c5741701b3866459dd1ffa2477cfd8776713612912693a5897f78aac795d23e9

Resubmissions

31/03/2025, 00:22

250331-apdw1ssjs8 10

28/03/2025, 22:52

250328-2tfd7avl15 10

25/03/2025, 14:57

250325-sb3mbsxxht 10

Analysis

max time kernel
523s
max time network
535s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
31/03/2025, 00:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RansomwareSamples/PwndLocker_04_03_2020_17KB.exe
Size

17KB
MD5

16a29314e8563135b18668036a6f63c8
SHA1

90cf5ca4df9d78cf92bb865b5b399a4d2752e55b
SHA256

4e6c191325b37da546e72f4a7334d820995d744bf7bb1a03605adb3ad30ce9ca
SHA512

45c023e6dd4202079e913b8946825b47fab30b584bbd79b0416152cc4a54975b12205393827289c1f03feb71b54d3b6b34490be3001e9b565c1f89e13e752032
SSDEEP

384:RJueT9Jtx33bRsoOjhveu+q7hPOx58Zbxe:RJueJx33bDO1uMbc

Score

10^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\H0w_T0_Rec0very_Files.txt

Ransom Note

Your network have been penetrated and encrypted with a strong algorythm Backups were either removed or encrypted No one can help you to recover the network except us Do not share this link or email. Otherwise, we will have to delete the decryption keys To get your files back you have to pay the decryption fee in BTC. The price depends on the network size, number of employess and annual revenue. Download TOR-Browser: https://www.torproject.org/download/ Login ax3spapdymip4jpy.onion using your ID I1VF02 or contact our support by email [email protected] You'll receive instructions inside. You should get in contact with us within 2 days after you noticed the encryption to have a good discount. The decryption key will be stored for 1 month. The price will be increased by 100% in two weeks We also have gathered your sensitive data. We would share it in case you refuse to pay Do not rename or move encrypted files Decryption using third party software is impossible. Attempts to self-decrypting files will result in the loss of your data.

Emails

[email protected]

URLs

http://ax3spapdymip4jpy.onion

Signatures

Renames multiple (5967) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000\Control Panel\International\Geo\Nation	PwndLocker_04_03_2020_17KB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 26 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Public\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\3DOBJE~1\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\DOCUME~1\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\SAVEDG~1\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Public\ACCOUN~1\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\DOWNLO~1\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\FAVORI~1\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Admin\FAVORI~1\Links\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\Office16\1033\DATASE~1\DESKTOP.INI	PwndLocker_04_03_2020_17KB.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\TRACKE~1\js\plugins\TRACKE~1\images\sat_logo.png	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Tracker\email_all.gif	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~3\PACKAG~1\{3A96B~1.882\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\TEMPLA~1\1033\Word 2010 look.dotx	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\app-api\dev\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\ON-BOA~1\images\THEMEL~1\HomeBanner.png	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\ON-BOA~1\images\THEMEL~1\LOCALI~1\fr-fr\PlayStore_icon.svg	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\VideoLAN\VLC\lua\http\images\Folder-48.png	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\files\dev\nls\fi-fi\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\editpdf\js\nls\fr-fr\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\OB-PRE~1\js\nls\fr-ma\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\Office16\1033\ClientVolumeLicense2019_eula.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\VideoLAN\VLC\locale\kab\LC_MES~1\vlc.mo	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\images\S_IlluCCFilesEmpty_180x180.svg	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\images\themes\dark\acrobat_parcel_generic_32.svg	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\ADD-AC~1\js\nls\ko-kr\ui-strings.js	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SEARCH~1\js\plugin.js	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\Google\Chrome\APPLIC~1\133069~1.60\Locales\sr.pak	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\LICENS~1\PersonalR_Retail-ul-oob.xrm-ms	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\Office16\ADDINS\POWERP~1\tracedefinition130.xml	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~1\VideoLAN\VLC\lua\intf\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\UNIFIE~1\js\nls\da-dk\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\LICENS~1\Access2019R_Retail-ppd.xrm-ms	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~1\MICROS~2\root\Office16\MSIPC\da\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\Office16\PAGESIZE\PGLBL027.XML	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\vfs\PROGRA~3\MICROS~1\ASOLED~1\140\CARTRI~1\as90.xsl	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~1\VideoLAN\VLC\locale\it\LC_MES~1\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\UNIFIE~1\js\nls\sl-si\ui-strings.js	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~1\VideoLAN\VLC\locale\gu\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\core\dev\nls\ca-es\ui-strings.js	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\TASK-H~1\js\nls\es-es\ui-strings.js	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\TRACKE~1\images\file_info2x.png	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\Office16\1033\ONENOTE_WHATSNEW.XML	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\ADD-AC~1\images\themes\dark\illustrations.png	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\digsig\js\nls\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\MY-COM~1\js\nls\en-gb\ui-strings.js	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\ON-BOA~1\js\nls\de-de\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\Java\jdk-1.8\release	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\LICENS~1\Excel2019VL_MAK_AE-ul-oob.xrm-ms	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\editpdf\js\nls\de-de\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\EXPORT~1\js\nls\hu-hu\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\fss\img\tools\dot.cur	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\OB-PRE~1\js\nls\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\updater.ini	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\Office16\LOGOIM~1\WinWordLogoSmall.contrast-white_scale-140.png	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\Office16\sdxs\FA0000~1\cardview\lib\NATIVE~1\assets\[email protected]	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\VideoLAN\VLC\lua\http\css\UI-LIG~1\images\ui-icons_222222_256x240.png	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\images\s_share_18.svg	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\Java\jdk-1.8\jre\lib\ext\nashorn.jar	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\ACTIVI~1\js\nls\pt-br\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\WALK-T~1\images\cross.png	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\InvokeEdit.lock	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\LICENS~1\O365BusinessR_Subscription-ppd.xrm-ms	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\LICENS~1\ProjectProCO365R_Subscription-pl.xrm-ms	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\LICENS~1\ProjectProVL_KMS_Client-ul.xrm-ms	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\LICENS~1\VisioProR_Trial-ul-oob.xrm-ms	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\files\dev\nls\root\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\DESKTO~2\js\nls\ru-ru\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\ON-BOA~1\js\nls\da-dk\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\reviews\js\nls\fr-ma\ui-strings.js	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SEND-F~1\images\s_agreement_filetype.svg	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Resource\TYPESU~1\Unicode\Mappings\Mac\CORPCHAR.TXT	PwndLocker_04_03_2020_17KB.exe
File created	C:\PROGRA~1\Java\jdk-1.8\jre\lib\jfr\H0w_T0_Rec0very_Files.txt	PwndLocker_04_03_2020_17KB.exe
File opened for modification	C:\PROGRA~1\MICROS~2\root\Office16\PAGESIZE\PGLBL020.XML	PwndLocker_04_03_2020_17KB.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Discovers systems in the same network 1 TTPs 1 IoCs

discovery

Remote System Discovery

T1018

pid	Process
892	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1728	PwndLocker_04_03_2020_17KB.exe
1728	PwndLocker_04_03_2020_17KB.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1728	PwndLocker_04_03_2020_17KB.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1728	PwndLocker_04_03_2020_17KB.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 3980	1728	PwndLocker_04_03_2020_17KB.exe	82
PID 1728 wrote to memory of 3980	1728	PwndLocker_04_03_2020_17KB.exe	82
PID 1728 wrote to memory of 3980	1728	PwndLocker_04_03_2020_17KB.exe	82
PID 1728 wrote to memory of 3016	1728	PwndLocker_04_03_2020_17KB.exe	84
PID 1728 wrote to memory of 3016	1728	PwndLocker_04_03_2020_17KB.exe	84
PID 1728 wrote to memory of 3016	1728	PwndLocker_04_03_2020_17KB.exe	84
PID 3980 wrote to memory of 2376	3980	net.exe	86
PID 3980 wrote to memory of 2376	3980	net.exe	86
PID 3980 wrote to memory of 2376	3980	net.exe	86
PID 3016 wrote to memory of 1288	3016	net.exe	87
PID 3016 wrote to memory of 1288	3016	net.exe	87
PID 3016 wrote to memory of 1288	3016	net.exe	87
PID 1728 wrote to memory of 4668	1728	PwndLocker_04_03_2020_17KB.exe	88
PID 1728 wrote to memory of 4668	1728	PwndLocker_04_03_2020_17KB.exe	88
PID 1728 wrote to memory of 4668	1728	PwndLocker_04_03_2020_17KB.exe	88
PID 1728 wrote to memory of 4328	1728	PwndLocker_04_03_2020_17KB.exe	90
PID 1728 wrote to memory of 4328	1728	PwndLocker_04_03_2020_17KB.exe	90
PID 1728 wrote to memory of 4328	1728	PwndLocker_04_03_2020_17KB.exe	90
PID 4668 wrote to memory of 1948	4668	net.exe	91
PID 4668 wrote to memory of 1948	4668	net.exe	91
PID 4668 wrote to memory of 1948	4668	net.exe	91
PID 4328 wrote to memory of 3888	4328	net.exe	93
PID 4328 wrote to memory of 3888	4328	net.exe	93
PID 4328 wrote to memory of 3888	4328	net.exe	93
PID 1728 wrote to memory of 3700	1728	PwndLocker_04_03_2020_17KB.exe	94
PID 1728 wrote to memory of 3700	1728	PwndLocker_04_03_2020_17KB.exe	94
PID 1728 wrote to memory of 3700	1728	PwndLocker_04_03_2020_17KB.exe	94
PID 1728 wrote to memory of 1752	1728	PwndLocker_04_03_2020_17KB.exe	96
PID 1728 wrote to memory of 1752	1728	PwndLocker_04_03_2020_17KB.exe	96
PID 1728 wrote to memory of 1752	1728	PwndLocker_04_03_2020_17KB.exe	96
PID 3700 wrote to memory of 3696	3700	net.exe	97
PID 3700 wrote to memory of 3696	3700	net.exe	97
PID 3700 wrote to memory of 3696	3700	net.exe	97
PID 1728 wrote to memory of 3168	1728	PwndLocker_04_03_2020_17KB.exe	99
PID 1728 wrote to memory of 3168	1728	PwndLocker_04_03_2020_17KB.exe	99
PID 1728 wrote to memory of 3168	1728	PwndLocker_04_03_2020_17KB.exe	99
PID 1752 wrote to memory of 3296	1752	net.exe	101
PID 1752 wrote to memory of 3296	1752	net.exe	101
PID 1752 wrote to memory of 3296	1752	net.exe	101
PID 1728 wrote to memory of 2200	1728	PwndLocker_04_03_2020_17KB.exe	102
PID 1728 wrote to memory of 2200	1728	PwndLocker_04_03_2020_17KB.exe	102
PID 1728 wrote to memory of 2200	1728	PwndLocker_04_03_2020_17KB.exe	102
PID 3168 wrote to memory of 4932	3168	net.exe	103
PID 3168 wrote to memory of 4932	3168	net.exe	103
PID 3168 wrote to memory of 4932	3168	net.exe	103
PID 2200 wrote to memory of 1756	2200	net.exe	105
PID 2200 wrote to memory of 1756	2200	net.exe	105
PID 2200 wrote to memory of 1756	2200	net.exe	105
PID 1728 wrote to memory of 3752	1728	PwndLocker_04_03_2020_17KB.exe	106
PID 1728 wrote to memory of 3752	1728	PwndLocker_04_03_2020_17KB.exe	106
PID 1728 wrote to memory of 3752	1728	PwndLocker_04_03_2020_17KB.exe	106
PID 1728 wrote to memory of 2008	1728	PwndLocker_04_03_2020_17KB.exe	108
PID 1728 wrote to memory of 2008	1728	PwndLocker_04_03_2020_17KB.exe	108
PID 1728 wrote to memory of 2008	1728	PwndLocker_04_03_2020_17KB.exe	108
PID 3752 wrote to memory of 2884	3752	net.exe	110
PID 3752 wrote to memory of 2884	3752	net.exe	110
PID 3752 wrote to memory of 2884	3752	net.exe	110
PID 2008 wrote to memory of 1104	2008	net.exe	111
PID 2008 wrote to memory of 1104	2008	net.exe	111
PID 2008 wrote to memory of 1104	2008	net.exe	111
PID 1728 wrote to memory of 4908	1728	PwndLocker_04_03_2020_17KB.exe	112
PID 1728 wrote to memory of 4908	1728	PwndLocker_04_03_2020_17KB.exe	112
PID 1728 wrote to memory of 4908	1728	PwndLocker_04_03_2020_17KB.exe	112
PID 1728 wrote to memory of 4460	1728	PwndLocker_04_03_2020_17KB.exe	114

C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\PwndLocker_04_03_2020_17KB.exe
"C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\PwndLocker_04_03_2020_17KB.exe"
1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "CSFalconService" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "CSFalconService" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2376
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "McAfeeFramework" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "McAfeeFramework" /y
    3⤵
    PID:1288
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "Alerter" /y
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Alerter" /y
    3⤵
    PID:1948
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "AcronisAgent" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "AcronisAgent" /y
    3⤵
    PID:3888
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "Acronis VSS Provider" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Acronis VSS Provider" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3696
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "BackupExecAgentAccelerator" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "BackupExecAgentAccelerator" /y
    3⤵
    PID:3296
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "BackupExecDeviceMediaService" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3168
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "BackupExecDeviceMediaService" /y
    3⤵
    PID:4932
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "BackupExecJobEngine" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "BackupExecJobEngine" /y
    3⤵
    PID:1756
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "BackupExecManagementService" /y
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3752
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "BackupExecManagementService" /y
    3⤵
    PID:2884
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "BackupExecRPCService" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "BackupExecRPCService" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1104
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "BackupExecVSSProvider" /y
  2⤵
  PID:4908
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "BackupExecVSSProvider" /y
    3⤵
    PID:1920
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "DFSR" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4460
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "DFSR" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2724
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "EPIntegrationService" /y
  2⤵
  PID:2468
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "EPIntegrationService" /y
    3⤵
    PID:3540
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "EPProtectedService" /y
  2⤵
  PID:2876
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "EPProtectedService" /y
    3⤵
    PID:3044
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "EPSecurityService" /y
  2⤵
  PID:3528
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "EPSecurityService" /y
    3⤵
    PID:3316
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "EPUpdateService" /y
  2⤵
  PID:8
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "EPUpdateService" /y
    3⤵
    PID:4532
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MB3Service" /y
  2⤵
  PID:1412
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MB3Service" /y
    3⤵
    PID:3260
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MBAMService" /y
  2⤵
  PID:960
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MBAMService" /y
    3⤵
    PID:3436
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MBEndpointAgent" /y
  2⤵
  PID:1716
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MBEndpointAgent" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:528
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeES" /y
  2⤵
  PID:3064
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeES" /y
    3⤵
    PID:3604
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeMGMT" /y
  2⤵
  PID:4060
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeMGMT" /y
    3⤵
    PID:1900
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeMTA" /y
  2⤵
  PID:1764
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeMTA" /y
    3⤵
    PID:1092
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeSA" /y
  2⤵
  PID:2404
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeSA" /y
    3⤵
    PID:324
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeSRS" /y
  2⤵
  PID:1248
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeSRS" /y
    3⤵
    PID:2488
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeADTopology" /y
  2⤵
  PID:5076
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeADTopology" /y
    3⤵
    PID:1796
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeDelivery" /y
  2⤵
  PID:1108
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeDelivery" /y
    3⤵
    PID:3432
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeDiagnostics" /y
  2⤵
  PID:116
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeDiagnostics" /y
    3⤵
    PID:964
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeEdgeSync" /y
  2⤵
  PID:1676
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeEdgeSync" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3972
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeHM" /y
  2⤵
  PID:1944
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeHM" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:860
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeHMRecovery" /y
  2⤵
  PID:1968
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeHMRecovery" /y
    3⤵
    PID:3336
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeIS" /y
  2⤵
  PID:468
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeIS" /y
    3⤵
    PID:4568
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeMailboxReplication" /y
  2⤵
  PID:2892
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeMailboxReplication" /y
    3⤵
    PID:1528
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeRPC" /y
  2⤵
  PID:3980
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeRPC" /y
    3⤵
    PID:2740
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeRepl" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1444
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeRepl" /y
    3⤵
    PID:3180
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeServiceHost" /y
  2⤵
  PID:2956
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeServiceHost" /y
    3⤵
    PID:548
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeTransport" /y
  2⤵
  PID:4328
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeTransport" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4376
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeUM" /y
  2⤵
  PID:3024
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeUM" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4016
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSExchangeUMCR" /y
  2⤵
  PID:1752
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSExchangeUMCR" /y
    3⤵
    PID:4768
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSOLAP$*" /y
  2⤵
  PID:4204
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSOLAP$*" /y
    3⤵
    PID:936
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLSERVER" /y
  2⤵
  PID:4180
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLSERVER" /y
    3⤵
    PID:232
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MsDtsServer" /y
  2⤵
  PID:892
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MsDtsServer" /y
    3⤵
    PID:1336
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MySQL57" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2460
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MySQL57" /y
    3⤵
    PID:2176
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "OSearch15" /y
  2⤵
  PID:2124
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "OSearch15" /y
    3⤵
    PID:4460
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "OracleClientCache80" /y
  2⤵
  PID:4804
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "OracleClientCache80" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4524
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "QuickBooksDB25" /y
  2⤵
  PID:864
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "QuickBooksDB25" /y
    3⤵
    PID:4676
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SPAdminV4" /y
  2⤵
  PID:444
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SPAdminV4" /y
    3⤵
    PID:3316
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SPSearchHostController" /y
  2⤵
  PID:420
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SPSearchHostController" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5056
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SPTraceV4" /y
  2⤵
  PID:2668
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SPTraceV4" /y
    3⤵
    PID:664
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SPUserCodeV4" /y
  2⤵
  PID:1364
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SPUserCodeV4" /y
    3⤵
    PID:64
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SPWriterV4" /y
  2⤵
  PID:2872
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SPWriterV4" /y
    3⤵
    PID:1924
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLBrowser" /y
  2⤵
  PID:3784
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLBrowser" /y
    3⤵
    PID:3900
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLSafeOLRService" /y
  2⤵
  PID:3680
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLSafeOLRService" /y
    3⤵
    PID:1812
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLsafe Backup Service" /y
  2⤵
  PID:3344
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLsafe Backup Service" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3384
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLSERVERAGENT" /y
  2⤵
  PID:2644
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLSERVERAGENT" /y
    3⤵
    PID:1548
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLTELEMETRY" /y
  2⤵
  PID:1220
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLTELEMETRY" /y
    3⤵
    PID:1424
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLBackups" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1396
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLBackups" /y
    3⤵
    PID:3028
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$*" /y
  2⤵
  PID:676
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$*" /y
    3⤵
    PID:2560
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$*" /y
  2⤵
  PID:1112
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$*" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2660
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSMQ" /y
  2⤵
  PID:4136
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSMQ" /y
    3⤵
    PID:4396
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "ReportServer" /y
  2⤵
  PID:1676
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "ReportServer" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1448
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "ReportServer$*" /y
  2⤵
  PID:4952
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "ReportServer$*" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1216
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLWriter" /y
  2⤵
  PID:3524
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLWriter" /y
    3⤵
    PID:2356
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLBackupAgent" /y
  2⤵
  PID:4068
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLBackupAgent" /y
    3⤵
    PID:1520
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "Symantec System Recovery" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1996
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Symantec System Recovery" /y
    3⤵
    PID:1076
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SyncoveryVSSService" /y
  2⤵
  PID:1072
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SyncoveryVSSService" /y
    3⤵
    PID:2276
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "VeeamBackupSvc" /y
  2⤵
  PID:4668
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamBackupSvc" /y
    3⤵
    PID:2448
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "VeeamCatalogSvc" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2972
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamCatalogSvc" /y
    3⤵
    PID:3248
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "VeeamCloudSvc" /y
  2⤵
  PID:4224
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamCloudSvc" /y
    3⤵
    PID:3392
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "VeeamEndpointBackupSvc" /y
  2⤵
  PID:3924
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamEndpointBackupSvc" /y
    3⤵
    PID:1792
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "VeeamEnterpriseManagerSvc" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3548
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamEnterpriseManagerSvc" /y
    3⤵
    PID:1740
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "VeeamMountSvc" /y
  2⤵
  PID:3676
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamMountSvc" /y
    3⤵
    PID:2352
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "VeeamNFSSvc" /y
  2⤵
  PID:4268
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamNFSSvc" /y
    3⤵
    PID:3312
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "VeeamRESTSvc" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1940
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamRESTSvc" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3200
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "VeeamTransportSvc /y
  2⤵
  PID:5016
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VeeamTransportSvc /y
    3⤵
    PID:840
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "Veeam Backup Catalog Data Service" /y
  2⤵
  PID:4804
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Veeam Backup Catalog Data Service" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3996
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "epag" /y
  2⤵
  PID:224
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "epag" /y
    3⤵
    PID:1648
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "epredline" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3044
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "epredline" /y
    3⤵
    PID:1876
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "mozyprobackup" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:744
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mozyprobackup" /y
    3⤵
    PID:2812
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "masvc" /y
  2⤵
  PID:3364
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "masvc" /y
    3⤵
    PID:3852
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "macmnsvc" /y
  2⤵
  PID:1096
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "macmnsvc" /y
    3⤵
    PID:3756
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "mfemms" /y
  2⤵
  PID:3900
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mfemms" /y
    3⤵
    PID:2224
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "McAfeeDLPAgentService" /y
  2⤵
  PID:1900
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "McAfeeDLPAgentService" /y
    3⤵
    PID:904
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "psqlWGE" /y
  2⤵
  PID:2784
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "psqlWGE" /y
    3⤵
    PID:1388
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "swprv" /y
  2⤵
  PID:4752
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "swprv" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2088
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "wsbexchange" /y
  2⤵
  PID:2516
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "wsbexchange" /y
    3⤵
    PID:3028
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "WinVNC4" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1664
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "WinVNC4" /y
    3⤵
    PID:1956
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "TMBMServer" /y
  2⤵
  PID:3552
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "TMBMServer" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2552
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "tmccsf" /y
  2⤵
  PID:3936
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "tmccsf" /y
    3⤵
    PID:2216
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "tmlisten" /y
  2⤵
  PID:2288
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "tmlisten" /y
    3⤵
    PID:1448
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "VSNAPVSS" /y
  2⤵
  PID:4844
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "VSNAPVSS" /y
    3⤵
    PID:2192
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "stc_endpt_svc" /y
  2⤵
  PID:1432
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "stc_endpt_svc" /y
    3⤵
    PID:4568
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "wbengine" /y
  2⤵
  PID:3352
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "wbengine" /y
    3⤵
    PID:4836
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "bbagent" /y
  2⤵
  PID:2188
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "bbagent" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1356
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "NasPmService" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4740
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "NasPmService" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2276
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "BASupportExpressStandaloneService_N_Central" /y
  2⤵
  PID:540
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "BASupportExpressStandaloneService_N_Central" /y
    3⤵
    PID:1948
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "BASupportExpressSrvcUpdater_N_Central" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3932
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "BASupportExpressSrvcUpdater_N_Central" /y
    3⤵
    PID:1444
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "hasplms" /y
  2⤵
  PID:1652
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "hasplms" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1544
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "EqlVss" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4084
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "EqlVss" /y
    3⤵
    PID:4712
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "EqlReqService" /y
  2⤵
  PID:3296
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "EqlReqService" /y
    3⤵
    PID:1792
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "RapidRecoveryAgent" /y
  2⤵
  PID:2060
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "RapidRecoveryAgent" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2808
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "YTBackup" /y
  2⤵
  PID:100
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "YTBackup" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1192
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "vhdsvc" /y
  2⤵
  PID:2840
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "vhdsvc" /y
    3⤵
    PID:2460
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "TeamViewer" /y
  2⤵
  - System Location Discovery: System Language Discovery
  - Discovers systems in the same network
  PID:892
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "TeamViewer" /y
    3⤵
    PID:4460
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSOLAP$SQL_2008" /y
  2⤵
  PID:3508
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSOLAP$SQL_2008" /y
    3⤵
    PID:3452
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSOLAP$SYSTEM_BGC" /y
  2⤵
  PID:4092
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSOLAP$SYSTEM_BGC" /y
    3⤵
    PID:1992
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSOLAP$TPS" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2532
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSOLAP$TPS" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3388
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSOLAP$TPSAMA" /y
  2⤵
  PID:1964
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSOLAP$TPSAMA" /y
    3⤵
    PID:3528
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$BKUPEXEC" /y
  2⤵
  PID:1320
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$BKUPEXEC" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:744
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$ECWDB2" /y
  2⤵
  PID:888
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$ECWDB2" /y
    3⤵
    PID:960
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$PRACTICEMGT" /y
  2⤵
  PID:4164
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$PRACTICEMGT" /y
    3⤵
    PID:1176
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$PRACTTICEBGC" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:528
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$PRACTTICEBGC" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1864
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$PROD" /y
  2⤵
  PID:4060
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$PROD" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1856
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$PROFXENGAGEMENT" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3012
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$PROFXENGAGEMENT" /y
    3⤵
    PID:2784
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$SBSMONITORING" /y
  2⤵
  PID:4828
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$SBSMONITORING" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4728
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$SHAREPOINT" /y
  2⤵
  PID:3968
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$SHAREPOINT" /y
    3⤵
    PID:2580
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$SOPHOS" /y
  2⤵
  PID:3028
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$SOPHOS" /y
    3⤵
    PID:1956
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$SQL_2008" /y
  2⤵
  PID:2560
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$SQL_2008" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2660
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$SQLEXPRESS" /y
  2⤵
  PID:2552
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$SQLEXPRESS" /y
    3⤵
    PID:2216
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$SYSTEM_BGC" /y
  2⤵
  PID:2576
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$SYSTEM_BGC" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4492
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$TPS" /y
  2⤵
  PID:1532
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$TPS" /y
    3⤵
    PID:3960
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$TPSAMA" /y
  2⤵
  PID:3176
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$TPSAMA" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3824
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$VEEAMSQL2008R2" /y
  2⤵
  PID:4604
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2008R2" /y
    3⤵
    PID:4836
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQL$VEEAMSQL2012" /y
  2⤵
  PID:3292
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2012" /y
    3⤵
    PID:1356
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLFDLauncher" /y
  2⤵
  PID:2084
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLFDLauncher" /y
    3⤵
    PID:4220
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y
  2⤵
  PID:2276
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y
    3⤵
    PID:1288
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$SBSMONITORING" /y
  2⤵
  PID:540
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLFDLauncher$SBSMONITORING" /y
    3⤵
    PID:4864
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$SHAREPOINT" /y
  2⤵
  PID:3932
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLFDLauncher$SHAREPOINT" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:452
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$SQL_2008" /y
  2⤵
  PID:1228
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLFDLauncher$SQL_2008" /y
    3⤵
    PID:4712
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$SYSTEM_BGC" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4016
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLFDLauncher$SYSTEM_BGC" /y
    3⤵
    PID:3168
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$TPS" /y
  2⤵
  PID:2916
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLFDLauncher$TPS" /y
    3⤵
    PID:3752
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLFDLauncher$TPSAMA" /y
  2⤵
  PID:760
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLFDLauncher$TPSAMA" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3312
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLSERVER" /y
  2⤵
  PID:4408
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLSERVER" /y
    3⤵
    PID:4652
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLServerADHelper" /y
  2⤵
  PID:2708
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLServerADHelper" /y
    3⤵
    PID:1940
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLServerADHelper100" /y
  2⤵
  PID:3080
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLServerADHelper100" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4676
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "MSSQLServerOLAPService" /y
  2⤵
  PID:3452
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "MSSQLServerOLAPService" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2564
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$BKUPEXEC" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1992
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$BKUPEXEC" /y
    3⤵
    PID:4324
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$CITRIX_METAFRAME" /y
  2⤵
  PID:444
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$CITRIX_METAFRAME" /y
    3⤵
    PID:3044
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$CXDB" /y
  2⤵
  PID:3528
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$CXDB" /y
    3⤵
    PID:2828
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$ECWDB2" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:840
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$ECWDB2" /y
    3⤵
    PID:1256
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$PRACTTICEBGC" /y
  2⤵
  PID:1924
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$PRACTTICEBGC" /y
    3⤵
    PID:3088
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$PRACTTICEMGT" /y
  2⤵
  PID:4380
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$PRACTTICEMGT" /y
    3⤵
    PID:64
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$PROD" /y
  2⤵
  PID:3032
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$PROD" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4232
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$PROFXENGAGEMENT" /y
  2⤵
  PID:4140
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$PROFXENGAGEMENT" /y
    3⤵
    PID:3900
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$SBSMONITORING" /y
  2⤵
  PID:1092
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$SBSMONITORING" /y
    3⤵
    PID:5060
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$SHAREPOINT" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4728
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$SHAREPOINT" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3720
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$SOPHOS" /y
  2⤵
  PID:4752
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$SOPHOS" /y
    3⤵
    PID:1196
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$SQL_2008" /y
  2⤵
  PID:2612
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$SQL_2008" /y
    3⤵
    PID:3432
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$SQLEXPRESS" /y
  2⤵
  PID:3488
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$SQLEXPRESS" /y
    3⤵
    PID:220
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$SYSTEM_BGC" /y
  2⤵
  PID:2552
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$SYSTEM_BGC" /y
    3⤵
    PID:1448
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$TPS" /y
  2⤵
  PID:2576
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$TPS" /y
    3⤵
    PID:4456
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$TPSAMA" /y
  2⤵
  PID:3492
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$TPSAMA" /y
    3⤵
    PID:1432
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$VEEAMSQL2008R2" /y
  2⤵
  PID:3912
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2008R2" /y
    3⤵
    PID:468
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "SQLAgent$VEEAMSQL2012" /y
  2⤵
  PID:1216
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2012" /y
    3⤵
    PID:3980
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "ReportServer$SQL_2008" /y
  2⤵
  PID:4740
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "ReportServer$SQL_2008" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4188
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "ReportServer$SYSTEM_BGC" /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3908
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "ReportServer$SYSTEM_BGC" /y
    3⤵
    PID:4668
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "ReportServer$TPS" /y
  2⤵
  PID:3696
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "ReportServer$TPS" /y
    3⤵
    PID:4376
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "ReportServer$TPSAMA" /y
  2⤵
  PID:2972
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "ReportServer$TPSAMA" /y
    3⤵
    PID:1312
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\RANSOM~1\PWNDLO~1.EXE >> NUL
  2⤵
  PID:1104

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv 3V7r7uAkN02xBOA5VQFLYQ.0.2
1⤵
PID:3492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~1\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
6828085ebab1f9444a6306d5dac2f5fd

SHA1
81acd3be11855a71558d99c36369ecce1e23445c

SHA256
17f453df4c551777d691c17e05bcab32f823bc38b7622cb91eb793a3233f5fbe

SHA512
fab98b4f94c966fdbe7b2beebbdfc6a5702c442e0b190119cdb24751201497fd85a16fff40b2236ddbc7e974922f69c6b0fe219be95a29e81cdaf3fd8ae1823b

Download Submit
C:\PROGRA~1\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
bfa05928f7dd450fe67989a34ad314f6

SHA1
2dfd8b704adfee330e49cf9492717c84d231e602

SHA256
cf64fdbec6f5008ee1df94df96ad7bc870435176338bebfc372380b2b7fa73b9

SHA512
d76f316482d2f1effccad910ec287a8d07f66e967f8eb88bfb264ee4b0ef3e30a623400f7ccc7e371030d5d4b69ee5dcc297aed3c82783d32f174770c958a3bb

Download Submit
C:\PROGRA~1\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
a12782b8496b2b73ee95ed29359032c3

SHA1
32f898d02518f2461f4e9ae3e4cf34be9239e39f

SHA256
f3394a0fd0d873a3b7cb858ce97983a8ea2e3e8bad7f894f8ab3b24d9e7ef164

SHA512
6660c66e5b274586276095e90351438857d370cf13f451e56e1aac19892c4188f837c67931b20ea00512a5360b1d567a0f35d82c5426801a72754d2dbfa83887

Download Submit
C:\PROGRA~1\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
d3ad437ef1788ff9cfb04d46197436b8

SHA1
8e03a98fe2a12930ddde94ea7f6f2581c4684d5e

SHA256
9a9347d3791005b917287fc18cdab8dd63573dbe7382a0a9c7dc0c6f9501f700

SHA512
a514015e90847d27266b12c6305aa7e682307aa5f54c7aaa8aeceaa297741b5cecdf79b373662a3d6f0642ab9dd192d725bbdc1d8dd8672245ec885880b25cce

Download Submit
C:\PROGRA~1\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
d1c213b4a746cf0c1aff879edf9625b0

SHA1
4857f524c80bd8ef29a482ddbd72c412e8991435

SHA256
10653a04d1694f39f6e5fbd655bd2c5be8d569635535c8c4ddc14059e4f66bf0

SHA512
35c65f647e33eaf1aacfcc70625faa1511cfe69573edbb06292406ead1a6f8a56b5bb334e9b588209ae2895790c19bd75821b0a6c019000fd268430aab03ee89

Download Submit
C:\PROGRA~1\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
92cca8306b19d63fe4d47db5657f3c33

SHA1
dc02bdab3861eafce38e2d076b88d3c0ba292109

SHA256
cddf6f5ba12b83b4595218bfe2e25285dd2e708eb84b84ffb620fae8ad8255f0

SHA512
28e377c105e57da817925a7ef765bc54a6791b06ee1c42569f6d070f42db251d84561b53b854573311c48843ba16f0f096a38a1df29b5e0c8ee2e962d34c6b01

Download Submit
C:\PROGRA~1\Java\jre-1.8\legal\jdk\bcel.md

Filesize
11KB

MD5
f0d5e4689b051673a95f6cde833592bb

SHA1
c6b4c0675c166d44eb03645cf570735a1c041574

SHA256
e2a223b4678e53ae5c3dc14ce0927a04850764b6983f1b1aecc4eb3c5f726d2c

SHA512
08af6a1dc47e84a7080b88fcf7c53ccc69e2bec7597081f20ea9691528ba3be8cf32224fc1c60000be569aca75ca2f865b1265d0a516446b4e814999bd53d054

Download Submit
C:\PROGRA~1\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
5fc2e5071810d1aa885eaaf96336078a

SHA1
7cb963faa4a06f846cddbc0f238f926f25fe8a0d

SHA256
8130fc5ad2090b9f356a938ae0db65f2c7a242916d7e55050640e933a201c047

SHA512
c94ad34e931e387cbd6cf1e247c649eceecc4e891955b4bc139aaefbb54bcb23ff8b0058f124b5ea4d3a3c2837b59aa937339fd39162813c7e90d820416193d7

Download Submit
C:\PROGRA~1\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
64e8062e5a3864bd396459935ddb1112

SHA1
7e2449f329fd043d5fb5d0134183be89cb66e5b9

SHA256
e2e57a96e5f03896b0f6f82ceba959060322f52219d4b181c5d72d32ce7e7313

SHA512
16f26bde0d71e073168a0d17811ab302624a58ff5d0575b9ea4121564499c9af655ffd3147dc44714dce3cf0ca393e1ed378c90087db42e0d52e7168705c0c11

Download Submit
C:\PROGRA~1\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
7940fa91d54aa7b31575a1464b56c7c4

SHA1
9cad4aba418813e07f272cff7e90515b56313413

SHA256
312c75b0f00241a169f0439bdb9a48e9dc6ccce58e99024a38fa5e2b6a9435fc

SHA512
01e6667daad5c71628d75cbb9456737a46779b7c7e1e0530749b298a206b3b96c76ee9396d2ffb2dd4b739b1dddaf79cabd96564d1d7b73b2327dc31059c6804

Download Submit
C:\PROGRA~1\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
3b935c346bcfffa64b01a2471948553d

SHA1
07a540e4d4f9a91d3218398d2cb34f7fe3ea2015

SHA256
62fa28f774b7d8d2f8363e6d1116e66ba3a4abe574e0c3cb1821b760bc41f90d

SHA512
e2eb6e898065a07761364c99e46648c77de9279954c664b9beb7a3223225d968ac47945da78c2216b606ffba52a1a162b64ac972a8035467e63cfe0c2ec2c8ee

Download Submit
C:\PROGRA~1\Java\jre-1.8\legal\jdk\xalan.md

Filesize
12KB

MD5
9951f9426cd9deb8fa823ec7f016487b

SHA1
2c2a1c5a31357b33b95b0e99be803d5c93a054fc

SHA256
93a63db7da2609af91abc3d17e6dbab33410e3ef884f3e520199f3a0faa66f62

SHA512
c36686111fc598d7918704466957b772569c9d05562f494af0e62b19d45d4f6a94ebe02e402fbc51d1ee9b72bc180be715142df3a3ddcbc8cf8b36831c27817b

Download Submit
C:\PROGRA~1\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
66b71147ea6ad5779183ff15d46cf978

SHA1
38b3bbd86fea20162d90dfcd6cb8d6eb09359234

SHA256
456b89ad21a9d015c1e090ce25177070d588f6d88adcc50c4e4ffb5df70b405e

SHA512
4c8204464fbc020c61d741b4d41c146becf467da661539d3a029dfc0076f035592c9d37062135a3aca1847a8b5ffa5144709f7feb3f4a510cbda5ec376ceb6a5

Download Submit
C:\PROGRA~1\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
20cdfd1439e7998dfdce4cb0b394367d

SHA1
d77e0398c6bb498bb78e188141c7b50f7ff21f2a

SHA256
3a8462564758e651cad517b5bf0410877e349ec74371cb58dea895b724f566a8

SHA512
6f89749589a94e431b89765050b1516207f9d0fcb617f0b40609ec210d3611acb5a1f22258efff27d6254269d638c505663590853a64f537e56e0a3e93da0c52

Download Submit
C:\PROGRA~1\MICROS~2\root\Office16\BIBLIO~1\Style\ISO690.XSL

Filesize
264KB

MD5
88b3462b8dd0408e10fe246cbfd05011

SHA1
cfa58fbcc3b9de04f11fd97ac645738dd4accee9

SHA256
757b8e8aab973409d4eb7c647312de4902f23fdad76c943ec64b4f7748ba914d

SHA512
5fed9e272ac8010deb43705ad4e5d29c99d142bb9440d1cc9045b2bf0c242e3ee0aa870231fd4d535528d12e74e18ef2d898f41e26793951f012d8c4e9415dfa

Download Submit
C:\PROGRA~1\MICROS~2\root\vfs\PROGRA~3\MICROS~1\ASOLED~1\140\CARTRI~1\Informix.xsl.pwnd

Filesize
31KB

MD5
a91363f23405db7a87b9fa4ff7a0a889

SHA1
a6cf608c977016f867c86abedd34ad962bdae272

SHA256
c194bd08950add2904afa8fcd317de621e8894138a0416c93f963ad509e46582

SHA512
e2c8cf9255c378c5b51f5cd10b0a82c7d57cd0f846f45f884684ce958dea17d54d855dc46dcef3f298c0b8525fcb5ec1b1424fc0b48d659d17c78c44b3afd2bd

Download Submit
C:\PROGRA~1\MICROS~2\root\vfs\PROGRA~3\MICROS~1\ASOLED~1\140\CARTRI~1\Sybase.xsl

Filesize
30KB

MD5
51eae42f2d3dd3d46e6cb7a9b59dd5e3

SHA1
bdf2acf6799b81e7daf31ad5274d869c15a9bf36

SHA256
46288be1b9cd3485f3d9fabeb224ae8760af010f1c0777e5591831c5728e8757

SHA512
f0a13f900bbef44f07a4078620076109e0127f67c45a9469394e99fea024b0f600b267d4d1ea314ee6bcd85a970a28ada8e7ae4863bbb795991e1d0e1420f41a

Download Submit
C:\PROGRA~1\MICROS~2\root\vfs\PROGRA~3\MICROS~1\ASOLED~1\140\CARTRI~1\msjet.xsl

Filesize
29KB

MD5
ccc2da9819691ac2fe936f5a1be55ee8

SHA1
3094fb4c50d5558818a72c1e4848f8a4b628e5af

SHA256
5be73f032b72e7ea6090ec1f37eda8aa5a66c9943655d1f97818c2b28f663b10

SHA512
7c1b384ce84da3354efdea86bd869f88d95a6d4862fac92d19e99b0bf4e91c26f9312d4e4285786fb1985090a07f8fa1c89e6446ab7dcc4ed4911722d2f165ef

Download Submit
C:\PROGRA~1\MICROS~2\root\vfs\PROGRA~3\MICROS~1\ASOLED~1\140\CARTRI~1\sql2000.xsl

Filesize
34KB

MD5
e66140d9f66817db8a91099e5901af2d

SHA1
fc007d27e9286fb8f3b979b1150e00f79a2e0773

SHA256
30aeb62b58f366ce702592606b6520a95329da228e68c180371231a135659ca9

SHA512
9e1ac3127f609bb009a4c48dd91601b4df9aa54447599cab63adeefa5c6dd9a6eaaf1f2ea0683cf9c18d1f96436053e9a13970fd39ca7694ec94c702490df505

Download Submit
C:\PROGRA~1\MICROS~2\root\vfs\PROGRA~3\MICROS~1\ASOLED~1\140\CARTRI~1\sql70.xsl

Filesize
32KB

MD5
5698dc282d38515a85c01eaa8569cee2

SHA1
a16006645b99dbe540b764b3ad5af5808e25591e

SHA256
b3b94c522874937a5b33a8f66bcf178be8cd0f1e2fbafa9d4d2b718e45d8beff

SHA512
5e1f68fb3c5bd9075a90687f5d764c1424cb740378a4ca102e76405822080068bb3886e81a5e877f943be24cb15827d7d24998dbc36d21d9b888f24d8b17f803

Download Submit
C:\PROGRA~1\MICROS~2\root\vfs\PROGRA~4\MICROS~1\ASOLED~1\140\CARTRI~1\hive.xsl

Filesize
80KB

MD5
b2bb933c058639dd396a943b2120c2f5

SHA1
ac5bd623760a4224d994f5f7dc6b4268ae95a714

SHA256
dae2db16d9e7c4fdd0ba1c47ca41889b71630d87a25ac9778ff093f48f76a0bb

SHA512
caf6d708029cf257b239c49116592f7f396597bd89344f37a340622cf48f8defa81f8095143e1ec94d8865d35748da692fd7502cbdf3e0cca2aa2f67791203a8

Download Submit
C:\PROGRA~1\VideoLAN\VLC\locale\da\LC_MES~1\vlc.mo

Filesize
584KB

MD5
f3067ceb7e5004b9696f017a6cb8dc42

SHA1
78790bd00c08b9c6826a41c76a5883ff181b4075

SHA256
e2b28083d562b2ca64da6de391068208a9ce4957e9f02d08091f2c47718250a4

SHA512
3892797bc5a366c7c74647faf438c5c0e80ac2f0bf5f2a026c504b071ada404cad54f554e7ceee02e582f43dc16366bfb7dd85e9a156e10c7cf81512a78de0a2

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\images\FILE_T~1\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
cf67c988befd3c5f064095a2bba9bdfd

SHA1
13963cb1a784b0d1e58fb0a7d8c4e9abf04d9b36

SHA256
542bf7e85fd9163138ae1d73e0e15155f756879096affaee4b986013f0ee0cda

SHA512
28da1bcd37582b5f5e1a73205de7f9a26e7d2a8852f58ac0422bf3b9b1ad35dfa37af972328af9789d31c352cf5175ee9955f7b3fb99be913d431e13d5ef1a34

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\images\themes\dark\s_export_18.svg

Filesize
7KB

MD5
9a59cca47c44660e57609077bf5d295c

SHA1
ccc6a9c09345860ead200f6c949d315d8138f582

SHA256
49ff3bda56131678d9317e865f8b0b0667fe4238074fefeacc08bd6dc5311410

SHA512
3f643c6a86522f06ea45a37d91450097d6d81da43c116aa1f87c07ec13c628be02f4c7c6cc9c4ed613e98d3a88d30662c5b7c93cf4731c7301e54a1790bbddf2

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\core\dev\nls\root\ui-strings.js

Filesize
28KB

MD5
e6e09aeee13c8ee68185be65fb8d0295

SHA1
ea98bf2ff0606a5480c1b264a805712012ed434a

SHA256
060ee07f329cdc2dfd00ba580272c28258ed94438fa956a1381f3b6a9a5bf92e

SHA512
0bc11c83500a454bbb0fad1e44444216be23bea348b57ed442d5ba40805c376c9d4092ebbebf75f88a5c18219a503400edaa3a742c42428042365833a7b2df89

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\files\dev\nls\root\ui-strings.js.pwnd

Filesize
7KB

MD5
9c6f84440286d8ec7a25ad0da68983bc

SHA1
aea71c06e7a8a0f440e6ea92fdd4ef79583b92e3

SHA256
ba6c2f392b56a96fb74699e314b134f8ba885734fc6493c89adbd5c0c322cb97

SHA512
88a2bfa6fb6791988c6a38f9f0dc9eff5cfc4d04c9f75fdd2f672aeeb16d31df9d7d02365499662153b390272ab3a8138efb34e4203f81a07147ecaa044fd670

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\ACTIVI~1\js\nls\root\ui-strings.js

Filesize
4KB

MD5
14c0e708b3b9b52df9985bd9561575af

SHA1
b68c9c51864cb44238a421b68828c9e575737489

SHA256
a79712a769b78920204f464cf1662280f735e8a82127d68156420e257e013b9f

SHA512
7773f3fb181fd61ddcd936cce9bc77247cf6ec2b965f474c2b3de2db0f1dd9d1273342a04af29f4152f9e4f7a3c94304ce84d96e47b620eda47767d65d0bde85

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\MY-COM~2\images\illustrations.png

Filesize
8KB

MD5
57c72f93bdeb91e74533a077a8c84397

SHA1
a37f4ee37b1befe1327c86291af47525e27a0cab

SHA256
09ae3d5af5806db202153232b9993a5378e9401afbe2265cc51780eafcfed4fc

SHA512
a9de820b6af1f9baa29baf84110bea92ae4a2586ec449028786e39112338eb7cf7b30f1566cf25809d2b9cd971fb5e5ad324cd798cd80a536b7ac2d70c58dce1

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\MY-COM~2\images\illustrations_retina.png

Filesize
19KB

MD5
cd440e839dd72fac9340d39be67e0339

SHA1
ced2fb36a645792a60884000397f5bedb4db0cd2

SHA256
7f4a2f7cb01fd712015504477e0b12ba4fea87b450eb70b9f72644a7159297eb

SHA512
fb89097fc81e5b3acfdb10e3aa2d2fc3b485b4455084a589f7bc56c94cc20a3749600b320c9be8faff84271903aca6df781bb9f14ed502f5330f4ea5c1c1dfe2

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\OB-PRE~1\js\nls\en-ae\ui-strings.js

Filesize
4KB

MD5
765aa17f1751a25a004e8aa369316c8a

SHA1
8c500e856a0966437e675b858b485067fc63bad2

SHA256
26e5df52b2c44f048bf7bee45d02214203389d6ec790ac96f5beaf923f9b4ffc

SHA512
e4e650cd5d12372b46d5ec4054ad3a8accf022013d595bece2ef75e2a295b6bcc004f396f232630d02f289a6a5b08a6f63d76956ed9f2eaf7537989b5bb7b365

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\ON-BOA~1\images\THEMEL~1\LOCALI~1\PlayStore_icon.svg

Filesize
5KB

MD5
941fd5693bab7d9411845534e8bb89b1

SHA1
2e6ba8df4a7f62a2be86dd2430d5a839c1002c74

SHA256
255fc87e724f15b3397c12686b2f58d90f498d30ac3a9cbbe52b202523c07848

SHA512
a15fa483587d2e556dab51254ed97a003239f503c9586b9cd83d056391b5359a82ce427adb0ae57458ade82d83661073e32510e735400f9826a3b05dbdf24f7d

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\ON-BOA~1\js\nls\root\ui-strings.js

Filesize
13KB

MD5
09305e06e489ed37e0e355154091a46e

SHA1
80aa7e81c0f142f6fbf3e7c964f2e460ac5c2d19

SHA256
530154d2a061b697dad79eddc3484fb9b7a91cdce41bbf8a3d59cc7e810700bb

SHA512
a9ca553da02031470cb6f9c34c6dbebb84c8d2f7e6623780877cd389f3fe63838f2c1998b0c63905fd52b620fe8fe0522450a6b48983e398fa1960c26bbd1846

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_cs_135x40.svg

Filesize
19KB

MD5
7c86c647c06de5961cf4cabeef3f5b36

SHA1
8655883d4ae7a51d3b75855079f6d396bc701782

SHA256
2f1d20f5b27f46c8c4f8f022908e5412d2bde4435b63a0cd7ff1d28f8eaee29c

SHA512
3aa985e1bbc2cddbb7df3dfb91e98afc23bda43b4c387d1460081e741dcb483756e72f7dd56f9cb769f6810107188629b047af98251a5a611d374ac8d86bd4e9

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_da_135x40.svg

Filesize
15KB

MD5
6ea1b03212e934e2c43d6ff75cdeef97

SHA1
97db5f098fde8ba0de0087a8789558fcdbe5f8a9

SHA256
4fef78268a6f590aacab0a3fc73927522e8d7864fa0aed4614fe70d859c1ccf7

SHA512
efe3e0f7bc8ea0cdbaf02c3e67e89d954c37536d79fd369e253170052548b2feebed0731b42bee822843a0305f2e62df71dbe114e371408f452f8d32bbb1f94c

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_de_135x40.svg

Filesize
17KB

MD5
90b92dad827a7cd44b2fc7016dfd6109

SHA1
feb3c0d0ac41dc5e9c98444311f936aff80da1a9

SHA256
488e7251c8c8720349b7c3eb76fa8b86f13a0e65b5d2a8fb1c583e9d24812fc8

SHA512
ddac655114c98d18e0060e84fff9fcdf8346fdb2b92fd0e9f65519d15c58f6931e78b4f3470ecf645f06d5daf566ff0a495a79b2ff918572074403d06afb7673

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_es_135x40.svg

Filesize
23KB

MD5
7b81174a08768970f681e4e5be57e1e8

SHA1
ee438352c64cdfcd8a646abf2c33973898a73209

SHA256
9ccf6c4b0815b69c0c837f9b922c6155e51d6317cbe5fcc42ba34ceaf389672a

SHA512
02ef0485c91cfa3fe0b29b89ac0b59280709190faf9f0890a0b9eb89bcbb81fe79b3a4c7d63c8662658558a0519075760cfbcc4e8256a8c163b33257b8599952

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_fi_135x40.svg

Filesize
18KB

MD5
a1161b2c0adf0e299216bee7914e0f11

SHA1
3e18e90cde4006bb5bbe03397c97003ca61b7f3f

SHA256
93c4e5f0e32f5c4da9ce319438c66fb0655793bd128aeba3860103a9bd3505b4

SHA512
6ba3dc2dec44027f9a4224cee987c872c77129e0860f203cff064f94518365a7203c78aa85cae7b7fa90706c0c99c9393e661f6d005a59ed2c73663ce7a073e5

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_fr_135x40.svg

Filesize
26KB

MD5
db77a5a9db81f3d3667350fb87dce68a

SHA1
095dfec4d01b535fec866e1242b9d4bdd6e7b73b

SHA256
72935fd8ae39f74435a37ab1f135ec7bf83e014bb90a983596d54efc6d875e8b

SHA512
1f39b1e3e47e4b1de8d3b3fc5e0040d9601ff50e9f3591a3eb6a5c5a4fd7578c55b6db14549d41d8f2002f6d0039da2e7ee149f4170913a448d1f4f6378a52e4

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_it_135x40.svg

Filesize
19KB

MD5
6d5ac1a28417a3be6a90384dce8d8f10

SHA1
a01262aa3524d77e0507e9cf255c70ee9e1dd51d

SHA256
58d8ecdbd7f25656d58c676bed1822fc64e596e99aca27c163eda19ea4e6c473

SHA512
02b722cdb68307cf903fe2974a0d37fe0b5f1c08b77ac0fe2fe45637cd396a3e23c6382460e6a8c99c8f46606f672796d485ec115f4697c09eb06b3e633b4390

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_ja_135x40.svg

Filesize
17KB

MD5
8b7927b08a17fc78e87f7ba05316c719

SHA1
6a6acb2aecd6ea2fa92e5af7bdf9cdfa540da640

SHA256
18f13185d4b9736cb369326985bc7c4dc87743bf3486634dc6bc56fe3c7da27f

SHA512
49c6f766b5bdba90e9aa6cd875b096507a47759e20813ea257f1a488b175fa4801e715903d11b51d70c63fd338c1da800fd1ce79b22a7ea48e599b937fdea0d5

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_ko_135x40.svg

Filesize
17KB

MD5
9db49ba1a41f91959c981984f918664e

SHA1
3a478ce2c195d99e687d77fb697f41a4f5354a71

SHA256
bc7be2cb09c8686e8ddc3b73e5e3d99e7b4ff8ddbdf0e074a24610ab9d9c61cb

SHA512
557eabbcae308d7593dbaeb5a340eefcd2a73fcb6fc206c1673287e8d6353f253013bc7a9e53640c9b876049a13d232e19c70287e426d24785cc14aa43651b07

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_nb_135x40.svg

Filesize
20KB

MD5
f34cf0b9d26c00de698a499b6082c9fa

SHA1
735d0f2d6baab2c619a373b53aa1d2b82bb6589f

SHA256
4b416aa7e710d8f7c78a6bbae98ee2957cfb15200f20f2d5c29d644a37eedb69

SHA512
2cb6763159b1e7f2eafc95e8a812288e32c24e6b53855bee954e22eeb3a82521707cf65e4768f8da1216add8011116d47610974a6e64f9d0818743ad99e78b89

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_pl_135x40.svg

Filesize
18KB

MD5
97663316e85221ec1bf86624eddd5c55

SHA1
a868f2afcd63c7ab1de62ba794546871de9bc721

SHA256
1b139ee7b5d395d54575dc8050ac20d579f834e1babdd9a3b56c8cf4fd82fbf0

SHA512
f409f60ed311494d5d42e1fb218962ec8d60e9604bf19ff964518ad3c3870aa8ad07b4adac65f09d5f90d861e59c2fc3a5fff6754b37bf36a60bc7e075736b3f

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_pt_135x40.svg

Filesize
18KB

MD5
d00809db05dd5ab6b4b2081eaa90359e

SHA1
9471b5838e5c64fa8b526de7e056fc50e812c7f8

SHA256
c0dc33a9de9fdc70d5fa50f5db54bf9935a9fe54e58a0d535d4cc7650f682629

SHA512
7777273a4d6e2c9dfdfeecc20f2abb80a2bc36f1119d438b8f74aa7371aed04492f1980bd9d7f4ee8ac5370da014e86e2c7dfaa0fe0f680c8b9280a512076734

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_ru_135x40.svg

Filesize
23KB

MD5
4f720e0a8440d77a69e00f50b999838f

SHA1
a58ef7a8b55998999296ee54bcacfb36b92b3b6b

SHA256
ec1a9c0af0d82fb6b3f2698e177d977efa09e7cff352d5c76199b26fa7c544db

SHA512
dc9c5a1caca7396c4fc94a09892b2e9d938fff23727671943f947e7b971bf43ce05f1cae5db8cbf0efe8ac4f8a68b8c43eb4dd6f1f6b7a5cad9a8077f662c09e

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_sv_135x40.svg

Filesize
17KB

MD5
687e36ab4c0a6521046e32e83a20548e

SHA1
9e76a0864dd514e8b7018e92310990befc135f42

SHA256
a67ad02b3745864f71f19b889e090e5d54738fee711e677c4c984604019418ae

SHA512
458da9049a24a32beb31b761e45bd666f896610f58763d186ebd8e0e24667834e5a4118c16daf7ba92a1fd7871bc58d18a5d204981adfabb971d57723a2bf1b7

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_tr_135x40.svg

Filesize
20KB

MD5
192f710e53c50c7a61ee191992c1f1ba

SHA1
4c1e0c2818e103fd7b84b3ca8a356d1a3c6daef5

SHA256
bc102afc7ffbafebbef9bed2f022ca9136196c3433cce67486f9530a0d9a6417

SHA512
16abfa8b590ffd9fe78e1fb8e33115a25161c95b6f96c754f6baac6cdcb97e0bb7b3f2389444c088408699bbaa8bcf0a9f5e38581236968d0185756b0d709de4

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_zh_cn_135x40.svg

Filesize
13KB

MD5
aa49ed5824496f2c6bf83b6e16610444

SHA1
ab49cc61b5857a6cf847423e5270601824cb9d26

SHA256
91eeb733c21bc16570ea1a713c3ca3493208567b742b625cf293c8b23dabce3f

SHA512
39193c0a62036ca5cc958d737b83c2f79c0e617365fd5e5e21bfbb9b06ceb7012c3faedce01e3483803453fff877c17c11059621144231f83e00e08f740606a2

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\Appstore\Download_on_the_App_Store_Badge_zh_tw_135x40.svg

Filesize
15KB

MD5
8b2b9ee6dd9ae39f891c3c7cd64bf2ca

SHA1
aa645854043e3ba38d610eff35c7d6562ddf600f

SHA256
b353b7dd1d0a0e4f7fd217f81f6b78cc384148fa5d35171b72fa5941f87e33ce

SHA512
d375566343e1bf9361eaa79f318f2cdd15e323bd3e6a882718f8b9c86b8fed6a00b6966e073394e330d0b66551349cbafcd4f41c558bc1a07c58e582d974b9de

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\cs_get.svg

Filesize
5KB

MD5
28681e2444f38295351a82391602a699

SHA1
52a815fccec02b87393c225affe781ca8c945c92

SHA256
10b0ff650bc21d4530b961e87fe61d8d3f98bd1c87cc20aa36b2253f14b15f27

SHA512
89dda219fd60ee95461f7074c4348049af919948e72d1b75445e46a01b2d484bcd497f9c1b6d25237f88a98e8a3cdd4f9b4d51dba8204f6c54224bfc982866cf

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\da_get.svg

Filesize
5KB

MD5
0d51542386678af10330f927afd3b533

SHA1
1967cae29ddb5b30d37c1dfa39892fec79d2bd8d

SHA256
d03dc40b612b7563f2145b910bfe7e8e7c218efb7b8f309704ee70ecc54b61e4

SHA512
be382cc6eb6757fb9f4ed71e09e9466e61fb2d4202aaf6b23f08353ab09e7b0de5cdaca2c62a3b997a62e1490b343901fd724c7e916389c0d8b52cb131c3f20b

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\de_get.svg.pwnd

Filesize
5KB

MD5
6900d1f5dd7ac60843983ee545523364

SHA1
917527960dd5e87279aa370c80e8d0e57a78eb73

SHA256
6c532e75b858b04bbbaa218f6ae24d574621b13e149e3a7e907e6d1529e22be2

SHA512
2c3b259e5432b26e048be8fc40674def19cad35f282086d383ad1f4f78a7370b142845429ffd6e20a17924bc1c67beaacb469c686dcf1568ecee3e054602d654

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\es-419_get.svg

Filesize
6KB

MD5
68a6d1188513d936fc68549b27866396

SHA1
2dcdb63cbcafb89b3d7ccc4383705c6cc6cdde45

SHA256
2b04e753869f6d7f7a8c41c5df72db687b266955afc5d6679c005de9d4ac6401

SHA512
1861d4162e17d3b3669c93a6f6e1e040016e4239f63d1b34d70e9090ec506e1c05df16847617dd400c08ed9f49f1789779888e5fab40bb04709a03a942164489

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\fi_get.svg

Filesize
5KB

MD5
6de42516b6330da8551ec326a213c5ff

SHA1
25d275986e3b1b2449099d63bc22aba8b8871c42

SHA256
43849b05134b243f0081b6574be8f30a3250aa02393344401cae6d85ea2f2c74

SHA512
b2d98c482e5c741fe036ad74b672dee85bb48175c5ce8c01841e010f4749eb347542d9e342dee758d9029561cfd4e91319663325483d4a476b3e1b79c10d0f28

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\fr_get.svg

Filesize
7KB

MD5
de89525510169af53fb660910e7a8cba

SHA1
52f13b3e0af39a4801ade91bef583b2ae9a3b256

SHA256
343f4e839acff8a4073de67103151b34d86e5fed20c6192d8ea565656306aedc

SHA512
371cdd49e66faadfcde4ace01de33c0d0709d4b54db04b87fbd15cee71a8efeda14d32a0a2bf025d63d5f867003cc7299db8c9052087beeb0a6715a3273bf2e1

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\it_get.svg

Filesize
7KB

MD5
e4335592c410b9f40f5f3847d788cc9e

SHA1
c4e01840e5b3fcb149c4013ac18e62903551b05b

SHA256
67eea158590e4036aab2eb1c3bb52f02fba7c30335d1e2f5831a24c4c4c53fc0

SHA512
7064187c440ec0a64725af8145a6c6eb6eff62179a9db6ce7a466b56b0a1d440ce5235b17e25a023875f1688c9bbd4b6d6165da84cc06b9577ccc6360faa084f

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\ko_get.svg

Filesize
5KB

MD5
c5317806c1287831f89be1528250a349

SHA1
7e26b4eb2830640eb4756787ca84450e4ce83f32

SHA256
c16cb46d419b69efdfaa8b5823dac083164aff78618d1e374bcc5b5594f53b20

SHA512
f05713220e2c9a445ad9bd736ff0c726a3d4d1ca348c47c6583878fbe95282ed98a92f97605f57df8144a19a4bfa4a208c63eac48a65fe5ba8df39a3f4e61033

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\no_get.svg

Filesize
6KB

MD5
62c5f44c7bfadfb174aa259caea01469

SHA1
89aac98e2cd1435aaff1a0f701fac9285c77e297

SHA256
147867ac8dda1e0bd574da0d5d318b382ccb3b232f437968168c6470d7e1b06d

SHA512
e16b457a7ae16acf9e733eb56651e8568cc83030add73598d320d0cfcf46840471d6cdbb71b6cc1aa0d2ee66348e3ef38df34dbefcc325e5e5fc1fee8fa452a4

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\pl_get.svg

Filesize
6KB

MD5
ded9ecb3a6741f835067d36554782bec

SHA1
94d0564386ee884fc812ffd19a98fbf1d5f2c441

SHA256
ea8131375cc0914d3ef7de0de5d1907d8cd3d59669572c982132269b45e961bf

SHA512
24c0c0dde11497df2a61a77d5ead614ebef71e8e8f59a84ba75b80d4321f24ed6006308122f0a5d8f313bd3158d52af4fcbc93c275f056b661f83a85bfe8680c

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\pt-br_get.svg

Filesize
6KB

MD5
c855f25f8726a751a00e79f0b0bd823b

SHA1
ec04918b9a9fe2d4194515cfc2e0b7f67cd4f476

SHA256
2b5017eb304c86ce5ae108e3a86d51d22d043938bda14902467d990c518b4546

SHA512
e3166ebef6df43e34b827345e1fb40939cda792cdc53ed0c64ea5f24f4f99b82c2acfaf21135e0a6c6794d0edb7a493fdf7f5766ffb20a1a9f140a8b30ee58b9

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\ru_get.svg

Filesize
6KB

MD5
327a390f105c1b284689559ca806d679

SHA1
b8e82de686bcdbbb2cc0bc01aa0bdd3bd306a424

SHA256
0165fb8f0c6998723cf0ad78e86645f5cc3672068b7838e7a35d07c227fec8f1

SHA512
f98fe1e919d7e47229745279bc95318035ad41ee81c6f5277ca0f94deaa426b9a653a222c329438bf03875818d86209f4e74cee315e7c6ed9cb492a984a4b9fc

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\sv_get.svg

Filesize
6KB

MD5
9626583a0c4d71595dffe40b4bf7e1e7

SHA1
90cdc727c807754cf1acaaa1f9bbf4eb30450905

SHA256
6fb3fc284f4c7ded6d8d263f6d2fb2865e22febe495a2a5b1cd8387536de5ca3

SHA512
8e79ef11f0bdb1c0ea9c0f237e8a0ed524a3d9457c36a0ff792036d59a12417255f56e3f4e86e32f0ffde63cf4b8467a526ee6ecb430be6d882f06554f6c354e

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\tr_get.svg

Filesize
5KB

MD5
3ec5ea64d0b75da60bec597b438dac3d

SHA1
35da3d538242643edd53990e6217ed2f2f26c274

SHA256
f509f9e84a0836df2459cb75fff9c87183d92898f27cd1fa71dd879ee45eacc9

SHA512
2baaf77b2092c348ab371218ae4406e61a418cdb157af09d17ef49efd9f6b9614543311805e00f53bb77809e36c0e826d8cd01c73b3a8863a9013ecf7c3eae99

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\zh-cn_get.svg

Filesize
7KB

MD5
13f42d42698516d7b2d158f4f1a962a0

SHA1
d93c3a6f8930d8cd8e52cdf0e9e1f0b6da192830

SHA256
99f0805a8803c34bb0b95a1f41eac00829d69a8ac9d80d1dc8a239ab1392201c

SHA512
21c91a0d2d7d2a1fe3ab92683e8a9ed81ec8e66a4b3da3843d423a274621da57893f6c99dbc6cf0e3237cafd78124c712d17bbb6a688283c121e356a83db797e

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SCAN-F~1\images\THEMEL~1\PLAYST~1\zh-tw_get.svg

Filesize
6KB

MD5
962ab3c191357cb164d136ffc958449f

SHA1
b528c7aeff0e98ea2c50b26408805bbe3bc451d3

SHA256
1bcd9b4e8328db3852f2caf15c19ebd84b90b3310a75b3e7e41e707d936699a6

SHA512
5d45b09b7f7c79bd83714fc54b904c36e5b68d64f972b8babe8c2946af242d6be6279876ff56e493423e932b77dec6557caec6f21defcc3800a3164faeac75f7

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SEND-F~1\images\progress.gif

Filesize
19KB

MD5
ff6e259771ac9ef63a477f1d4ddb32a7

SHA1
794161b535c46111fb1a01570d833aeb44c0a25f

SHA256
b52feef5377b7cfea65fba6ebf695534907e3a3e05a4a751f85413402e10405d

SHA512
439c6419acd60adf07c7b69bfcd34128f6c02d73a8aff5b2916c108e2e1c027554ef058020d15d6b7c763d88e751a71f504c193b97d0dab594743fe230001188

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SEND-F~1\images\themes\dark\faf_icons.png

Filesize
6KB

MD5
510a7f09241821bdda1e4adb5c09b21b

SHA1
cfa9a0aae1a8a8c05fca8a62e963a5a56fdb9a49

SHA256
6e24425428288ff0b7a1d4ec5d2a33bc47318187b41ae018c02c55a6344df58f

SHA512
a422fea9bfd9ac83cf4897e8ab2733ad30c3c00f2416406c42d4c2c3ca508b69d5e6c35874f72b49747111ca856481d3910d801de9593759f3350a6c74826668

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SEND-F~1\js\nls\root\ui-strings.js

Filesize
8KB

MD5
39797d27bd777252918f8c2a2c9b7b3d

SHA1
2e1c43c8a7ee912dfb72cdd7028da5d1b58f98d1

SHA256
fc24034d00b42c0702daa57d877184a6b8d55df0adf0d7dfb3315a1d67f2c119

SHA512
852f08a1761e409f462e53c7a7347e55a598ff0a938feb8ba944337ee422c0038faa2291b2fa68a6f36e1d442b2744a4f28c29a80bb466a844b82f658d813468

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SIGNAT~1\images\cstm_brand_preview2x.png

Filesize
4KB

MD5
d1a752735bf2120a66a43eff27620522

SHA1
7e71944b665d211790734a030814410904014ef7

SHA256
57ed01bbf7033bee4ba4157734a3efeec4a08a1480e29e0720e548a5fd712b0f

SHA512
229b765d45ba24778a435a97bc755cf8ec29e27d5119ee2916c679b41e2d7d3c2996be4cc0ca1ddcbf859f8c85fa7b58f4068fff6f84de97fdaa54158b6eb44d

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SIGNAT~1\images\illustrations.png

Filesize
4KB

MD5
fd07876908c374e05f132827822f7a5b

SHA1
c7ae3aef4c52afc8ee8de3cc07bf32eb5cc43a9c

SHA256
ef76ca2e610a9a30a7455b79491b0eab084e6b9792394ed06fb019e7571142b7

SHA512
bf28a9709d10ef6ce136892794df57e63229180f58b42ccbabfc09c8fcb9c60b4c48741260d02dfcccc1b088d9e40294da6a9d47e727f446ef9d1ebdb252f2bc

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\SIGNAT~1\js\nls\root\ui-strings.js

Filesize
13KB

MD5
2cda418c696158e4beb304d1ff40c993

SHA1
d351b09043783abba4e8fbaa13470aaa6930401c

SHA256
903d2727d59ed02d5088a28c422e19c56339b967558d2101a50472c5e623dd8d

SHA512
4f804e65b0c54d7330df66ccdb04dde2bd94ce21037dab187a107e276a64110f18170457c9a9cf0ba1a0a2df3bc74543f098d0afc0f9331644665b818260e50d

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\TRACKE~1\images\logo_retina.png

Filesize
6KB

MD5
723fe70a41a5e02bf7d1fdac00c1ce56

SHA1
7fcb35ae7b2332f607209c9dfd03c006560aea52

SHA256
157f9065062b0b02875b0a825d442ad3591c586b4f45b7fff402bf0a0fa7e4fb

SHA512
4fdd8d7ff4a1f0c5d9529f68c5a970221a5fb41f40af4990c8c0b5bf0be2494454c6dabd098e534925ad5774a307eab5d2283cd97acaa9db04a58d9dea6d3dc9

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\TRACKE~1\js\plugins\TRACKE~1\js\nls\en-gb\ui-strings.js

Filesize
10KB

MD5
20189301a758b4d2046ef3737c1e1e2b

SHA1
0f68699ee36a1281af44d608def633efa1822582

SHA256
b720b5a1efaca0c151754f4134b384ef4c513531b9f45950d7d1c3167bb0cb8a

SHA512
e8ca0959ca9bb1a99aae9bbad83c955a2c1d779f13477269a9dd39ec10990af2c269345604c748fb650121f00ac99884885b0c9d649b1bfa0a08c53cd4a731be

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\TRACKE~1\js\plugins\TRACKE~1\js\nls\root\ui-strings.js

Filesize
14KB

MD5
19ff659400c056816157ce31beb93b1e

SHA1
6724fbbe453e4a28d1980f4b15658c4377bac34d

SHA256
89f52959956e6ef81a6cef466d95252a7ff49db3fbd6b2f2790f426a4c7112af

SHA512
8683378168a2cf78762df28f5c6de3e65b2a0e7915c826a5b1298414a41f19052d597c91f4c35551f72b03d177899672b12daee291111195802364a7b8dd210e

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\UNIFIE~1\js\nls\en-il\ui-strings.js

Filesize
18KB

MD5
71376fbc54299906e8e2f88bdeef4f23

SHA1
283d547685e4a3a61a88aee5b1e3ef8a367801cb

SHA256
d85cafeca4d2b7ac3a50605150e9e0e3ed3a1520cc918ff9d5dce403916c8c8a

SHA512
45f1fb57f53b2255f70342c8ca8c731d05f4c2a416674c0989aa7654c81ad012d0f30c298e553fad604fc2fb53e962c275910f14afa8562e9329c50a2db60b2d

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-selector.js

Filesize
175KB

MD5
55fb0b0ef9e7a2f6e6fdb0a2f9cb5813

SHA1
522dd98c552d636712fdaeb3356da75617391c13

SHA256
4edbbfde40d21f8dd142cac70071e45116d89dadd054dd912411d66f234791ef

SHA512
90cddb59261ffd48c1441adfa20131c98b12a893b2cbf945624c5f98600c387cf8ce3e8c3726ec341619a1bf37da9fe259b86bc74742d704fb8ffa7ad649c427

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\aicuc\js\plugins\rhp\exportpdf-rna-tool-view.js

Filesize
385KB

MD5
b985797c7e4c9ea0df03074a951cf972

SHA1
c801662247c7425124b6d44cc4d2256bcefe1c98

SHA256
515d99fb1422c1f40a10915e25bbebcc883914d060eed8d0f439799c19b73ac9

SHA512
9c1396891cefe70f90bb4916002c621ef32624f875c5aa493256b18b8bbdd2ff3bf8408c9e313e20a27824590820c6f67b2dc534adb55352aa125859613d8abb

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\digsig\js\nls\root\ui-strings.js

Filesize
9KB

MD5
579cea12faf899213fa233dc8b54f934

SHA1
5cff4489976cd2b1c6294f75e826ee40e0437fe1

SHA256
17fc47da85612271100fb118c16db4ee83a72d3c531742b2c067cf1cad7a56c5

SHA512
d61aae468869f170b511a71f312870a7fb0efc07101a00939b1b31f731edf7a4d61174c9f2f6edec10815957b90ee3128c7dd24431662e4171b7e5d482c0352e

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\home\images\new_icons.png

Filesize
8KB

MD5
58dbc5c4a57186fc1942139d0b322adc

SHA1
534c8beefba46f37f66a24117197d09fc85baa53

SHA256
663f0583f8883fc192f6a88de697b352ea15b893aa27d16b4233a54b27ff3629

SHA512
87df78f90d813e13e42bbbe7a334fa456e116976987e45c6823af6ab709e3b083b066a46e0dac598148bf96fbe968f01ba55eebc4c6dfa7ad257030d2124f747

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\home\images\new_icons_retina.png

Filesize
17KB

MD5
8af29721e93b1c91153ac7084e4a70ad

SHA1
a2963444ba46f89bd58202c757d54cb3e6a24197

SHA256
c4dc253cd1a9d33a4ba420e138676a5189c7eea397ae93c6809d713732276109

SHA512
02f770bf838bed043f730fed27792428c608018aafd052e073855cc9813184f02d80e1a46c930f5958ec00ce9d0be527ca172bcd2840cdd5d6625eff4d52319b

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\home\images\themes\dark\icons.png

Filesize
8KB

MD5
de82a926ef3b7bb70f82f55c7381f55e

SHA1
ab88a914b33bdff7d90246826bc7bb801956c702

SHA256
7e8e3301dcec4215256eb682c88f8d9a144d32b22afeb2e7bdf88a4cbb33ba5a

SHA512
120cfe21b847d617b0142fd9e5404a405c450184c3e746746fdb73746ddcf593442bab38553e805f0b11fc63bc43adc46bf51d2e0dcbff45983ca496cb488554

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\home\images\themes\dark\icons_ie8.gif

Filesize
8KB

MD5
e8e619c7acef2146d72f1adfff2b9ad3

SHA1
936476169fab6c6fc661e8f8acf18d562dc8f7b9

SHA256
42c56c10b0b54105ba2dd609e4e143546a69cea7eb5e4b2704f9a710f4ab0ecb

SHA512
188324b1cd86cbb46f4f07ad332c483314d29d7dde842efb8af06a0dc68307a2609a6d9ab6801fd63ee4d090b1fb85d86c4a0c132f87b0cf88dd652cc421ea8c

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\home\images\themes\dark\icons_retina.png

Filesize
15KB

MD5
b025e11492dd9b17be8ad2f8bc392a94

SHA1
dedd7267a4fb48aecb552ecd48ffcb5180041e64

SHA256
72aea2c7c6d84551ca5aeb09c15a08f78a9899829fab55f6d277e2f7ba9fd8d6

SHA512
bacc4764a87b01dbf561316df8967c068e0b5c01fc3e6286de6abf661123335572ff8f42b779c001b3037e15b6014195d5309d4afcc3305555a6a98d1333950f

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WEBRES~1\RESOUR~1\static\js\plugins\reviews\js\nls\root\ui-strings.js

Filesize
14KB

MD5
5c3f450ac376d8c1be2fd99547c3598f

SHA1
9e8e47c9cf3e58f4b6ae3859bda862475118f230

SHA256
3c89c049bfe351d2958b308f20331007706c218ffceba85b4e1cc448d797600f

SHA512
325eed21c472955d1539a026644a13912bfb277f65552da6ffc9270a6d8fad7e1b313d88a3f13b110fc6edd9fa154f01816f9b355bd60c6b7df60743480bd226

Download Submit
C:\Users\Admin\AppData\Local\Comms\UNISTO~1\USSres00002.jrs

Filesize
3.0MB

MD5
38bc8b7e4b3442170e63a62cd7d317ef

SHA1
8b3ed9e128b2a6e9bf8120965597d9bf3e472dc7

SHA256
8f10fa162702d263c8a1829b192d94f89f3983f13d5c862b2d493155653fdf74

SHA512
5cb896dedb4267d0aefc99b02910d63133505b6746e365a5e4119b5984054f6d602a6619a174de79b1f5e7447f224b526b29a58c11a7051b52d1549fedd5e4c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\USERDA~1\Default\GPUCache\data_0

Filesize
8KB

MD5
3e69dc6ac9316bf8dbfaea83bc39dcfa

SHA1
d417804bcbe85c58e992c3ef1bfac680cb30bc06

SHA256
c1f05aa72af09aae949f83d059b479b95558402ec8e20e57d6e018d0eabfe526

SHA512
1f4dfaa48e36d8af54ddc590ae2a87a8837f8c606b3680eced914293e3cee3747d5d1b63a939e3ebf3062754b1078a9b437c7998404d95f53833a3f7822104bf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\USERDA~1\Default\GPUCache\data_1

Filesize
264KB

MD5
7a779985627b047b80addfcb74802eac

SHA1
e7e98b5df3c48395e1731b41a60cd5a404d1a204

SHA256
b9cbb431f66630eb58d7fd09161983a6bb3fce215e6121a2c27411c86b63500b

SHA512
6791c010afc80f1d2bd068ffa5c486f912906c1667ebf065c5e8b9c8dd6e43758bd758f83d460f16f28c1ec8148d2b0f84ae401ed4707a61e9ab31e92d0ceffd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\USERDA~1\Default\GPUCache\data_2

Filesize
8KB

MD5
5dd74d4d7f4ba71fd104a84e27a56cf8

SHA1
11513b0edfea8f768515f2e932b211df544e716c

SHA256
81304cc87e0d6f937eab34ee718b359cb83c708d64cef860f3f1319bfb78c26b

SHA512
54433b6334cf8165bd025a9633743a62eee0fb362ae072448d9f45c48d467178b5ad5c36ee51b2822729c8636c3cbbfc21955ef139e39f485c0a5120163663ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\USERDA~1\Default\GPUCache\data_3

Filesize
8KB

MD5
c7139aa071c2ebf649258ebab727ac9d

SHA1
79f2b23fa040a43c5c5535ef0eee419c83bf0d59

SHA256
cd8576d61d266e92b1ccf4c357ff18b95cd878564db74c3f9b6fe59d5b61fc5c

SHA512
8b23665780c89f237e17afab5a3c57f07913e5c34550bddb103cd4f36ab696bae585a2d944eaf27a5ae16747eaa9ab2cc8fa24015ccad189b9dad9d99cec25cf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\USERDA~1\Default\GPUCache\index

Filesize
256KB

MD5
d53a1a815f1be3fa4eaf2b12a66e646f

SHA1
ac4fdf6b6efed65898620be77bdcfebde33c531c

SHA256
ad643bba78385c548a40b95bdd606f77498b2ad262a39d3408dd63bad24ec855

SHA512
843524178fc1421dabce85a79661ee7118597c12a5a44325c16513875cfcb3d7b65fb9fb2a40375742ffce7af1fa3fee9a3d50f3bea71725d5c8411352007f87

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\YL5UZ7~1.DEF\places.sqlite-shm

Filesize
32KB

MD5
96c39c69b3de2154f3046a8b2b854080

SHA1
5eceac9d19aace22dd9e1c18a31f2406410e7ac1

SHA256
ef2b193d2c7cca507e89e138beda70b2ab81c66dffc0c055d8bc5cf5e42867bb

SHA512
c7a0d6ca1806a16202f2f2c334adaca503cf02602719f244b8788807f4aa8c16073444a16c9a82314259b921652b2d27a9f23bd37c46d28de4cf1fd703191680

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\YL5UZ7~1.DEF\storage\PERMAN~1\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite

Filesize
48KB

MD5
3d0bb884465a90fbd3a997f2e3f8acbd

SHA1
870e994ecfc2ae82c47b3e85428356f4e579e676

SHA256
1fd0e062c255c98c071eb4d65537c30f5c26670b92eda04173a47358f9d5f954

SHA512
35f67a8c2b1e9930163f07d38f041e2fa3f8ba5909bf54e444349c292fb4ec5f517424dfef7d7ef1446e34dcd7d0ceca5b968b1a8770bf65260ef95aa2a3f83f

Download Submit
C:\Users\H0w_T0_Rec0very_Files.txt

Filesize
1KB

MD5
b2ccdb9e6b914e7ae08defd418e526e9

SHA1
9a7e36c5f16df2d8f462d0bbc94324b65aab0b79

SHA256
710134a6f194afa24b8374666ebcfaec47d36c310bd1a90f3e634c017f1507cf

SHA512
f743ac73c8337c78de40f3ec23fb4d9a2aaf38d3e23b844aae4ffa45052fe8feb3ccce2ba6fc8a5fb94ef828dcf54ebba7d990671f0f17d94f3eea2a2b7f4cc1

Download Submit
memory/1728-1-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1728-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1728-14580-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1728-14582-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download