c5741701b3866459dd1ffa2477cfd8776713612912693a5897f78aac795d23e9

Resubmissions

31/03/2025, 00:22

250331-apdw1ssjs8 10

28/03/2025, 22:52

250328-2tfd7avl15 10

25/03/2025, 14:57

250325-sb3mbsxxht 10

Analysis

max time kernel
444s
max time network
555s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
28/03/2025, 22:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RansomwareSamples/PwndLocker_04_03_2020_17KB.exe
Size

17KB
MD5

16a29314e8563135b18668036a6f63c8
SHA1

90cf5ca4df9d78cf92bb865b5b399a4d2752e55b
SHA256

4e6c191325b37da546e72f4a7334d820995d744bf7bb1a03605adb3ad30ce9ca
SHA512

45c023e6dd4202079e913b8946825b47fab30b584bbd79b0416152cc4a54975b12205393827289c1f03feb71b54d3b6b34490be3001e9b565c1f89e13e752032
SSDEEP

384:RJueT9Jtx33bRsoOjhveu+q7hPOx58Zbxe:RJueJx33bDO1uMbc

Score

10^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Extracted

Path

C:\E3FDDA~1\H0w_T0_Rec0very_Files.txt

Ransom Note

Your network have been penetrated and encrypted with a strong algorythm Backups were either removed or encrypted No one can help you to recover the network except us Do not share this link or email. Otherwise, we will have to delete the decryption keys To get your files back you have to pay the decryption fee in BTC. The price depends on the network size, number of employess and annual revenue. Download TOR-Browser: https://www.torproject.org/download/ Login ax3spapdymip4jpy.onion using your ID I1VF02 or contact our support by email [email protected] You'll receive instructions inside. You should get in contact with us within 2 days after you noticed the encryption to have a good discount. The decryption key will be stored for 1 month. The price will be increased by 100% in two weeks We also have gathered your sensitive data. We would share it in case you refuse to pay Do not rename or move encrypted files Decryption using third party software is impossible. Attempts to self-decrypting files will result in the loss of your data.

Emails

[email protected]

URLs

http://ax3spapdymip4jpy.onion

Signatures

Renames multiple (6102) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000\Control Panel\International\Geo\Nation	PwndLocker_04_03_2020_17KB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 26 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\DOCUME~1\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\FAVORI~1\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\Office16\1033\DATASE~1\DESKTOP.INI	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\3DOBJE~1\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\DOWNLO~1\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\FAVORI~1\Links\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Public\ACCOUN~1\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Public\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\SAVEDG~1\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	PwndLocker_04_03_2020_17KB.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\ON-BOA~1\js\nls\fi-fi\ui-strings.js	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\LICENS~1\WordVL_MAK-ppd.xrm-ms	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\editpdf\js\nls\zh-tw\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\ADD-AC~2\css\main.css	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SAMPLE~1\js\nls\sv-se\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\TRACKE~1\css\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\LICENS~1\Access2019VL_KMS_Client_AE-ul.xrm-ms	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\LICENS~1\ProjectStdR_Retail-ul-oob.xrm-ms	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\LICENS~1\VisioStdR_Retail-pl.xrm-ms	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\EXPORT~1\js\nls\sl-si\ui-strings.js	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SEND-F~1\js\nls\sl-sl\ui-strings.js	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\Java\jre-1.8\legal\javafx\mesa3d.md	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\Office16\MEDIA\EXPLODE.WAV	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~1\MICROS~2\root\Office16\MSIPC\th\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\VideoLAN\VLC\locale\pt_PT\LC_MES~1\vlc.mo	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\CREATE~1\js\nls\nl-nl\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SIGNAT~1\js\nls\pt-br\ui-strings.js	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~1\MICROS~2\root\vfs\PROGRA~1\MICROS~1\VBA\VBA7.1\1033\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\LICENS~1\ExcelR_Trial-pl.xrm-ms	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\LICENS~1\ProjectStdO365R_SubTest-pl.xrm-ms	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\Office16\LOGOIM~1\OneNoteLogoSmall.contrast-black_scale-80.png	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~1\MICROS~2\root\Office16\MSIPC\de\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~1\VideoLAN\VLC\locale\ms\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\EXPORT~1\js\nls\sv-se\ui-strings.js	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\MY-REC~2\js\nls\ro-ro\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\vreg\officemuiset.msi.16.en-us.vreg.dat	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\Java\jdk-1.8\lib\ct.sym	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\LICENS~1\O365SmallBusPremR_Subscription1-pl.xrm-ms	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\LICENS~1\Personal2019R_Trial-ul-oob.xrm-ms	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\images\FILE_T~1\HI_CON~1\aic_file_icons_hiContrast_bow.png	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SAMPLE~1\js\nls\sl-si\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\Office16\LOGOIM~1\ExcelLogo.contrast-black_scale-180.png	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\Office16\msoutilstat.etw.man	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\OB-PRE~1\js\plugin.js	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\Office16\BIBLIO~1\Style\ISO690Nmerical.XSL	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\files\dev\nls\hu-hu\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\UNIFIE~1\images\themes\dark\AddressBook2x.png	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\WALK-T~1\js\nls\fr-fr\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\LICENS~1\Word2019R_Retail-ppd.xrm-ms	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\vfs\PROGRA~1\MICROS~1\THEMES16\ECLIPSE\PREVIEW.GIF	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\ADD-AC~2\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\DOCUME~1\THEMEF~1\Gill Sans MT.xml	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\LICENS~1\ProjectStdVL_KMS_Client-ppd.xrm-ms	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Tracker\forms_super.gif	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\files\dev\nls\pt-br\ui-strings.js	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\files\dev\nls\tr-tr\ui-strings.js	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\MY-COM~1\js\nls\hr-hr\ui-strings.js	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\ON-BOA~1\images\THEMEL~1\LOCALI~1\ja-jp\AppStore_icon.svg	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\7-Zip\Lang\el.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\7-Zip\Lang\ms.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\ON-BOA~1\images\THEMEL~1\pdf-ownership-variant2.gif	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SIGN-S~1\js\nls\ko-kr\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\UNIFIE~1\images\SearchEmail2x.png	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\LICENS~1\StandardMSDNR_Retail-ppd.xrm-ms	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\PAGES-~1\js\plugins\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~3\PACKAG~1\{2BB73~1.879\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\vfs\PROGRA~1\MICROS~1\TRANSLAT\FREN\MSB1FREN.ITS	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~3\PACKAG~1\{662A0~1.307\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\LICENS~1\VisioStdCO365R_SubTest-pl.xrm-ms	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\USS-SE~1\js\nls\root\ui-strings.js	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\7-Zip\Lang\da.txt	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~3\Packages\MICROS~1.STA\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\Google\Chrome\APPLIC~1\133069~1.60\VISUAL~1\LogoCanary.png	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\LICENS~1\O365ProPlusR_Subscription4-pl.xrm-ms	PwndLocker_04_03_2020_17KB.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Discovers systems in the same network 1 TTPs 1 IoCs

discovery

Remote System Discovery

T1018

pid	Process
1732	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
416	PwndLocker_04_03_2020_17KB.exe
416	PwndLocker_04_03_2020_17KB.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
416	PwndLocker_04_03_2020_17KB.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	416	PwndLocker_04_03_2020_17KB.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 416 wrote to memory of 5776	416	PwndLocker_04_03_2020_17KB.exe	82
PID 416 wrote to memory of 5776	416	PwndLocker_04_03_2020_17KB.exe	82
PID 416 wrote to memory of 5776	416	PwndLocker_04_03_2020_17KB.exe	82
PID 5776 wrote to memory of 2716	5776	net.exe	84
PID 5776 wrote to memory of 2716	5776	net.exe	84
PID 5776 wrote to memory of 2716	5776	net.exe	84
PID 416 wrote to memory of 5320	416	PwndLocker_04_03_2020_17KB.exe	85
PID 416 wrote to memory of 5320	416	PwndLocker_04_03_2020_17KB.exe	85
PID 416 wrote to memory of 5320	416	PwndLocker_04_03_2020_17KB.exe	85
PID 5320 wrote to memory of 2940	5320	net.exe	87
PID 5320 wrote to memory of 2940	5320	net.exe	87
PID 5320 wrote to memory of 2940	5320	net.exe	87
PID 416 wrote to memory of 5880	416	PwndLocker_04_03_2020_17KB.exe	88
PID 416 wrote to memory of 5880	416	PwndLocker_04_03_2020_17KB.exe	88
PID 416 wrote to memory of 5880	416	PwndLocker_04_03_2020_17KB.exe	88
PID 5880 wrote to memory of 4368	5880	net.exe	90
PID 5880 wrote to memory of 4368	5880	net.exe	90
PID 5880 wrote to memory of 4368	5880	net.exe	90
PID 416 wrote to memory of 1536	416	PwndLocker_04_03_2020_17KB.exe	91
PID 416 wrote to memory of 1536	416	PwndLocker_04_03_2020_17KB.exe	91
PID 416 wrote to memory of 1536	416	PwndLocker_04_03_2020_17KB.exe	91
PID 1536 wrote to memory of 1072	1536	net.exe	93
PID 1536 wrote to memory of 1072	1536	net.exe	93
PID 1536 wrote to memory of 1072	1536	net.exe	93
PID 416 wrote to memory of 5820	416	PwndLocker_04_03_2020_17KB.exe	94
PID 416 wrote to memory of 5820	416	PwndLocker_04_03_2020_17KB.exe	94
PID 416 wrote to memory of 5820	416	PwndLocker_04_03_2020_17KB.exe	94
PID 5820 wrote to memory of 1632	5820	net.exe	96
PID 5820 wrote to memory of 1632	5820	net.exe	96
PID 5820 wrote to memory of 1632	5820	net.exe	96
PID 416 wrote to memory of 1464	416	PwndLocker_04_03_2020_17KB.exe	97
PID 416 wrote to memory of 1464	416	PwndLocker_04_03_2020_17KB.exe	97
PID 416 wrote to memory of 1464	416	PwndLocker_04_03_2020_17KB.exe	97
PID 416 wrote to memory of 4616	416	PwndLocker_04_03_2020_17KB.exe	99
PID 416 wrote to memory of 4616	416	PwndLocker_04_03_2020_17KB.exe	99
PID 416 wrote to memory of 4616	416	PwndLocker_04_03_2020_17KB.exe	99
PID 1464 wrote to memory of 2304	1464	net.exe	101
PID 1464 wrote to memory of 2304	1464	net.exe	101
PID 1464 wrote to memory of 2304	1464	net.exe	101
PID 4616 wrote to memory of 2464	4616	net.exe	102
PID 4616 wrote to memory of 2464	4616	net.exe	102
PID 4616 wrote to memory of 2464	4616	net.exe	102
PID 416 wrote to memory of 5600	416	PwndLocker_04_03_2020_17KB.exe	103
PID 416 wrote to memory of 5600	416	PwndLocker_04_03_2020_17KB.exe	103
PID 416 wrote to memory of 5600	416	PwndLocker_04_03_2020_17KB.exe	103
PID 416 wrote to memory of 4752	416	PwndLocker_04_03_2020_17KB.exe	105
PID 416 wrote to memory of 4752	416	PwndLocker_04_03_2020_17KB.exe	105
PID 416 wrote to memory of 4752	416	PwndLocker_04_03_2020_17KB.exe	105
PID 5600 wrote to memory of 2772	5600	net.exe	107
PID 5600 wrote to memory of 2772	5600	net.exe	107
PID 5600 wrote to memory of 2772	5600	net.exe	107
PID 4752 wrote to memory of 4860	4752	net.exe	108
PID 4752 wrote to memory of 4860	4752	net.exe	108
PID 4752 wrote to memory of 4860	4752	net.exe	108
PID 416 wrote to memory of 4784	416	PwndLocker_04_03_2020_17KB.exe	109
PID 416 wrote to memory of 4784	416	PwndLocker_04_03_2020_17KB.exe	109
PID 416 wrote to memory of 4784	416	PwndLocker_04_03_2020_17KB.exe	109
PID 416 wrote to memory of 4904	416	PwndLocker_04_03_2020_17KB.exe	111
PID 416 wrote to memory of 4904	416	PwndLocker_04_03_2020_17KB.exe	111
PID 416 wrote to memory of 4904	416	PwndLocker_04_03_2020_17KB.exe	111
PID 4784 wrote to memory of 4960	4784	net.exe	113
PID 4784 wrote to memory of 4960	4784	net.exe	113
PID 4784 wrote to memory of 4960	4784	net.exe	113
PID 4904 wrote to memory of 5396	4904	net.exe	114

C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\PwndLocker_04_03_2020_17KB.exe
"C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\PwndLocker_04_03_2020_17KB.exe"
1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:416
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "CSFalconService" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5776
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "CSFalconService" /y
    3⤵
    PID:2716
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "McAfeeFramework" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5320
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "McAfeeFramework" /y
    3⤵
    PID:2940
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "Alerter" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5880
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Alerter" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4368
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "AcronisAgent" /y
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "AcronisAgent" /y
    3⤵
    PID:1072
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "Acronis VSS Provider" /y
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5820
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Acronis VSS Provider" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1632
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "BackupExecAgentAccelerator" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1464
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "BackupExecAgentAccelerator" /y
    3⤵
    PID:2304
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "BackupExecDeviceMediaService" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "BackupExecDeviceMediaService" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2464
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "BackupExecJobEngine" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5600
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "BackupExecJobEngine" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2772
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "BackupExecManagementService" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "BackupExecManagementService" /y
    3⤵
    PID:4860
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "BackupExecRPCService" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "BackupExecRPCService" /y
    3⤵
    PID:4960
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "BackupExecVSSProvider" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "BackupExecVSSProvider" /y
    3⤵
    PID:5396
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "DFSR" /y
  2⤵
  PID:876
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "DFSR" /y
    3⤵
    PID:3580
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "EPIntegrationService" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2704
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "EPIntegrationService" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1288
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "EPProtectedService" /y
  2⤵
  PID:5012
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "EPProtectedService" /y
    3⤵
    PID:3660
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "EPSecurityService" /y
  2⤵
  PID:1844
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "EPSecurityService" /y
    3⤵
    PID:3620
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "EPUpdateService" /y
  2⤵
  PID:4708
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "EPUpdateService" /y
    3⤵
    PID:6112
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MB3Service" /y
  2⤵
  PID:6000
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MB3Service" /y
    3⤵
    PID:5756
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MBAMService" /y
  2⤵
  PID:4944
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MBAMService" /y
    3⤵
    PID:5256
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MBEndpointAgent" /y
  2⤵
  PID:4684
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MBEndpointAgent" /y
    3⤵
    PID:3688
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeES" /y
  2⤵
  PID:5536
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeES" /y
    3⤵
    PID:3712
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeMGMT" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3328
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeMGMT" /y
    3⤵
    PID:2840
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeMTA" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1720
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeMTA" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1048
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeSA" /y
  2⤵
  PID:4736
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeSA" /y
    3⤵
    PID:4816
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeSRS" /y
  2⤵
  PID:4068
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeSRS" /y
    3⤵
    PID:4996
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeADTopology" /y
  2⤵
  PID:1324
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeADTopology" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5004
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeDelivery" /y
  2⤵
  PID:3436
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeDelivery" /y
    3⤵
    PID:2972
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeDiagnostics" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5020
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeDiagnostics" /y
    3⤵
    PID:2344
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeEdgeSync" /y
  2⤵
  PID:5852
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeEdgeSync" /y
    3⤵
    PID:4588
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeHM" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5056
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeHM" /y
    3⤵
    PID:3364
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeHMRecovery" /y
  2⤵
  PID:5204
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeHMRecovery" /y
    3⤵
    PID:436
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeIS" /y
  2⤵
  PID:4544
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeIS" /y
    3⤵
    PID:4828
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeMailboxReplication" /y
  2⤵
  PID:5684
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeMailboxReplication" /y
    3⤵
    PID:1636
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeRPC" /y
  2⤵
  PID:5572
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeRPC" /y
    3⤵
    PID:3956
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeRepl" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4272
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeRepl" /y
    3⤵
    PID:2008
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeServiceHost" /y
  2⤵
  PID:524
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeServiceHost" /y
    3⤵
    PID:408
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeTransport" /y
  2⤵
  PID:5472
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeTransport" /y
    3⤵
    PID:2196
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeUM" /y
  2⤵
  PID:4836
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeUM" /y
    3⤵
    PID:5224
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeUMCR" /y
  2⤵
  PID:5312
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeUMCR" /y
    3⤵
    PID:5468
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSOLAP$*" /y
  2⤵
  PID:448
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSOLAP$*" /y
    3⤵
    PID:5664
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLSERVER" /y
  2⤵
  PID:236
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLSERVER" /y
    3⤵
    PID:5544
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MsDtsServer" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1428
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MsDtsServer" /y
    3⤵
    PID:3824
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MySQL57" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3636
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MySQL57" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5880
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "OSearch15" /y
  2⤵
  PID:216
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "OSearch15" /y
    3⤵
    PID:3812
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "OracleClientCache80" /y
  2⤵
  PID:1244
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "OracleClientCache80" /y
    3⤵
    PID:2928
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "QuickBooksDB25" /y
  2⤵
  PID:5192
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "QuickBooksDB25" /y
    3⤵
    PID:1084
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SPAdminV4" /y
  2⤵
  PID:6028
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SPAdminV4" /y
    3⤵
    PID:2772
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SPSearchHostController" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4760
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SPSearchHostController" /y
    3⤵
    PID:4896
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SPTraceV4" /y
  2⤵
  PID:4796
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SPTraceV4" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4960
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SPUserCodeV4" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4928
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SPUserCodeV4" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:988
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SPWriterV4" /y
  2⤵
  PID:4972
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SPWriterV4" /y
    3⤵
    PID:876
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLBrowser" /y
  2⤵
  PID:6132
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLBrowser" /y
    3⤵
    PID:2704
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLSafeOLRService" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3872
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLSafeOLRService" /y
    3⤵
    PID:5100
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLsafe Backup Service" /y
  2⤵
  PID:5092
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLsafe Backup Service" /y
    3⤵
    PID:4956
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLSERVERAGENT" /y
  2⤵
  PID:5480
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLSERVERAGENT" /y
    3⤵
    PID:3832
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLTELEMETRY" /y
  2⤵
  PID:560
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLTELEMETRY" /y
    3⤵
    PID:1764
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLBackups" /y
  2⤵
  PID:4448
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLBackups" /y
    3⤵
    PID:5716
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$*" /y
  2⤵
  PID:1032
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$*" /y
    3⤵
    PID:4684
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$*" /y
  2⤵
  PID:6064
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$*" /y
    3⤵
    PID:3308
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSMQ" /y
  2⤵
  PID:6032
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSMQ" /y
    3⤵
    PID:4008
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "ReportServer" /y
  2⤵
  PID:3328
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "ReportServer" /y
    3⤵
    PID:1048
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "ReportServer$*" /y
  2⤵
  PID:3788
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "ReportServer$*" /y
    3⤵
    PID:4816
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLWriter" /y
  2⤵
  PID:2292
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLWriter" /y
    3⤵
    PID:4996
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLBackupAgent" /y
  2⤵
  PID:4124
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLBackupAgent" /y
    3⤵
    PID:5140
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "Symantec System Recovery" /y
  2⤵
  PID:1448
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Symantec System Recovery" /y
    3⤵
    PID:5624
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SyncoveryVSSService" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5560
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SyncoveryVSSService" /y
    3⤵
    PID:2896
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "VeeamBackupSvc" /y
  2⤵
  PID:3804
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamBackupSvc" /y
    3⤵
    PID:5852
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "VeeamCatalogSvc" /y
  2⤵
  PID:5892
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamCatalogSvc" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5500
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "VeeamCloudSvc" /y
  2⤵
  PID:5864
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamCloudSvc" /y
    3⤵
    PID:1620
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "VeeamEndpointBackupSvc" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1472
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamEndpointBackupSvc" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2448
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "VeeamEnterpriseManagerSvc" /y
  2⤵
  PID:5200
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamEnterpriseManagerSvc" /y
    3⤵
    PID:1356
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "VeeamMountSvc" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5752
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamMountSvc" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4272
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "VeeamNFSSvc" /y
  2⤵
  PID:540
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamNFSSvc" /y
    3⤵
    PID:5448
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "VeeamRESTSvc" /y
  2⤵
  PID:2384
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamRESTSvc" /y
    3⤵
    PID:1584
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "VeeamTransportSvc /y
  2⤵
  PID:5612
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamTransportSvc /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2676
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "Veeam Backup Catalog Data Service" /y
  2⤵
  PID:2200
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Veeam Backup Catalog Data Service" /y
    3⤵
    PID:5312
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "epag" /y
  2⤵
  PID:3376
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "epag" /y
    3⤵
    PID:448
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "epredline" /y
  2⤵
  PID:2888
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "epredline" /y
    3⤵
    PID:3672
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "mozyprobackup" /y
  2⤵
  PID:1188
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mozyprobackup" /y
    3⤵
    PID:5432
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "masvc" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5596
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "masvc" /y
    3⤵
    PID:2920
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "macmnsvc" /y
  2⤵
  PID:5812
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "macmnsvc" /y
    3⤵
    PID:216
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "mfemms" /y
  2⤵
  PID:5824
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mfemms" /y
    3⤵
    PID:1244
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "McAfeeDLPAgentService" /y
  2⤵
  PID:5820
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "McAfeeDLPAgentService" /y
    3⤵
    PID:5192
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "psqlWGE" /y
  2⤵
  PID:2360
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "psqlWGE" /y
    3⤵
    PID:2596
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "swprv" /y
  2⤵
  PID:4948
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "swprv" /y
    3⤵
    PID:4888
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "wsbexchange" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:836
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "wsbexchange" /y
    3⤵
    PID:4692
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "WinVNC4" /y
  2⤵
  PID:4968
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "WinVNC4" /y
    3⤵
    PID:4792
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "TMBMServer" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4928
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "TMBMServer" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2080
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "tmccsf" /y
  2⤵
  PID:4972
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "tmccsf" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3800
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "tmlisten" /y
  2⤵
  PID:6132
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "tmlisten" /y
    3⤵
    PID:5028
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "VSNAPVSS" /y
  2⤵
  PID:3620
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VSNAPVSS" /y
    3⤵
    PID:6112
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "stc_endpt_svc" /y
  2⤵
  PID:4840
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "stc_endpt_svc" /y
    3⤵
    PID:1764
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "wbengine" /y
  2⤵
  PID:4188
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "wbengine" /y
    3⤵
    PID:2104
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "bbagent" /y
  2⤵
  PID:4984
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "bbagent" /y
    3⤵
    PID:3532
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "NasPmService" /y
  2⤵
  PID:1064
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "NasPmService" /y
    3⤵
    PID:6064
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "BASupportExpressStandaloneService_N_Central" /y
  2⤵
  PID:3792
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "BASupportExpressStandaloneService_N_Central" /y
    3⤵
    PID:4044
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "BASupportExpressSrvcUpdater_N_Central" /y
  2⤵
  PID:3176
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "BASupportExpressSrvcUpdater_N_Central" /y
    3⤵
    PID:4580
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "hasplms" /y
  2⤵
  PID:5928
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "hasplms" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4556
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "EqlVss" /y
  2⤵
  PID:1896
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "EqlVss" /y
    3⤵
    PID:5980
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "EqlReqService" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5264
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "EqlReqService" /y
    3⤵
    PID:4644
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "RapidRecoveryAgent" /y
  2⤵
  PID:2620
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "RapidRecoveryAgent" /y
    3⤵
    PID:5020
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "YTBackup" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5592
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "YTBackup" /y
    3⤵
    PID:5744
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "vhdsvc" /y
  2⤵
  PID:568
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "vhdsvc" /y
    3⤵
    PID:4548
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "TeamViewer" /y
  2⤵
  - Discovers systems in the same network
  PID:1732
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "TeamViewer" /y
    3⤵
    PID:5056
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSOLAP$SQL_2008" /y
  2⤵
  PID:4052
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSOLAP$SQL_2008" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2308
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSOLAP$SYSTEM_BGC" /y
  2⤵
  PID:5740
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSOLAP$SYSTEM_BGC" /y
    3⤵
    PID:5984
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSOLAP$TPS" /y
  2⤵
  PID:2448
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSOLAP$TPS" /y
    3⤵
    PID:1396
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSOLAP$TPSAMA" /y
  2⤵
  PID:2424
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSOLAP$TPSAMA" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4664
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$BKUPEXEC" /y
  2⤵
  PID:5228
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$BKUPEXEC" /y
    3⤵
    PID:5932
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$ECWDB2" /y
  2⤵
  PID:1136
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$ECWDB2" /y
    3⤵
    PID:824
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$PRACTICEMGT" /y
  2⤵
  PID:1232
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$PRACTICEMGT" /y
    3⤵
    PID:1036
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$PRACTTICEBGC" /y
  2⤵
  PID:3936
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$PRACTTICEBGC" /y
    3⤵
    PID:5708
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$PROD" /y
  2⤵
  PID:4048
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$PROD" /y
    3⤵
    PID:2200
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$PROFXENGAGEMENT" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4552
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$PROFXENGAGEMENT" /y
    3⤵
    PID:4536
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$SBSMONITORING" /y
  2⤵
  PID:5544
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$SBSMONITORING" /y
    3⤵
    PID:236
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$SHAREPOINT" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4372
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$SHAREPOINT" /y
    3⤵
    PID:3464
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$SOPHOS" /y
  2⤵
  PID:3824
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$SOPHOS" /y
    3⤵
    PID:5596
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$SQL_2008" /y
  2⤵
  PID:3112
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$SQL_2008" /y
    3⤵
    PID:2068
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$SQLEXPRESS" /y
  2⤵
  PID:1476
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$SQLEXPRESS" /y
    3⤵
    PID:5196
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$SYSTEM_BGC" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5796
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$SYSTEM_BGC" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2076
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$TPS" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3828
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$TPS" /y
    3⤵
    PID:5088
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$TPSAMA" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5600
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$TPSAMA" /y
    3⤵
    PID:4896
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$VEEAMSQL2008R2" /y
  2⤵
  PID:4716
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2008R2" /y
    3⤵
    PID:4912
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$VEEAMSQL2012" /y
  2⤵
  PID:4924
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2012" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:984
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLFDLauncher" /y
  2⤵
  PID:3496
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLFDLauncher" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5748
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y
  2⤵
  PID:3468
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y
    3⤵
    PID:2704
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$SBSMONITORING" /y
  2⤵
  PID:5008
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLFDLauncher$SBSMONITORING" /y
    3⤵
    PID:6060
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$SHAREPOINT" /y
  2⤵
  PID:5100
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLFDLauncher$SHAREPOINT" /y
    3⤵
    PID:5092
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$SQL_2008" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6112
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLFDLauncher$SQL_2008" /y
    3⤵
    PID:5268
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$SYSTEM_BGC" /y
  2⤵
  PID:2600
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLFDLauncher$SYSTEM_BGC" /y
    3⤵
    PID:2020
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$TPS" /y
  2⤵
  PID:6048
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLFDLauncher$TPS" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1032
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$TPSAMA" /y
  2⤵
  PID:2604
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLFDLauncher$TPSAMA" /y
    3⤵
    PID:3540
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLSERVER" /y
  2⤵
  PID:2656
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLSERVER" /y
    3⤵
    PID:3544
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLServerADHelper" /y
  2⤵
  PID:3704
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLServerADHelper" /y
    3⤵
    PID:2132
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLServerADHelper100" /y
  2⤵
  PID:3856
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLServerADHelper100" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3780
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLServerOLAPService" /y
  2⤵
  PID:1364
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLServerOLAPService" /y
    3⤵
    PID:4996
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$BKUPEXEC" /y
  2⤵
  PID:1720
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$BKUPEXEC" /y
    3⤵
    PID:1664
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$CITRIX_METAFRAME" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5140
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$CITRIX_METAFRAME" /y
    3⤵
    PID:4004
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$CXDB" /y
  2⤵
  PID:5624
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$CXDB" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2440
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$ECWDB2" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2896
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$ECWDB2" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5560
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$PRACTTICEBGC" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5652
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$PRACTTICEBGC" /y
    3⤵
    PID:3192
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$PRACTTICEMGT" /y
  2⤵
  PID:5840
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$PRACTTICEMGT" /y
    3⤵
    PID:4548
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$PROD" /y
  2⤵
  PID:5704
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$PROD" /y
    3⤵
    PID:5056
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$PROFXENGAGEMENT" /y
  2⤵
  PID:5916
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$PROFXENGAGEMENT" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:544
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$SBSMONITORING" /y
  2⤵
  PID:5240
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$SBSMONITORING" /y
    3⤵
    PID:1656
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$SHAREPOINT" /y
  2⤵
  PID:5376
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$SHAREPOINT" /y
    3⤵
    PID:1356
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$SOPHOS" /y
  2⤵
  PID:2584
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$SOPHOS" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4272
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$SQL_2008" /y
  2⤵
  PID:3148
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$SQL_2008" /y
    3⤵
    PID:3064
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$SQLEXPRESS" /y
  2⤵
  PID:824
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$SQLEXPRESS" /y
    3⤵
    PID:2064
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$SYSTEM_BGC" /y
  2⤵
  PID:5540
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$SYSTEM_BGC" /y
    3⤵
    PID:5224
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$TPS" /y
  2⤵
  PID:1572
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$TPS" /y
    3⤵
    PID:644
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$TPSAMA" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2376
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$TPSAMA" /y
    3⤵
    PID:4540
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$VEEAMSQL2008R2" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4520
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2008R2" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:236
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$VEEAMSQL2012" /y
  2⤵
  PID:3460
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2012" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5084
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "ReportServer$SQL_2008" /y
  2⤵
  PID:2940
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "ReportServer$SQL_2008" /y
    3⤵
    PID:4368
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "ReportServer$SYSTEM_BGC" /y
  2⤵
  PID:912
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "ReportServer$SYSTEM_BGC" /y
    3⤵
    PID:216
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "ReportServer$TPS" /y
  2⤵
  PID:5504
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "ReportServer$TPS" /y
    3⤵
    PID:5952
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "ReportServer$TPSAMA" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1476
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "ReportServer$TPSAMA" /y
    3⤵
    PID:1728
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\RANSOM~1\PWNDLO~1.EXE >> NUL
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\E3FDDA~1\H0w_T0_Rec0very_Files.txt

Filesize
1KB

MD5
b2ccdb9e6b914e7ae08defd418e526e9

SHA1
9a7e36c5f16df2d8f462d0bbc94324b65aab0b79

SHA256
710134a6f194afa24b8374666ebcfaec47d36c310bd1a90f3e634c017f1507cf

SHA512
f743ac73c8337c78de40f3ec23fb4d9a2aaf38d3e23b844aae4ffa45052fe8feb3ccce2ba6fc8a5fb94ef828dcf54ebba7d990671f0f17d94f3eea2a2b7f4cc1

Download Submit
C:\PROGRA~1\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
59fa8931cef3ca3340d1ffa645553d98

SHA1
385e91dff521d91ebb9a4b62f9cb37d6b2a2ebb9

SHA256
a4e8b52a8a637819fc41b1e8e34c2bef9e7342cf6e1f589ef9db796fe1cfd7b1

SHA512
af28f5b2f43d0dd750c0d5ad15b92d1e1114cc8c766d5b64e421b409634f651ef1fd309a79d54c542a36b7b83813f3bd9c3db789386b5dab6e090aa17de63dcb

Download Submit
C:\PROGRA~1\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
947d134acdd331c453d3fd2a7b5b287b

SHA1
2e9c34ef149c4b206b7c4502093907feca181849

SHA256
ef7afe0ff68b15036dd54c84275931fc5bb169dbcfb3efb66c92c1c9c28616c9

SHA512
f4bfe25b59d4ba0f9dc1df3db81544cc089dfbeca8eefa460ce4d8172cd9b82c0b0e7fa19e5d51c415e9794f10c2164b24f1909080a72c18ae80179d0f1eefe8

Download Submit
C:\PROGRA~1\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
458770b2296fb8814bf9b0895e7c0094

SHA1
44e7ca404b8f7af2de5e477318adb2a62971f985

SHA256
de4f638abb8ae387870904957266756383554e0878ff6959a73d09e7cf60a693

SHA512
8b95674c6f6537deedb2db85acc906d0f42a2770fd4dc7910aff107495304636edfcfa297f47b14b27e336e15d41678b13570368e83d6680cbf677e97485cf87

Download Submit
C:\PROGRA~1\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
f670a39f8e5893b5216b11830274c2c5

SHA1
71fab9f3371f2de2d2b0fce345c73efdcf0f9433

SHA256
0b4f965ca4009e9ba1cc6de5e1d8aa07110789adf1ba18664a7a029d4aa650dd

SHA512
2227da27dc41ee12888a3103f844a129dbdbee6d9f3dc9a1918402df58ee31b48e28cca4f50d007f006ffadc7c9cdd558d4421ee0041334a85a1a1c2860f12d7

Download Submit
C:\PROGRA~1\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
533902ab54242acf622295e5efc94db5

SHA1
cbec9af6fc5c6c48dc84ba0f2b53f30a93c2f530

SHA256
e5ec4e17c3e62aa8f023c7620db6fcd02e1715c243bfba93bcc8d981c4135553

SHA512
b221b089ca86d2f85bd5ca5e6a8eab715c5cbad470f0c87c132f95815892d38dd7488c1fc54e824a00a4eeddd3577a4f9e6e672ab5a4ba9a632cc6ef1031d171

Download Submit
C:\PROGRA~1\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
b36a4395852cfc46fdad22d78524c721

SHA1
b8f021c3dc7fac12fc82a7a6a5f8f28ff484e499

SHA256
87920b3626846bd762ffe38a8e8fdd30fcdc535cc094cbb85c9c79eb60bbe586

SHA512
b15f5858478d75efe3380c1f7844c27feafbb018f7cde1cab606eea0164ae7b3ad27e318e262ea374136c1fe70ad7a067096b327d4f7db36a7c50dd30006e420

Download Submit
C:\PROGRA~1\Java\jre-1.8\legal\jdk\bcel.md

Filesize
11KB

MD5
3985b94d33dbf5270c9f0f63708a8b25

SHA1
21a8bd2d8133367cade6ae6e70f88a63f4b9bf27

SHA256
7ab6721fe2e522b03241c269218df96186f86c7fb88beacb7cbb65135df3af82

SHA512
9f21e306c51864ef72e6ff6402e40942608ef0ebd28bc148ee3de01c824fcfee41b8f0506396a92b079d98833dd35e60600ebe9c86603794d427c8939b8787d1

Download Submit
C:\PROGRA~1\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
c464592ba51d1897ddecb0132a7f4d7b

SHA1
d1444282eac5761d435fe0e984a81b52cb704c3c

SHA256
346bed1aa928572ffac0415d938bd52dd9d80b46416e8a20f4198917e37ea44e

SHA512
9df59611a8307c9792ae012f2075d84b2d3a5114b2419b4b943efab04633adc99de6baef772c4be4c73031c9e137a83d74964f9e77033fe92a7577df591f4694

Download Submit
C:\PROGRA~1\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
b28f7abf59c0c041549992426eeed3e0

SHA1
4d75aa2fb7cfb134787b5abcb5d88a41a47ff363

SHA256
38583b725c1edc35b907d545bc1c5e246a4340661f7f132c6f867022ea04a79e

SHA512
b6e344d08753faba2ace9b8a9446f4dbfaf48ce58a1771301a096cfe4dfdb0ab025f5c2ba40b3a3402203cbb91422297551e6687b0b6f807cd1eea4f9edb4247

Download Submit
C:\PROGRA~1\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
3dd9d5e87a2a2188a07a1bf415fef4eb

SHA1
e9a8dc24f0d3cad036b8ce750662780ed63b0cd2

SHA256
fe832c9f0e69e9561cac6f0ba9000457cf1870e3bcd98f819fd10423a1414208

SHA512
29101e0d51e4e8d89e6daedf7fea0850694e99cf5a32e5e299961760be1f48d22941282fd370c37a84f54dae5966eb52b5f64fa80dde6cf2bd394c3c5a035ed7

Download Submit
C:\PROGRA~1\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
bbe1a364a3fc4c2a8db5fcde3cd244cb

SHA1
e50db15968d5bc82f8fc50397a7f79f954588cee

SHA256
bc84ae7d3a87c497dd84800484ba1ac1bbd0f9703a3c1bc377bde7987769837b

SHA512
1d39017e932fa8ff513025e0b272ca5ce7b183f70e8cd2b92070afa6b53954f958daf82aeb8113108f02e64973a09dfb1ddc4d58db86e8032a9a4812539c3c97

Download Submit
C:\PROGRA~1\Java\jre-1.8\legal\jdk\xalan.md

Filesize
12KB

MD5
d5c36c59d2e9c5e26c9f8f4e634558e6

SHA1
5d0fa2a27ebda1033122fcfd2863cd864f688004

SHA256
b295f558463e66ca503be97c7dc1ac4cace6fc46b431d3d70dd491883443b154

SHA512
fd88b679fdc6a91d3b66147db99225975b977aacb7b52ed4a2d2dc36fea1dfd53266f0af227dee578dc53b739f1ca6802d5b902e893521545fffef3791b21735

Download Submit
C:\PROGRA~1\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
615b9520bf0e3cadbf91900213b1b687

SHA1
38db4b13a6df4ed1e0c9b4ef2972b4588bc4f787

SHA256
c9373e960ce33f2a6d22d2130c8a401f695bb00eb0c9ac90422e369ba8345877

SHA512
2031bc40677ec1f13c61c40a75ea2aa1d0a7e62f6aa7e16e6c2bc05ec1ae22eb1374ea995bd4bda63676c0f0d70b70cbdd42763da2829a9303267ff89637af5c

Download Submit
C:\PROGRA~1\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
52460826411b35e351a7647a05bab294

SHA1
bc6008679ae11304dc6b25bef5280c305391cf82

SHA256
052e2062e24c93badef42d9b8950630821f06e480f57ac74768157bd666d4c32

SHA512
20a1d91c5a6a6a09237715404b466c3ac1f473c842dfe15c6eb9222d38753bc793a6c644221e414f60fa87ed1ca9916cbc903b0e23586431e4497da49c340319

Download Submit
C:\PROGRA~1\MICROS~2\root\Office16\BIBLIO~1\Style\SIST02.XSL

Filesize
245KB

MD5
a90d8eec328b287a972afcae0ede8a44

SHA1
8afee515392a504b0adcad4f99f1e95f6400e44d

SHA256
0ca0f1eb76d3edb443ffa3cc959d8f52dc815793260ad5af511bcdcaaf1e0862

SHA512
52fb8ad2d0575dba6362b6885f63552ab47c6532bc23b4c7f7a4067c86184bf0c75a5376a2c26b026039757366243f8605484de4ba5352362eff8954eb59e407

Download Submit
C:\PROGRA~1\MICROS~2\root\vfs\PROGRA~3\MICROS~1\ASOLED~1\140\CARTRI~1\Informix.xsl

Filesize
31KB

MD5
a4ce4a35867245abe13cdbeb71b052d0

SHA1
509f85478ce504b3857d4d8b161fc25b195dfb39

SHA256
6cd9f9d669d37dab4f6eea4b01be13376efd4ef1c53bc8da1d64adea26d9cdc2

SHA512
f49930fee180efcc9c248e347f62e21134bc5368b373654893b89e768b05d68807033d8e5ffa4c3cbc1d0ec857209f997bc18dcb6770c209ad5206dfa5c60e46

Download Submit
C:\PROGRA~1\MICROS~2\root\vfs\PROGRA~3\MICROS~1\ASOLED~1\140\CARTRI~1\Sybase.xsl

Filesize
30KB

MD5
dd277c5ab196e5a35e5ef83c62aa0af5

SHA1
03c1c107a29519912551019f07d31f85378a194e

SHA256
de009bc2867d7aa76f52b4b7d66a902ec1eb40c69c9dd2981754cbec19d9d935

SHA512
cbfc57ce2f2e1da116bcb3dfb5bc4a7112c6c2c2e39784ff411970dd9f6cc31e9a35a90532a0e3cea0c43835be340f46081844b2ab2e3dc4ea14a03531a06f2c

Download Submit
C:\PROGRA~1\MICROS~2\root\vfs\PROGRA~3\MICROS~1\ASOLED~1\140\CARTRI~1\msjet.xsl

Filesize
29KB

MD5
878a14408227c9c1f044a045ba382a0e

SHA1
de3116dc0189975783c8b2c5f58933d6dba7373e

SHA256
fe02a9e2249bc4467c5322ef5d3b4335ef1030db54e0be4368d238a5afc0ffe3

SHA512
07f495d95eeaeb6bb10cdab95297e1de31a3c9185c03888b04565051697ca3269de99440919be1bacb7b00ea404a7095a6d2b1b183559e853cb95a357472c5a3

Download Submit
C:\PROGRA~1\MICROS~2\root\vfs\PROGRA~3\MICROS~1\ASOLED~1\140\CARTRI~1\sql2000.xsl

Filesize
34KB

MD5
ac411825609fde907db9a86726224c7b

SHA1
30f75d042ad33e3e123d32d6751fa78c631c67b7

SHA256
a9a2d9b371e371a49eaf611d7a3530036a76d76b4a5792b90a63b514b65111f7

SHA512
19ac5ced57244940de4ac360c7431fcd00419f9ab92ba798811453fa5229472e164d1a15683d1758c2a41e525717d083e53f0420122b6eff3a03126816a53d54

Download Submit
C:\PROGRA~1\MICROS~2\root\vfs\PROGRA~3\MICROS~1\ASOLED~1\140\CARTRI~1\sql70.xsl

Filesize
32KB

MD5
5ee76bb7ebcefb4d382d9e6209e6d838

SHA1
23a0e261534e6840ffabf676b40c4d0d2ebbfad7

SHA256
33fff6a0c580c6523caa1e7867d87bfe5575b48041e7d9a904e23e6d32640270

SHA512
51bcdcf56917c84a68ef3a99ec71bd62f5a2242a5fcaff5ff43758e2998ff031a3156d93c837116b359f5726bf60d26b0f35ef5553761a42989d3525a8bbe378

Download Submit
C:\PROGRA~1\MICROS~2\root\vfs\PROGRA~4\MICROS~1\ASOLED~1\140\CARTRI~1\hive.xsl

Filesize
80KB

MD5
243940862dceabb6f0b51d4d5498d4cb

SHA1
26cc498595cc3070c2434ae0e0cee5a86647d308

SHA256
1ef0ec745eb74b307d66f9e7cf54d082b68f26a1a2d51d6926a1e39ea86b192e

SHA512
e16dd0704dfb84291547b8afecff73b2aee89f1ddeed16c1c2334dd2d604a4d8fedc3c1f821ebd917888de64d353a49a18c7325808e82a2b7eab29be4dc83958

Download Submit
C:\PROGRA~1\VideoLAN\VLC\locale\de\LC_MES~1\vlc.mo

Filesize
607KB

MD5
8487347ee2131868523ae46a2a2048d4

SHA1
12d8d198f98d0e60ea4fc764bff2ebb10b5d9a22

SHA256
78226355425a0cdcb3e3b8c18764a4de3a18c5b2c7877e22b47e25274c761ae9

SHA512
2c9a9091b6d88458594a2aeaf92462f140352e351122e2101a9884c4eecd379655738914756d4b0cea597ca873e9a02d73dfa5d8c62018dcbd1659897492a981

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\images\FILE_T~1\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
e2227203f76db7a415854079bb83b89b

SHA1
334eabaa4f01f53eab1da958147cac16e98a1290

SHA256
a555d3d0e1695ced3b381dc1417798bb66288b5ab46ec4d8d2bef1e84736e246

SHA512
d8cd6f537b349c587309d3cf912fe352f2484d4630650883f19652da64b057f97aedf0d7aa38315b725362756e9944cdb4509a8a6474d134107844bd47531aec

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\images\themes\dark\s_export_18.svg

Filesize
7KB

MD5
d64b1080e68423e5bb784e47ad9f4927

SHA1
8019cf302630d33fe93242271e41b07afb875a7d

SHA256
5784ccede7032752c118611561613a2cb4cf495121cd2fc5dc7c0287104317f3

SHA512
8ff831f86cf1e683cbc5ed208355ef5b1852117feab43b718417f1f0b26a5e3ce3727741a8299248bbd997f1437571cf6ee3b37dcb8377f96d1f442f12043f01

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\core\dev\nls\root\ui-strings.js

Filesize
28KB

MD5
95b86e6fb53fce5842aa900773310509

SHA1
ebbbe3511059358f977a370b5fcf2ce28763eb3c

SHA256
964d7f456b2e24f55e6d5f49932366bde6c8e0af69a9672dfc5e4711c65d490e

SHA512
6cd5d8e295d57c7f19b55a16824bec1856095e9c6d22cdefa4f1f4af4e803354521f0c609d9befa744a759205cb911395dbe0d1ed03aa737d31618022e49cea8

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\files\dev\nls\root\ui-strings.js

Filesize
7KB

MD5
c4c57d9ffdeca828a78b7fcbeb4a0717

SHA1
aa19fa4b1c3ffd3ac47350851f0df9dec9794545

SHA256
d3ca2fa6d521b4e35a4b15c1f4606fa4e67fa872c117d1221b82a12cda6c3cac

SHA512
b5c30d57b9ef03e1a2230200826af58fda9cf7d980186a4ade97bb0e7c7c61ca470146fd28d0761f23cf9795af7838b298169658e07d3bb732303203a2cf95b2

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\ACTIVI~1\js\nls\root\ui-strings.js

Filesize
4KB

MD5
3384fecdd7ade9b4097989b358c4bd08

SHA1
b88831a1171eb847583cc7ade11d80663f8939d7

SHA256
09b0ab69c47095a9d5a2a62a38319e96587b00f8b3832be3f997e7706338c466

SHA512
a4d4c41550b82fcb349c12f14b635231dd5cfc1c21f56e0b4018a8e0918e0c8613666f5dfd446fd30579c85a1fc460a0744393d25ea0c7a827be4bcbc964ad57

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\MY-COM~2\images\illustrations.png

Filesize
8KB

MD5
58ccfb4bea877e23e9ad5d2c39d9cd0f

SHA1
f89d7a20d0a2ffda9c477a2058928f2214a2a0e9

SHA256
3767338c17e88c4d926d0212790aae7f7171aaa3e5279c53a906a8d6e326f1a4

SHA512
25096e12b753da2999786932fadbe960eca9b6e10727c005ae4da782e52a859f74b4002a1954eb3b9167fd489348fcf27bee99be8750b3f7e030f16bb1910cb1

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\MY-COM~2\images\illustrations_retina.png

Filesize
19KB

MD5
23d83c3e6e4cf9340ab3ad20a3f07e72

SHA1
44ae3c3168cd552539dd0957d09f940f32ce4dca

SHA256
2a674dbd895aae6f636416f5e3c22242e6d226a669d05166530d92ae0a3f9bba

SHA512
23d4a2496ce90a0fd71d727aa39aa1dfc1ad19aefda84866c7de3797cccf0a7e6a5cbd45ee63aa198746844afa79c2717f2abae48dc99dad925257f8ddf5575e

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\OB-PRE~1\js\nls\root\ui-strings.js

Filesize
4KB

MD5
29828f848d0cf450f8a87c304b2a1522

SHA1
899de48a596dbb91c03699f4f0178be8af600eed

SHA256
fa283370d62230b879fa5dba797ce8c8331834b4d030997a460638396b8c3e8c

SHA512
5ac6d157c544414e31d2de950d0248b7415a5901bc426b719946cfdf392ace3c2b1927977690ed6488ed0703e1bbba3be0123c65a2c1ebf91a17721782eff269

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\ON-BOA~1\images\THEMEL~1\LOCALI~1\PlayStore_icon.svg

Filesize
5KB

MD5
7622ce1a3c9c2c72806d57f8fc802a2c

SHA1
0d7e592afeb347413f30feb2c43777e5221440c6

SHA256
e0aed5881c8d2a74f785bca309089d88d341dba8dcc3084ef716f1d7aea6066b

SHA512
7ecd5ce80cd30eddcf3dbcd11d9660167fcd7ffee264e8c19d2d6a5f199429664b8a68dfcd5709a5ec5960a1924264dc0d81b6703117910aa2b75b9e47c49f6f

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\ON-BOA~1\js\nls\root\ui-strings.js

Filesize
13KB

MD5
16c34ed932a9b9801da33ef9910c0fd1

SHA1
55c57340bab58d4d12c845873f69b2578422ee02

SHA256
f18ff4c3db260d332a6003f8dc51c67384bfa862b11d0bb2cafe4b730b42fe4e

SHA512
7502d6b6792f2dfb3e3cb038231ccd7f848479fcebf13d86988a9749e19ee0b7626c862295099b50d3c051d7caacbfd7b8e54b35348bfff48b4f9551adf80879

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_cs_135x40.svg

Filesize
19KB

MD5
32acf4b9dc86c8d0a0549e51fa29b594

SHA1
476a08d0ce950330ebe1d75c6bdb8d385b140146

SHA256
ccccff9287f5ac3b28c51be38eb57f987072999e2ac3037cc610a784616e8501

SHA512
152da1ddfd83d14367d5b6cef3a04615794d40be062b386e39947daff59e36772a36ccbc8877b6e3ab323c6cf641a08fbace3ab291f599518dc7aa98c000aceb

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_da_135x40.svg

Filesize
15KB

MD5
669f285ee9c168c69f0978a4875b4835

SHA1
b803cdc5f5cdf44e84e4e9d6e4dc0bca653f10dd

SHA256
822d24618a5fafc244610363fae9cec881d2e200cc44abe6206cf73c6697816c

SHA512
035008c17cd4638c18fc966fb548e47a206099881305486186d2459d1a360feafe782621cef52b5188260f6906ab3fce4e64a8dc21b7fc91030078e76d27fe68

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_de_135x40.svg

Filesize
17KB

MD5
e5c8dae269b10297df4717159bb581c7

SHA1
615a61697cc5d12a35b686d186c5212ec685c636

SHA256
0c3c2af6a20d790be0a823a9ccecd9eb8833fcf4923155613631619903a1ec0d

SHA512
c31bc35035b31a2e1f638d2116c965b0d7bc79ca3bd692023d021cc93205008d682af09f8d991693928662e49053c0d0bc27db8552678e1a2cab5d4455ff53ea

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_es_135x40.svg

Filesize
23KB

MD5
ad8f319af355a2434cdb74c69f2abfdf

SHA1
e18e63e7c81c470f3400fab0e50d7d15e0b3268b

SHA256
2145935ac6282e01ca99f6167e6b91f916a390d08044b731b0fa72c52ae9bcc5

SHA512
7c4718ae9ccf9b4e4fe54c135840de3214e5285321049e0b23cbc8f5081727e65cd6e79622d0e8473af20b8300ca5bb12dfe59efa3b62e0005cc7c027eecf7bf

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_fi_135x40.svg

Filesize
18KB

MD5
46ba7df3281a0877b14cf278cddd321b

SHA1
6fe0563b3d19a63ffad182d81092a364f8da393f

SHA256
677cf5cfbcee07f5dd63e1ef8e23fbedded3893d0cc3b1c2d3edf5b0ffa32dc2

SHA512
1fbf752ee3524959583c7ca23adc05a41016874e492afcddef3437eb1dfb9ebf1ae272fbdf3fd80e78478ec9266f0b6ef5efc75ab3aa3e3a3e4b4afefa1672a8

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_fr_135x40.svg

Filesize
26KB

MD5
00aebcabb4705a4aa061967e63ec79a5

SHA1
950f764c846f446556ef913c0ff17641c5fef528

SHA256
c71fa98d61ef5a5d8c11810aa23a706b654476bff40e83c61dc5d3c3c1d0c870

SHA512
c366ac9c904417457fef5027fc0eebaad13e1ea5fca6ebb86501f12383155f8cd233de65f764423ede88b442afe53ba77f808162886f25334eabc8d581aa2493

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_it_135x40.svg

Filesize
19KB

MD5
ff182717c942646792d54a5fab37d6b6

SHA1
37e8cfc5393f6e9eca1b34bf7f9cd271374b57b0

SHA256
ddc3cbbdf22295d8ac8abd160e9ebda52fe83f3747ae095bcee4b8b89c49d6cf

SHA512
e368cf6074c99f382a785d34688fc149360cc4d6b22e7521db14ed9abe0f9948dfd90284f85fac502ba3596caf5195908e2b7580b9537df61830f0a882bdd8fb

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_ja_135x40.svg

Filesize
17KB

MD5
965a7d206b18171634f9d4d92628dedb

SHA1
ca2f01ac4dfc7acf6feee955b3779cc884fbad65

SHA256
ed466cf95e4cd0ee7b0444942a0913c0b6ac9f881e0e1218030e85936ab6800e

SHA512
d6fe72507f9d0a2eb5ce6315e6f01000e90d1314e86b4379522cf51dfffe6d16f4a6961231bf11adef9d045c6bdf75f9785246ba4fc3a720294dcbddba219b8a

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_ko_135x40.svg

Filesize
17KB

MD5
da66aae776494e3b1174b075de56cd3c

SHA1
1312a8938edbd42019646545dc8e7191eef055ec

SHA256
490396b718f16342884b8d88909ec8f9757ab9ed73c105b52243891fcdafcd5a

SHA512
0ca8d22971a0ee9bc63c330e5ec11a107a18f22a6088145b3bc32b8739799215678cf9fdd527b0322f2f51af6f32003c43163d3d5897957ba536e4a81a6f5e55

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_nb_135x40.svg

Filesize
20KB

MD5
1929e67ad6911a83c00ae1886ad17a84

SHA1
3cea1d0e00d4d660bee443d3cc66524caf347a98

SHA256
d5541878df0efc6d19c8833b8868d2b69254e336945ed732d7b126510932d3ce

SHA512
c180823a0f7dc5c0a7d6d8242fe5f73983e78a2bf3cb5fa03dd6a714f2507b7cba03654d7820f354bcea76e3a4a134b14ceee3384996e13ddcf697b78cdb0501

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_pl_135x40.svg

Filesize
18KB

MD5
a3c4422fbde25dead7a65d7241e760a7

SHA1
cc768903394fb2cb0fa4a7c0575e5ff29edce89e

SHA256
f87787a1c4b157fbc8db187ff29202e471e8f1464ea92457647c975043c444ed

SHA512
d81de01f1590bce798a38a856aeb2df9d178bcd26859692998a94958aaea89594ed1be9c614950dd798e629849e92b5a5c99555c3491e16e91cdb92f4862e130

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_pt_135x40.svg

Filesize
18KB

MD5
0bb72c4cb849ae1a5067183034cef8b3

SHA1
a3327ec6487cbf08b07d834cbade0236a04f922f

SHA256
60589883783ab7d16b6ade0e6aa973d41db006911768aeff432741ca7e810551

SHA512
1fb8445c888b9453b99d80bf96a56a2d0f873a57f5776b9b78d635ea410e48bf9c44cff8f9a6a6105404e96cc76befb16325a287b2a73eb52b06726b6122110b

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_ru_135x40.svg

Filesize
23KB

MD5
64cb7b7803c70c5182bcdc17c748de0f

SHA1
5ba4c66e21ada2684f71650bc653977f4bbb6ee0

SHA256
c2d630c3746111f139d1c88aec5b420efb35495598cbfbdfc11424ace91c86c3

SHA512
7e345f5c0acc82bc90a19e92bcb4c7c07b92acde940fa59ce19e9a975739b2ef94f001f8b4bb8e1559229fd549f575432772a8e3cf69e3bc243b46e21bf54d7d

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_sv_135x40.svg

Filesize
17KB

MD5
76c28bca6f0dfa8496d65a7443d70413

SHA1
26050ac7773f5a972efb0d579680838d4677a770

SHA256
36320b301d459037fa8c7fc7ef3e7ba051873cf55ff547a2a069725d2f87721b

SHA512
96138d5a5e24eca7ee2aef5c7516e89fc66a5c19f2c1c9e2f834d22ebfaf2c32411551422abe121a0d5877dd171c28833ec8dab03d4bd16789b2f90a352eedac

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_tr_135x40.svg

Filesize
20KB

MD5
1789ec76e739644f88ae5355d50234a9

SHA1
3a8b990e65bd0b65f71d3641e2e9fcf3f60cb62e

SHA256
0106993720b9ae5e8ffed99fbd0ee71e3327554936d8ee5198880069bbd7c887

SHA512
fd45acc08ee43e69fcbf1d4df6a9478cf1d5ea4f087751d7687c4796a19a7e5f7f449f309f0aa0310a19bf3d905d27c551e9f78d038737acfcbfd41dae89457a

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_zh_cn_135x40.svg

Filesize
13KB

MD5
eb2168b27df711e8a5bd9bc8af202b37

SHA1
c5e69883193c17bc011775b2fd3669e2a298d1a0

SHA256
687bd9ac2d3cf209321ab053451825dc3e3ce8173e9c420363c43872ca50f852

SHA512
3293183ac593742eb1c24c5d109ccaf9dfb2fe4ef9d5b9c0fce5d2180d3752ed1d036e184630729d38bc85fe748e769a5cc5aaa3d47c6b202d7d9d1d320d48d5

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_zh_tw_135x40.svg

Filesize
15KB

MD5
0cc30bc6421a47b196dfa6e0d3505429

SHA1
6e5d27bfe32fb28b9ab250071a13a51529dab653

SHA256
fc29810ed5bd3dbdfcef3d6d98e948a6f3d66fcca184ccb1c201a7935307d6b8

SHA512
f7c063a4e8132c0a9315dc1407d733ad2013610bb08433dd35d48c32e484d6351dce56e53dca59e96323bd210fa2f83e3efad3df962c7920a098994d6d0186ca

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\cs_get.svg

Filesize
5KB

MD5
239ff313e0f6fd97f9a9c37ea07ec71a

SHA1
51bf3318e4d25fa7fd82a2a1a91876e0ef9fee0f

SHA256
ee336df6cef9e06028bbf9afa10bb4c12eeeda29cf99daa3a4601eb529392562

SHA512
58ffc793815b3a3e193587844714fb3ed9f9c868495daee03d956c301b7bf07be93a3992ad1435172b1f21cc74f9ada200481da1d0386905d45401b7129e1b80

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\da_get.svg

Filesize
5KB

MD5
50362884cb4392a5c39fbaf6c96e3961

SHA1
d403f5276f64242c0736ed5b3152ee17f065dbf9

SHA256
abefc3a8c84ef063cf86f63419de249ada0c52a5a6e12985442ff4d28f901912

SHA512
cd48058d40c35f9b1d33f563df93bed4d8e9941efd2ccabe493261586d17941d40ee988b12b7e30b874adb5df1a625e8c8fe4db2d9c9c714fa220a048a28b27d

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\de_get.svg

Filesize
5KB

MD5
7f551f9b999c896cd0f46174fb4e8b17

SHA1
dc82a01c1caf3c63935aeefd3dd50a46dd2cdea9

SHA256
03b9fba3bf4fae9400a40ca5ba434824e85fc2166f38cfb8bf552fc2e7a0c21e

SHA512
f7ad3221d22e99427ba3c87f3d128cd9e5da59ceb109e3806ef859bc623b94d6d992e258beb8e75309606c0cf2574436b9999ed5c2df15d3b710ba1d0f304620

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\es-419_get.svg

Filesize
6KB

MD5
e5266ad50618ab806da2f9f2623df162

SHA1
c54bcad3e4ea3da40af434e185fb82a0d8b61daa

SHA256
0df3871a6c8f96da245a5c7ef3229dfeef87ce8b80f55b50efa2fb84e35ea6d4

SHA512
0438e3f5e29bafc464679e5bbe669e16bc794558b892cef8634cfbe1cfb2f2a405c0bd3fa8f43b9332deca330cb1f7b20cac61f316e2c85df1453c669883f598

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\fi_get.svg

Filesize
5KB

MD5
2d2e970c535276801e7b3a43c3898c87

SHA1
764fa47712affb9f915c7ea9863b51331cc4caba

SHA256
8e17cd45ad47647aec58afe89748477bcb408917045c7cae099e188108eaacf3

SHA512
4fcfa6ed8c8bda9adc084dff5c0e5b371466026b81cfe2f98174639ea7f0810721b1d4ff310c2fc0c72b74fac1ea67c45d8a7150cf0a54dd2c119ee0f6a077b0

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\fr_get.svg

Filesize
7KB

MD5
1ab3cd443ac05aae2466754895a5a602

SHA1
088f1c23749d5b70e41e9171a2701d2915659eb6

SHA256
bb1a1df74e7af45e977ac84f63669193a1b32fc23ffe0790088bb56592ca8e55

SHA512
67a8349a26b3995355a719e083798935a62818c0a0d25b9fc72c1dfc3867aaf80787b86617896cf2e53d4bfdb4da384ba6db9113ab24cc3038e7ba7853ac8c08

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\it_get.svg

Filesize
7KB

MD5
bbb749c11391316da9a093736829d605

SHA1
0771a43ded946b552ba557c75e5ef6999aa703e1

SHA256
0e7ea75a01573889cd584163a94ad996eb427c6672fd46095ecadc34e1e66ac9

SHA512
c570add6e6661d98dc135aaf66950eacc33f57e2526f2975df13939f7c99c178e80321617319fb17c542509f6c3b8e17f2ab3f66c8305a2cf11c242f0afff617

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\ko_get.svg

Filesize
5KB

MD5
4564f2c59e1a3b458c94e85c876daaf1

SHA1
11d5d4fb25ae39dad766ba72b3f254f135113a22

SHA256
07c9e8aa999ccd753afe56f2e307b7319a34b7e57b14743caff1875473ab2ef7

SHA512
39a591245c2dced43901b1d44be5fd329daf1d90e2a6ebf52df9a3f4930e5232e96e906e7c7472b20b0f122925a98d2e9c92d73138581443b232c61eeda0117d

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\no_get.svg

Filesize
6KB

MD5
4d42ebc5d212bad955765851b8347a6a

SHA1
8bfb8e01d97889e3cdea5a9366e5b3df6a2b9e34

SHA256
d9b51308cccf6db4f0eb2c3a0f184eeb0e7e2590db29a563f45651e856427f29

SHA512
c6518dd10d7ef292e8ea669e8c339434e6540fd66ce35843c47eedd7cf46336fda8e3d0e45b9c794df264ad8554b4187aff56409aed3989849fa0e1ea6dfceb4

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\pl_get.svg

Filesize
6KB

MD5
136a655f3d6362baa3fa25484e087ce0

SHA1
1086dfc86f615cf28a440fbac36a662a98210302

SHA256
5275a717166ee5ad905afc1d4473cbde972d8833301d9b55989c598eb96af32b

SHA512
c7f4120334399d05599362cbfeed97924f43d03bbbc721889ffd5896dab296b15157abe0a2b63ce348002348f8ca3b23d4afd70f323afc8e6561fa3184be7067

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\pt-br_get.svg

Filesize
6KB

MD5
e16e38be872833bfce710b4f2632b919

SHA1
2efb7900c4da31e936805096da3657f7820762a3

SHA256
bf99d573f8545879e818c5a4e3e6586af9959fef4488317bf1e3ccc433caa176

SHA512
b36d6ef284e1359ff2a0526f6e7cf89cfb83fe391b50c78e6b140ad68fab994b436c142a1b33bbaf2e3c6e1cc2fb5d0c72648b891f544bc1b7544e68260e19fd

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\ru_get.svg

Filesize
6KB

MD5
2169b8434e76ae7dbbbdd272514ce98e

SHA1
c1fcae2db9a4da9407553a227da18e61ecdefd73

SHA256
07d88a8ed3e28ed6ec86bfabb800af6eea0a024e0edf75cb6db733225d1a3255

SHA512
2ad5321eb462b5f6195fd942db5ba8f0a7f290fc5f40e29c0a3fb5f1446efea5966d64028f62ba94feeb9619536bcb1d6a68ab0feeda301d418f7e5829c090c0

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\sv_get.svg

Filesize
6KB

MD5
34d59e6fa50aef16997b579a3227146b

SHA1
daa891225e84c4934bf7223617a85933ef61902e

SHA256
3d35f61e1028072f6d19ffd2fc60efc7d40d34821d9d687970977047c3e5a8e2

SHA512
ab565fd6929d3d9813bb49c9f5c24bf0f4f923843fcb66021aa92c3378c2d0e67a323ad10faa7aed4594efb55310fea955fd4f0a873842874939564c9a1b2bf3

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\tr_get.svg

Filesize
5KB

MD5
7ed4bb035d594bb313fe5b1b459c9dfa

SHA1
d788be507509e7cd8d7d5f1506b22ef7badd8f88

SHA256
f993705557e484bd634381d3d72ede2721d29593db0d92570ffeebb37b66b8b1

SHA512
1e6ee5c7cb94dfeec6522c4107cbd0cf8a270f2447a78a78c298c0c1b84dbb843688e2299cf7a3c15e9f13447b7f434f5226db7b3de5c5d8329f454d72597223

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\zh-cn_get.svg

Filesize
7KB

MD5
66022357259c4e0fb620b7e70c770f1d

SHA1
bc4100ecb53df41ce289d4acf6939406b1f68d2f

SHA256
9d2d7b79893771aea6eeba24b4f1d5278a12602372a61d926aee60bbad4d5edd

SHA512
23d7ce59a9010c34ad2f65d239efb181bfa3513ec69558feeae986664b33584f9f2d33d419d6bd56dd8288c1127e812916bfd0c61f7fbe9849319ade39e6c233

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\zh-tw_get.svg

Filesize
6KB

MD5
ed7d8ebd66d2a83a4eacc26418232574

SHA1
5971dc8c3d5f3a7b5c5f06ea61f51389d94dfa75

SHA256
4e0e95bd1b3220974312f0d042dc7e5da2be869b2b08b3ffa64cd28c975fa69d

SHA512
1c559dc7f645d6b208d2c998595953625f7bcc32f39353c5eae58d5e49b995b966b6ea1b58817e13f3ebe957ec676a7bb846d22e563fffd523c3781d0e26a69d

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SEND-F~1\images\progress.gif

Filesize
19KB

MD5
0f1b9824bcf4f9879ed1f16cc6c18f05

SHA1
05c2ddf245cd8a42f008dae77e43f90704f584fb

SHA256
a591e392aeea28d2d8002719a79c5a888f52c5d93781c4a96398a8e65eb4a800

SHA512
b1667eaf9893fff505df4ab0edbd5978105753e0be9020e950fb0ddf378c03cebeed8e96838775dccbb81e5d877440df34929b37ef79fd616f66b6354b829f10

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SEND-F~1\images\themes\dark\faf_icons.png

Filesize
6KB

MD5
71c538da5b080ff4a4ae90b1663b5217

SHA1
de52ea6c5c063f349008dfc13047dd77540c4696

SHA256
bca4eed485c9c41d4aded670e46d725f436b8191ae8a19bc6425c8029567524e

SHA512
80e84706f9cf9afb2068bb957dc35908b5a8a7ae87193b5f894b5e6e9f9e4e720aa57fd6c9cd062055737e168bc29fef1508e46e570adc1e553ccc4e1c83fff0

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SEND-F~1\js\nls\root\ui-strings.js

Filesize
8KB

MD5
ac3cde3a4cd85370130c4b10bceb6bf3

SHA1
0f429605664554dcda076d6c6e7fb2f145159b77

SHA256
265dc4d5ec8a716b52e8fff46885a6f48cbb2014865804d8c14ab782cd0d6019

SHA512
a735dfb4ed2397e65096f4638ae62dcc2a35c4f4ee84a7d4d53ca80039773aa26b26b9f14d088588811a1c0e68f18a6d05103db955d0c43a3fec7b95efad6ffd

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SIGNAT~1\images\cstm_brand_preview2x.png

Filesize
4KB

MD5
c128634752d921f93a5bb42a64fe22ae

SHA1
f9d42e7db1175628399c01fd0ba1cbe8d2686c09

SHA256
efb1b4920418acfe9f1285d5336c1acfa91a9e2a60c1f8d8af2d3d18fc4713d0

SHA512
dfef56beaa26c30635a0ca071c7f928dfb536eeb5ae473bcac3eee6487eff17831e16ba7a47d35966d9cbfc434bae8bd56ac0a884a4452599724ac37bf51f1a4

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SIGNAT~1\images\illustrations.png

Filesize
4KB

MD5
9235c3d63e6da143a3ef9712b7e0c6ce

SHA1
025e19222fffd1ccd2c80a1bebe334149c5a16b2

SHA256
0d1a14adab337b76de99e2e20535b8e1aef2e1057d1f2cea484ab0c53db3cb68

SHA512
cebe08c95c5edbdffb0370959e769a7b249dcf109f9961f0a6f3b6a4d0a533120dd251d53e14efd6a7da272ba826def2f2019b76e67107a053baae749677dd5d

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SIGNAT~1\js\nls\root\ui-strings.js

Filesize
13KB

MD5
d14b58d28e5272411f432991e3a4b9f4

SHA1
433e0b68b69d693279f75f7155e33a5a66ea0ec9

SHA256
c9e470cbb70a26cef8888daa589b81db128068f0afb525594b0877e9caee9a8c

SHA512
796021bc757975501c354470d2c6965b303ef5e810da3f584b989bcc18deb5f171327e6ce4c5a07f2b97c9cd7e6baad7504644626315fea28a7926700c359815

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\TRACKE~1\images\logo_retina.png

Filesize
6KB

MD5
296f7500dc8b072368ea206508ec10f4

SHA1
2b4dd024c5d7298bb2418bec81e78d5077a0ec11

SHA256
e2ccb1206890c0d751effb09225421c14c1a72c28b37a423318f95976f4f8217

SHA512
5b5ed3aa9595fd481d48dd09a14621d69f95d96a1e888e85797872e4f32e2f678c309808249b5b2d91b1caeb539875cea7b219f5c8a785f288e78d61c7db4ce1

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\TRACKE~1\js\plugins\TRACKE~1\js\nls\en-gb\ui-strings.js

Filesize
10KB

MD5
b59426c6db2cff58db15ffcba4a57598

SHA1
549eebb381f3b09c3548b2c24213226c6f5a7d38

SHA256
08485dea76c0a910149595c24b7111049b2dec1142af183c5a8c4412db266155

SHA512
000684899fa9fcfbe3b59c953d365c9cf300e4cde3db9a80ac69b391b2b0a67cc6d1af8e83d4bc4544645c0c69375504cfcea9855a18339ab2344f6959863999

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\TRACKE~1\js\plugins\TRACKE~1\js\nls\root\ui-strings.js

Filesize
14KB

MD5
5ee15cd69b39d0abe5dc3bebed8dc506

SHA1
3602acc35510947f17005a0c79b54e30d28b785c

SHA256
a1e021e7d6ff221b39b37af16c09707aa46714923741efcb09fe616a658cd0aa

SHA512
aa4f7d97562a03fbab95cf157488106f9ab15b3b0479f96141ae178a5a4632b66f9a91a27a248a06bea8041a219ccf2078ca88a25590263e9325d9bde96b77ca

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\UNIFIE~1\js\nls\root\ui-strings.js

Filesize
18KB

MD5
2379980aaf4f27e6f39f2eb00a6ce74b

SHA1
bee2dc7ea10b8b286985fd9dfd88e78cd15273c2

SHA256
e85c98d929864fb8022fe1d367feeb864932ee84cdc63eb8839aa10a6bdb91e3

SHA512
9745052ba872a2050978b657bf8143492eb0a1461a066a4fed095b99bc9743bfc63af373f616f671009aea5388fe808aeada6de0be2547d0f78c55928faba58a

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-selector.js

Filesize
175KB

MD5
39cf7a40787c171fb88d1b0f61c27aba

SHA1
b5db2ebee09fd73300ad9ee19b3f582d4e201206

SHA256
f95f2badc4ed7f8af9bbffc7266fa4926bafe3c38b61aecc3ab1ff54af850b2a

SHA512
8670d42926e3412deb4410fbbcd9f18941fbeb3325cf4acf98092112a763efd108933636c9cf8ac48530f04662a88e2513b687cf27b17115772ca33ad1336543

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-tool-view.js

Filesize
376KB

MD5
ab310ca83678b460ec42191d6f8b5ce5

SHA1
96ca2bacc8816ffd06740d31ff69bbe892ee1df3

SHA256
371c93f933d810e15cdc58c5d823ecbaf79f39df0faeb5b86c11249d8f648d13

SHA512
b27ab360140f3f0db7dfbea7ec826e305ab32ba56ee9172a68e686d96768f4f8a3bc9ff40c2b073652b4f2559fe6b0b6dae0b4a7008ba2ca1be650383c363e83

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\digsig\js\nls\root\ui-strings.js

Filesize
9KB

MD5
1c3d17ebf2c1ef9ee67811db74d7bb5b

SHA1
f90d2a8aff8acbd4d0618dde4ebda2313970602f

SHA256
f00f7ef7559b56722d925597ac6067a6def2e44acdbaa44ef22ca5c53e69078d

SHA512
da915d8ebc60405aec345df967f7b74b0ae5b24c56a3b151a7e38b304caaaf92cbe44157e9fdc2a59b1dbcb733416673ac470a863b37afb90c60640e1ca0bd7b

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\home\images\icons.png

Filesize
8KB

MD5
8e384f9eba07f8fd14a9b49ef5420333

SHA1
94ef754708311d66a8bff2e37c5578087259eab1

SHA256
ba50b4a6d179f8bfbca0e49afd0c00e71d17d8a93e4db2d220907562eaf07539

SHA512
46e7b05965a41bf6226f141f026aff011fd2d7922ac2a78c8d937020de247841fed4cb558176954d61084b8b4971d73db08fc6bf404465090e553032727d7e54

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\home\images\themes\dark\icons_ie8.gif

Filesize
8KB

MD5
e18dd3b87c8879ad2ef87974b45d9f32

SHA1
3fe1782014878c55c30e26d54d35b8c26404e478

SHA256
1451ae2e2c8ac80bd2c8667d2cf2fd12a746645ad6ee8476da8aa9414fb85c20

SHA512
9209e8f60541b2edb6eacfac200f8f8c6dfb9c12420b500b1938d8b69e4b3e7eb7a7088c605e7724d61fdff01dd0288c3a0a74a8707f3b952ff7f32945f2e4ad

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\home\images\themes\dark\icons_retina.png

Filesize
15KB

MD5
b0e6fc9a36d775d288395346c3541299

SHA1
6f2e80f63e4217e1105d8916b59fe2385d343e8a

SHA256
845a2c39538962d0c1ec8d2431138310de128c0f71dd343f7377b5a0d42543fe

SHA512
6b13a4b8dc230ab4cd76dedb3b0392c52be7f072ded0cea0b543e047d76a7b543cc58e5d4960bc8f0eff6e46b3e3ef745c6c2fc713fe541e8fe3a7b91245d5f1

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\home\images\themes\dark\new_icons.png

Filesize
8KB

MD5
ed05dac15a13576e31a6d38318a52c30

SHA1
b44be0f3d1e59732b78d15be5dd1cfc19c41df5c

SHA256
8f4c4d78346902777728f6d2b5b05c91ad88a74cbdc3fe279b02143fc8d3e94b

SHA512
5c779c9a0fec9fbee7592a4e8744f979e80be272757822391d6730f414ad45190d2383025a6685281298691cdb9a2f5627a1795f5c0ee79a7c528d41cd7ac56c

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\home\images\themes\dark\new_icons_retina.png

Filesize
17KB

MD5
84fc47519d1db62f8c18bb5b4c78bc71

SHA1
920108b3e13b1b7fba3b6977f7afcd86199f92a4

SHA256
d69af47f874fa64553b40c9ef1c838c58180ac4360aa7e1ddac2000ac8c65b1a

SHA512
23778320a6c317839ce87c8252a1a95d265d7f3bb43436f9443e19bae4ecc891c8a0447398aad8977adee704371166eb177ca5fbd240c93f53df4e96f50b5fc3

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\reviews\js\nls\en-il\ui-strings.js

Filesize
14KB

MD5
16efe0d3fb9122d2b5b136383a810aa1

SHA1
91ff809ca8126ed25dd19e4d23f27487145e1f41

SHA256
d9fd350d6cb952dd012d6661be1694ad35db7303799c0bae2393e22b50599ede

SHA512
6f1f358f083e7449c54f67220ceb0a818be190d0fb4716e00303dfafd682d73b40c482fb4eb66427ce5d587f812d26083d1b9f3bf2a3085ac2655f4f75babbdb

Download Submit
C:\Users\Admin\AppData\Local\Comms\UNISTO~1\USSres00001.jrs

Filesize
3.0MB

MD5
95560b1b00861772a83b8046e712b911

SHA1
ba9c073e4536ab4127f55f710fa60a097a964469

SHA256
3cd206e7b923bdfff8bc169612122d51e32d2a038b17ea3a114312a15325d27c

SHA512
d00507eebeca4184dad4e453e3a81f882760d14f35fd04d8ffbcf595bb3806bcac1ddb6450b8e54e08af5bf6f726f14f306cfa6b31a2d4415c56e7e9f62ffc45

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\USERDA~1\Default\GPUCache\data_0

Filesize
8KB

MD5
9bd09eb4c2d8427ddb68df989cd684bd

SHA1
0594c68886595394ac852f8532a51f704bfbff04

SHA256
b044d2fc3588df8a6e77e5f99ec4b2d01a502176943cebe0785018106d142f2b

SHA512
ee4408e7d113b3ce9f27cbdd252c0e568ebdf37b458b18ee600aacb21ba5e721559fb807d115194310fd66a185cafd1290cda985f7e3c617976de6ce4f79968f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\USERDA~1\Default\GPUCache\data_1

Filesize
264KB

MD5
5fda5fd40044b4a27b748383ddf67bcd

SHA1
89464d8bc4d4adc4e28b4bf76a422c0fb584c87c

SHA256
6f4212b16e9aa9d226bf4df4b4dd920bb85000441450101d003bc865fbb7dfc4

SHA512
d84ee34f6665db076482876a835da89867bd7e9b05452a02551ac59c8c150e9c39e24f89b4fb87cd7a00714c7c9f782623735056e2fc458c29da8f814c16a772

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\USERDA~1\Default\GPUCache\data_2

Filesize
8KB

MD5
1fd0044d67e0018bacaf1eb05427ffa6

SHA1
5ed2772ba7051c9038541627953d2b9e4f0a78d1

SHA256
ff63545b637d39d98e88f2fc2d399fbedc54b6ea6696351b3effa34576b1173e

SHA512
f9128ee764e126edde9268d559f230e6caa1fc3e2feb39a1d64d46601b40457742e88f9a48672f8d1db5922e2eeef7d3a0182875c4faecbc7e8e0ae0b7af4248

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\USERDA~1\Default\GPUCache\data_3

Filesize
8KB

MD5
fe676d17e4e1d44ea0c55b4670330255

SHA1
8dfc06ad981edcbcd210e0d871ebe19554793a3d

SHA256
8f7df4d099439c386d71cb7f4f52d2f4500ede94cd4146928d69d45fd215cb91

SHA512
68903ac4a38797f90a9f03b7208ae5e096ba8c6eb7d9b834583dbd35ec68a5a4a747c18c2098fc6ccfcb757afd5a9e7b0a0aff813ebd1bd0d58201b3a34fb9a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\USERDA~1\Default\GPUCache\index

Filesize
256KB

MD5
dcc47fd032065e35a7791090d4fab9f6

SHA1
fa6143a58b52c04d7ab9a28e715b322e600662b3

SHA256
a4d8c9722e82a985b2b374e126349653f342fad8618e336f510c084eed0a6aea

SHA512
0eaf23d2e7dca18d5a4d629c1e6e136fd59d9d27698c672b8cfb01db78c3420c128d62bdc661346839ce04be426bae1d1503614b30bc4e52bd9a3ccb9be08d29

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50JFTT~1.DEF\favicons.sqlite-shm

Filesize
32KB

MD5
a4e3e8b64ec1441f6b49f429b8a58dfd

SHA1
7bbc7110bd52dbc79699fc5b3092ab7d8af37900

SHA256
0ce9a5beedd372c7271408121366abc34552de828d0464134d033e10504f0378

SHA512
e0de8b996d8f2bf76016a8f41f871435517387a9b2da1cbe01358268c7626bbe873a80cb3c334bdd04b9b54e69c56fa36d5e1e4a16e28de42a7941b92d2477a2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50JFTT~1.DEF\storage\PERMAN~1\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite

Filesize
48KB

MD5
7ff5cce0531f578cc24a8f76d77c8598

SHA1
7d725aaf7283311a6ff19973ba528e47c5000306

SHA256
d0dd2349631ee11c4ab96e913779e683cc1b12b48b332065ff7b5857830d86a0

SHA512
588d69c26a181a1ab869dd6d8dc8ca528334c0cb471a52f7154d425fbf672a13a33954ef8c55cb7e5ccaf535a9b7ef6b1697f0525bed363428e6f14e7bae6d0c

Download Submit
memory/416-1-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/416-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/416-15009-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/416-15011-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download