c5741701b3866459dd1ffa2477cfd8776713612912693a5897f78aac795d23e9

max time kernel
523s
max time network
535s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
31/03/2025, 00:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RansomwareSamples/PwndLocker_04_03_2020_17KB.exe
Size 17KB
Sample250331-apdw1ssjs8
SHA256 4e6c191325b37da546e72f4a7334d820995d744bf7bb1a03605adb3ad30ce9ca
MD5 16a29314e8563135b18668036a6f63c8
SHA1 90cf5ca4df9d78cf92bb865b5b399a4d2752e55b
SHA512 45c023e6dd4202079e913b8946825b47fab30b584bbd79b0416152cc4a54975b12205393827289c1f03feb71b54d3b6b34490be3001e9b565c1f89e13e752032
SSDEEP 384:RJueT9Jtx33bRsoOjhveu+q7hPOx58Zbxe:RJueJx33bDO1uMbc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\H0w_T0_Rec0very_Files.txt

Ransom Note

Your network have been penetrated and encrypted with a strong algorythm Backups were either removed or encrypted No one can help you to recover the network except us Do not share this link or email. Otherwise, we will have to delete the decryption keys To get your files back you have to pay the decryption fee in BTC. The price depends on the network size, number of employess and annual revenue. Download TOR-Browser: https://www.torproject.org/download/ Login ax3spapdymip4jpy.onion using your ID I1VF02 or contact our support by email [email protected] You'll receive instructions inside. You should get in contact with us within 2 days after you noticed the encryption to have a good discount. The decryption key will be stored for 1 month. The price will be increased by 100% in two weeks We also have gathered your sensitive data. We would share it in case you refuse to pay Do not rename or move encrypted files Decryption using third party software is impossible. Attempts to self-decrypting files will result in the loss of your data.

Emails

[email protected]

URLs

http://ax3spapdymip4jpy.onion

Signatures

Renames multiple (5967) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000\Control Panel\International\Geo\Nation	PwndLocker_04_03_2020_17KB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 26 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Public\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\3DOBJE~1\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\DOCUME~1\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\SAVEDG~1\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Public\ACCOUN~1\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\DOWNLO~1\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\FAVORI~1\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\FAVORI~1\Links\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\Office16\1033\DATASE~1\DESKTOP.INI	PwndLocker_04_03_2020_17KB.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\TRACKE~1\js\plugins\TRACKE~1\images\sat_logo.png	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Tracker\email_all.gif	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~3\PACKAG~1\{3A96B~1.882\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\TEMPLA~1\1033\Word 2010 look.dotx	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\app-api\dev\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\ON-BOA~1\images\THEMEL~1\HomeBanner.png	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\ON-BOA~1\images\THEMEL~1\LOCALI~1\fr-fr\PlayStore_icon.svg	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\VideoLAN\VLC\lua\http\images\Folder-48.png	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\files\dev\nls\fi-fi\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\editpdf\js\nls\fr-fr\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\OB-PRE~1\js\nls\fr-ma\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\Office16\1033\ClientVolumeLicense2019_eula.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\VideoLAN\VLC\locale\kab\LC_MES~1\vlc.mo	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\images\S_IlluCCFilesEmpty_180x180.svg	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\images\themes\dark\acrobat_parcel_generic_32.svg	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\ADD-AC~1\js\nls\ko-kr\ui-strings.js	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SEARCH~1\js\plugin.js	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\Google\Chrome\APPLIC~1\133069~1.60\Locales\sr.pak	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\LICENS~1\PersonalR_Retail-ul-oob.xrm-ms	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\Office16\ADDINS\POWERP~1\tracedefinition130.xml	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~1\VideoLAN\VLC\lua\intf\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\UNIFIE~1\js\nls\da-dk\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\LICENS~1\Access2019R_Retail-ppd.xrm-ms	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~1\MICROS~2\root\Office16\MSIPC\da\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\Office16\PAGESIZE\PGLBL027.XML	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\vfs\PROGRA~3\MICROS~1\ASOLED~1\140\CARTRI~1\as90.xsl	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~1\VideoLAN\VLC\locale\it\LC_MES~1\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\UNIFIE~1\js\nls\sl-si\ui-strings.js	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~1\VideoLAN\VLC\locale\gu\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\core\dev\nls\ca-es\ui-strings.js	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\TASK-H~1\js\nls\es-es\ui-strings.js	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\TRACKE~1\images\file_info2x.png	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\Office16\1033\ONENOTE_WHATSNEW.XML	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\ADD-AC~1\images\themes\dark\illustrations.png	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\digsig\js\nls\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\MY-COM~1\js\nls\en-gb\ui-strings.js	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\ON-BOA~1\js\nls\de-de\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\Java\jdk-1.8\release	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\LICENS~1\Excel2019VL_MAK_AE-ul-oob.xrm-ms	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\editpdf\js\nls\de-de\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\EXPORT~1\js\nls\hu-hu\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\fss\img\tools\dot.cur	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\OB-PRE~1\js\nls\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\updater.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\Office16\LOGOIM~1\WinWordLogoSmall.contrast-white_scale-140.png	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\Office16\sdxs\FA0000~1\cardview\lib\NATIVE~1\assets\[email protected]	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\VideoLAN\VLC\lua\http\css\UI-LIG~1\images\ui-icons_222222_256x240.png	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\images\s_share_18.svg	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\Java\jdk-1.8\jre\lib\ext\nashorn.jar	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\ACTIVI~1\js\nls\pt-br\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\WALK-T~1\images\cross.png	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\InvokeEdit.lock	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\LICENS~1\O365BusinessR_Subscription-ppd.xrm-ms	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\LICENS~1\ProjectProCO365R_Subscription-pl.xrm-ms	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\LICENS~1\ProjectProVL_KMS_Client-ul.xrm-ms	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\LICENS~1\VisioProR_Trial-ul-oob.xrm-ms	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\files\dev\nls\root\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\DESKTO~2\js\nls\ru-ru\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\ON-BOA~1\js\nls\da-dk\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\reviews\js\nls\fr-ma\ui-strings.js	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SEND-F~1\images\s_agreement_filetype.svg	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Resource\TYPESU~1\Unicode\Mappings\Mac\CORPCHAR.TXT	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~1\Java\jdk-1.8\jre\lib\jfr\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\Office16\PAGESIZE\PGLBL020.XML	PwndLocker_04_03_2020_17KB.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Discovers systems in the same network 1 TTPs 1 IoCs

discovery

Remote System Discovery

T1018

pid	Process
892	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1728	PwndLocker_04_03_2020_17KB.exe
1728	PwndLocker_04_03_2020_17KB.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1728	PwndLocker_04_03_2020_17KB.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1728	PwndLocker_04_03_2020_17KB.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 3980	1728	PwndLocker_04_03_2020_17KB.exe	82
PID 1728 wrote to memory of 3980	1728	PwndLocker_04_03_2020_17KB.exe	82
PID 1728 wrote to memory of 3980	1728	PwndLocker_04_03_2020_17KB.exe	82
PID 1728 wrote to memory of 3016	1728	PwndLocker_04_03_2020_17KB.exe	84
PID 1728 wrote to memory of 3016	1728	PwndLocker_04_03_2020_17KB.exe	84
PID 1728 wrote to memory of 3016	1728	PwndLocker_04_03_2020_17KB.exe	84
PID 3980 wrote to memory of 2376	3980	net.exe	86
PID 3980 wrote to memory of 2376	3980	net.exe	86
PID 3980 wrote to memory of 2376	3980	net.exe	86
PID 3016 wrote to memory of 1288	3016	net.exe	87
PID 3016 wrote to memory of 1288	3016	net.exe	87
PID 3016 wrote to memory of 1288	3016	net.exe	87
PID 1728 wrote to memory of 4668	1728	PwndLocker_04_03_2020_17KB.exe	88
PID 1728 wrote to memory of 4668	1728	PwndLocker_04_03_2020_17KB.exe	88
PID 1728 wrote to memory of 4668	1728	PwndLocker_04_03_2020_17KB.exe	88
PID 1728 wrote to memory of 4328	1728	PwndLocker_04_03_2020_17KB.exe	90
PID 1728 wrote to memory of 4328	1728	PwndLocker_04_03_2020_17KB.exe	90
PID 1728 wrote to memory of 4328	1728	PwndLocker_04_03_2020_17KB.exe	90
PID 4668 wrote to memory of 1948	4668	net.exe	91
PID 4668 wrote to memory of 1948	4668	net.exe	91
PID 4668 wrote to memory of 1948	4668	net.exe	91
PID 4328 wrote to memory of 3888	4328	net.exe	93
PID 4328 wrote to memory of 3888	4328	net.exe	93
PID 4328 wrote to memory of 3888	4328	net.exe	93
PID 1728 wrote to memory of 3700	1728	PwndLocker_04_03_2020_17KB.exe	94
PID 1728 wrote to memory of 3700	1728	PwndLocker_04_03_2020_17KB.exe	94
PID 1728 wrote to memory of 3700	1728	PwndLocker_04_03_2020_17KB.exe	94
PID 1728 wrote to memory of 1752	1728	PwndLocker_04_03_2020_17KB.exe	96
PID 1728 wrote to memory of 1752	1728	PwndLocker_04_03_2020_17KB.exe	96
PID 1728 wrote to memory of 1752	1728	PwndLocker_04_03_2020_17KB.exe	96
PID 3700 wrote to memory of 3696	3700	net.exe	97
PID 3700 wrote to memory of 3696	3700	net.exe	97
PID 3700 wrote to memory of 3696	3700	net.exe	97
PID 1728 wrote to memory of 3168	1728	PwndLocker_04_03_2020_17KB.exe	99
PID 1728 wrote to memory of 3168	1728	PwndLocker_04_03_2020_17KB.exe	99
PID 1728 wrote to memory of 3168	1728	PwndLocker_04_03_2020_17KB.exe	99
PID 1752 wrote to memory of 3296	1752	net.exe	101
PID 1752 wrote to memory of 3296	1752	net.exe	101
PID 1752 wrote to memory of 3296	1752	net.exe	101
PID 1728 wrote to memory of 2200	1728	PwndLocker_04_03_2020_17KB.exe	102
PID 1728 wrote to memory of 2200	1728	PwndLocker_04_03_2020_17KB.exe	102
PID 1728 wrote to memory of 2200	1728	PwndLocker_04_03_2020_17KB.exe	102
PID 3168 wrote to memory of 4932	3168	net.exe	103
PID 3168 wrote to memory of 4932	3168	net.exe	103
PID 3168 wrote to memory of 4932	3168	net.exe	103
PID 2200 wrote to memory of 1756	2200	net.exe	105
PID 2200 wrote to memory of 1756	2200	net.exe	105
PID 2200 wrote to memory of 1756	2200	net.exe	105
PID 1728 wrote to memory of 3752	1728	PwndLocker_04_03_2020_17KB.exe	106
PID 1728 wrote to memory of 3752	1728	PwndLocker_04_03_2020_17KB.exe	106
PID 1728 wrote to memory of 3752	1728	PwndLocker_04_03_2020_17KB.exe	106
PID 1728 wrote to memory of 2008	1728	PwndLocker_04_03_2020_17KB.exe	108
PID 1728 wrote to memory of 2008	1728	PwndLocker_04_03_2020_17KB.exe	108
PID 1728 wrote to memory of 2008	1728	PwndLocker_04_03_2020_17KB.exe	108
PID 3752 wrote to memory of 2884	3752	net.exe	110
PID 3752 wrote to memory of 2884	3752	net.exe	110
PID 3752 wrote to memory of 2884	3752	net.exe	110
PID 2008 wrote to memory of 1104	2008	net.exe	111
PID 2008 wrote to memory of 1104	2008	net.exe	111
PID 2008 wrote to memory of 1104	2008	net.exe	111
PID 1728 wrote to memory of 4908	1728	PwndLocker_04_03_2020_17KB.exe	112
PID 1728 wrote to memory of 4908	1728	PwndLocker_04_03_2020_17KB.exe	112
PID 1728 wrote to memory of 4908	1728	PwndLocker_04_03_2020_17KB.exe	112
PID 1728 wrote to memory of 4460	1728	PwndLocker_04_03_2020_17KB.exe	114

C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\PwndLocker_04_03_2020_17KB.exe
"C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\PwndLocker_04_03_2020_17KB.exe"
1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "CSFalconService" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "CSFalconService" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2376
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "McAfeeFramework" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "McAfeeFramework" /y
    3⤵
    PID:1288
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "Alerter" /y
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Alerter" /y
    3⤵
    PID:1948
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "AcronisAgent" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "AcronisAgent" /y
    3⤵
    PID:3888
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "Acronis VSS Provider" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Acronis VSS Provider" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3696
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "BackupExecAgentAccelerator" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "BackupExecAgentAccelerator" /y
    3⤵
    PID:3296
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "BackupExecDeviceMediaService" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3168
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "BackupExecDeviceMediaService" /y
    3⤵
    PID:4932
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "BackupExecJobEngine" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "BackupExecJobEngine" /y
    3⤵
    PID:1756
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "BackupExecManagementService" /y
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3752
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "BackupExecManagementService" /y
    3⤵
    PID:2884
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "BackupExecRPCService" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "BackupExecRPCService" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1104
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "BackupExecVSSProvider" /y
  2⤵
  PID:4908
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "BackupExecVSSProvider" /y
    3⤵
    PID:1920
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "DFSR" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4460
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "DFSR" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2724
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "EPIntegrationService" /y
  2⤵
  PID:2468
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "EPIntegrationService" /y
    3⤵
    PID:3540
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "EPProtectedService" /y
  2⤵
  PID:2876
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "EPProtectedService" /y
    3⤵
    PID:3044
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "EPSecurityService" /y
  2⤵
  PID:3528
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "EPSecurityService" /y
    3⤵
    PID:3316
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "EPUpdateService" /y
  2⤵
  PID:8
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "EPUpdateService" /y
    3⤵
    PID:4532
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MB3Service" /y
  2⤵
  PID:1412
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MB3Service" /y
    3⤵
    PID:3260
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MBAMService" /y
  2⤵
  PID:960
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MBAMService" /y
    3⤵
    PID:3436
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MBEndpointAgent" /y
  2⤵
  PID:1716
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MBEndpointAgent" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:528
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeES" /y
  2⤵
  PID:3064
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeES" /y
    3⤵
    PID:3604
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeMGMT" /y
  2⤵
  PID:4060
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeMGMT" /y
    3⤵
    PID:1900
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeMTA" /y
  2⤵
  PID:1764
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeMTA" /y
    3⤵
    PID:1092
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeSA" /y
  2⤵
  PID:2404
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeSA" /y
    3⤵
    PID:324
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeSRS" /y
  2⤵
  PID:1248
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeSRS" /y
    3⤵
    PID:2488
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeADTopology" /y
  2⤵
  PID:5076
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeADTopology" /y
    3⤵
    PID:1796
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeDelivery" /y
  2⤵
  PID:1108
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeDelivery" /y
    3⤵
    PID:3432
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeDiagnostics" /y
  2⤵
  PID:116
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeDiagnostics" /y
    3⤵
    PID:964
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeEdgeSync" /y
  2⤵
  PID:1676
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeEdgeSync" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3972
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeHM" /y
  2⤵
  PID:1944
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeHM" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:860
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeHMRecovery" /y
  2⤵
  PID:1968
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeHMRecovery" /y
    3⤵
    PID:3336
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeIS" /y
  2⤵
  PID:468
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeIS" /y
    3⤵
    PID:4568
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeMailboxReplication" /y
  2⤵
  PID:2892
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeMailboxReplication" /y
    3⤵
    PID:1528
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeRPC" /y
  2⤵
  PID:3980
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeRPC" /y
    3⤵
    PID:2740
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeRepl" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1444
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeRepl" /y
    3⤵
    PID:3180
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeServiceHost" /y
  2⤵
  PID:2956
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeServiceHost" /y
    3⤵
    PID:548
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeTransport" /y
  2⤵
  PID:4328
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeTransport" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4376
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeUM" /y
  2⤵
  PID:3024
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeUM" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4016
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeUMCR" /y
  2⤵
  PID:1752
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeUMCR" /y
    3⤵
    PID:4768
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSOLAP$*" /y
  2⤵
  PID:4204
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSOLAP$*" /y
    3⤵
    PID:936
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLSERVER" /y
  2⤵
  PID:4180
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLSERVER" /y
    3⤵
    PID:232
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MsDtsServer" /y
  2⤵
  PID:892
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MsDtsServer" /y
    3⤵
    PID:1336
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MySQL57" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2460
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MySQL57" /y
    3⤵
    PID:2176
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "OSearch15" /y
  2⤵
  PID:2124
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "OSearch15" /y
    3⤵
    PID:4460
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "OracleClientCache80" /y
  2⤵
  PID:4804
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "OracleClientCache80" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4524
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "QuickBooksDB25" /y
  2⤵
  PID:864
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "QuickBooksDB25" /y
    3⤵
    PID:4676
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SPAdminV4" /y
  2⤵
  PID:444
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SPAdminV4" /y
    3⤵
    PID:3316
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SPSearchHostController" /y
  2⤵
  PID:420
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SPSearchHostController" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5056
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SPTraceV4" /y
  2⤵
  PID:2668
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SPTraceV4" /y
    3⤵
    PID:664
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SPUserCodeV4" /y
  2⤵
  PID:1364
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SPUserCodeV4" /y
    3⤵
    PID:64
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SPWriterV4" /y
  2⤵
  PID:2872
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SPWriterV4" /y
    3⤵
    PID:1924
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLBrowser" /y
  2⤵
  PID:3784
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLBrowser" /y
    3⤵
    PID:3900
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLSafeOLRService" /y
  2⤵
  PID:3680
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLSafeOLRService" /y
    3⤵
    PID:1812
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLsafe Backup Service" /y
  2⤵
  PID:3344
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLsafe Backup Service" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3384
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLSERVERAGENT" /y
  2⤵
  PID:2644
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLSERVERAGENT" /y
    3⤵
    PID:1548
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLTELEMETRY" /y
  2⤵
  PID:1220
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLTELEMETRY" /y
    3⤵
    PID:1424
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLBackups" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1396
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLBackups" /y
    3⤵
    PID:3028
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$*" /y
  2⤵
  PID:676
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$*" /y
    3⤵
    PID:2560
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$*" /y
  2⤵
  PID:1112
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$*" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2660
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSMQ" /y
  2⤵
  PID:4136
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSMQ" /y
    3⤵
    PID:4396
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "ReportServer" /y
  2⤵
  PID:1676
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "ReportServer" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1448
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "ReportServer$*" /y
  2⤵
  PID:4952
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "ReportServer$*" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1216
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLWriter" /y
  2⤵
  PID:3524
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLWriter" /y
    3⤵
    PID:2356
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLBackupAgent" /y
  2⤵
  PID:4068
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLBackupAgent" /y
    3⤵
    PID:1520
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "Symantec System Recovery" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1996
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Symantec System Recovery" /y
    3⤵
    PID:1076
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SyncoveryVSSService" /y
  2⤵
  PID:1072
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SyncoveryVSSService" /y
    3⤵
    PID:2276
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "VeeamBackupSvc" /y
  2⤵
  PID:4668
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamBackupSvc" /y
    3⤵
    PID:2448
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "VeeamCatalogSvc" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2972
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamCatalogSvc" /y
    3⤵
    PID:3248
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "VeeamCloudSvc" /y
  2⤵
  PID:4224
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamCloudSvc" /y
    3⤵
    PID:3392
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "VeeamEndpointBackupSvc" /y
  2⤵
  PID:3924
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamEndpointBackupSvc" /y
    3⤵
    PID:1792
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "VeeamEnterpriseManagerSvc" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3548
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamEnterpriseManagerSvc" /y
    3⤵
    PID:1740
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "VeeamMountSvc" /y
  2⤵
  PID:3676
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamMountSvc" /y
    3⤵
    PID:2352
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "VeeamNFSSvc" /y
  2⤵
  PID:4268
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamNFSSvc" /y
    3⤵
    PID:3312
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "VeeamRESTSvc" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1940
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamRESTSvc" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3200
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "VeeamTransportSvc /y
  2⤵
  PID:5016
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamTransportSvc /y
    3⤵
    PID:840
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "Veeam Backup Catalog Data Service" /y
  2⤵
  PID:4804
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Veeam Backup Catalog Data Service" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3996
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "epag" /y
  2⤵
  PID:224
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "epag" /y
    3⤵
    PID:1648
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "epredline" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3044
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "epredline" /y
    3⤵
    PID:1876
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "mozyprobackup" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:744
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mozyprobackup" /y
    3⤵
    PID:2812
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "masvc" /y
  2⤵
  PID:3364
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "masvc" /y
    3⤵
    PID:3852
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "macmnsvc" /y
  2⤵
  PID:1096
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "macmnsvc" /y
    3⤵
    PID:3756
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "mfemms" /y
  2⤵
  PID:3900
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mfemms" /y
    3⤵
    PID:2224
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "McAfeeDLPAgentService" /y
  2⤵
  PID:1900
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "McAfeeDLPAgentService" /y
    3⤵
    PID:904
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "psqlWGE" /y
  2⤵
  PID:2784
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "psqlWGE" /y
    3⤵
    PID:1388
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "swprv" /y
  2⤵
  PID:4752
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "swprv" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2088
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "wsbexchange" /y
  2⤵
  PID:2516
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "wsbexchange" /y
    3⤵
    PID:3028
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "WinVNC4" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1664
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "WinVNC4" /y
    3⤵
    PID:1956
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "TMBMServer" /y
  2⤵
  PID:3552
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "TMBMServer" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2552
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "tmccsf" /y
  2⤵
  PID:3936
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "tmccsf" /y
    3⤵
    PID:2216
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "tmlisten" /y
  2⤵
  PID:2288
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "tmlisten" /y
    3⤵
    PID:1448
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "VSNAPVSS" /y
  2⤵
  PID:4844
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VSNAPVSS" /y
    3⤵
    PID:2192
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "stc_endpt_svc" /y
  2⤵
  PID:1432
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "stc_endpt_svc" /y
    3⤵
    PID:4568
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "wbengine" /y
  2⤵
  PID:3352
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "wbengine" /y
    3⤵
    PID:4836
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "bbagent" /y
  2⤵
  PID:2188
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "bbagent" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1356
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "NasPmService" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4740
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "NasPmService" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2276
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "BASupportExpressStandaloneService_N_Central" /y
  2⤵
  PID:540
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "BASupportExpressStandaloneService_N_Central" /y
    3⤵
    PID:1948
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "BASupportExpressSrvcUpdater_N_Central" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3932
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "BASupportExpressSrvcUpdater_N_Central" /y
    3⤵
    PID:1444
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "hasplms" /y
  2⤵
  PID:1652
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "hasplms" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1544
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "EqlVss" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4084
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "EqlVss" /y
    3⤵
    PID:4712
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "EqlReqService" /y
  2⤵
  PID:3296
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "EqlReqService" /y
    3⤵
    PID:1792
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "RapidRecoveryAgent" /y
  2⤵
  PID:2060
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "RapidRecoveryAgent" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2808
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "YTBackup" /y
  2⤵
  PID:100
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "YTBackup" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1192
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "vhdsvc" /y
  2⤵
  PID:2840
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "vhdsvc" /y
    3⤵
    PID:2460
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "TeamViewer" /y
  2⤵
  - System Location Discovery: System Language Discovery
  - Discovers systems in the same network
  PID:892
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "TeamViewer" /y
    3⤵
    PID:4460
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSOLAP$SQL_2008" /y
  2⤵
  PID:3508
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSOLAP$SQL_2008" /y
    3⤵
    PID:3452
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSOLAP$SYSTEM_BGC" /y
  2⤵
  PID:4092
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSOLAP$SYSTEM_BGC" /y
    3⤵
    PID:1992
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSOLAP$TPS" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2532
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSOLAP$TPS" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3388
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSOLAP$TPSAMA" /y
  2⤵
  PID:1964
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSOLAP$TPSAMA" /y
    3⤵
    PID:3528
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$BKUPEXEC" /y
  2⤵
  PID:1320
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$BKUPEXEC" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:744
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$ECWDB2" /y
  2⤵
  PID:888
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$ECWDB2" /y
    3⤵
    PID:960
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$PRACTICEMGT" /y
  2⤵
  PID:4164
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$PRACTICEMGT" /y
    3⤵
    PID:1176
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$PRACTTICEBGC" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:528
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$PRACTTICEBGC" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1864
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$PROD" /y
  2⤵
  PID:4060
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$PROD" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1856
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$PROFXENGAGEMENT" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3012
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$PROFXENGAGEMENT" /y
    3⤵
    PID:2784
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$SBSMONITORING" /y
  2⤵
  PID:4828
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$SBSMONITORING" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4728
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$SHAREPOINT" /y
  2⤵
  PID:3968
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$SHAREPOINT" /y
    3⤵
    PID:2580
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$SOPHOS" /y
  2⤵
  PID:3028
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$SOPHOS" /y
    3⤵
    PID:1956
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$SQL_2008" /y
  2⤵
  PID:2560
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$SQL_2008" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2660
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$SQLEXPRESS" /y
  2⤵
  PID:2552
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$SQLEXPRESS" /y
    3⤵
    PID:2216
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$SYSTEM_BGC" /y
  2⤵
  PID:2576
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$SYSTEM_BGC" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4492
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$TPS" /y
  2⤵
  PID:1532
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$TPS" /y
    3⤵
    PID:3960
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$TPSAMA" /y
  2⤵
  PID:3176
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$TPSAMA" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3824
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$VEEAMSQL2008R2" /y
  2⤵
  PID:4604
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2008R2" /y
    3⤵
    PID:4836
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$VEEAMSQL2012" /y
  2⤵
  PID:3292
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2012" /y
    3⤵
    PID:1356
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLFDLauncher" /y
  2⤵
  PID:2084
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLFDLauncher" /y
    3⤵
    PID:4220
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y
  2⤵
  PID:2276
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y
    3⤵
    PID:1288
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$SBSMONITORING" /y
  2⤵
  PID:540
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLFDLauncher$SBSMONITORING" /y
    3⤵
    PID:4864
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$SHAREPOINT" /y
  2⤵
  PID:3932
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLFDLauncher$SHAREPOINT" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:452
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$SQL_2008" /y
  2⤵
  PID:1228
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLFDLauncher$SQL_2008" /y
    3⤵
    PID:4712
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$SYSTEM_BGC" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4016
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLFDLauncher$SYSTEM_BGC" /y
    3⤵
    PID:3168
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$TPS" /y
  2⤵
  PID:2916
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLFDLauncher$TPS" /y
    3⤵
    PID:3752
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$TPSAMA" /y
  2⤵
  PID:760
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLFDLauncher$TPSAMA" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3312
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLSERVER" /y
  2⤵
  PID:4408
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLSERVER" /y
    3⤵
    PID:4652
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLServerADHelper" /y
  2⤵
  PID:2708
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLServerADHelper" /y
    3⤵
    PID:1940
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLServerADHelper100" /y
  2⤵
  PID:3080
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLServerADHelper100" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4676
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLServerOLAPService" /y
  2⤵
  PID:3452
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLServerOLAPService" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2564
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$BKUPEXEC" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1992
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$BKUPEXEC" /y
    3⤵
    PID:4324
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$CITRIX_METAFRAME" /y
  2⤵
  PID:444
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$CITRIX_METAFRAME" /y
    3⤵
    PID:3044
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$CXDB" /y
  2⤵
  PID:3528
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$CXDB" /y
    3⤵
    PID:2828
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$ECWDB2" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:840
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$ECWDB2" /y
    3⤵
    PID:1256
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$PRACTTICEBGC" /y
  2⤵
  PID:1924
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$PRACTTICEBGC" /y
    3⤵
    PID:3088
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$PRACTTICEMGT" /y
  2⤵
  PID:4380
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$PRACTTICEMGT" /y
    3⤵
    PID:64
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$PROD" /y
  2⤵
  PID:3032
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$PROD" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4232
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$PROFXENGAGEMENT" /y
  2⤵
  PID:4140
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$PROFXENGAGEMENT" /y
    3⤵
    PID:3900
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$SBSMONITORING" /y
  2⤵
  PID:1092
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$SBSMONITORING" /y
    3⤵
    PID:5060
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$SHAREPOINT" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4728
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$SHAREPOINT" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3720
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$SOPHOS" /y
  2⤵
  PID:4752
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$SOPHOS" /y
    3⤵
    PID:1196
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$SQL_2008" /y
  2⤵
  PID:2612
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$SQL_2008" /y
    3⤵
    PID:3432
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$SQLEXPRESS" /y
  2⤵
  PID:3488
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$SQLEXPRESS" /y
    3⤵
    PID:220
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$SYSTEM_BGC" /y
  2⤵
  PID:2552
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$SYSTEM_BGC" /y
    3⤵
    PID:1448
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$TPS" /y
  2⤵
  PID:2576
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$TPS" /y
    3⤵
    PID:4456
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$TPSAMA" /y
  2⤵
  PID:3492
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$TPSAMA" /y
    3⤵
    PID:1432
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$VEEAMSQL2008R2" /y
  2⤵
  PID:3912
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2008R2" /y
    3⤵
    PID:468
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$VEEAMSQL2012" /y
  2⤵
  PID:1216
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2012" /y
    3⤵
    PID:3980
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "ReportServer$SQL_2008" /y
  2⤵
  PID:4740
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "ReportServer$SQL_2008" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4188
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "ReportServer$SYSTEM_BGC" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3908
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "ReportServer$SYSTEM_BGC" /y
    3⤵
    PID:4668
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "ReportServer$TPS" /y
  2⤵
  PID:3696
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "ReportServer$TPS" /y
    3⤵
    PID:4376
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "ReportServer$TPSAMA" /y
  2⤵
  PID:2972
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "ReportServer$TPSAMA" /y
    3⤵
    PID:1312
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\RANSOM~1\PWNDLO~1.EXE >> NUL
  2⤵
  PID:1104

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv 3V7r7uAkN02xBOA5VQFLYQ.0.2
1⤵
PID:3492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

glib.md

Path C:\PROGRA~1\Java\jre-1.8\legal\javafx\glib.md
Size 31KB
SHA256 17f453df4c551777d691c17e05bcab32f823bc38b7622cb91eb793a3233f5fbe
MD5 6828085ebab1f9444a6306d5dac2f5fd
SHA1 81acd3be11855a71558d99c36369ecce1e23445c
SHA512 fab98b4f94c966fdbe7b2beebbdfc6a5702c442e0b190119cdb24751201497fd85a16fff40b2236ddbc7e974922f69c6b0fe219be95a29e81cdaf3fd8ae1823b
SSDEEP 768:gVd/V5LZnSXslTChemsj4Q8PsY96UBo5pm35PeVRvHo1M:Ed/V5dhBChemsj4Q8Psq6UBo5pm35GVT
MD5 SHA1 SHA512 SSDEEP

Submit Download

gstreamer.md

Path C:\PROGRA~1\Java\jre-1.8\legal\javafx\gstreamer.md
Size 34KB
SHA256 cf64fdbec6f5008ee1df94df96ad7bc870435176338bebfc372380b2b7fa73b9
MD5 bfa05928f7dd450fe67989a34ad314f6
SHA1 2dfd8b704adfee330e49cf9492717c84d231e602
SHA512 d76f316482d2f1effccad910ec287a8d07f66e967f8eb88bfb264ee4b0ef3e30a623400f7ccc7e371030d5d4b69ee5dcc297aed3c82783d32f174770c958a3bb
SSDEEP 768:Ai+25LZnSXslTChemsj4Q8PsY96UBo5pm35PeVRvhVU:hT5dhBChemsj4Q8Psq6UBo5pm35GV1hi
MD5 SHA1 SHA512 SSDEEP

Submit Download

icu_web.md

Path C:\PROGRA~1\Java\jre-1.8\legal\javafx\icu_web.md
Size 23KB
SHA256 f3394a0fd0d873a3b7cb858ce97983a8ea2e3e8bad7f894f8ab3b24d9e7ef164
MD5 a12782b8496b2b73ee95ed29359032c3
SHA1 32f898d02518f2461f4e9ae3e4cf34be9239e39f
SHA512 6660c66e5b274586276095e90351438857d370cf13f451e56e1aac19892c4188f837c67931b20ea00512a5360b1d567a0f35d82c5426801a72754d2dbfa83887
SSDEEP 384:IQAWUkxLK4jA/j3HZYG+shnyTAJf2gF1QYaj4uqiD/oqvDqTFA63yedEIj/DDXNm:vAWsrHOQyTAJfnTQXj4mjouaFA6C6DU
MD5 SHA1 SHA512 SSDEEP

Submit Download

mesa3d.md

Path C:\PROGRA~1\Java\jre-1.8\legal\javafx\mesa3d.md
Size 5KB
SHA256 9a9347d3791005b917287fc18cdab8dd63573dbe7382a0a9c7dc0c6f9501f700
MD5 d3ad437ef1788ff9cfb04d46197436b8
SHA1 8e03a98fe2a12930ddde94ea7f6f2581c4684d5e
SHA512 a514015e90847d27266b12c6305aa7e682307aa5f54c7aaa8aeceaa297741b5cecdf79b373662a3d6f0642ab9dd192d725bbdc1d8dd8672245ec885880b25cce
SSDEEP 96:bnRkmAI4Ob2wvi0wJc87MOHq0D00EVAiZ8GeQNoD002MwCFAu4E/w7jt:bRktUSwuy8YOHq0AdAifeEoAbMXqE/w7
MD5 SHA1 SHA512 SSDEEP

Submit Download

public_suffix.md

Path C:\PROGRA~1\Java\jre-1.8\legal\javafx\public_suffix.md
Size 17KB
SHA256 10653a04d1694f39f6e5fbd655bd2c5be8d569635535c8c4ddc14059e4f66bf0
MD5 d1c213b4a746cf0c1aff879edf9625b0
SHA1 4857f524c80bd8ef29a482ddbd72c412e8991435
SHA512 35c65f647e33eaf1aacfcc70625faa1511cfe69573edbb06292406ead1a6f8a56b5bb334e9b588209ae2895790c19bd75821b0a6c019000fd268430aab03ee89
SSDEEP 384:gnl4wt7HVLWXt4wBZ3MssuZ3Vy9fSUr/fCp:gnXt7HBW94wBNMssbFpr/
MD5 SHA1 SHA512 SSDEEP

Submit Download

webkit.md

Path C:\PROGRA~1\Java\jre-1.8\legal\javafx\webkit.md
Size 320KB
SHA256 cddf6f5ba12b83b4595218bfe2e25285dd2e708eb84b84ffb620fae8ad8255f0
MD5 92cca8306b19d63fe4d47db5657f3c33
SHA1 dc02bdab3861eafce38e2d076b88d3c0ba292109
SHA512 28e377c105e57da817925a7ef765bc54a6791b06ee1c42569f6d070f42db251d84561b53b854573311c48843ba16f0f096a38a1df29b5e0c8ee2e962d34c6b01
SSDEEP 6144:OyqA13qG4KGBTFagIpXvMfyxz7GAB569x+JQMd4:zqW3d4KGhFagIpXEfyxz7GABux+JQMd4
MD5 SHA1 SHA512 SSDEEP

Submit Download

bcel.md

Path C:\PROGRA~1\Java\jre-1.8\legal\jdk\bcel.md
Size 11KB
SHA256 e2a223b4678e53ae5c3dc14ce0927a04850764b6983f1b1aecc4eb3c5f726d2c
MD5 f0d5e4689b051673a95f6cde833592bb
SHA1 c6b4c0675c166d44eb03645cf570735a1c041574
SHA512 08af6a1dc47e84a7080b88fcf7c53ccc69e2bec7597081f20ea9691528ba3be8cf32224fc1c60000be569aca75ca2f865b1265d0a516446b4e814999bd53d054
SSDEEP 192:FPmUwMgFCCZ4ZDY4ULXCR4a2fnBiigArXK33gLEn3c:gUw8Y4UWR4njvrE3gQs
MD5 SHA1 SHA512 SSDEEP

Submit Download

ecc.md

Path C:\PROGRA~1\Java\jre-1.8\legal\jdk\ecc.md
Size 28KB
SHA256 8130fc5ad2090b9f356a938ae0db65f2c7a242916d7e55050640e933a201c047
MD5 5fc2e5071810d1aa885eaaf96336078a
SHA1 7cb963faa4a06f846cddbc0f238f926f25fe8a0d
SHA512 c94ad34e931e387cbd6cf1e247c649eceecc4e891955b4bc139aaefbb54bcb23ff8b0058f124b5ea4d3a3c2837b59aa937339fd39162813c7e90d820416193d7
SSDEEP 768:leE+JIUh9VJ93lGS4Q8PjTJAC+pqa7sysF5QoGEVmGBUB:EELC9vVlB4Q8Pjd+pqesycbmGBUB
MD5 SHA1 SHA512 SSDEEP

Submit Download

libpng.md

Path C:\PROGRA~1\Java\jre-1.8\legal\jdk\libpng.md
Size 6KB
SHA256 e2e57a96e5f03896b0f6f82ceba959060322f52219d4b181c5d72d32ce7e7313
MD5 64e8062e5a3864bd396459935ddb1112
SHA1 7e2449f329fd043d5fb5d0134183be89cb66e5b9
SHA512 16f26bde0d71e073168a0d17811ab302624a58ff5d0575b9ea4121564499c9af655ffd3147dc44714dce3cf0ca393e1ed378c90087db42e0d52e7168705c0c11
SSDEEP 192:asnrKnyt6Z+N1ZLYMVcwiGXjQbOTAqNNIRkuAoMj:5n2nw6sZLvVc/GXjpT5Gp
MD5 SHA1 SHA512 SSDEEP

Submit Download

mesa3d.md

Path C:\PROGRA~1\Java\jre-1.8\legal\jdk\mesa3d.md
Size 5KB
SHA256 312c75b0f00241a169f0439bdb9a48e9dc6ccce58e99024a38fa5e2b6a9435fc
MD5 7940fa91d54aa7b31575a1464b56c7c4
SHA1 9cad4aba418813e07f272cff7e90515b56313413
SHA512 01e6667daad5c71628d75cbb9456737a46779b7c7e1e0530749b298a206b3b96c76ee9396d2ffb2dd4b739b1dddaf79cabd96564d1d7b73b2327dc31059c6804
SSDEEP 96:jnRkmAI4Ob2wvi0wJc87MOHq0D00EVAiZ8GeQNoD002MwCFAu4E/w7jt:jRktUSwuy8YOHq0AdAifeEoAbMXqE/w7
MD5 SHA1 SHA512 SSDEEP

Submit Download

santuario.md

Path C:\PROGRA~1\Java\jre-1.8\legal\jdk\santuario.md
Size 11KB
SHA256 62fa28f774b7d8d2f8363e6d1116e66ba3a4abe574e0c3cb1821b760bc41f90d
MD5 3b935c346bcfffa64b01a2471948553d
SHA1 07a540e4d4f9a91d3218398d2cb34f7fe3ea2015
SHA512 e2eb6e898065a07761364c99e46648c77de9279954c664b9beb7a3223225d968ac47945da78c2216b606ffba52a1a162b64ac972a8035467e63cfe0c2ec2c8ee
SSDEEP 192:0fhCqZrXXjwDZdVeDzWNcoGDpydEoXkrntDOdnEsRpft6fadL9wq+2T8riQsMiHi:2hCYr0DzAzW6oypydEoXkxDOvRceg2T
MD5 SHA1 SHA512 SSDEEP

Submit Download

xalan.md

Path C:\PROGRA~1\Java\jre-1.8\legal\jdk\xalan.md
Size 12KB
SHA256 93a63db7da2609af91abc3d17e6dbab33410e3ef884f3e520199f3a0faa66f62
MD5 9951f9426cd9deb8fa823ec7f016487b
SHA1 2c2a1c5a31357b33b95b0e99be803d5c93a054fc
SHA512 c36686111fc598d7918704466957b772569c9d05562f494af0e62b19d45d4f6a94ebe02e402fbc51d1ee9b72bc180be715142df3a3ddcbc8cf8b36831c27817b
SSDEEP 384:9Z/3Fjrm0EIScizrv/1PFJbl/9Gohn1Lw6mz:30E4n/1PXVhh1L
MD5 SHA1 SHA512 SSDEEP

Submit Download

xerces.md

Path C:\PROGRA~1\Java\jre-1.8\legal\jdk\xerces.md
Size 11KB
SHA256 456b89ad21a9d015c1e090ce25177070d588f6d88adcc50c4e4ffb5df70b405e
MD5 66b71147ea6ad5779183ff15d46cf978
SHA1 38b3bbd86fea20162d90dfcd6cb8d6eb09359234
SHA512 4c8204464fbc020c61d741b4d41c146becf467da661539d3a029dfc0076f035592c9d37062135a3aca1847a8b5ffa5144709f7feb3f4a510cbda5ec376ceb6a5
SSDEEP 192:n/HjnI+5OAET9ASvPxzRHjZaWrkCRKcF41vBFIk7VJhdoakeO3MHsW5LHRWfmo:n/HP4T9fQiNF41pFIkhdoZv8MujR
MD5 SHA1 SHA512 SSDEEP

Submit Download

xmlresolver.md

Path C:\PROGRA~1\Java\jre-1.8\legal\jdk\xmlresolver.md
Size 11KB
SHA256 3a8462564758e651cad517b5bf0410877e349ec74371cb58dea895b724f566a8
MD5 20cdfd1439e7998dfdce4cb0b394367d
SHA1 d77e0398c6bb498bb78e188141c7b50f7ff21f2a
SHA512 6f89749589a94e431b89765050b1516207f9d0fcb617f0b40609ec210d3611acb5a1f22258efff27d6254269d638c505663590853a64f537e56e0a3e93da0c52
SSDEEP 192:4kuzHYolIygoci2A57Wb/07f8s3/HVP9ZJ/xRx0A1N9VejsmohxB1xxw6S7j0F:bu0EIScizrv/1PFJbl/9Gohn1Lw6
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISO690.XSL

Path C:\PROGRA~1\MICROS~2\root\Office16\BIBLIO~1\Style\ISO690.XSL
Size 264KB
SHA256 757b8e8aab973409d4eb7c647312de4902f23fdad76c943ec64b4f7748ba914d
MD5 88b3462b8dd0408e10fe246cbfd05011
SHA1 cfa58fbcc3b9de04f11fd97ac645738dd4accee9
SHA512 5fed9e272ac8010deb43705ad4e5d29c99d142bb9440d1cc9045b2bf0c242e3ee0aa870231fd4d535528d12e74e18ef2d898f41e26793951f012d8c4e9415dfa
SSDEEP 6144:1mq8oV745R95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeo:8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Informix.xsl.pwnd

Path C:\PROGRA~1\MICROS~2\root\vfs\PROGRA~3\MICROS~1\ASOLED~1\140\CARTRI~1\Informix.xsl.pwnd
Size 31KB
SHA256 c194bd08950add2904afa8fcd317de621e8894138a0416c93f963ad509e46582
MD5 a91363f23405db7a87b9fa4ff7a0a889
SHA1 a6cf608c977016f867c86abedd34ad962bdae272
SHA512 e2c8cf9255c378c5b51f5cd10b0a82c7d57cd0f846f45f884684ce958dea17d54d855dc46dcef3f298c0b8525fcb5ec1b1424fc0b48d659d17c78c44b3afd2bd
SSDEEP 768:L9bH5UgF+VrCWAVpHYx1FecBe6UfUseTIkzHmdPkEnz:Rkt2HYzFr0wIk74MQz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sybase.xsl

Path C:\PROGRA~1\MICROS~2\root\vfs\PROGRA~3\MICROS~1\ASOLED~1\140\CARTRI~1\Sybase.xsl
Size 30KB
SHA256 46288be1b9cd3485f3d9fabeb224ae8760af010f1c0777e5591831c5728e8757
MD5 51eae42f2d3dd3d46e6cb7a9b59dd5e3
SHA1 bdf2acf6799b81e7daf31ad5274d869c15a9bf36
SHA512 f0a13f900bbef44f07a4078620076109e0127f67c45a9469394e99fea024b0f600b267d4d1ea314ee6bcd85a970a28ada8e7ae4863bbb795991e1d0e1420f41a
SSDEEP 384:E4MV39LAEAIO7y9uaD6D1P7Wa8yrwwQ/EEeTPAkzr5GMce8QRrKaV:E4GfLQ1ao16rycwQ/VeTIkzrQMB8Qpf
MD5 SHA1 SHA512 SSDEEP

Submit Download

msjet.xsl

Path C:\PROGRA~1\MICROS~2\root\vfs\PROGRA~3\MICROS~1\ASOLED~1\140\CARTRI~1\msjet.xsl
Size 29KB
SHA256 5be73f032b72e7ea6090ec1f37eda8aa5a66c9943655d1f97818c2b28f663b10
MD5 ccc2da9819691ac2fe936f5a1be55ee8
SHA1 3094fb4c50d5558818a72c1e4848f8a4b628e5af
SHA512 7c1b384ce84da3354efdea86bd869f88d95a6d4862fac92d19e99b0bf4e91c26f9312d4e4285786fb1985090a07f8fa1c89e6446ab7dcc4ed4911722d2f165ef
SSDEEP 768:psRRs+M+7vRG+y5L/XHYxhudyzZOMLQpf:pWfmFHYyy0
MD5 SHA1 SHA512 SSDEEP

Submit Download

sql2000.xsl

Path C:\PROGRA~1\MICROS~2\root\vfs\PROGRA~3\MICROS~1\ASOLED~1\140\CARTRI~1\sql2000.xsl
Size 34KB
SHA256 30aeb62b58f366ce702592606b6520a95329da228e68c180371231a135659ca9
MD5 e66140d9f66817db8a91099e5901af2d
SHA1 fc007d27e9286fb8f3b979b1150e00f79a2e0773
SHA512 9e1ac3127f609bb009a4c48dd91601b4df9aa54447599cab63adeefa5c6dd9a6eaaf1f2ea0683cf9c18d1f96436053e9a13970fd39ca7694ec94c702490df505
SSDEEP 768:uO/EtdlbdQRKfEHY/2KHYxhUVgkmmXR5CfAaPkEnzE:7/UdQuEHK2KHY7mhyAaMQzE
MD5 SHA1 SHA512 SSDEEP

Submit Download

sql70.xsl

Path C:\PROGRA~1\MICROS~2\root\vfs\PROGRA~3\MICROS~1\ASOLED~1\140\CARTRI~1\sql70.xsl
Size 32KB
SHA256 b3b94c522874937a5b33a8f66bcf178be8cd0f1e2fbafa9d4d2b718e45d8beff
MD5 5698dc282d38515a85c01eaa8569cee2
SHA1 a16006645b99dbe540b764b3ad5af5808e25591e
SHA512 5e1f68fb3c5bd9075a90687f5d764c1424cb740378a4ca102e76405822080068bb3886e81a5e877f943be24cb15827d7d24998dbc36d21d9b888f24d8b17f803
SSDEEP 768:xx7qA1715TOtRA4r4g+NybLtcQC2zHvRnjwHFZlV:znZ5TesN9ijSFrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

hive.xsl

Path C:\PROGRA~1\MICROS~2\root\vfs\PROGRA~4\MICROS~1\ASOLED~1\140\CARTRI~1\hive.xsl
Size 80KB
SHA256 dae2db16d9e7c4fdd0ba1c47ca41889b71630d87a25ac9778ff093f48f76a0bb
MD5 b2bb933c058639dd396a943b2120c2f5
SHA1 ac5bd623760a4224d994f5f7dc6b4268ae95a714
SHA512 caf6d708029cf257b239c49116592f7f396597bd89344f37a340622cf48f8defa81f8095143e1ec94d8865d35748da692fd7502cbdf3e0cca2aa2f67791203a8
SSDEEP 1536:iwuVQ8nmWJ8sllbxHc3oHt8K4gE1KlBb4bt0J0AKbT:iwu3JWtz3
MD5 SHA1 SHA512 SSDEEP

Submit Download

vlc.mo

Path C:\PROGRA~1\VideoLAN\VLC\locale\da\LC_MES~1\vlc.mo
Size 584KB
SHA256 e2b28083d562b2ca64da6de391068208a9ce4957e9f02d08091f2c47718250a4
MD5 f3067ceb7e5004b9696f017a6cb8dc42
SHA1 78790bd00c08b9c6826a41c76a5883ff181b4075
SHA512 3892797bc5a366c7c74647faf438c5c0e80ac2f0bf5f2a026c504b071ada404cad54f554e7ceee02e582f43dc16366bfb7dd85e9a156e10c7cf81512a78de0a2
SSDEEP 6144:8Rwr0WbnRplU4gUXl9ZFltZCgEe5B7SsRoimsA8eBYEp+jmIvbaeDatCt74bdq89:Z0YjUYXlfaK5oJByaeFchcwrFx
MD5 SHA1 SHA512 SSDEEP

Submit Download

aic_file_icons.png

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\images\FILE_T~1\themes\dark\aic_file_icons.png
Size 50KB
SHA256 542bf7e85fd9163138ae1d73e0e15155f756879096affaee4b986013f0ee0cda
MD5 cf67c988befd3c5f064095a2bba9bdfd
SHA1 13963cb1a784b0d1e58fb0a7d8c4e9abf04d9b36
SHA512 28da1bcd37582b5f5e1a73205de7f9a26e7d2a8852f58ac0422bf3b9b1ad35dfa37af972328af9789d31c352cf5175ee9955f7b3fb99be913d431e13d5ef1a34
SSDEEP 1536:zG4gXImYKB2+uQH0OFNdY74NR2hg05Np7T:a4RDM2uHXFV/2h/5f
MD5 SHA1 SHA512 SSDEEP

Submit Download

s_export_18.svg

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\images\themes\dark\s_export_18.svg
Size 7KB
SHA256 49ff3bda56131678d9317e865f8b0b0667fe4238074fefeacc08bd6dc5311410
MD5 9a59cca47c44660e57609077bf5d295c
SHA1 ccc6a9c09345860ead200f6c949d315d8138f582
SHA512 3f643c6a86522f06ea45a37d91450097d6d81da43c116aa1f87c07ec13c628be02f4c7c6cc9c4ed613e98d3a88d30662c5b7c93cf4731c7301e54a1790bbddf2
SSDEEP 192:jHtbLatbO1OuwQfml6UZJU1gJftJDoWezXTAwZKbIVJ:jNbLcb+OOfm6UjXD8WezDbKQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ui-strings.js

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\core\dev\nls\root\ui-strings.js
Size 28KB
SHA256 060ee07f329cdc2dfd00ba580272c28258ed94438fa956a1381f3b6a9a5bf92e
MD5 e6e09aeee13c8ee68185be65fb8d0295
SHA1 ea98bf2ff0606a5480c1b264a805712012ed434a
SHA512 0bc11c83500a454bbb0fad1e44444216be23bea348b57ed442d5ba40805c376c9d4092ebbebf75f88a5c18219a503400edaa3a742c42428042365833a7b2df89
SSDEEP 768:Cuz4qXnPVnM4k454o4xJ96js3YL83d/TylOI16PNNXUM2:jRXPVM4kq4o4xnv3YalIsP/2
MD5 SHA1 SHA512 SSDEEP

Submit Download

ui-strings.js.pwnd

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\files\dev\nls\root\ui-strings.js.pwnd
Size 7KB
SHA256 ba6c2f392b56a96fb74699e314b134f8ba885734fc6493c89adbd5c0c322cb97
MD5 9c6f84440286d8ec7a25ad0da68983bc
SHA1 aea71c06e7a8a0f440e6ea92fdd4ef79583b92e3
SHA512 88a2bfa6fb6791988c6a38f9f0dc9eff5cfc4d04c9f75fdd2f672aeeb16d31df9d7d02365499662153b390272ab3a8138efb34e4203f81a07147ecaa044fd670
SSDEEP 96:Ct6IHujLy74BdtVRPEhRIC2bd0t+bWnYpnT2SVWgIQLnGAiZvN662ydLPWnMaa1t:Ctrnhc7OwbVtLGPZF3Nsa99K6k+1yM
MD5 SHA1 SHA512 SSDEEP

Submit Download

ui-strings.js

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\ACTIVI~1\js\nls\root\ui-strings.js
Size 4KB
SHA256 a79712a769b78920204f464cf1662280f735e8a82127d68156420e257e013b9f
MD5 14c0e708b3b9b52df9985bd9561575af
SHA1 b68c9c51864cb44238a421b68828c9e575737489
SHA512 7773f3fb181fd61ddcd936cce9bc77247cf6ec2b965f474c2b3de2db0f1dd9d1273342a04af29f4152f9e4f7a3c94304ce84d96e47b620eda47767d65d0bde85
SSDEEP 96:Q01eYyjFG8nVX3tCDrZ27/+Z7M2rJBEwT3ef:THiVX3tCDICJ9T3
MD5 SHA1 SHA512 SSDEEP

Submit Download

illustrations.png

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\MY-COM~2\images\illustrations.png
Size 8KB
SHA256 09ae3d5af5806db202153232b9993a5378e9401afbe2265cc51780eafcfed4fc
MD5 57c72f93bdeb91e74533a077a8c84397
SHA1 a37f4ee37b1befe1327c86291af47525e27a0cab
SHA512 a9de820b6af1f9baa29baf84110bea92ae4a2586ec449028786e39112338eb7cf7b30f1566cf25809d2b9cd971fb5e5ad324cd798cd80a536b7ac2d70c58dce1
SSDEEP 192:oo6uPpI8TD36+xTAWJeNsANxGU5Y9Jk5mMKCPpeE82uL5WWWWWz:ojupjbMgeFjF5Y9JL6vb
MD5 SHA1 SHA512 SSDEEP

Submit Download

illustrations_retina.png

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\MY-COM~2\images\illustrations_retina.png
Size 19KB
SHA256 7f4a2f7cb01fd712015504477e0b12ba4fea87b450eb70b9f72644a7159297eb
MD5 cd440e839dd72fac9340d39be67e0339
SHA1 ced2fb36a645792a60884000397f5bedb4db0cd2
SHA512 fb89097fc81e5b3acfdb10e3aa2d2fc3b485b4455084a589f7bc56c94cc20a3749600b320c9be8faff84271903aca6df781bb9f14ed502f5330f4ea5c1c1dfe2
SSDEEP 384:w+c2Cqbt/YhbnIfqn8ZZ5A+S9NiaNfIvS+uipP8xyupxY0mCCJhh:wj5q5AhbnIfY+S+Kl+uiV8oMxY0C
MD5 SHA1 SHA512 SSDEEP

Submit Download

ui-strings.js

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\OB-PRE~1\js\nls\en-ae\ui-strings.js
Size 4KB
SHA256 26e5df52b2c44f048bf7bee45d02214203389d6ec790ac96f5beaf923f9b4ffc
MD5 765aa17f1751a25a004e8aa369316c8a
SHA1 8c500e856a0966437e675b858b485067fc63bad2
SHA512 e4e650cd5d12372b46d5ec4054ad3a8accf022013d595bece2ef75e2a295b6bcc004f396f232630d02f289a6a5b08a6f63d76956ed9f2eaf7537989b5bb7b365
SSDEEP 96:B001eYyjFGHpkV+GgNqs6Ye34+GBOUfPda9pxOklHudLEwS7dNj+gOFzU/FldM2:dHhpkoGgQsO34+GYUfPcOIELEwS7dNKi
MD5 SHA1 SHA512 SSDEEP

Submit Download

PlayStore_icon.svg

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\ON-BOA~1\images\THEMEL~1\LOCALI~1\PlayStore_icon.svg
Size 5KB
SHA256 255fc87e724f15b3397c12686b2f58d90f498d30ac3a9cbbe52b202523c07848
MD5 941fd5693bab7d9411845534e8bb89b1
SHA1 2e6ba8df4a7f62a2be86dd2430d5a839c1002c74
SHA512 a15fa483587d2e556dab51254ed97a003239f503c9586b9cd83d056391b5359a82ce427adb0ae57458ade82d83661073e32510e735400f9826a3b05dbdf24f7d
SSDEEP 96:+d4hW4Fh81Yud/ibllvKvGDaiBCKUJEorM+ePWst4KfsiMFvR47BhFdjwcCl33AN:o4hW4DXc/ibiOfBC5JEoo+Jst4EF85WF
MD5 SHA1 SHA512 SSDEEP

Submit Download

ui-strings.js

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\ON-BOA~1\js\nls\root\ui-strings.js
Size 13KB
SHA256 530154d2a061b697dad79eddc3484fb9b7a91cdce41bbf8a3d59cc7e810700bb
MD5 09305e06e489ed37e0e355154091a46e
SHA1 80aa7e81c0f142f6fbf3e7c964f2e460ac5c2d19
SHA512 a9ca553da02031470cb6f9c34c6dbebb84c8d2f7e6623780877cd389f3fe63838f2c1998b0c63905fd52b620fe8fe0522450a6b48983e398fa1960c26bbd1846
SSDEEP 192:bvOkTJPEaIUDVQqCwqgWZCUa3Em8wNhBBBMd3+Vhr26xyT1ZXWxLKFa0afQznFH:7dPpDp/gA3DzBBBBhqpWxN0afQzF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Download_on_the_App_Store_Badge_cs_135x40.svg

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_cs_135x40.svg
Size 19KB
SHA256 2f1d20f5b27f46c8c4f8f022908e5412d2bde4435b63a0cd7ff1d28f8eaee29c
MD5 7c86c647c06de5961cf4cabeef3f5b36
SHA1 8655883d4ae7a51d3b75855079f6d396bc701782
SHA512 3aa985e1bbc2cddbb7df3dfb91e98afc23bda43b4c387d1460081e741dcb483756e72f7dd56f9cb769f6810107188629b047af98251a5a611d374ac8d86bd4e9
SSDEEP 384:Pkm2ne/0GThhYGyWJ0PAivAny4IRLBQ+wlziblP+Pq7h5nTWFjqlKq9K:vt0kYGygFiI/v4SUT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Download_on_the_App_Store_Badge_da_135x40.svg

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_da_135x40.svg
Size 15KB
SHA256 4fef78268a6f590aacab0a3fc73927522e8d7864fa0aed4614fe70d859c1ccf7
MD5 6ea1b03212e934e2c43d6ff75cdeef97
SHA1 97db5f098fde8ba0de0087a8789558fcdbe5f8a9
SHA512 efe3e0f7bc8ea0cdbaf02c3e67e89d954c37536d79fd369e253170052548b2feebed0731b42bee822843a0305f2e62df71dbe114e371408f452f8d32bbb1f94c
SSDEEP 384:U8yn4un6H58K/rKJ5Xiha/NXBs+4lziblP+Pq7h5nTJx+2YRh:7hH51qXNqj4SUTJQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Download_on_the_App_Store_Badge_de_135x40.svg

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_de_135x40.svg
Size 17KB
SHA256 488e7251c8c8720349b7c3eb76fa8b86f13a0e65b5d2a8fb1c583e9d24812fc8
MD5 90b92dad827a7cd44b2fc7016dfd6109
SHA1 feb3c0d0ac41dc5e9c98444311f936aff80da1a9
SHA512 ddac655114c98d18e0060e84fff9fcdf8346fdb2b92fd0e9f65519d15c58f6931e78b4f3470ecf645f06d5daf566ff0a495a79b2ff918572074403d06afb7673
SSDEEP 384:I45brmUdehZzbOUkM7EeBg+4lzdPSCP1Ctc/onxv4DiX7Yl6:5BrhcDzJ3ejPN0cQrrYA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Download_on_the_App_Store_Badge_es_135x40.svg

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_es_135x40.svg
Size 23KB
SHA256 9ccf6c4b0815b69c0c837f9b922c6155e51d6317cbe5fcc42ba34ceaf389672a
MD5 7b81174a08768970f681e4e5be57e1e8
SHA1 ee438352c64cdfcd8a646abf2c33973898a73209
SHA512 02ef0485c91cfa3fe0b29b89ac0b59280709190faf9f0890a0b9eb89bcbb81fe79b3a4c7d63c8662658558a0519075760cfbcc4e8256a8c163b33257b8599952
SSDEEP 384:I8yn4un6H58K/rKJ5Xiyz5L6yWbuweCixAv3FfP75oti3CFHq2i6oRvA73cR3uEa:XhH51qXd5LO/X1v3NatcQH2IKe2ATV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Download_on_the_App_Store_Badge_fi_135x40.svg

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_fi_135x40.svg
Size 18KB
SHA256 93c4e5f0e32f5c4da9ce319438c66fb0655793bd128aeba3860103a9bd3505b4
MD5 a1161b2c0adf0e299216bee7914e0f11
SHA1 3e18e90cde4006bb5bbe03397c97003ca61b7f3f
SHA512 6ba3dc2dec44027f9a4224cee987c872c77129e0860f203cff064f94518365a7203c78aa85cae7b7fa90706c0c99c9393e661f6d005a59ed2c73663ce7a073e5
SSDEEP 384:L8ygv42HgtT8hfJ+4/3wqgQjLR6Oc0GuKiOoMY9zYsF8nTEnPK7nMvcj:gHgt4hfJr/wqgQ0T0QiJMY1Yu8TyGMkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Download_on_the_App_Store_Badge_fr_135x40.svg

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_fr_135x40.svg
Size 26KB
SHA256 72935fd8ae39f74435a37ab1f135ec7bf83e014bb90a983596d54efc6d875e8b
MD5 db77a5a9db81f3d3667350fb87dce68a
SHA1 095dfec4d01b535fec866e1242b9d4bdd6e7b73b
SHA512 1f39b1e3e47e4b1de8d3b3fc5e0040d9601ff50e9f3591a3eb6a5c5a4fd7578c55b6db14549d41d8f2002f6d0039da2e7ee149f4170913a448d1f4f6378a52e4
SSDEEP 384:qCBzgLT3pbO4ljGzPFdyqd05Ive5FRqtmWGTZur+rhNaGHRSsh8CzH:dB8fpC4FQPbTmImg0Z02OMBh8G
MD5 SHA1 SHA512 SSDEEP

Submit Download

Download_on_the_App_Store_Badge_it_135x40.svg

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_it_135x40.svg
Size 19KB
SHA256 58d8ecdbd7f25656d58c676bed1822fc64e596e99aca27c163eda19ea4e6c473
MD5 6d5ac1a28417a3be6a90384dce8d8f10
SHA1 a01262aa3524d77e0507e9cf255c70ee9e1dd51d
SHA512 02b722cdb68307cf903fe2974a0d37fe0b5f1c08b77ac0fe2fe45637cd396a3e23c6382460e6a8c99c8f46606f672796d485ec115f4697c09eb06b3e633b4390
SSDEEP 384:qGUyqpSdHsNTnuP1eEa+iFAO1BC8VdcBxs9q+EUOJRCmZeiAdM:DUy0SdMNKyFZP3ecENJRpeI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Download_on_the_App_Store_Badge_ja_135x40.svg

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_ja_135x40.svg
Size 17KB
SHA256 18f13185d4b9736cb369326985bc7c4dc87743bf3486634dc6bc56fe3c7da27f
MD5 8b7927b08a17fc78e87f7ba05316c719
SHA1 6a6acb2aecd6ea2fa92e5af7bdf9cdfa540da640
SHA512 49c6f766b5bdba90e9aa6cd875b096507a47759e20813ea257f1a488b175fa4801e715903d11b51d70c63fd338c1da800fd1ce79b22a7ea48e599b937fdea0d5
SSDEEP 384:M8yRsH3jzRWWtUYs1dX3sMxKe6buPu7tLv9EwGXoDUM0:uKzAOG1dH5xc60tLv2q
MD5 SHA1 SHA512 SSDEEP

Submit Download

Download_on_the_App_Store_Badge_ko_135x40.svg

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_ko_135x40.svg
Size 17KB
SHA256 bc7be2cb09c8686e8ddc3b73e5e3d99e7b4ff8ddbdf0e074a24610ab9d9c61cb
MD5 9db49ba1a41f91959c981984f918664e
SHA1 3a478ce2c195d99e687d77fb697f41a4f5354a71
SHA512 557eabbcae308d7593dbaeb5a340eefcd2a73fcb6fc206c1673287e8d6353f253013bc7a9e53640c9b876049a13d232e19c70287e426d24785cc14aa43651b07
SSDEEP 384:58yvUC2MjLcbyltYroQG0K2j9q+SUO5eUZ2ZnpGHNQybRvka:jUCF74VG4PSXeUZ29pn4ka
MD5 SHA1 SHA512 SSDEEP

Submit Download

Download_on_the_App_Store_Badge_nb_135x40.svg

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_nb_135x40.svg
Size 20KB
SHA256 4b416aa7e710d8f7c78a6bbae98ee2957cfb15200f20f2d5c29d644a37eedb69
MD5 f34cf0b9d26c00de698a499b6082c9fa
SHA1 735d0f2d6baab2c619a373b53aa1d2b82bb6589f
SHA512 2cb6763159b1e7f2eafc95e8a812288e32c24e6b53855bee954e22eeb3a82521707cf65e4768f8da1216add8011116d47610974a6e64f9d0818743ad99e78b89
SSDEEP 384:j8yrClKd41QIqgLk7tD7vH3HDBxPh2yaPnJWCF7Zq/Ih0Rvo7sGxPln:D8QpD5PzPfGJWQcWWAs8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Download_on_the_App_Store_Badge_pl_135x40.svg

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_pl_135x40.svg
Size 18KB
SHA256 1b139ee7b5d395d54575dc8050ac20d579f834e1babdd9a3b56c8cf4fd82fbf0
MD5 97663316e85221ec1bf86624eddd5c55
SHA1 a868f2afcd63c7ab1de62ba794546871de9bc721
SHA512 f409f60ed311494d5d42e1fb218962ec8d60e9604bf19ff964518ad3c3870aa8ad07b4adac65f09d5f90d861e59c2fc3a5fff6754b37bf36a60bc7e075736b3f
SSDEEP 384:4Ml1MOYFEqliRFrZYvw04SMxM7CkuH6O4F0QcIMhPoCmE+nTMVRPzNuBM67:rR7AMrD04yN0XjoffTCNGF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Download_on_the_App_Store_Badge_pt_135x40.svg

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_pt_135x40.svg
Size 18KB
SHA256 c0dc33a9de9fdc70d5fa50f5db54bf9935a9fe54e58a0d535d4cc7650f682629
MD5 d00809db05dd5ab6b4b2081eaa90359e
SHA1 9471b5838e5c64fa8b526de7e056fc50e812c7f8
SHA512 7777273a4d6e2c9dfdfeecc20f2abb80a2bc36f1119d438b8f74aa7371aed04492f1980bd9d7f4ee8ac5370da014e86e2c7dfaa0fe0f680c8b9280a512076734
SSDEEP 384:f8yrClKd41QIqNcTUDwsGLsZKzPH0GDYrizxbGHCMUoiM3:P8QpNcgmpUUESl7MT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Download_on_the_App_Store_Badge_ru_135x40.svg

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_ru_135x40.svg
Size 23KB
SHA256 ec1a9c0af0d82fb6b3f2698e177d977efa09e7cff352d5c76199b26fa7c544db
MD5 4f720e0a8440d77a69e00f50b999838f
SHA1 a58ef7a8b55998999296ee54bcacfb36b92b3b6b
SHA512 dc9c5a1caca7396c4fc94a09892b2e9d938fff23727671943f947e7b971bf43ce05f1cae5db8cbf0efe8ac4f8a68b8c43eb4dd6f1f6b7a5cad9a8077f662c09e
SSDEEP 384:d8yn4un6H58K/rKJ5Xi23f/XKdxgKE9W/cVdpyH98FyDRn4UKdre2kSN3FmUMeVJ:whH51qXJ3XKPgH9WCpqu412re2Tz+S7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Download_on_the_App_Store_Badge_sv_135x40.svg

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_sv_135x40.svg
Size 17KB
SHA256 a67ad02b3745864f71f19b889e090e5d54738fee711e677c4c984604019418ae
MD5 687e36ab4c0a6521046e32e83a20548e
SHA1 9e76a0864dd514e8b7018e92310990befc135f42
SHA512 458da9049a24a32beb31b761e45bd666f896610f58763d186ebd8e0e24667834e5a4118c16daf7ba92a1fd7871bc58d18a5d204981adfabb971d57723a2bf1b7
SSDEEP 384:x8yn4un6H58K/rKJ5XirTDYrU9xMjS4zuaByv8Ctz/kgTer:8hH51qXwTypI80zz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Download_on_the_App_Store_Badge_tr_135x40.svg

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_tr_135x40.svg
Size 20KB
SHA256 bc102afc7ffbafebbef9bed2f022ca9136196c3433cce67486f9530a0d9a6417
MD5 192f710e53c50c7a61ee191992c1f1ba
SHA1 4c1e0c2818e103fd7b84b3ca8a356d1a3c6daef5
SHA512 16abfa8b590ffd9fe78e1fb8e33115a25161c95b6f96c754f6baac6cdcb97e0bb7b3f2389444c088408699bbaa8bcf0a9f5e38581236968d0185756b0d709de4
SSDEEP 384:U8yaKMnJw7rM3PG9Z8IAH1GpSdKQ5J+1wY7hNRuGZoj7:iOwvM3rHRNJolSyoj7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Download_on_the_App_Store_Badge_zh_cn_135x40.svg

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_zh_cn_135x40.svg
Size 13KB
SHA256 91eeb733c21bc16570ea1a713c3ca3493208567b742b625cf293c8b23dabce3f
MD5 aa49ed5824496f2c6bf83b6e16610444
SHA1 ab49cc61b5857a6cf847423e5270601824cb9d26
SHA512 39193c0a62036ca5cc958d737b83c2f79c0e617365fd5e5e21bfbb9b06ceb7012c3faedce01e3483803453fff877c17c11059621144231f83e00e08f740606a2
SSDEEP 384:xbj6iY1X4gcpZsc+4lzivUlhmZ1krWi5/gT:xbSofp5jCpSWui
MD5 SHA1 SHA512 SSDEEP

Submit Download

Download_on_the_App_Store_Badge_zh_tw_135x40.svg

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_zh_tw_135x40.svg
Size 15KB
SHA256 b353b7dd1d0a0e4f7fd217f81f6b78cc384148fa5d35171b72fa5941f87e33ce
MD5 8b2b9ee6dd9ae39f891c3c7cd64bf2ca
SHA1 aa645854043e3ba38d610eff35c7d6562ddf600f
SHA512 d375566343e1bf9361eaa79f318f2cdd15e323bd3e6a882718f8b9c86b8fed6a00b6966e073394e330d0b66551349cbafcd4f41c558bc1a07c58e582d974b9de
SSDEEP 384:8bj6iY1X4gchCgsl0+r4DzPWF+ugJ02G:8bSofv+rOWFb
MD5 SHA1 SHA512 SSDEEP

Submit Download

cs_get.svg

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\cs_get.svg
Size 5KB
SHA256 10b0ff650bc21d4530b961e87fe61d8d3f98bd1c87cc20aa36b2253f14b15f27
MD5 28681e2444f38295351a82391602a699
SHA1 52a815fccec02b87393c225affe781ca8c945c92
SHA512 89dda219fd60ee95461f7074c4348049af919948e72d1b75445e46a01b2d484bcd497f9c1b6d25237f88a98e8a3cdd4f9b4d51dba8204f6c54224bfc982866cf
SSDEEP 96:+IUnKe0hKE1G/rEGKU6jbxa4JVINRlNKc4KxgjAPkd37971lte1n3gDPHtr:XAKe0hKEI/o86j9a4PIN3NKvyPkZ971X
MD5 SHA1 SHA512 SSDEEP

Submit Download

da_get.svg

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\da_get.svg
Size 5KB
SHA256 d03dc40b612b7563f2145b910bfe7e8e7c218efb7b8f309704ee70ecc54b61e4
MD5 0d51542386678af10330f927afd3b533
SHA1 1967cae29ddb5b30d37c1dfa39892fec79d2bd8d
SHA512 be382cc6eb6757fb9f4ed71e09e9466e61fb2d4202aaf6b23f08353ab09e7b0de5cdaca2c62a3b997a62e1490b343901fd724c7e916389c0d8b52cb131c3f20b
SSDEEP 96:+IUnKe0hKE1G/rEGKU6mbxa4JVINRlNKc4KxgjAPkd37971ltePLn+xrgKmTlXFg:XAKe0hKEI/o86m9a4PIN3NKvyPkZ971Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

de_get.svg.pwnd

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\de_get.svg.pwnd
Size 5KB
SHA256 6c532e75b858b04bbbaa218f6ae24d574621b13e149e3a7e907e6d1529e22be2
MD5 6900d1f5dd7ac60843983ee545523364
SHA1 917527960dd5e87279aa370c80e8d0e57a78eb73
SHA512 2c3b259e5432b26e048be8fc40674def19cad35f282086d383ad1f4f78a7370b142845429ffd6e20a17924bc1c67beaacb469c686dcf1568ecee3e054602d654
SSDEEP 96:+IUnKe0hKE1G/rEGKU6Hbxa4JVINRlNKc4KxgjAPkd37971lteWJGfqU159vIP:XAKe0hKEI/o86H9a4PIN3NKvyPkZ971R
MD5 SHA1 SHA512 SSDEEP

Submit Download

es-419_get.svg

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\es-419_get.svg
Size 6KB
SHA256 2b04e753869f6d7f7a8c41c5df72db687b266955afc5d6679c005de9d4ac6401
MD5 68a6d1188513d936fc68549b27866396
SHA1 2dcdb63cbcafb89b3d7ccc4383705c6cc6cdde45
SHA512 1861d4162e17d3b3669c93a6f6e1e040016e4239f63d1b34d70e9090ec506e1c05df16847617dd400c08ed9f49f1789779888e5fab40bb04709a03a942164489
SSDEEP 192:XAKe0hKEI/o86iK5pGy3F9uym3TBGjTdOMSHE9qS3A2HbyGHkI2c:Xx2EEo75p5Fk9GjTdOMGQqSlbh
MD5 SHA1 SHA512 SSDEEP

Submit Download

fi_get.svg

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\fi_get.svg
Size 5KB
SHA256 43849b05134b243f0081b6574be8f30a3250aa02393344401cae6d85ea2f2c74
MD5 6de42516b6330da8551ec326a213c5ff
SHA1 25d275986e3b1b2449099d63bc22aba8b8871c42
SHA512 b2d98c482e5c741fe036ad74b672dee85bb48175c5ce8c01841e010f4749eb347542d9e342dee758d9029561cfd4e91319663325483d4a476b3e1b79c10d0f28
SSDEEP 96:+d4hW4Fh81Yud/ibllvKvGDaiBCKUOCEorM+ePWst4KfsiMFvR47BhFdjwcCl33D:o4hW4DXc/ibiOfBC55Eoo+Jst4EF85WF
MD5 SHA1 SHA512 SSDEEP

Submit Download

fr_get.svg

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\fr_get.svg
Size 7KB
SHA256 343f4e839acff8a4073de67103151b34d86e5fed20c6192d8ea565656306aedc
MD5 de89525510169af53fb660910e7a8cba
SHA1 52f13b3e0af39a4801ade91bef583b2ae9a3b256
SHA512 371cdd49e66faadfcde4ace01de33c0d0709d4b54db04b87fbd15cee71a8efeda14d32a0a2bf025d63d5f867003cc7299db8c9052087beeb0a6715a3273bf2e1
SSDEEP 192:XAKe0hKEI/o86YK5pGy3F9uym3TBGjTdOMSO6x9qS3AH7f2oVvD+:Xx2EEoJ5p5Fk9GjTdOMOfqSeJVvD
MD5 SHA1 SHA512 SSDEEP

Submit Download

it_get.svg

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\it_get.svg
Size 7KB
SHA256 67eea158590e4036aab2eb1c3bb52f02fba7c30335d1e2f5831a24c4c4c53fc0
MD5 e4335592c410b9f40f5f3847d788cc9e
SHA1 c4e01840e5b3fcb149c4013ac18e62903551b05b
SHA512 7064187c440ec0a64725af8145a6c6eb6eff62179a9db6ce7a466b56b0a1d440ce5235b17e25a023875f1688c9bbd4b6d6165da84cc06b9577ccc6360faa084f
SSDEEP 192:XAKe0hKEI/o86eK5pGy3F9uym3TBGjTdOXYQ/dyjS3AU+EjyoKE:Xx2EEo35p5Fk9GjTdOoQ0jS9bjyP
MD5 SHA1 SHA512 SSDEEP

Submit Download

ko_get.svg

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\ko_get.svg
Size 5KB
SHA256 c16cb46d419b69efdfaa8b5823dac083164aff78618d1e374bcc5b5594f53b20
MD5 c5317806c1287831f89be1528250a349
SHA1 7e26b4eb2830640eb4756787ca84450e4ce83f32
SHA512 f05713220e2c9a445ad9bd736ff0c726a3d4d1ca348c47c6583878fbe95282ed98a92f97605f57df8144a19a4bfa4a208c63eac48a65fe5ba8df39a3f4e61033
SSDEEP 96:+IUnKe0hKE1G/rEGKU6qKK5gEGy86F9UfyoE5e/3TBbDVsjTdyFVmVUosbj9njwF:XAKe0hKEI/o86vK5pGy3F9uym3TBGjTN
MD5 SHA1 SHA512 SSDEEP

Submit Download

no_get.svg

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\no_get.svg
Size 6KB
SHA256 147867ac8dda1e0bd574da0d5d318b382ccb3b232f437968168c6470d7e1b06d
MD5 62c5f44c7bfadfb174aa259caea01469
SHA1 89aac98e2cd1435aaff1a0f701fac9285c77e297
SHA512 e16b457a7ae16acf9e733eb56651e8568cc83030add73598d320d0cfcf46840471d6cdbb71b6cc1aa0d2ee66348e3ef38df34dbefcc325e5e5fc1fee8fa452a4
SSDEEP 192:XAKe0hKEI/o867K5pGy3F9uym3TBGjTdOjzfM0yx5lAXeA/WAzSi0k:Xx2EEoQ5p5Fk9GjTdOPfrsAXtZ90k
MD5 SHA1 SHA512 SSDEEP

Submit Download

pl_get.svg

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\pl_get.svg
Size 6KB
SHA256 ea8131375cc0914d3ef7de0de5d1907d8cd3d59669572c982132269b45e961bf
MD5 ded9ecb3a6741f835067d36554782bec
SHA1 94d0564386ee884fc812ffd19a98fbf1d5f2c441
SHA512 24c0c0dde11497df2a61a77d5ead614ebef71e8e8f59a84ba75b80d4321f24ed6006308122f0a5d8f313bd3158d52af4fcbc93c275f056b661f83a85bfe8680c
SSDEEP 192:XAKe0hKEI/o86YK5pGy3F9uym3TBGjTdO8DYoGGXOIick:Xx2EEoV5p5Fk9GjTdO8NGGFV
MD5 SHA1 SHA512 SSDEEP

Submit Download

pt-br_get.svg

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\pt-br_get.svg
Size 6KB
SHA256 2b5017eb304c86ce5ae108e3a86d51d22d043938bda14902467d990c518b4546
MD5 c855f25f8726a751a00e79f0b0bd823b
SHA1 ec04918b9a9fe2d4194515cfc2e0b7f67cd4f476
SHA512 e3166ebef6df43e34b827345e1fb40939cda792cdc53ed0c64ea5f24f4f99b82c2acfaf21135e0a6c6794d0edb7a493fdf7f5766ffb20a1a9f140a8b30ee58b9
SSDEEP 192:XAKe0hKEI/o86HK5pGy3F9uym3TBGjTdOCjPGntBM6witkJ562/Q:Xx2EEoU5p5Fk9GjTdOCCtBzwit4562/Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

ru_get.svg

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\ru_get.svg
Size 6KB
SHA256 0165fb8f0c6998723cf0ad78e86645f5cc3672068b7838e7a35d07c227fec8f1
MD5 327a390f105c1b284689559ca806d679
SHA1 b8e82de686bcdbbb2cc0bc01aa0bdd3bd306a424
SHA512 f98fe1e919d7e47229745279bc95318035ad41ee81c6f5277ca0f94deaa426b9a653a222c329438bf03875818d86209f4e74cee315e7c6ed9cb492a984a4b9fc
SSDEEP 192:XAKe0hKEI/o86XK5pGy3F9uym3TBGjTdOmMX5EtM0QgW:Xx2EEoU5p5Fk9GjTdOpXOvQg
MD5 SHA1 SHA512 SSDEEP

Submit Download

sv_get.svg

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\sv_get.svg
Size 6KB
SHA256 6fb3fc284f4c7ded6d8d263f6d2fb2865e22febe495a2a5b1cd8387536de5ca3
MD5 9626583a0c4d71595dffe40b4bf7e1e7
SHA1 90cdc727c807754cf1acaaa1f9bbf4eb30450905
SHA512 8e79ef11f0bdb1c0ea9c0f237e8a0ed524a3d9457c36a0ff792036d59a12417255f56e3f4e86e32f0ffde63cf4b8467a526ee6ecb430be6d882f06554f6c354e
SSDEEP 192:XAKe0hKEI/o860K5pGy3F9uym3TBGjTdOYXyr7e6SQoRJO:Xx2EEoF5p5Fk9GjTdOYyrS6SQoRw
MD5 SHA1 SHA512 SSDEEP

Submit Download

tr_get.svg

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\tr_get.svg
Size 5KB
SHA256 f509f9e84a0836df2459cb75fff9c87183d92898f27cd1fa71dd879ee45eacc9
MD5 3ec5ea64d0b75da60bec597b438dac3d
SHA1 35da3d538242643edd53990e6217ed2f2f26c274
SHA512 2baaf77b2092c348ab371218ae4406e61a418cdb157af09d17ef49efd9f6b9614543311805e00f53bb77809e36c0e826d8cd01c73b3a8863a9013ecf7c3eae99
SSDEEP 96:+IUlaH0hKa/rEXXlfU68K5gpDIBlSJ8Gi+8swjpSJ1huzwVMOVl4nwTdi8LZ:X7H0hKa/oF868K5UwaCL1jaizwVMOVlf
MD5 SHA1 SHA512 SSDEEP

Submit Download

zh-cn_get.svg

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\zh-cn_get.svg
Size 7KB
SHA256 99f0805a8803c34bb0b95a1f41eac00829d69a8ac9d80d1dc8a239ab1392201c
MD5 13f42d42698516d7b2d158f4f1a962a0
SHA1 d93c3a6f8930d8cd8e52cdf0e9e1f0b6da192830
SHA512 21c91a0d2d7d2a1fe3ab92683e8a9ed81ec8e66a4b3da3843d423a274621da57893f6c99dbc6cf0e3237cafd78124c712d17bbb6a688283c121e356a83db797e
SSDEEP 192:XAKe0hKEI/o86rK5pGy3F9uym3TBGjTdOCaDXIOOoqi/fQ:Xx2EEo85p5Fk9GjTdOd4OJo
MD5 SHA1 SHA512 SSDEEP

Submit Download

zh-tw_get.svg

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\zh-tw_get.svg
Size 6KB
SHA256 1bcd9b4e8328db3852f2caf15c19ebd84b90b3310a75b3e7e41e707d936699a6
MD5 962ab3c191357cb164d136ffc958449f
SHA1 b528c7aeff0e98ea2c50b26408805bbe3bc451d3
SHA512 5d45b09b7f7c79bd83714fc54b904c36e5b68d64f972b8babe8c2946af242d6be6279876ff56e493423e932b77dec6557caec6f21defcc3800a3164faeac75f7
SSDEEP 192:X7H0hKa/oF86oK5UwaCL1jaizwVMOVl08JfatpCklBwrW:X7v2oF55d1jaiz3O7LJfatp0W
MD5 SHA1 SHA512 SSDEEP

Submit Download

progress.gif

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SEND-F~1\images\progress.gif
Size 19KB
SHA256 b52feef5377b7cfea65fba6ebf695534907e3a3e05a4a751f85413402e10405d
MD5 ff6e259771ac9ef63a477f1d4ddb32a7
SHA1 794161b535c46111fb1a01570d833aeb44c0a25f
SHA512 439c6419acd60adf07c7b69bfcd34128f6c02d73a8aff5b2916c108e2e1c027554ef058020d15d6b7c763d88e751a71f504c193b97d0dab594743fe230001188
SSDEEP 384:UcIsUP/i7643TYT26J8fxv2hX4eIlBUy0NaxHktQWjmhwl0DJs:3ITP/i243K2C8AhoeIHUyuRKWyhwl0D+
MD5 SHA1 SHA512 SSDEEP

Submit Download

faf_icons.png

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SEND-F~1\images\themes\dark\faf_icons.png
Size 6KB
SHA256 6e24425428288ff0b7a1d4ec5d2a33bc47318187b41ae018c02c55a6344df58f
MD5 510a7f09241821bdda1e4adb5c09b21b
SHA1 cfa9a0aae1a8a8c05fca8a62e963a5a56fdb9a49
SHA512 a422fea9bfd9ac83cf4897e8ab2733ad30c3c00f2416406c42d4c2c3ca508b69d5e6c35874f72b49747111ca856481d3910d801de9593759f3350a6c74826668
SSDEEP 96:fDh/JaPi3FyBkvSlVC+vDXhPXLmbdJUabMuMIB9v6UEiehC5CT5vPRUigC:fSPiQGuCwXBs2UMKCUE1h+CTxP/gC
MD5 SHA1 SHA512 SSDEEP

Submit Download

ui-strings.js

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SEND-F~1\js\nls\root\ui-strings.js
Size 8KB
SHA256 fc24034d00b42c0702daa57d877184a6b8d55df0adf0d7dfb3315a1d67f2c119
MD5 39797d27bd777252918f8c2a2c9b7b3d
SHA1 2e1c43c8a7ee912dfb72cdd7028da5d1b58f98d1
SHA512 852f08a1761e409f462e53c7a7347e55a598ff0a938feb8ba944337ee422c0038faa2291b2fa68a6f36e1d442b2744a4f28c29a80bb466a844b82f658d813468
SSDEEP 192:mHBQPAcIxjpH+YwMBQkW2xpgWyuej6FjZJIkPDoLoP8q:sJjjepvkvxpByuejSjXPoo
MD5 SHA1 SHA512 SSDEEP

Submit Download

cstm_brand_preview2x.png

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SIGNAT~1\images\cstm_brand_preview2x.png
Size 4KB
SHA256 57ed01bbf7033bee4ba4157734a3efeec4a08a1480e29e0720e548a5fd712b0f
MD5 d1a752735bf2120a66a43eff27620522
SHA1 7e71944b665d211790734a030814410904014ef7
SHA512 229b765d45ba24778a435a97bc755cf8ec29e27d5119ee2916c679b41e2d7d3c2996be4cc0ca1ddcbf859f8c85fa7b58f4068fff6f84de97fdaa54158b6eb44d
SSDEEP 96:PdBcV9eF910kZbpHGxnLCrt23Lkb9aYwgs5OmpQHlwYlyEyFg2PpOdjjKqQytdm:PvcVWH0knGxLCrtMw94gUOmp55Fg+pMI
MD5 SHA1 SHA512 SSDEEP

Submit Download

illustrations.png

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SIGNAT~1\images\illustrations.png
Size 4KB
SHA256 ef76ca2e610a9a30a7455b79491b0eab084e6b9792394ed06fb019e7571142b7
MD5 fd07876908c374e05f132827822f7a5b
SHA1 c7ae3aef4c52afc8ee8de3cc07bf32eb5cc43a9c
SHA512 bf28a9709d10ef6ce136892794df57e63229180f58b42ccbabfc09c8fcb9c60b4c48741260d02dfcccc1b088d9e40294da6a9d47e727f446ef9d1ebdb252f2bc
SSDEEP 96:fhV5dtb7UwRp2RDafQhhZyMwXwBo+AeTTEjmcM5A3l:nzCwvZfz9XsF5ZcMu
MD5 SHA1 SHA512 SSDEEP

Submit Download

ui-strings.js

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SIGNAT~1\js\nls\root\ui-strings.js
Size 13KB
SHA256 903d2727d59ed02d5088a28c422e19c56339b967558d2101a50472c5e623dd8d
MD5 2cda418c696158e4beb304d1ff40c993
SHA1 d351b09043783abba4e8fbaa13470aaa6930401c
SHA512 4f804e65b0c54d7330df66ccdb04dde2bd94ce21037dab187a107e276a64110f18170457c9a9cf0ba1a0a2df3bc74543f098d0afc0f9331644665b818260e50d
SSDEEP 384:/datzwSFgha3fbIovhVqp2pGg9EUZxlHRsHFboi:/wb33fhVq8pGM4HFD
MD5 SHA1 SHA512 SSDEEP

Submit Download

logo_retina.png

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\TRACKE~1\images\logo_retina.png
Size 6KB
SHA256 157f9065062b0b02875b0a825d442ad3591c586b4f45b7fff402bf0a0fa7e4fb
MD5 723fe70a41a5e02bf7d1fdac00c1ce56
SHA1 7fcb35ae7b2332f607209c9dfd03c006560aea52
SHA512 4fdd8d7ff4a1f0c5d9529f68c5a970221a5fb41f40af4990c8c0b5bf0be2494454c6dabd098e534925ad5774a307eab5d2283cd97acaa9db04a58d9dea6d3dc9
SSDEEP 192:XrWHIvWizInclrt9umuH8n2xEcdnqD4KGRI/NHA2cnD:bWHWzIcFwu2SOLR0xc
MD5 SHA1 SHA512 SSDEEP

Submit Download

ui-strings.js

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\TRACKE~1\js\plugins\TRACKE~1\js\nls\en-gb\ui-strings.js
Size 10KB
SHA256 b720b5a1efaca0c151754f4134b384ef4c513531b9f45950d7d1c3167bb0cb8a
MD5 20189301a758b4d2046ef3737c1e1e2b
SHA1 0f68699ee36a1281af44d608def633efa1822582
SHA512 e8ca0959ca9bb1a99aae9bbad83c955a2c1d779f13477269a9dd39ec10990af2c269345604c748fb650121f00ac99884885b0c9d649b1bfa0a08c53cd4a731be
SSDEEP 192:ZHjs9wHO5G3FcOgBRWxFsASBxjq2P1bGSlf7QnPtHGZXJywzV:RsaO5G3FcOlxF5EjvpGgDkPtmZZDzV
MD5 SHA1 SHA512 SSDEEP

Submit Download

ui-strings.js

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\TRACKE~1\js\plugins\TRACKE~1\js\nls\root\ui-strings.js
Size 14KB
SHA256 89f52959956e6ef81a6cef466d95252a7ff49db3fbd6b2f2790f426a4c7112af
MD5 19ff659400c056816157ce31beb93b1e
SHA1 6724fbbe453e4a28d1980f4b15658c4377bac34d
SHA512 8683378168a2cf78762df28f5c6de3e65b2a0e7915c826a5b1298414a41f19052d597c91f4c35551f72b03d177899672b12daee291111195802364a7b8dd210e
SSDEEP 384:JbDWaQzwSFgha3fbIovhVqp2pGg9EU8kze1j:JHu33fhVq8pGM8
MD5 SHA1 SHA512 SSDEEP

Submit Download

ui-strings.js

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\UNIFIE~1\js\nls\en-il\ui-strings.js
Size 18KB
SHA256 d85cafeca4d2b7ac3a50605150e9e0e3ed3a1520cc918ff9d5dce403916c8c8a
MD5 71376fbc54299906e8e2f88bdeef4f23
SHA1 283d547685e4a3a61a88aee5b1e3ef8a367801cb
SHA512 45f1fb57f53b2255f70342c8ca8c731d05f4c2a416674c0989aa7654c81ad012d0f30c298e553fad604fc2fb53e962c275910f14afa8562e9329c50a2db60b2d
SSDEEP 384:Gg59craf3RYZ1m24p4NMRQgnO8EvxSkgbFLPzHbWP32abs5WzooPIOnZfPD:35urae1miMirx3gt7u32ZYEo/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

convertpdf-rna-selector.js

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-selector.js
Size 175KB
SHA256 4edbbfde40d21f8dd142cac70071e45116d89dadd054dd912411d66f234791ef
MD5 55fb0b0ef9e7a2f6e6fdb0a2f9cb5813
SHA1 522dd98c552d636712fdaeb3356da75617391c13
SHA512 90cddb59261ffd48c1441adfa20131c98b12a893b2cbf945624c5f98600c387cf8ce3e8c3726ec341619a1bf37da9fe259b86bc74742d704fb8ffa7ad649c427
SSDEEP 1536:WQwHD+8lYJEjtKqh4hjlfL46iwVLSv2yJ+obugn849NxVxrg+IYL6cGGxiVv4A8R:kHDblYDhjZ4UWNy
MD5 SHA1 SHA512 SSDEEP

Submit Download

exportpdf-rna-tool-view.js

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\aicuc\js\plugins\rhp\exportpdf-rna-tool-view.js
Size 385KB
SHA256 515d99fb1422c1f40a10915e25bbebcc883914d060eed8d0f439799c19b73ac9
MD5 b985797c7e4c9ea0df03074a951cf972
SHA1 c801662247c7425124b6d44cc4d2256bcefe1c98
SHA512 9c1396891cefe70f90bb4916002c621ef32624f875c5aa493256b18b8bbdd2ff3bf8408c9e313e20a27824590820c6f67b2dc534adb55352aa125859613d8abb
SSDEEP 3072:y7CfPZdutpuB3doAGmD0ffCKykIGX98fDbbKq2123IHBAHtDa:t3ZYtpuB34mD0SKHIbR2123I2ta
MD5 SHA1 SHA512 SSDEEP

Submit Download

ui-strings.js

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\digsig\js\nls\root\ui-strings.js
Size 9KB
SHA256 17fc47da85612271100fb118c16db4ee83a72d3c531742b2c067cf1cad7a56c5
MD5 579cea12faf899213fa233dc8b54f934
SHA1 5cff4489976cd2b1c6294f75e826ee40e0437fe1
SHA512 d61aae468869f170b511a71f312870a7fb0efc07101a00939b1b31f731edf7a4d61174c9f2f6edec10815957b90ee3128c7dd24431662e4171b7e5d482c0352e
SSDEEP 192:ZHZucEg9hftzY6MShnQ2yAwUHEkrlRcIWl6sYCW+gzlqiTY8LdlOs5dNBYYOE:LkQhZY6MShnQ2AUkWE5YfrzAArJMsLNi
MD5 SHA1 SHA512 SSDEEP

Submit Download

new_icons.png

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\home\images\new_icons.png
Size 8KB
SHA256 663f0583f8883fc192f6a88de697b352ea15b893aa27d16b4233a54b27ff3629
MD5 58dbc5c4a57186fc1942139d0b322adc
SHA1 534c8beefba46f37f66a24117197d09fc85baa53
SHA512 87df78f90d813e13e42bbbe7a334fa456e116976987e45c6823af6ab709e3b083b066a46e0dac598148bf96fbe968f01ba55eebc4c6dfa7ad257030d2124f747
SSDEEP 192:ZKspzWtX8ZztpDXD4KwHMge3gGIXXbi0hNBQ7Cg:JoOztxF3ZrYLDhNB4C
MD5 SHA1 SHA512 SSDEEP

Submit Download

new_icons_retina.png

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\home\images\new_icons_retina.png
Size 17KB
SHA256 c4dc253cd1a9d33a4ba420e138676a5189c7eea397ae93c6809d713732276109
MD5 8af29721e93b1c91153ac7084e4a70ad
SHA1 a2963444ba46f89bd58202c757d54cb3e6a24197
SHA512 02f770bf838bed043f730fed27792428c608018aafd052e073855cc9813184f02d80e1a46c930f5958ec00ce9d0be527ca172bcd2840cdd5d6625eff4d52319b
SSDEEP 384:Nem83XCSFn20bdydBOQcjbVWWvQps+6upH:gL3SSXIKQcj5Pk
MD5 SHA1 SHA512 SSDEEP

Submit Download

icons.png

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\home\images\themes\dark\icons.png
Size 8KB
SHA256 7e8e3301dcec4215256eb682c88f8d9a144d32b22afeb2e7bdf88a4cbb33ba5a
MD5 de82a926ef3b7bb70f82f55c7381f55e
SHA1 ab88a914b33bdff7d90246826bc7bb801956c702
SHA512 120cfe21b847d617b0142fd9e5404a405c450184c3e746746fdb73746ddcf593442bab38553e805f0b11fc63bc43adc46bf51d2e0dcbff45983ca496cb488554
SSDEEP 192:a77pEk5RCD6ZIKecCASgHO4ByLn8yU2l4dXsLucxHQK:mpHrCD6ZIOyLn8ml4daxwK
MD5 SHA1 SHA512 SSDEEP

Submit Download

icons_ie8.gif

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\home\images\themes\dark\icons_ie8.gif
Size 8KB
SHA256 42c56c10b0b54105ba2dd609e4e143546a69cea7eb5e4b2704f9a710f4ab0ecb
MD5 e8e619c7acef2146d72f1adfff2b9ad3
SHA1 936476169fab6c6fc661e8f8acf18d562dc8f7b9
SHA512 188324b1cd86cbb46f4f07ad332c483314d29d7dde842efb8af06a0dc68307a2609a6d9ab6801fd63ee4d090b1fb85d86c4a0c132f87b0cf88dd652cc421ea8c
SSDEEP 192:PhUYc/M0F8xaKato/pCuXlbVpQTpK/U/RPoBkfQV6i:y/M0yfay/pCGbVpQdK/YDf
MD5 SHA1 SHA512 SSDEEP

Submit Download

icons_retina.png

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\home\images\themes\dark\icons_retina.png
Size 15KB
SHA256 72aea2c7c6d84551ca5aeb09c15a08f78a9899829fab55f6d277e2f7ba9fd8d6
MD5 b025e11492dd9b17be8ad2f8bc392a94
SHA1 dedd7267a4fb48aecb552ecd48ffcb5180041e64
SHA512 bacc4764a87b01dbf561316df8967c068e0b5c01fc3e6286de6abf661123335572ff8f42b779c001b3037e15b6014195d5309d4afcc3305555a6a98d1333950f
SSDEEP 384:f7m4R86fYDOkY1pP8HozsGdWCBq3iaRLVHpFYYAd:DB6OkYzP8Hoeh3iaF9Yl
MD5 SHA1 SHA512 SSDEEP

Submit Download

ui-strings.js

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\reviews\js\nls\root\ui-strings.js
Size 14KB
SHA256 3c89c049bfe351d2958b308f20331007706c218ffceba85b4e1cc448d797600f
MD5 5c3f450ac376d8c1be2fd99547c3598f
SHA1 9e8e47c9cf3e58f4b6ae3859bda862475118f230
SHA512 325eed21c472955d1539a026644a13912bfb277f65552da6ffc9270a6d8fad7e1b313d88a3f13b110fc6edd9fa154f01816f9b355bd60c6b7df60743480bd226
SSDEEP 384:5++rUB5nmQM4MK/BhxF5aLgd+OgWmbKKM7lHRsHF:59UTjM4JhxjaLTORmecHF
MD5 SHA1 SHA512 SSDEEP

Submit Download

USSres00002.jrs

Path C:\Users\Admin\AppData\Local\Comms\UNISTO~1\USSres00002.jrs
Size 3.0MB
SHA256 8f10fa162702d263c8a1829b192d94f89f3983f13d5c862b2d493155653fdf74
MD5 38bc8b7e4b3442170e63a62cd7d317ef
SHA1 8b3ed9e128b2a6e9bf8120965597d9bf3e472dc7
SHA512 5cb896dedb4267d0aefc99b02910d63133505b6746e365a5e4119b5984054f6d602a6619a174de79b1f5e7447f224b526b29a58c11a7051b52d1549fedd5e4c6
SSDEEP 12:3DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDO:+yAj4
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\USERDA~1\Default\GPUCache\data_0
Size 8KB
SHA256 c1f05aa72af09aae949f83d059b479b95558402ec8e20e57d6e018d0eabfe526
MD5 3e69dc6ac9316bf8dbfaea83bc39dcfa
SHA1 d417804bcbe85c58e992c3ef1bfac680cb30bc06
SHA512 1f4dfaa48e36d8af54ddc590ae2a87a8837f8c606b3680eced914293e3cee3747d5d1b63a939e3ebf3062754b1078a9b437c7998404d95f53833a3f7822104bf
SSDEEP 12:dtDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDm:d
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\USERDA~1\Default\GPUCache\data_1
Size 264KB
SHA256 b9cbb431f66630eb58d7fd09161983a6bb3fce215e6121a2c27411c86b63500b
MD5 7a779985627b047b80addfcb74802eac
SHA1 e7e98b5df3c48395e1731b41a60cd5a404d1a204
SHA512 6791c010afc80f1d2bd068ffa5c486f912906c1667ebf065c5e8b9c8dd6e43758bd758f83d460f16f28c1ec8148d2b0f84ae401ed4707a61e9ab31e92d0ceffd
SSDEEP 12:U/xT07DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDf:2Fy
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\USERDA~1\Default\GPUCache\data_2
Size 8KB
SHA256 81304cc87e0d6f937eab34ee718b359cb83c708d64cef860f3f1319bfb78c26b
MD5 5dd74d4d7f4ba71fd104a84e27a56cf8
SHA1 11513b0edfea8f768515f2e932b211df544e716c
SHA512 54433b6334cf8165bd025a9633743a62eee0fb362ae072448d9f45c48d467178b5ad5c36ee51b2822729c8636c3cbbfc21955ef139e39f485c0a5120163663ae
SSDEEP 12:9DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDP:GcD
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\USERDA~1\Default\GPUCache\data_3
Size 8KB
SHA256 cd8576d61d266e92b1ccf4c357ff18b95cd878564db74c3f9b6fe59d5b61fc5c
MD5 c7139aa071c2ebf649258ebab727ac9d
SHA1 79f2b23fa040a43c5c5535ef0eee419c83bf0d59
SHA512 8b23665780c89f237e17afab5a3c57f07913e5c34550bddb103cd4f36ab696bae585a2d944eaf27a5ae16747eaa9ab2cc8fa24015ccad189b9dad9d99cec25cf
SSDEEP 12:2DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDP:C
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\USERDA~1\Default\GPUCache\index
Size 256KB
SHA256 ad643bba78385c548a40b95bdd606f77498b2ad262a39d3408dd63bad24ec855
MD5 d53a1a815f1be3fa4eaf2b12a66e646f
SHA1 ac4fdf6b6efed65898620be77bdcfebde33c531c
SHA512 843524178fc1421dabce85a79661ee7118597c12a5a44325c16513875cfcb3d7b65fb9fb2a40375742ffce7af1fa3fee9a3d50f3bea71725d5c8411352007f87
SSDEEP 12:Ls8Pc7DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDS:wzFw
MD5 SHA1 SHA512 SSDEEP

Submit Download

places.sqlite-shm

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\YL5UZ7~1.DEF\places.sqlite-shm
Size 32KB
SHA256 ef2b193d2c7cca507e89e138beda70b2ab81c66dffc0c055d8bc5cf5e42867bb
MD5 96c39c69b3de2154f3046a8b2b854080
SHA1 5eceac9d19aace22dd9e1c18a31f2406410e7ac1
SHA512 c7a0d6ca1806a16202f2f2c334adaca503cf02602719f244b8788807f4aa8c16073444a16c9a82314259b921652b2d27a9f23bd37c46d28de4cf1fd703191680
SSDEEP 12:pCSaCF5DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDB:8SzCp
MD5 SHA1 SHA512 SSDEEP

Submit Download

1451318868ntouromlalnodry--epcr.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\YL5UZ7~1.DEF\storage\PERMAN~1\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite
Size 48KB
SHA256 1fd0e062c255c98c071eb4d65537c30f5c26670b92eda04173a47358f9d5f954
MD5 3d0bb884465a90fbd3a997f2e3f8acbd
SHA1 870e994ecfc2ae82c47b3e85428356f4e579e676
SHA512 35f67a8c2b1e9930163f07d38f041e2fa3f8ba5909bf54e444349c292fb4ec5f517424dfef7d7ef1446e34dcd7d0ceca5b968b1a8770bf65260ef95aa2a3f83f
SSDEEP 96:OaWV4LFQPtIVj7EHnemD9zt9OEfYiEcphT/t+E6mXcH0U:OajL6PtgenemDxt9OgYiE+T176mSh
MD5 SHA1 SHA512 SSDEEP

Submit Download

H0w_T0_Rec0very_Files.txt

Path C:\Users\H0w_T0_Rec0very_Files.txt
Size 1KB
SHA256 710134a6f194afa24b8374666ebcfaec47d36c310bd1a90f3e634c017f1507cf
MD5 b2ccdb9e6b914e7ae08defd418e526e9
SHA1 9a7e36c5f16df2d8f462d0bbc94324b65aab0b79
SHA512 f743ac73c8337c78de40f3ec23fb4d9a2aaf38d3e23b844aae4ffa45052fe8feb3ccce2ba6fc8a5fb94ef828dcf54ebba7d990671f0f17d94f3eea2a2b7f4cc1
MD5 SHA1 SHA512

Submit Download

memory/1728-1-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/1728-0-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/1728-14580-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/1728-14582-0x0000000000400000-0x0000000000407000-memory.dmp

Download