play | 006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55

max time kernel
100s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2023, 07:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PLAY.mal_.exe
Size

178KB
MD5

223eff1610b432a1f1aa06c60bd7b9a6
SHA1

14177730443c65aefeeda3162b324fdedf9cf9e0
SHA256

006ae41910887f0811a3ba2868ef9576bbd265216554850112319af878f06e55
SHA512

cf8b097e4d8dae444c4759a6588bcc5769694d34675f17fed5ee6d0b7aa52ed44263b0cc73f4ff422182a01ad8d69b18a71110c4fc4e9dd2233e9cfe833cbd36
SSDEEP

3072:Yrl2uRkddO+iR7OZOQ+dzeIP9mwUGU3l2bxW1/9JnOC/fhKJ2hXh3lmG:22uyqOh2g8U12K9dtEWx17

Score

10^/10

play ransomware spyware stealer

Malware Config

Signatures

PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
ransomware play

Modifies extensions of user files 4 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\EnterOpen.tif => C:\Users\Admin\Pictures\EnterOpen.tif.PLAY	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Pictures\EnterOpen.tif.PLAY	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Pictures\FindUse.tif.PLAY	PLAY.mal_.exe
File renamed	C:\Users\Admin\Pictures\FindUse.tif => C:\Users\Admin\Pictures\FindUse.tif.PLAY	PLAY.mal_.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops desktop.ini file(s) 29 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Public\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Program Files\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1529757233-3489015626-3409890339-1000\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	PLAY.mal_.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	PLAY.mal_.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	PLAY.mal_.exe
File opened (read-only)	\??\F:	PLAY.mal_.exe
File opened (read-only)	\??\G:	PLAY.mal_.exe
File opened (read-only)	\??\L:	PLAY.mal_.exe
File opened (read-only)	\??\P:	PLAY.mal_.exe
File opened (read-only)	\??\Q:	PLAY.mal_.exe
File opened (read-only)	\??\W:	PLAY.mal_.exe
File opened (read-only)	\??\B:	PLAY.mal_.exe
File opened (read-only)	\??\R:	PLAY.mal_.exe
File opened (read-only)	\??\U:	PLAY.mal_.exe
File opened (read-only)	\??\V:	PLAY.mal_.exe
File opened (read-only)	\??\Y:	PLAY.mal_.exe
File opened (read-only)	\??\Z:	PLAY.mal_.exe
File opened (read-only)	\??\A:	PLAY.mal_.exe
File opened (read-only)	\??\H:	PLAY.mal_.exe
File opened (read-only)	\??\I:	PLAY.mal_.exe
File opened (read-only)	\??\J:	PLAY.mal_.exe
File opened (read-only)	\??\N:	PLAY.mal_.exe
File opened (read-only)	\??\T:	PLAY.mal_.exe
File opened (read-only)	\??\E:	PLAY.mal_.exe
File opened (read-only)	\??\K:	PLAY.mal_.exe
File opened (read-only)	\??\M:	PLAY.mal_.exe
File opened (read-only)	\??\O:	PLAY.mal_.exe
File opened (read-only)	\??\S:	PLAY.mal_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_TileSmallSquare.scale-100.png	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\ShareProvider_CopyLink24x24.scale-200.png	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarBadge.scale-150.png	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui	PLAY.mal_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\DigSig.api.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\NoConnection.scale-200.png	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarSplashLogo.scale-150.png	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\trash.gif	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\error-icon.png	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sv-se\ui-strings.js	PLAY.mal_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\high-contrast.css.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\el_get.svg.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msado21.tlb	PLAY.mal_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ARIALN.TTF.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\s_agreement_filetype.svg.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\pt-br\ui-strings.js.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sk-sk\ui-strings.js.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\da-dk\ui-strings.js.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_ru.jar	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-200_contrast-white.png	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-si\ui-strings.js	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\eu-es\ui-strings.js	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\CompleteCheckmark2x.png.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\RedAndBlackReport.dotx.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\LargeTile.scale-125.png	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupSmallTile.scale-125.png	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\SlowMotionEditor\UserControls\VariableFrameRateVideoPlayer.xbf	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-white\WideTile.scale-200.png	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\ui-strings.js	PLAY.mal_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-pl.xrm-ms.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-GoogleCloudCacheMini.scale-200.png	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsSplashScreen.scale-100.png	PLAY.mal_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_ja_4.4.0.v20140623020002.jar	PLAY.mal_.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\deploy\messages_ko.properties	PLAY.mal_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Library\EUROTOOL.XLAM	PLAY.mal_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\vlc.mo	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-24_altform-unplated.png	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\7734_36x36x32.png	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.Tests.ps1	PLAY.mal_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\bin\setNetworkServerCP.bat.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ja-jp\ui-strings.js.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-cn\ui-strings.js.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\de-de\ui-strings.js.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_cs.jar	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\LockScreenLogo.scale-200.png	PLAY.mal_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.properties.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui	PLAY.mal_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-options-api.jar	PLAY.mal_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\powerpivot.x-none.msi.16.x-none.boot.tree.dat	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-black\MedTile.scale-100.png	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldBeGreaterThan.snippets.ps1xml	PLAY.mal_.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_ja.jar	PLAY.mal_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesdistinctive.dotx	PLAY.mal_.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MpAsDesc.dll.mui	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\39.jpg	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\1949_24x24x32.png	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-60.png	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailSmallTile.scale-100.png	PLAY.mal_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\S-1-5-21-1529757233-3489015626-3409890339-1000-MergedResources-0.pri	PLAY.mal_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-100.png.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\sample-thumb.png.PLAY	PLAY.mal_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ul-phn.xrm-ms	PLAY.mal_.exe

C:\Users\Admin\AppData\Local\Temp\PLAY.mal_.exe
"C:\Users\Admin\AppData\Local\Temp\PLAY.mal_.exe"
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
PID:3452

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1529757233-3489015626-3409890339-1000\desktop.ini

Filesize
1KB

MD5
a83c3637d426f573a8576de97c0ef7b6

SHA1
78d204ff8de72b90423303a3a9807571568bb10d

SHA256
cd684d73c2fc552225d2a1fee9ac7c6f7d7ea065a3f3cfae9a44d1f85bb44d0d

SHA512
45feac3c249458b075dde8b087692a1f46fd66ef93883cdb2883d9ba0a1c83915ca507ad8d2e1f7e5bc3b0e2260fedb82f007f5d2739901b7184eccfb00b5c02

Download Submit
C:\$Recycle.Bin\S-1-5-21-1529757233-3489015626-3409890339-1000\desktop.ini

Filesize
1KB

MD5
fa64991df16ad01a7d73e2d8121535f2

SHA1
8bb884a1169a9cf9c2bcd03d4ffaf7a1cce9eb6c

SHA256
0f3170fca314c4f97cdc1ae514975095a819c58b7de262171634fc9405e81d51

SHA512
8b456d9c6f1f14b00cf7f7f43dbdb232b6783325ff81fd1a32030f0646f870ef2a6e821073fa3dfaa6c7e765f1eed3221ef690772d0d0181684d2f5052474315

Download Submit
C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRdrDCUpd1901020069.msp.PLAY

Filesize
143.6MB

MD5
23ff0b3db1e6af125b2ee3c957cd1d44

SHA1
377667d66f2c92e1e19cebcfd5730e00d0f01e36

SHA256
248d4ec7a19a22055a16b0a9ed50160a620bd317ab61a6604da7bb3a3f92bdc3

SHA512
54ea33d1fe570f8f5113d83208d81362b64e637fa58bf76024179fe06fc78c7d836e5edecfb667ffa4c27b2c7e7d2efa4589c1e7620bff5f464682a73e46112d

Download Submit
C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Data1.cab.PLAY

Filesize
112.5MB

MD5
6722595af8bb8e1fbbb686b5e4845b7e

SHA1
80a9939cf4e54941fed5415c619f64e2ace13cbf

SHA256
c17aa18ec515990ea8a544dc3607fb232feca08b879badd41255549a86a6df9e

SHA512
9638a6699756c785c9fddf1cd815425880310452c41e5f76c7e266789afd645ea4a691c07ce4e93dbcad2078e5945eef7fffab0e9faf2507966cde59a2a717ae

Download Submit
C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\abcpy.ini.PLAY

Filesize
1KB

MD5
f529b16acb999cbc7f1d650bac7884fb

SHA1
84f86ceaf65185645c0a553820d2f3bcc31114d4

SHA256
05c19ea81bb97406277a5dd8f1d1472be6710ce49c6b40d089b3863ab27f61be

SHA512
57b2a016d46db4490fc37898183bb962f4db310fa58bb1a4c8b42d82dccfc42ce7b1fea5761c5eaa9727ab0ec8da79af89422d5fc56d07705363023407ca1904

Download Submit
C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.ini.PLAY

Filesize
1KB

MD5
5f0aa505f7e1b1fad1ad1301c797a998

SHA1
36d1ff262b3df2194ac66422d66958e0ef152bf6

SHA256
3caf54d700136563460360b47c79c65d1d6fd05b49baaf311bdedce2401e2211

SHA512
e8810e6a4a346b29466cb0cf10e100b2a5fc2474f7f9fdf678f8e2c8961ac648d6f920027627db0f3835c64049079713806eedc7d388cbced3b58e4ca7bcdb34

Download Submit
C:\ProgramData\Microsoft OneDrive\setup\refcount.ini.PLAY

Filesize
1KB

MD5
b31427b92ac620059591a44b69d6c47a

SHA1
944337830ca7fbe3b60606a2ec5d3d93fb486926

SHA256
fac642f434d3e92f6457c3314406bf6940558c3b65076aff2ce29ab3315bcf8b

SHA512
a2f0e5f4c22f92e0e4addd39a3303d115fac9d1a37d7888fef80fd18a4d653d2fc64506ac4d1c84f1c969140cfbdc6f51058f73f8406343911f0ebeaaefd2fd9

Download Submit
C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json.PLAY

Filesize
1KB

MD5
689541d1e79c49efda927824339a0a99

SHA1
2996dd0abdba5b8ca48c9c57d83fa25df0e9a57f

SHA256
1c236f91c070d1934f7b57916050b581b6c96f1187d53b402bdac947ff1f46d1

SHA512
771e25ef131696784a564a7a427eb3521274c13259d9d57a31e8bec7b87b9b94740ee0ff52f37f99dab5c6405972f7f3df68026ab825bad8d5654ac79e4fb816

Download Submit
C:\ProgramData\Oracle\Java\installcache_x64\baseimagefam8.PLAY

Filesize
78.7MB

MD5
502af31b554410dd3a3bdb34036918a2

SHA1
9bb93ef898e873cc17eff84b096921f92378de01

SHA256
9ccb0665daa3e9aa6c390ce02d2dfec8ad60b3e2d9ebc942bce56015fee9de93

SHA512
c74994757cb64e6a7aa3d63187f3eec2125740e2851b4f0d9bfe0ab2b9f6ccc9da72ad8b3e4f8ec4823b4c612abbd04960d448ed24228f461b7902f5a8375e43

Download Submit
C:\ProgramData\Oracle\Java\java.settings.cfg.PLAY

Filesize
1KB

MD5
3701080d655a3a7f4fa16752c6973bd4

SHA1
9b02456decaf5123c066d8ea973ccffee98861f5

SHA256
e532a1542eed067332eabc51eb160a996b14f5cd937c3cf9649df79401cd55f7

SHA512
a6a0cbe6d11467bfc50f5fd1c7bd2111e6b4174a647ca86c240746a972f56960be46b1a90f701ece2af3d5f1f1b26d823fd8d60a686efdf242e9b4c41aaa0c60

Download Submit
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm.PLAY

Filesize
1KB

MD5
eda678751be576d338cab288b2126083

SHA1
1e0e3a98e8ee4dcb7712a5969db49b24ae72a00a

SHA256
cac03213388668b4bc2b62e483617aef41c51e42d0cd1cc60f8e0cca59e6237f

SHA512
c1d55df4dc0b1ff632a1776cbac7637a265575186e8989809933d94683aa26bdba2c50cb50e726dfb6be759b4d0ad66658ef5def4496b4801f8b0d5c35fe3db4

Download Submit
C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\cab1.cab.PLAY

Filesize
5.5MB

MD5
c7856bbfe4848b98125b942cd45ec62b

SHA1
f4028dc967edb765b67b7be3e29d4bf614a750cc

SHA256
e0d56febc2222fb40b379e6e91230c0c1ad9f93abd87ea412c3274e9f8e922c3

SHA512
f5d30d7f3a3d8a426331cc42f82cef71313fc7fde15eb45bdfcb9a70423e03bea92e914f23ce17e4821377ea0d5e9a2c320c78bc4ac8d72c603e5bc945bb75fb

Download Submit
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\state.rsm.PLAY

Filesize
1KB

MD5
6c6f092e0a2c9a110fa424015007d2c3

SHA1
c899cb07925da5577548e39039d902f2f10dab91

SHA256
5ec4ada4c79b2d381e9bea100ef42db184447ea951dac4853433e2c17569a931

SHA512
ef9ec250f9e49fd2e52dde912c5d262ccb8c3d544084ee9575bd064269d19f08e1fe908a6d5486619ba813df1d1c0a043ab387894c2d2cbe8209efd76e3de2a7

Download Submit
C:\ProgramData\Package Cache\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}v12.0.40660\packages\vcRuntimeAdditional_amd64\cab1.cab.PLAY

Filesize
5.3MB

MD5
e26eaada6384c53f685a2f6b7e51177c

SHA1
e27bccd4c20976bb5557562c0801cb3ae3a90a6c

SHA256
4db75631837b8aa72680b056b2b25b5b89827c569147a48c3a5de0cb91cd5ca2

SHA512
7774af444dee75d49279e44ded69cdb99a9540f3b0feed1ee8412e0ba13ce625b59f653d9e07c80e9db6b2f7f25abf104fa68696470390d791a0cf917991e519

Download Submit
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\state.rsm.PLAY

Filesize
1KB

MD5
db5cb9e0fc10378c95c44122ad950f78

SHA1
6a638efac94945debdd5e17fdc54b845d0f14b7d

SHA256
eb91f010c2ef82ed8976d2930074ab6f0a175086b828cb00927e8c995353eae8

SHA512
5c28a8a035c0744203ee00d0207e920c400506644fc0d85d1716e6ebcd85f6a99b80a855e552b1fb001baa437630c7d7ed05a71a06a73e89c1f68671c9c28843

Download Submit
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\state.rsm.PLAY

Filesize
1KB

MD5
9354c0d10b771f38efcd447e4d1b7beb

SHA1
6095167e4fc063050ba052e189b559c7c92386e9

SHA256
7f1346f64f8b1adef4a9ab4a796cc800e31c48b78b77c3aa0032f87fcbaa5649

SHA512
a33d0946939db6cec89fcabb972f891344b93cb14d42bb98678daf6e7387a47c329fc0e4634b0736aba81d9f6c59171c35139a4b9125bf81a44ad0a9bc1461a0

Download Submit
C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\cab1.cab.PLAY

Filesize
870KB

MD5
6575dc393c6c49ef7c5421bdd9d1d119

SHA1
3b5f3c92587ad8fa2564237e1dc9ed3b0fe53468

SHA256
a7f64bd127fb85592259f27b3ab1cf844f3fd6039f93bdd8fca9989c1b7a1796

SHA512
2cfbe338c8070f430cefd961476b7a23fa3677bcbc3ca3ca3878b2b9eee9b9076991b1b1996030723340167dc39208c0adc37b63dbb055f58748fae1ef5976a2

Download Submit
C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\cab1.cab.PLAY

Filesize
5.4MB

MD5
737d587f7dfbfe6a597962a73624c42b

SHA1
dca6ff505d1cc722607127b412fdb516c44a2b6b

SHA256
d525531fa6f386b5ccea79fc92526483f0dd5c8f22687c6145a6b3f8646c4198

SHA512
4808347ed57a10e6413e428784bbe27f25b2c55f02249074fc0aae65f28bdada722654406f4351140a2c76c67fac503a56b0ade140624cf92d24434646670c13

Download Submit
C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\cab1.cab.PLAY

Filesize
4.7MB

MD5
e92429a9c25c748b2f10c938bd9f75b8

SHA1
e7b3f6ec6167168f995d7d18b013b994a072d0b1

SHA256
f55c3d4f8cac245d69f9a19386c4ee968de01c81b8a09fd896158a3ca62d6cc2

SHA512
73cd9c56e6cf97fcd9ce3fe5ebd4bb234cc75ecdb490ef4a6196bf214c32c6c34e8e006b8c509a223477968981275072918488302d4c616f46487588041eaf7e

Download Submit
C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\cab1.cab.PLAY

Filesize
4.9MB

MD5
935001f83162eea61177660808d06f62

SHA1
3caf1d4f2266cf8cb61517df1990a8d7a2045789

SHA256
91f89cb275b161d140b27aedd238a9bca8c419917f127ec19a2ea0ef8419fc1c

SHA512
83c489c6b39b4e21f897f6f1accb9e38d6cce77425b341833a183f4afc531aad823c0581006a9727fa399db3f94b9cc5a1ad755469bd13ddeb16c0c1e6619f3f

Download Submit
C:\ProgramData\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\cab1.cab.PLAY

Filesize
803KB

MD5
c057bb71c1d727e711ea384193d076d0

SHA1
b894d1730baa759ae54e098770f0848f3862fa5b

SHA256
7c1f74e7a2c50a89a2ae137d5c17c0d45f38364dd593f9a76a303c5559f2564c

SHA512
b9424add4243cf0f783f515df5e06f6110904cb215f4dd0737fd2c9d87ec24d7b0545fbd8e09af972e8fd03acb0e9e71c8f35c777a79247c0dd7899b6c0d5071

Download Submit
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\cab1.cab.PLAY

Filesize
4.9MB

MD5
9728f78eea44c22e5da5e6eb32207455

SHA1
8e4b1e07e28b2535102cbf6b61418199205620c5

SHA256
6812eebebc9a1c0e62ca3888ee51457eb8d8c3a56faafb8d5902913f6edc1f53

SHA512
97d540a3f1ec32c4ca33b5a9602607d0350296bec5c2082d8dc950a4584f7e0d39a78d04cb6d18ef7c3e206b505b0651d7546322604fa087b51144ae976d2172

Download Submit
C:\ProgramData\Package Cache\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\packages\vcRuntimeMinimum_amd64\cab1.cab.PLAY

Filesize
1011KB

MD5
1a18d38556cb050a82ccd493e93a6467

SHA1
4600cc09b21f81f670c7f6cb174e8a22527f630d

SHA256
83a02ddaa02cc3cb877790cc5310c0e12f726041609685c4976922195b50f774

SHA512
6e5c44b59b2b81b7340881914bf72fa0ebaed05c1fed004e4e10c28fa8f4a1321e7bf076b0eb77e3ad9ad74daf48da0859d0be0af2c9cac5f40366fa3c6ac149

Download Submit
C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\cab1.cab.PLAY

Filesize
791KB

MD5
ed21f9abc4f87b9b2045112a88fac80c

SHA1
033b121877fc2b7b05898b644399ef0e880adf97

SHA256
43185171ef1e56e02da5e28c33b600f422332538812af55e4840810a36f25981

SHA512
cde0a34bfd75ee31d8bd2dd5c7e121db0b5097ec5ce61fa2d4cd1f98c0c7fb2433a4b1b5429af43e8a22773cf6d30d20503017fcb185259db6cd2ed32574eb1e

Download Submit
C:\ProgramData\Package Cache\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}v12.0.40660\packages\vcRuntimeMinimum_x86\cab1.cab.PLAY

Filesize
974KB

MD5
52c4b255a8504fbff7d9853396b5b886

SHA1
c32a28e3a65bb8b5c262f1308b0b2d2a386902d2

SHA256
29708b9822f4352569c4f2406c7ab0c97ce43a64abc14a99c8b9029cface9d4d

SHA512
6a8268090609533b5524bcaede9481e643397dbf27620000157b8226e27c60b3cf892ef782a769ac6a0284ce673854d6d5e3cf939ae23384b7ac804eff9013d4

Download Submit
C:\ProgramData\Package Cache\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}v14.30.30704\packages\vcRuntimeMinimum_x86\cab1.cab.PLAY

Filesize
742KB

MD5
1e16b829d8568584bf7f257d66fa9f99

SHA1
315d81888059df8d56516fde15fb907385ced7d3

SHA256
2fd027f15bb228473d6c024c647ff8ad4b18b002ac7889edb47a5a624d560f2f

SHA512
ebcf0ea809490b3bce5ffbc8e4cdb91bd965512009ed8a161269b990b97620c1764d3765867b3ce576291bc185ce19327c92f27010894046fdac271424117c67

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm.PLAY

Filesize
1KB

MD5
fe74715f082fdcadf38e879574b88687

SHA1
433b3901a3d15463d4d04275cd9e0c29b4075dca

SHA256
008d232d2ac3f325cd47730bbdf24c77876bd3a07d262b93008238b5550e7bbd

SHA512
4a14cb467246118ae1204c0b6b0c94c7427c35ceaf42978f92cd131dadd641ae4d05296b0e6f6e2887a33a00279b6abff7b8f533723f06a94a5b8070c19f4ecf

Download Submit
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\state.rsm.PLAY

Filesize
1KB

MD5
b9602fb1712b17f821b1af913aab7384

SHA1
354a7874f016b93c490dd699e4d846133e8417d4

SHA256
2e1268bb1f4285df127b775927a1ce901aefab0af6f1252acf79a06f36106efe

SHA512
eeb746c5c74d4f45a64861aeb28fa897184d3c6bf513f9c34545c6ab203e048801eca90653a64ab1f007ba4cf2b8ea31fc69bfb2176e217e04fd4b465bea0df2

Download Submit
C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag.PLAY

Filesize
2KB

MD5
7915f6bffd46322f7b27983a39369b9b

SHA1
c8148fca96f879441c5a8bbca2a3401e90429e5d

SHA256
b8c726c278cdd7ea07afdf8260005a943833b91e538d46af725d8a95ef2a4804

SHA512
bf179bb1a41e8043821e808942c77bcfc6e5a93f78dd5cc5f066ab28738c23841f8d7a963ebc430c5e2f4988b548dc34d5c07a28e8e24351f2500c44b80d74f0

Download Submit
C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag.PLAY

Filesize
2KB

MD5
3885709d272f2d38da742ae8f9cf4c87

SHA1
ed49d4876df313467c24a5911d976163b92ed050

SHA256
312b4d170fc5ffd9e1e0c64afd43da0a0df6fd8f9c08b9a1968401bb2c09f4c7

SHA512
1f84c00da1e69038f9347a86ba7c7addb88d81589646c1e641c8c7f43c958deac741a8812e9e192b6b07445e02dddd0c4d1f8ed90af64bc5ad58ff1ede24b18c

Download Submit
C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag.PLAY

Filesize
2KB

MD5
065bed2f37e54beeadb6f01e4f01c517

SHA1
a9cf49fd11ac09d8ed0607d07e1dedb33a0bbd08

SHA256
e3a4b17bd43bed12dd2973e8172c154b442e87e7c48457bceecf0d4646eb7201

SHA512
08f23745f4d2a8368c123dfbb625e6809e70e8153327082aa4f35687d20e504551113a4d4c21c7c61340f278ea8b2701abb2b7770d3af0bb7a58840df5ea9b61

Download Submit
C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.PLAY

Filesize
2KB

MD5
0e0067a48c8a9cc14b03536f8ff691a5

SHA1
ca73a3b6381ef100cf39624036e0ece4f4e58b94

SHA256
8959ff0de5ceb5da7ab60fb4a21233782cdd75943ad997cce5940f6d4697a3ab

SHA512
8be3b4595b4b65f2aee7d4f8bbd8ceba5b00b7025c49d97ecae5e7007afb98eab80c4b96e6963a0686cd17f3bd284c63ef81d079bcbe8f662b63e361f27e54ca

Download Submit
memory/3452-133-0x0000000002F00000-0x0000000002F2C000-memory.dmp

Filesize
176KB

Download

Resubmissions

Analysis