab09c9eb73d6

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                      Filesize

                                                      6KB

                                                      MD5

                                                      49c0aab48d33b5ba21ef5b2f1473fe11

                                                      SHA1

                                                      fbfb61410c81c74c5ff26309492328b4814b897b

                                                      SHA256

                                                      f16b4164c1f29e0e0527c1f85688d33f4aa434f04e534637650b58d0ee5aeefa

                                                      SHA512

                                                      8ea85e60d790ee56c4bbe0bf38c18f265980ad88ebb66f74a089737ec03ab5846d9a21f52f0556fbbac4e0c0eec0b0290310383a82f68048cf6e90fadfc07764

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                      Filesize

                                                      6KB

                                                      MD5

                                                      5d4c0946d502a2cc2464f2fcf242a57b

                                                      SHA1

                                                      e12db45bb8875c90920f9bfadf5912f0abd2defb

                                                      SHA256

                                                      9e85644cc04615ccff26f26a2962b80aa6af65dac7452efb1b24080cf1420ca8

                                                      SHA512

                                                      220482f7fe7f5edce5da5f557c0c68a8789dc98a2e3d5ee6af26e9a0a12b3695e69edb208ea307109d0dd4ebaa115fa64098e6ca0c3f979e563a478815836274

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                      Filesize

                                                      16B

                                                      MD5

                                                      46295cac801e5d4857d09837238a6394

                                                      SHA1

                                                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                      SHA256

                                                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                      SHA512

                                                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                      Filesize

                                                      16B

                                                      MD5

                                                      206702161f94c5cd39fadd03f4014d98

                                                      SHA1

                                                      bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                      SHA256

                                                      1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                      SHA512

                                                      0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db
                                                      Filesize

                                                      16KB

                                                      MD5

                                                      9e02552124890dc7e040ce55841d75a4

                                                      SHA1

                                                      f4179e9e3c00378fa4ad61c94527602c70aa0ad9

                                                      SHA256

                                                      7b6e4ce73ddd8b5e7a7c4a94374ac2815d0048a5296879d7659a92ee0b425c77

                                                      SHA512

                                                      3e10237b1bff73f3bb031f108b8de18f1b3c3396d63dfee8eb2401ce650392b9417143a9ef5234831d8386fc12e232b583dd45eada3f2828b3a0a818123dd5cd

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
                                                      Filesize

                                                      44KB

                                                      MD5

                                                      c40ba880d17bea2cc2d608ba1344422c

                                                      SHA1

                                                      8c559204bdbc194384393c2164a1a82fda79b7d6

                                                      SHA256

                                                      9b87386f7c0cb7c1fedebfadea017d31a86aff9843ff138142b280e50e2f6fce

                                                      SHA512

                                                      66b02aedab2a0b70b1e3ea05f1ae37c81926e20135d2f70d5345adf596a96c2b760098a35e6ddaf0356d2ec952335904ca2bdb18d00a4b6ab03c7d318a29ede3

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                      Filesize

                                                      8KB

                                                      MD5

                                                      662e51172350bad2efe4c1d37c3b89d1

                                                      SHA1

                                                      f590ca0bd6254ace3e54b34d581498a5069fd6e9

                                                      SHA256

                                                      50d23714f2ed31e0077da3f76bb79a0ea209ac54a1171e24ed495809329635d5

                                                      SHA512

                                                      70fd5c0e952ffd9081bd463c2bead22890fa606d8760396678197c64d6a4167b0bec721eebb2f3e5e91fa038773ca56c7e41e294a781c642a4f7b82b4c33dd0a

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                      Filesize

                                                      8KB

                                                      MD5

                                                      23b673b83d83fe579808d6918440381d

                                                      SHA1

                                                      deb91c1f83d1ea476ddd7c40b97044cfa2f4bcb0

                                                      SHA256

                                                      befee1ffcb037d4053c2a5797fd84466669c57bdc981ebcf41a8c4a475baf9f4

                                                      SHA512

                                                      5d1c437bb84999ccf0ec3bd039fb9d30247710d0c0f1bee66d99c3e315f40c63c23b8d89ed53234f7d36405f88cff977794f11788a9378d8317c0ba3f1f83577

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt
                                                      Filesize

                                                      4B

                                                      MD5

                                                      b3152cf3901c2153ea7755d82a3d7fe8

                                                      SHA1

                                                      eff3ebf64e01c776dc9dee0d3bc449f8e1cde1d4

                                                      SHA256

                                                      fb06ba3498c31ae2d3bbaf9364a786ddfb4e82a15b7c8810e07e5bb14c4005db

                                                      SHA512

                                                      91317496b64d3eb64652830e4270045348ef3b8e2bf1d101d52eae7feb7ab4b72b18ba97bce4a3deb3419cc821bf61914d0364c705899676eeaf502ff94dcb60

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\cversions.3.db.rubly
                                                      Filesize

                                                      16KB

                                                      MD5

                                                      e1bc4adfa7babbf0f800ac291d6522a6

                                                      SHA1

                                                      d80ead2f156422d07159665512dff031906fdb15

                                                      SHA256

                                                      011c27fb946e505a730c8e9b491628c925c51c81fb6b947a1bd9562b9bd57b46

                                                      SHA512

                                                      1e299590427b239a93b6b5a42cefcd1a8773b8cad83b49729f4c05e22de38b8443041de5ec16bc76c0ca30edb5bca702696a4fc96a8c0dc4cd0d739326589586

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001a.db.rubly
                                                      Filesize

                                                      93KB

                                                      MD5

                                                      bc91ff10cba9a00dcc034246aebf507c

                                                      SHA1

                                                      86eca69beee8e3dca3dcefa7943ada1f92142fc3

                                                      SHA256

                                                      012dabf83c0cbc4032dab6ec939024bb2ca636a64356be740c0d21db0979d48b

                                                      SHA512

                                                      c3d4c40ae01e794a07a4a402f406aaaac691fe2ed541a4a483ccf7355ad7e668854970da98f7784b7fd2a2eea5fb7bc32032f0ebbdbf4f511669bdd6c1e6ff08

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000010.db.rubly
                                                      Filesize

                                                      73KB

                                                      MD5

                                                      d34fe7da8ef1ccb48b0d4963c4354116

                                                      SHA1

                                                      3c0799c9bcde571a6849b85d10b35e51673d8b8b

                                                      SHA256

                                                      ceb2db3df22b2541c51c89d29c62baeed3a3e9fa617aa2a807329e09970683ab

                                                      SHA512

                                                      d12d87ebbbe88370363c5ca78e4fc1327a6336dfd65df871cfbd9c3e5b0557884ad0fc13061ed9e624d0562211da2a641cf56538cebcde6cd3802e97249a5492

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.rubly
                                                      Filesize

                                                      8KB

                                                      MD5

                                                      f22599af9343cac74a6c5412104d748c

                                                      SHA1

                                                      e2ac4c57fa38f9d99f3d38c2f6582b4334331df5

                                                      SHA256

                                                      36537e56d60910ab6aa548e64ca4adafdcabde9d60739013993e12ba061dfd65

                                                      SHA512

                                                      5c8afc025e1d8342d93b7842dc7ef22eca61085857a80a08ba9b3f156ee3b814606bb32bc244bd525a7913e7915bdf3a86771d39577f4a1176ade04dc381c6d4

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\eventbeacons.dat.rubly
                                                      Filesize

                                                      640B

                                                      MD5

                                                      b9db7ceae9d87cf82d23c87a26a21ac8

                                                      SHA1

                                                      966cb17cdff142d15198d069608461e302f4ddb2

                                                      SHA256

                                                      d3bb61f26c687c4909807fa137ac7fbc5a6814726d665d444f6defd2cea1bf48

                                                      SHA512

                                                      038b8a57959312ca64e4c29a790333366f1142a2cd597afd4a562987ff026b6cbbc0e3fc54946125a19aabb9e816f18fb8c29c15bc6b930f19d8c756e426dd5d

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{b3ac7b7f-3b7d-4c8e-a87d-0364fd14d074}\0.1.filtertrie.intermediate.txt.rubly
                                                      Filesize

                                                      16B

                                                      MD5

                                                      1fd532d45d20d5c86da0196e1af3f59a

                                                      SHA1

                                                      34adcab9d06e04ea6771fa6c9612b445fe261fab

                                                      SHA256

                                                      dae6420ea1d7dbe55ab9d32b04270a2b7092a9b6645ed4e87ad2c2da5fdd6bae

                                                      SHA512

                                                      f778cd0256eda2c1d8724a46f82e18ab760221181f75649e49dd32e9a2558bec0e9c52c5306ad17b18ab60395d83c438742103fe9adddf808e40c3d8384ea0b0

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{b3ac7b7f-3b7d-4c8e-a87d-0364fd14d074}\0.2.filtertrie.intermediate.txt.rubly
                                                      Filesize

                                                      16B

                                                      MD5

                                                      f405f596786198c6260d9c5c2b057999

                                                      SHA1

                                                      f8f3345eb5abc30606964a460d8eef43d3304076

                                                      SHA256

                                                      58e3090edb9316d9141065ac654a08169f2833091e6eb3a53b5a774a61b7e30a

                                                      SHA512

                                                      a0b3573dae218ade265709a6fdee5f7700c9754eb10747de5af34af340ae95909d0a8902159a735e82eb5d7091f50a7997113661a7ec3fcc2b408fb6c78a4c39

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\ED0F.tmp\disable_taskmgr.bat
                                                      Filesize

                                                      109B

                                                      MD5

                                                      3fc537b642d3756646715325299c6367

                                                      SHA1

                                                      0a6b4d2012d44fe631dd8bf56da001bfd04b99bb

                                                      SHA256

                                                      708511c356493e41ca103db51b8df3fb57898ddb2bb7cf4f11560facde9425ed

                                                      SHA512

                                                      7a290cd5a44ac4ba51d5b8ab6ea7bd2f2c392a1237c8b923267d524b2ab92e532e3c27dd21d96c3e89c5b84060f0e8ee2a4d9e59e21cfc8c3e15322c5334d064

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\bg.bat
                                                      Filesize

                                                      147B

                                                      MD5

                                                      308060ff726cb2be6ee2023c1b2a401d

                                                      SHA1

                                                      e616761e6026cd0de0111c0fa1da49c248138182

                                                      SHA256

                                                      0c0760682d75388a03cc7ba621d338871fc66e17f6d82c8b5147371cb7ce9a47

                                                      SHA512

                                                      382b42ea9d652c02adf879145a897fab94d729c85b491c6099a5cd91b8bf3249ff9d5c536033263f5d78881f42776a1a5c28dd17285b830b577aaadc813355ad

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\bg.bmp
                                                      Filesize

                                                      37KB

                                                      MD5

                                                      889074311bf2b2985e461c4aa4971ed2

                                                      SHA1

                                                      3d89a7b1a7fd4aced01d840102bbbb6877a0702e

                                                      SHA256

                                                      1dd0f0c3dc81a7a202ab34b00fb1581d76d10d514859e9efee7701de1e5824f8

                                                      SHA512

                                                      2340fd94bedb01af0550dbc5e98bf60357c13b097d91a41f52d0ffdb5da40c21f579aad28faddbd6746846cc8a87604823411afded0cd45c7d8e7f5dc7859855

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\dt.exe
                                                      Filesize

                                                      25KB

                                                      MD5

                                                      5e46ffab95250291c5410237340b9439

                                                      SHA1

                                                      dc2afa42285590e315bac889fdcf3e2236fe9ea5

                                                      SHA256

                                                      08373ea2c1bca3f832667dd9fa6ba51af4c5ddabbb1492b5ba887c36850ac5ee

                                                      SHA512

                                                      2a5debc880692ba90a1abbfd79faa57bdf7e2bbb11881ec677c07702cb9e34775f1516616bee3140a596d272b2e218ecda9858812a64c498033811d03b91005b

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\run.bat
                                                      Filesize

                                                      418B

                                                      MD5

                                                      be7966cbf9d04a6300febebc0802fd36

                                                      SHA1

                                                      53d3b879f6213dc614fe777e6f91e4e944b81948

                                                      SHA256

                                                      f7bdf62e1e46336cbe0f25681a5ac643d59e6fb4cd69bf55c0b2d5da746ca59a

                                                      SHA512

                                                      2d28d835c11c46a725576371d698b96101e6be9f3a5f41ec0e88800745c5b790106e2e30fb4bfae00e24d53bdad4c9ccd70b0fcc9480ee23c3ed2d5fc1d93841

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\{4E253388-23BB-4C68-9D05-D402AA3B7406} - OProcSessId.dat.rubly
                                                      Filesize

                                                      16B

                                                      MD5

                                                      8ebcc5ca5ac09a09376801ecdd6f3792

                                                      SHA1

                                                      81187142b138e0245d5d0bc511f7c46c30df3e14

                                                      SHA256

                                                      619e246fc0ac11320ff9e322a979948d949494b0c18217f4d794e1b398818880

                                                      SHA512

                                                      cec50bfc6ad2f57f16da99459f40f2d424c6d5691685fa1053284f46c8c8c8a975d7bcb1f3521c4f3fbdc310cf4714e29404aa23be6021e2e267c97b090dc650

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg.rubly
                                                      Filesize

                                                      110KB

                                                      MD5

                                                      0686a5c9645edd12f48a4445b0acf3e4

                                                      SHA1

                                                      cfaf73bc8d429334429ab52b9be070178096d838

                                                      SHA256

                                                      a75b372dd0f04bb19acf9d5153b407a2f45d38d26bf4df35748a3dee1a72d4ff

                                                      SHA512

                                                      57c542a5febbb1154659da5f5ac314851822d4d949f01caaa992b80d2dfd7640512f5821c779ce4044166e29855fb4ba10e091dd96bf22ba974728dd232e9456

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\System32Work\Address.txt
                                                      Filesize

                                                      21B

                                                      MD5

                                                      b3580d0d7864b8dc259e53cdecb33715

                                                      SHA1

                                                      6f9254adc4f1db28aadd607c05651345519f023e

                                                      SHA256

                                                      efc003244989ecb42e6360b48d4d5464432d2e513aec3af53fa68fd6cb40bb72

                                                      SHA512

                                                      f7dc63a05e29984cf139a6cd1fac91c111b87dc88f25f2b7d6bdfbcac31db49ba40e3884ff58300e6827298acc24b09ad13ce96d04dd41d1b28cbc60901a66f0

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\System32Work\EncryptedFileList.txt
                                                      Filesize

                                                      425KB

                                                      MD5

                                                      5dc6361ed15d0b0d0899d5529bfcb4dd

                                                      SHA1

                                                      baab86a0b67fcadce952984c3a7a3f147b9df5e1

                                                      SHA256

                                                      f93819d7ee2a962b234c46fb61dea12bed81e3a0e85492a70d08b701a0db5e8a

                                                      SHA512

                                                      4cbc0ed05bbf2e86451f4a38c45934f590239d01b77b88cc153eeddf2579e45c4a88ade0cafe7664b63527867a77b19ef51984333443ea0ef9ad712c90b61111

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\bg.exe
                                                      Filesize

                                                      343KB

                                                      MD5

                                                      19ed87e5bf49f790025490e8368b1ec5

                                                      SHA1

                                                      1936200fcbd3c6f9b27a5c58c5e95b76b5c46371

                                                      SHA256

                                                      372d505837d53fdf76d62aa6e1adbf2c9a30bab0efa9e2ae6248bb3bcc1f4ff9

                                                      SHA512

                                                      edfce1b54104687f00bbdb2691f3808c83d0cc5c2d9e48ef2c5931404b06094c4554b10857ea55f9dd0d6e2826713fe42aa66ed4cf363b4f688b8831883f8662

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\dt.exe
                                                      Filesize

                                                      328KB

                                                      MD5

                                                      79466f9bb9e981220a43897d33e57d1e

                                                      SHA1

                                                      159af42edf25c9b1ce42a8aac06571ad4a46cc9e

                                                      SHA256

                                                      77fe524e36d99865c5c1e12ed9d8f128f3366a6772c2fdf2533821079b5422fb

                                                      SHA512

                                                      b039d46aa7e777b715d673b7d69a41dd56d16aceddcb3d0c2b9c9e81ab48fb6923517f668becedbcbf90cde1f32320994bc7051f86579f6c486c68de2d8b2d16

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\mtrmbr.exe
                                                      Filesize

                                                      410KB

                                                      MD5

                                                      2aeb6b2b282f21a87b38989750c5271b

                                                      SHA1

                                                      2482c160b146a5a5710135497ec2218e728c4fc0

                                                      SHA256

                                                      6474f5643f4ce5e6d58daf25c90ccd3ce0149a335fc1a1e0490afb3d458478a1

                                                      SHA512

                                                      1883e705fff13fdade6bf3bfa77bb126bdf94af84c8299d18b6d7077a954a01aabd5907fa9aa02150fc46d25a90dc87a8115e812d30af375ec2b7612aa8a74d0

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\restart.bat
                                                      Filesize

                                                      24B

                                                      MD5

                                                      b1e5726bd11a59cf5ab2f3a655108569

                                                      SHA1

                                                      1e2499ead1ff24d61363cdfe9d19707bfdc01f83

                                                      SHA256

                                                      77a9c6aa0dc9979f56ddaac475e1ef31462edc559b542763cf94e658be9de8ac

                                                      SHA512

                                                      4b67b8c7efa5a47a59ebbaf0cf9e8c14c6ecccd4d7cd4f6e7e9f748b89927a6cc0b739064adb29bf43131e6b2e0784f8b01c5ff894a4f598f51f6208309c7072

                                                      Download Submit

                                                    • memory/1984-59-0x0000000000400000-0x0000000000410000-memory.dmp

                                                      Filesize

                                                      64KB

                                                      Download

                                                    • memory/1984-79-0x0000000000400000-0x0000000000410000-memory.dmp

                                                      Filesize

                                                      64KB

                                                      Download

                                                    • memory/2908-70-0x0000000000400000-0x0000000000412000-memory.dmp

                                                      Filesize

                                                      72KB

                                                      Download

                                                    • memory/4940-94-0x00000000013D0000-0x00000000013D8000-memory.dmp

                                                      Filesize

                                                      32KB

                                                      Download

                                                    • memory/5088-77-0x000000001B910000-0x000000001B9AC000-memory.dmp

                                                      Filesize

                                                      624KB

                                                      Download

                                                    • memory/5088-74-0x000000001B3A0000-0x000000001B86E000-memory.dmp

                                                      Filesize

                                                      4.8MB

                                                      Download