1cdf0dcd13a46906d73588a4f2ef20637d25706ce90b53a7b6f1701c28cb3596

Resubmissions

26/03/2024, 14:35

240326-ryecksfd5y10

26/03/2024, 14:27

240326-rse2xsfb8y10

Analysis

max time kernel
1698s
max time network
1175s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
Size 2.2MB
Sample240326-ryecksfd5y
SHA256 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4
MD5 f5f2f6c370db4b38bdf8032ea3ef2a64
SHA1 b5e188540539bc2b1d128f408160fa91e724c84b
SHA512 f2216faac5d07fb2d6f3faf6cf1e18e94c0ada8aba35a8d2d8491efd1ada526d5358a592b6877a9783cc9b5e81dd54fec8b9969ffd650c0f8aff2e3243dbe18c
SSDEEP 49152:UtAZanCoV4BdnctNbS/iXmYjlV8O7pzTs8OYFFxZbVybdXERd:9x6Mdn0p7pzTsQR
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 34 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\drivers\UMDF\uk-UA\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\drivers\de-DE\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\drivers\DriverData\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\drivers\etc\protocol	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\drivers\UMDF\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\drivers\UMDF\ja-JP\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\drivers\UMDF\en-US\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\drivers\etc\networks	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\drivers\etc\services	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\drivers\UMDF\de-DE\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\drivers\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\drivers\en-US\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\drivers\en-US\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\drivers\es-ES\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\drivers\UMDF\fr-FR\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\drivers\uk-UA\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\drivers\UMDF\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\drivers\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\SysWOW64\drivers\gmreadme.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\drivers\it-IT\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\drivers\uk-UA\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\drivers\UMDF\it-IT\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\drivers\de-DE\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\drivers\etc\hosts	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\drivers\fr-FR\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\drivers\gmreadme.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\drivers\es-ES\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\drivers\ja-JP\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\drivers\it-IT\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\drivers\UMDF\en-US\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\drivers\etc\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\drivers\ja-JP\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\drivers\UMDF\es-ES\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\drivers\fr-FR\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	\??\c:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\DriverStore\FileRepository\mdmcxhv6.inf_amd64_f1a7a2fbd6554d60\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\PerceptionSimulation\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\restore\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\config\systemprofile\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\net7500-x64-n650f.inf_amd64_cc87c915f33d1c27\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\Tasks\Microsoft\Windows\Autochk\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\fr-FR\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\Speech_OneCore\Engines\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\en-US\lipeula.rtf	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\Tasks\Microsoft\Windows\Windows Media Sharing\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\uk-UA\Licenses\_Default\Professional\license.rtf	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\Printing_Admin_Scripts\de-DE\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\c_wpd.inf_amd64_0245a364d71cf6b5\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\netl1c63x64.inf_amd64_4d6630ce07a4fb42\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RegistryResource\ja-JP\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Windows Anytime Upgrade\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\mdmbug3.inf_amd64_aef240978776cd0b\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\PhoneSystemToastIcon.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSScheduledJob\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\Speech\Engines\TTS\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TrustedPlatformModule\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\VpnClient\uk-UA\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\slmgr\0409\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\Sysprep\es-ES\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TrustedPlatformModule\fr-FR\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\smrvolume.inf_amd64_9a3d52a168ca8fee\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\stexstor.inf_amd64_fefc1160d15aa667\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\it-IT\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\Tasks\Microsoft\Windows\PI\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\InputMethod\JPN\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\Speech\Engines\SR\de-DE\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\config\systemprofile\AppData\Roaming\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\MsDtc\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\WindowsPowerShell\v1.0\it-IT\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Schemas\PSMaml\base.xsd	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\c_dot4print.inf_amd64_33c48c563d7541f7\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\spool\tools\ja-JP\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\oobe\en-US\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\config\systemprofile\AppData\Local\tw-ae8-c04-31e1.tmp\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\mdmtdkj7.inf_amd64_161e1375bcff85d9\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\fr-FR\Licenses\OEM\Professional\license.rtf	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\Speech_OneCore\common\en-US\Tokens_VoiceActivation_en-US.xml	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\WindowsPowerShell\v1.0\Modules\UEV\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_5938c699b80ebb8f\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\ja-jp\Licenses\_Default\Professional\license.rtf	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\sensorsalsdriver.inf_amd64_a6da30fe583368a4\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\usb.inf_amd64_683fd853c8b8a4db\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\Printing_Admin_Scripts\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\WindowsPowerShell\v1.0\Modules\TrustedPlatformModule\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\en-US\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\mdmoptn.inf_amd64_583bd0f3892e01df\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\fr-FR\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\iscsi.inf_amd64_c089962740ea1f84\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\mdmx5560.inf_amd64_209486f1c39d4b46\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\oobe\de-DE\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_PackageResource\uk-UA\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\DriverStore\FileRepository\tsprint.inf_amd64_6066bc96a5f28b44\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\System32\spool\tools\Microsoft XPS Document Writer\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SysWOW64\DriverStore\en-US\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.scale-400.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeAppList.targetsize-24_altform-unplated.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-36_altform-lightunplated.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Microsoft.PowerShell.Operation.Validation.Tests.ps1	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL075.XML	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailBadge.scale-200.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Program Files (x86)\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageSmallTile.scale-400.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\LICENSE	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSmallTile.scale-150.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailMediumTile.scale-125.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\Contain.Tests.ps1	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.2.2_2.2.27328.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorSmallTile.contrast-white_scale-200.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailWideTile.scale-150.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-white\MedTile.scale-200.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-150.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.scale-100.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Exchange.scale-150.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\pt-br\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-24_altform-unplated.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-40_altform-lightunplated.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Validator\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\es.pak.DATA	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.WindowsAlarms_2019.807.41.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarBadge.scale-125.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-96_altform-lightunplated.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sl-si\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Program Files\Common Files\System\Ole DB\es-ES\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeAppList.targetsize-48_altform-unplated.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\List.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-20_contrast-black.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-64_altform-unplated_contrast-white.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-60.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\Dismiss.scale-80.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\VisualElements\SmallLogo.png.DATA	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-40_altform-unplated.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-64_altform-unplated.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\manifest.xml	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.es-es.xml	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreAppList.scale-100.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\CardUIBkg.scale-125.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\vi-VN\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageWideTile.scale-200.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreBadgeLogo.scale-100.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ru-ru\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp7.scale-125.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	\??\c:\Windows\WinSxS\amd64_xboxgipsynthetic.inf.resources_31bf3856ad364e35_10.0.19041.1_de-de_c7276cc25cbd8053\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5021dd18efc0460c\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-s..rtup-core.resources_31bf3856ad364e35_10.0.19041.1151_en-us_c9f16b25e2c56827\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\msil_multipoint-wmsusertab_31bf3856ad364e35_10.0.19041.1_none_1be305bb83cd1748\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.Implementation\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-drvstore_31bf3856ad364e35_10.0.19041.1081_none_65d23b04f8a3fe59\r\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.906_en-gb_1dbdc338c2468486\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.19041.1_none_f89a6b0476f024dd\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\amd64_netr28ux.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_5808b2e0b9745a05\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\v4.0_1.0.0.0_es_31bf3856ad364e35\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\amd64_circlass.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_0ee87c6e27c63e82\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.19041.1_none_43fe9f4e368e081f\6.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-setupapi.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c2d4adb909b8c60e\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-vidproc_31bf3856ad364e35_10.0.19041.789_none_a739d930d582bc4f\r\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-a..evicevirtualization_31bf3856ad364e35_10.0.19041.1_none_888692f10660b270\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-security-browsercore_31bf3856ad364e35_10.0.19041.1151_none_cf9de3ecb3a8f61c\r\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-unimodem-core_31bf3856ad364e35_10.0.19041.1_none_4a89404f73eb75e5\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-w..lity-base.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_0ad64c5e33b30873\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\wow64_microsoft-windows-wininit-mof.resources_31bf3856ad364e35_10.0.19041.1_es-es_283959f126f48cdf\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-g..cy-script.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_19c60a32558ae412\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.19041.1_de-de_8104a9c94ccdad95\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-m..band-experience-api_31bf3856ad364e35_10.0.19041.1081_none_6e71490dbda799c0\f\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-nfs-adminmmc.resources_31bf3856ad364e35_10.0.19041.1_it-it_08581ee7f58b4a03\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-security-tokenbrokerui_31bf3856ad364e35_10.0.19041.1266_none_516b1c7e45ec53ea\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\wow64_microsoft-windows-security-ntlm_31bf3856ad364e35_10.0.19041.1023_none_fbdf4db34c0ff11b\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_0b4ed891dd9ccbc8\Splashscreen.scale-125.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\WinSxS\amd64_microsoft-windows-o..documents.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_6ae61beebd6b13dd\oobe_learn_more_activity_history.htm	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-s..-servicehostbuilder_31bf3856ad364e35_10.0.19041.746_none_023b74f176dd78ae\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-u..-controls.resources_31bf3856ad364e35_10.0.19041.1_es-es_9e5ec905bcce3097\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.DataSetExtensions\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\Prefetch\RUNDLL32.EXE-18665B15.pf	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\amd64_amdsata.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_f61df630eb0c2b11\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-e..zard-task.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_df54438386a88879\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-intl.resources_31bf3856ad364e35_10.0.19041.1_es-es_80cbb406cc386410\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-l2na_31bf3856ad364e35_10.0.19041.1_none_60b4ee44b96a7f24\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-wmi-provider-common_31bf3856ad364e35_10.0.19041.1_none_5e30d23f787e0374\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\x86_microsoft-windows-csvde.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_9904ba05c8dbaa0f\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare150x150Logo.scale-200_contrast-black.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.19041.928_none_138fb436497565f4\r\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-i..mon-printexperience_31bf3856ad364e35_10.0.19041.746_none_753a35e56850cf18\r\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\amd64_windows-media-speech-winrt.resources_31bf3856ad364e35_10.0.19041.789_da-dk_9bc6f58302dbd449\f\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.19041.1110_none_c0da534e38c01f4d\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Activities.resources\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-onecore-o..component.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_32d6fa2d7e4c8e38\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-eappcfgui.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_af86a6d0a68a60fc\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.19041.546_none_476476bb5c3a0bbc\SquareTile44x44.targetsize-48_altform-unplated_devicefamily-colorfulunplated.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\amd64_dual_wmbclass_wmc_union.inf_31bf3856ad364e35_10.0.19041.1_none_c155eb8fc7ea0c53\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\wow64_microsoft-windows-shwebsvc_31bf3856ad364e35_10.0.19041.1_none_c65a2937ddcf3f77\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\x86_microsoft-windows-photoacquire.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_de8ea6b3e139eeff\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\wow64_microsoft-windows-settingsync-azure_31bf3856ad364e35_10.0.19041.1202_none_62edb3d9ad59c5e1\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.ConfigCI.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_0b4ed891dd9ccbc8\wide310x150logo.scale-125.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-directmanipulation_31bf3856ad364e35_10.0.19041.84_none_44bf3519cfab87ee\f\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-imapiv2-base.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_318f8fc29c0c4795\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\wow64_microsoft-windows-a..-messagingdatamodel_31bf3856ad364e35_10.0.19041.746_none_72ca938126770958\r\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\x86_netfx-culture_dll_b03f5f7f11d50a3a_10.0.19041.1_none_9b96711be13ca628\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms.resources\v4.0_4.0.0.0_ja_b77a5c561934e089\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\Prefetch\SHUTDOWN.EXE-E7D5C9CC.pf	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File opened for modification	\??\c:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\debugger\images\functionIconMapped.png	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\unifiedEnrollment\js\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-autochk_31bf3856ad364e35_10.0.19041.1266_none_56b9c0cf76f27918\f\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-onecore-c..dexperiencehost-api_31bf3856ad364e35_10.0.19041.1266_none_33f574e0c5dd4531\r\Dont_Worry.txt	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-983155329-280873152-1838004294-1000\{367BB9FA-D8E0-4D5F-B2E6-DD63636270C3}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\MuiCache	SearchApp.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2592	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
2592	1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5048	explorer.exe
Token: SeCreatePagefilePrivilege	5048	explorer.exe
Token: SeShutdownPrivilege	5048	explorer.exe
Token: SeCreatePagefilePrivilege	5048	explorer.exe
Token: SeShutdownPrivilege	5048	explorer.exe
Token: SeCreatePagefilePrivilege	5048	explorer.exe
Token: SeShutdownPrivilege	5048	explorer.exe
Token: SeCreatePagefilePrivilege	5048	explorer.exe
Token: SeShutdownPrivilege	5048	explorer.exe
Token: SeCreatePagefilePrivilege	5048	explorer.exe
Token: SeShutdownPrivilege	5048	explorer.exe
Token: SeCreatePagefilePrivilege	5048	explorer.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
5048	explorer.exe
5048	explorer.exe
5048	explorer.exe
5048	explorer.exe
5048	explorer.exe
5048	explorer.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
5048	explorer.exe
5048	explorer.exe
5048	explorer.exe
5048	explorer.exe
5048	explorer.exe
5048	explorer.exe
5048	explorer.exe
5048	explorer.exe

C:\Users\Admin\AppData\Local\Temp\1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
"C:\Users\Admin\AppData\Local\Temp\1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2592

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5048

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies registry class
PID:4640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Dont_Worry.txt

Path C:\$Recycle.Bin\Dont_Worry.txt
Size 738B
SHA256 d00e18a6aabc9c410cf6ed54974e57d13a29d30cf561e21f3f2d6155fbc2a07d
MD5 7854423ffc1ddebaf6d2aa0319df9da6
SHA1 102f885e12ab54c45788d080dfbfc259719c8897
SHA512 0d7b9473e003df7184d88c57c1f2a82c7afce00c560c8b8bf3d111551e89a0b651ec1fbccad8d6aa7042bcf23ba96a804cbc3b5b73466ea8b74bc18f2cc8345d
MD5 SHA1 SHA512

Submit Download

aic_file_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png
Size 52KB
SHA256 51f64a93a25cd12a019065796bcd7c9e8ed42a88ddf6e055aeea2edde09fef68
MD5 5eaee5092d01fd39b4abeaf43ef9d80e
SHA1 eb2ebaddd251aff6894230d95377c86ed6ead537
SHA512 a5cc56da99547da8a4ca0af4c308e9b617046051ce679e1eb720a2c2413fbf19ab84bf3e0ec7c98219cec93e36cc4ef64506430f6d4f12a2a9e41e5308d5c3ee
SSDEEP 1536:KsrtE7LRei0NMluMV+tBn74mfMKSeAff3kFXNTjc:KctE/9V++eAXUJN
MD5 SHA1 SHA512 SSDEEP

Submit Download

selection-actions2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png
Size 5KB
SHA256 2ef59d0f7bb254b4c3ab2d96b23747a78818bab8ad1547d95d753707fe13dcfd
MD5 93067d32993ffd611c11de18574798df
SHA1 b6f3431999e67e1cadb5cecc91a14533492ff505
SHA512 e2a9c55e0921da2d4f3c000c63babf763f2e2238d49ab1764795799c06db53d0d87f07498722212083c1c12d819fc8f23194f267b2b9cba5881cfeeeb80a8e52
SSDEEP 96:6COlzfFYPqzv/ugz0iIPxK7yrXmC2k6D+OqFa3PJNeTF58:6p9f3zv/uQ0iIE7QBVrM3PvUF5
MD5 SHA1 SHA512 SSDEEP

Submit Download

icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons.png
Size 9KB
SHA256 14a1883a1a28b0e51916bf0910ba95f189219b52ba6dfb1ba529645306cfe8d1
MD5 2e46b6935202da0450fd1f384088db06
SHA1 8dc69652997a1c0297f16a04c73001e9b968d9b4
SHA512 fa2db71fe852ab80713a61b70af4d328ad011c208d3437b970f68eff704e93f8c8c418ba51a9f0e5af372ad517e2ac9bb420f98768480f3d02bd24cafdc3c303
SSDEEP 192:Ven6TpKAQqwAuzlXLeQ84ot3sGsbd+s3gI/+ux1U+Ry67KqrkcBI4E42o3o6:Vr9KAQblir45+s3go+ux1xRy67KqrjIG
MD5 SHA1 SHA512 SSDEEP

Submit Download

icons_ie8.gif

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_ie8.gif
Size 9KB
SHA256 f0a22bfbe60d535bdd3b618d32f691f41681aa830a892e955ddd673a6c278c56
MD5 b6dfafbb2a05dc380fd2c57cf9c49458
SHA1 c46170be9d88cb44698e09df2b8c2f698ed34d2d
SHA512 d4fd6f11afc101d38919e22c377cff85a7ab7960792aac076670c5a365ec392b9a12b3bff27f88268e33b94d38f52ef8a69a01b2c370daa6e67d58242473ae76
SSDEEP 192:mZXZFvg8WJ6IBUr5+x/MvWE5B92GW5WLQznn:Go8W5B65+0f2PNb
MD5 SHA1 SHA512 SSDEEP

Submit Download

icons_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_retina.png
Size 16KB
SHA256 99e9ccb65495e0b72fa9a35c17cb5d310fb4a5674649e6e3e7de1f1af8cf3c79
MD5 3a5bca007d35cbecf1c5d376791227e5
SHA1 7f08e0be73dffaac5034ec1277ddca453b4cb8e3
SHA512 72136fb7a692bb6a7a36f59dc2b2e39a0ba9f94efd31641a529f3210993451ca56b6f04409ba767bc7dd620bf23c5a51091c01af85e7a5c799348740f2fe82ba
SSDEEP 192:nP1SkCTS84mvlpKu4OibaWNwopwC1D5hxf+9OTBjZjMYMOgcT6WgKwrouqkQ1:P1StW8l8ujimWCFC1Zfr5ZZMOJjJhT1
MD5 SHA1 SHA512 SSDEEP

Submit Download

new_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons.png
Size 9KB
SHA256 1a3c006c854f7b22f8f0ff86cc03ba782abbfa8f9bf6c2f97b8dd517ea6c6cd5
MD5 722cb0773777496a629899316290803f
SHA1 a6b1de68e91c7f2a7e1e42c36d4bacf8c511438c
SHA512 798f34ade1da1ed6fcb16113f171334563f01cd8dc3db805f013990f866cabfa36b905c7f1c26c28aedf59bc94fa6da282577d0bf57235f0fd6074a1fba5820d
SSDEEP 192:pzhNOyZ+rFrpWwqVgK3rwCMLgN40yQMcutn8IVJFN+BlMl/73z:l7aWj1rb7ByT7RN
MD5 SHA1 SHA512 SSDEEP

Submit Download

new_icons_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons_retina.png
Size 18KB
SHA256 67c53d8362bbf60b3923be5fe44cd8d25abdf890ef86ebd30473c3ea12b21690
MD5 b248edee06a7f18e06f3b197051c5460
SHA1 63c3c82b745d444a0750c513a1dcfab1d7d5ddcf
SHA512 6d69327d38efafaecb53a4b48a5c016cb44b88aa3ce553bacc221ae0d480974eb6aef2d4de2e26a707cc4bfe419ee134d180bc760392ab9de4ec5d912195f748
SSDEEP 384:h7XmrTHZaNs5E+d1yRa2J7KSZqmNco6m8xIo5bQEMoh3i1198G9n5u:hTmXHZa+51sa+WI+G8ColpM4Sn
MD5 SHA1 SHA512 SSDEEP

Submit Download

new_icons_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\new_icons_retina.png
Size 18KB
SHA256 0301770ac3ba68db961c506891edbf63e2b01ff6e815c6d626029620ae1e8a61
MD5 8f8a203ace0cc9e1f4299b9448e9dd8c
SHA1 510e99dbbc81c5f1cca6448f7810a46ec9e2eb90
SHA512 89766dbd1c291be87427562b9b9511c838b09de3a360e6e46eb1eda5296d89674a2fd9d31c02a6034e8cc5755e3eda9a8ccbdfa02a233ade5f21694ced7d51ce
SSDEEP 192:APHmzJRtPMwFna3a1n6gUYsrvoggzxK8qdQsuDjWPWsMw+5JDr9+qs0rLzDpr:APHcMAOYoPgzxKJQsuvWPId51JP/p
MD5 SHA1 SHA512 SSDEEP

Submit Download

cstm_brand_preview2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png
Size 6KB
SHA256 58ce9f1fe6a2c0a92bc3fcf6db6e0e868ef3d4c5fb237ae5d9ab7caa5d3016c8
MD5 ec22296a1a7e6bbe16f7fbcb4c516196
SHA1 ddf74360ead6fe5afc3d49c3ab93c9bbf28cb089
SHA512 e4ee33defd9f811d2360aaebae61b8127bc53ebe0a46b1298bf4c7658528f4a8b5e87677a19bc12dfe4ad59a89dda3eea31d5d9959cb49dbc1fa15269b656d77
SSDEEP 96:RRvZgf3as7uzxHunSa9krUgu5wKxT9CoIHHu7LXpkJh37:RRxo3a1ES3rUA/u7Lej
MD5 SHA1 SHA512 SSDEEP

Submit Download

DisplayLanguageNames.en_GB_EURO.txt

Path C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt
Size 34KB
SHA256 8f79265bb3a07ac13504f6123d50edba8ccb6f365c4db73c7dcd9c70256a8416
MD5 7fdbd652c81eb64406c3f5426ba154ad
SHA1 ff00d63682b47b5bf74e6e4f8a1249e396399edd
SHA512 1ae9c38057c7bbaa2fde62c41da28dd2aa4712be37d069745c8d7c70e896ab9e44b2b3a0eb755cc1cd01a4e7afdf7a1f68252d8383989e25eaad0cf3f2e5c392
SSDEEP 768:+Fe049Aqh/E4cmDN3kRb3QYSILT6812vuohmaNonMgnRExxVUV:+Q049n1vTNS37T/2vuoLIPREx
MD5 SHA1 SHA512 SSDEEP

Submit Download

edbres00001.jrs

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\edbres00001.jrs
Size 1.0MB
SHA256 3fef59c94e2d4f25033d9177b44a543b535cc38530ea391c80e2d6334087ab8a
MD5 e5b035352dd3462e33818c3721882460
SHA1 ad6a4f47a7946291bb824697ea809020d5a8e7db
SHA512 21b7f4156880f2c57a033a37b16a01f9a7ab7efc86e480c7c77dd51e887a72db68afb47c700e105a3dd442b51eb1ef3b0be7e0ac2717d317ff4239575b55506e
SSDEEP 24:R66666666666666666666666666666666666666666666666666666666666666x:tff7eCFm7xVdi
MD5 SHA1 SHA512 SSDEEP

Submit Download

{0B501CCD-3742-4A87-8FC1-8D2F666948F9}[email protected]

Path C:\ProgramData\Microsoft\Windows\Caches\{0B501CCD-3742-4A87-8FC1-8D2F666948F9}[email protected]
Size 2KB
SHA256 94bbea63329e88acf38106fa7d1ed5995077a4d3930e7ad047a052a251ee3e03
MD5 3b971bf16f27a62afa2c544590d217db
SHA1 e00a58a6738fe71714fc96848e6e68940429470c
SHA512 363c7bb13db12268cb7dc60483212ec0d467bf20204ce7ce64e90a842a8e01a54234edfee4569c5e3fee13e5e2286662eb70d40f285729e1ab7c96199e16e11f
MD5 SHA1 SHA512

Submit Download

{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}[email protected]

Path C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}[email protected]
Size 624KB
SHA256 be6b189e8fcea447916345ca878ce4953c692b5e4426c1f95fd3a7f7f83baf20
MD5 3f7f77d7672f3abf37e4bb6526350ced
SHA1 28eeb3dd2a7cb678eca8e76f539ff98c84791edb
SHA512 aafac639255afb59b89c976e31092784f9106f7865c15944ae41bb6c601e5251401781303c9da9e98cdd769bddcd682b6dc30e2c6b7510e37630b12023f68774
SSDEEP 12288:mjFCqnwngSWR8WzK3eXRhHTR5CJlF6pvD8Gj83VNTvoGJ5V0ORAcyFRkF:CupBWnhhHN5C6vD+337rPGJB
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_2
Size 9KB
SHA256 74346e5d524ab26043d0dd76a52daf1b53952aaab2dc355a6f0cbf0aed3033f1
MD5 c4c2f442f5cf46074080b52b178dbc8e
SHA1 6a7dc65c70056d97c0dea7d7a5ac6818337b6fbc
SHA512 de2a9cae85815e603e2a5e53ea3a2a4169b63c510618764bc8f1df6cc02642b76c79ae063878a0399d4b07894bcfd838990e4e61b9c3caa1f1e8942d91f157fa
SSDEEP 24:I66666666666666666666666666666666666666666666666666666666666666G:tVf7eCTm6eZn5
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_0
Size 9KB
SHA256 db7a4576a85ee0151bbb0b56ac97b4d4352d9fc464ce4ed9d230bedff2c57c1f
MD5 1273c31c143f67f942455123a5fe003f
SHA1 ec9637afc2a79ff4b2f6d812ff98587ff8806854
SHA512 6edbacc3b1318ff0c5b01ce20002ed03b53fcf35389b4f8004e10b4b389fb5c6d5ea6c8f06c7457da8ad4e00880cb883e29c9d2053dc05f509dc58c63e3d4883
SSDEEP 24:w66666666666666666666666666666666666666666666666666666666666666N:l3f7eCixaDgR3
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_1
Size 265KB
SHA256 9fdbf5f00ce82bb5973fcbca94989760c1558f77406b128eb39203ce4d54c7ff
MD5 72fb806b5d731d2d6fe31f6ec41011b8
SHA1 4a47662d7ce1e412888370c9773ff18462592f18
SHA512 78d23db0371fa985dc452d42f0bf12496b2b6653738472926661c22d664ae67c401a135d8d461d4e50f259ca757003cbef1109267dbb4a71caa67d19e33dc5bb
SSDEEP 24:k6fT2z666666666666666666666666666666666666666666666666666666666H:h2kQf7eCohOodoDE
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_3
Size 9KB
SHA256 8d76bde660695b82b9d66af9e450530ad71706e5ad2ef62f2e6d82ce6f1dcb00
MD5 db97b084f05d936657f93fe44a23ea45
SHA1 d5a729072aa886dad52b0949853fda5cf9d41adb
SHA512 d3b971ba85f10dfabe080f850ce8cf1ae11a4ca2d1b7409645ae729ce18c2ad0b1a37d11831fa46038bae5c3b355c514f54668ab372af96e61881e8cb1736616
SSDEEP 24:gS6666666666666666666666666666666666666666666666666666666666666d:g3vuf7eC3XI0p
MD5 SHA1 SHA512 SSDEEP

Submit Download

https___java_com_help

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\https___java_com_help
Size 37KB
SHA256 0fb2638e56e08121aba4791c7aa4a6c1bf5ab99135d7591b1c3c534b4d72ab23
MD5 2037f52b68db0a6ea37c5953ae6dc934
SHA1 c98bf7bd34b44e06c6d13d51046b2ebb8567bc44
SHA512 a0f684fb8c6ae075d54092f5596e8b025b6a1938c888639ebad135f3d6c68c4a10f7a37a350f028e4d088b88a390d8bf06012cda6bb55a9a9321570586640054
SSDEEP 192:IywYvJItond9xNBUMeOWHPUFN3doz4VTixP2fE:IraJItodzXTMPSNtVVToD
MD5 SHA1 SHA512 SSDEEP

Submit Download

{6D809377-6AF0-444B-8957-A3773F02200E}_VideoLAN_VLC_vlc_exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_VideoLAN_VLC_vlc_exe
Size 37KB
SHA256 2864b70bc209656eeb9f4840113fc4250290fba62901ec4a386c7c1f9731e314
MD5 189ba3de8e185f8e6bc8f537120e1518
SHA1 180181e8db3f23897658b5b1901db4699474cdbd
SHA512 2dd0d5511dadac56e25e7358592b66d71617e50e8525ad1cf873acbf8dd66abaf225579703b3aa02c72e40851daff0abcdec68738475126387389165b63946bf
SSDEEP 768:Xksspssssssssssssssssssssssssdss5sstssSssKssKssDssOss4Qss43ss5Es:3FwAO441kwF+
MD5 SHA1 SHA512 SSDEEP

Submit Download

0.0.filtertrie.intermediate.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{b439d8cd-4918-4c70-9e19-9a97d753728f}\0.0.filtertrie.intermediate.txt
Size 30KB
SHA256 15067ad5ac9e6c9205c1396b2c11ae739d08f0cf2984d2c795c56c6c51be1da8
MD5 8b00354c75f18335e6edde029ed2af54
SHA1 2a491c640e1afee26cbf1c3326701b1f529630dd
SHA512 82d9437cc9351b712e544d4608ff6d03dfe90ba41c80414b789e3033cc820c0ca28bb5773e157ad9762613d2445e46582819c7fd398e7be1248a3b8a681d1f71
SSDEEP 768:tRSPmRe6V26keCcdPMwBHR86PZSPu/hqj8ob7h3quZpa:tsOTXUw9tPgPu/cj8Md
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133534370011333363.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534370011333363.txt
Size 48KB
SHA256 f0a038b98a30e463755ae66b69a5d9de3ec64883a48ba58e7cc29ee0242507bb
MD5 10bdc940ffa50647282045d2799ffcc9
SHA1 32dd5f1483b99eaf8d43df27cc8c4b51c9ea0a1a
SHA512 e67c750b2de4fe0b41c95feca49950e5d3180775112676f8915405ace6af207ad113ece20e962712ab3ee9c00bbce469d1d15dd44f0c45ac1ace720ffe8d8e44
SSDEEP 1536:qsiGypTCbWThlQ9jlaTWXrAejdzT8YEe:NKTCbW3YlaqbZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133534387468409957.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534387468409957.txt
Size 75KB
SHA256 6cb39d17a3e2c1bffb16fc72d8462ee2fd0509279f00a8358574ce554f651fa3
MD5 e2f0cdf0b17ed1e85278844abe675808
SHA1 0f2ad18e38d61f7ab31a3be731840713c82b4021
SHA512 3dd300e578aa49788f3614b8f498d42f065d7f4504248349a07f03dd8b344642f158f44dc97150bab06bb8b3f7df47fd14e350bf267743cbc78b2eaf3a0812e4
SSDEEP 1536:zs+G8SoBdd3/mhpAzguDeu8s/O0lPUwvyxVZUB9:zs+G0VPmhSzgxuvl8eyzZUD
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133559381484545984.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133559381484545984.txt
Size 3KB
SHA256 0bf49416f4e8e1838ce28e68b66074a38d113ccb0f6da4d4186e849c54b5f505
MD5 6c02e95684c22fea3d0d39b174a8f651
SHA1 4024578af114c95438fb2876cee5a13c3880544c
SHA512 c3cc8776d21856d64731dd60dbda995345c0a90041e90f78538c7d3fe0fd79f5a13bebb76dd062513388e2f5456f3eec95d58303fff24297f81f80a547fc30f5
MD5 SHA1 SHA512

Submit Download

CortanaUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
Size 7KB
SHA256 39eecfc2335395cca6efd4cd6af9b632f25016d4011a92a6d7d6a33fc7431a2b
MD5 43f5ec18968f5117691b6915c22c9dcc
SHA1 354464cf4204e724a48fc8194b0538a4a7c7c3c1
SHA512 c17b8cd3e4a8a3302f100b1df8d371119e5023504266644419afe5cad584623d24a51fac20df0b78a5ee9e4ac4f1a57b9b1c91a9423c10e14f1acad2b925d029
SSDEEP 96:B9hHyIu19mvWnplbvL+ri0wDLdd3OvwRP59wlCD4HDakzBHYUatpNI:xyNOqG04H9
MD5 SHA1 SHA512 SSDEEP

Submit Download

wct60C3.tmp

Path C:\Users\Admin\AppData\Local\Temp\wct60C3.tmp
Size 64KB
SHA256 d1a84833902729489333e26cfc68cb1857cb3d4d072a44857ad35964855ca93f
MD5 9064001cbdd9d5d9992885a508816fac
SHA1 ccbc186b24f6a698bfba26c67d2d26cdff394027
SHA512 6372ae9b44fc50b97584782061264ecafa65247c868bdb0e23abe88bf17d4ff355f3c28c07c259cc022a3e64698c068dd629d5c386810beea18b385ce86980f3
SSDEEP 1536:htECIqLbzZJL5TBwBbnCptjJlddj2KU/c4AsLBy/a7ddX:hPzZ/tw1Qlld1cGQByedd
MD5 SHA1 SHA512 SSDEEP

Submit Download

wsuA336.tmp

Path C:\Users\Admin\AppData\Local\Temp\wsuA336.tmp
Size 15KB
SHA256 0a5827a8a0b81a71f2c456a0580b93e63049d46384f94fa8f97e361bd359245d
MD5 def1771957242448a18f49d9eb03683d
SHA1 eec8cfc5fd464f705db9cc9f3821fbf3d6d65b35
SHA512 2896e42d3277ea503fee89c40dbf8a135c17a8d88b14845a9b70ff272ae60ad9b8594da765ebc401f6af5ea4c7cd8fe021d376e0d034becefb105d0550db010f
SSDEEP 384:dFcaP22ibrAy2UEbIZkFG+Af2SxNn6j4Igp9wKcxaMb:dFcaeBwDUEbIaLWSKPu
MD5 SHA1 SHA512 SSDEEP

Submit Download

SourceHash{3A706840-2882-423C-90EB-B31545E2BC7A}

Path C:\Windows\Installer\SourceHash{3A706840-2882-423C-90EB-B31545E2BC7A}
Size 21KB
SHA256 0adea435d4ed33cb08066186ec2d2198397f1bc5cd608f846325de8f6a29b29e
MD5 24bacae6c84a9c37e69ed6f2b7f2166b
SHA1 4e27dd228fc0a47032c8bf82053180fe311b332b
SHA512 8ea13fd01b5efda91213507c6eb3a6a19771a73056e9d3798114686e4e1f229d38fc9d787b8173dc865f26766d185225d8d27c035116e6d85273860e8eee58b9
SSDEEP 384:YZ3dtTKg+uHhYymjCKkymHGp7CwZpKn8/BzGDLv2lr84mj:oLKg+1LmqCOev8hY
MD5 SHA1 SHA512 SSDEEP

Submit Download

SourceHash{90160000-008C-0409-1000-0000000FF1CE}

Path C:\Windows\Installer\SourceHash{90160000-008C-0409-1000-0000000FF1CE}
Size 21KB
SHA256 3f32032b87a2a88f9627c3e04e209460ea5211439be1f428b8390d0fd8f1d5c7
MD5 4abf4df83fe6ad3adaf3a818e529a7e7
SHA1 bfc388cb2251eba2df9ae822265a721e3c840b2c
SHA512 74933c96ab00703b77e82d2106e51bdb598a19fabcec54f29efc2c8b9970ab718822b981936ab398b15e8f6e31f00aa0e3d8584a369f6748482d7fb1f4bcce0c
SSDEEP 384:iVZZ1aSIPIfuLs7zMkf1Bdez4R35ypkN2m1WX4e1XzNP3Zb5e69LVznmsryJQ7h:GZgSIPs/eq5vN2mAoUzNNk69tnwq
MD5 SHA1 SHA512 SSDEEP

Submit Download

SqlPersistenceProviderLogic.sql

Path C:\Windows\Microsoft.NET\Framework64\v3.5\SQL\fr\SqlPersistenceProviderLogic.sql
Size 14KB
SHA256 75a61e96988f0bb520c20fdf906accbb7a2a8404addc88bec032783a6cfc0202
MD5 049f07ec1c24d2b2460fe202587b4ae1
SHA1 4b0d2ea238cee19fae2395cd893dc08e585bf4c9
SHA512 700ef6f686f702ffba80aad98ac13078e56e44af5f424e913d5f7f314f4c56da3269609cc97204cd1e45f052577f4ec9e4e77ea4884360c093285f76da181cbc
SSDEEP 384:LmyWO7zfU/m5976O2KNaJLg+lTdHL4bt0zK7xq:wI78jCc8ml4GK7x
MD5 SHA1 SHA512 SSDEEP

Submit Download

SqlPersistenceProviderLogic.sql

Path C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\SqlPersistenceProviderLogic.sql
Size 14KB
SHA256 661db78acc65670c115bff8e130fe54860de8fb2852baeb60b83a04beef0fdc4
MD5 9efb1c7c2339fdf1aa644d884543e8d9
SHA1 7aa910dbbf3a85b170f84661beea036f386cddbf
SHA512 76ebab0a86d2f29c067c253299b130edb42f11113e3f72415b29de558fb9a066be39712075c0cf9d7b5d68c7ec5e98a227912e1182356cfd73cabfc924e8afd7
SSDEEP 384:7ltDvs/39a1jG6KMSK5PkaMEjV2YMpsP95/tUAhpobei0:7nAP9EGsS42YG295yJCi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Steps Recorder.lnk

Path C:\Windows\WinSxS\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.19041.746_none_b8eadbf8a9c907b3\Steps Recorder.lnk
Size 2KB
SHA256 ac0ed6dae5267d8a0e5effe906fe9977a2f150b2891854d24a6d121702c25b18
MD5 245b8ca66207c9b8bdb0042dc9b11ea0
SHA1 c59ec61b990af5f208ba41e2d3f0f44fd00cc5bd
SHA512 d38b1bc94d58ea8bdb7829de9d637d9d4346d08542cc5e5c065ef3b1ead38f9b6a46f689337c08600b265edfe4e01f1f2372f010f55616a36e6e0e3a897509d6
MD5 SHA1 SHA512

Submit Download

Task Manager.lnk

Path C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.84_none_a689f818199cbaf8\Task Manager.lnk
Size 2KB
SHA256 08b200da6846eac1f9f4f9a80bab0feeb925f8453aab0602fb672d3933fbd9b7
MD5 e883bb272ce33bd066cbc9b86d870531
SHA1 e08e53efc1c8b75b582b6add642ad905e72bf3c1
SHA512 f7412048768f8696f4be72e971c283dbcfb059934aa2a3f1b1994e8798b8baf86cb87c70e090ca2924367908c7caafc68a351183bd4b48353ff7a9c35a5fbaf6
MD5 SHA1 SHA512

Submit Download

Computer Management.lnk

Path C:\Windows\WinSxS\amd64_microsoft-windows-c..termanagementsnapin_31bf3856ad364e35_10.0.19041.746_none_290f6af7d5263efa\Computer Management.lnk
Size 2KB
SHA256 4a5485b1b83a7ad1d1fcfb0156883a6b834b2c0f1a200002719e586536391d5a
MD5 fd86caf9d4017df48b1bd197080017de
SHA1 df006d5feb6e017ae587954d8c519491d3befab3
SHA512 6f37efd63b471cd3c621dc313cb96ce88f226a1794b885578dae469e72443f6ccd4c63114d01571d7610b06ba3dfbd53f50bd7735b98090296f471f48a764023
MD5 SHA1 SHA512

Submit Download

Disk Cleanup.lnk

Path C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.19041.1_none_233543e4fce957ae\Disk Cleanup.lnk
Size 2KB
SHA256 e595a9160e55c996920b712b44583dbab9d2f6ce597b5468601f63159556f75e
MD5 69a282a23069de69be357993793bb4fa
SHA1 191718c5f3fcd04bf2d41a294c8d958ce24746d2
SHA512 f0a11348188e2e6325faeef484c0cf1b8c20f033900078c9b9984c5f80494586ffbb1b626b5b5d8440f5b9c08c68ec50784c9f6fd97e9942fe4c44561302c2d7
MD5 SHA1 SHA512

Submit Download

dfrgui.lnk

Path C:\Windows\WinSxS\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.19041.84_none_90b92bf6be625d1b\dfrgui.lnk
Size 2KB
SHA256 0b34ec91cd2e29e3cdcd8721d74c007d37351c03f5232dbddc61f159db6f4e1b
MD5 f6ad5c71c9e40bc1834eade98620c9cd
SHA1 a6bac4a50a66df79c81f3fe6ef39a1704a3c25d0
SHA512 8f55d02b79e692fd94c9252c3b15f0303a58859941128682c299f1c29c312be3af2bd4bb23edf655cdd157c3c2718281835fc2f30cb7d8cdb3cafa3653a177af
MD5 SHA1 SHA512

Submit Download

Fax Recipient.lnk

Path C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.19041.746_none_56f2f7338735a9a6\Fax Recipient.lnk
Size 2KB
SHA256 5c850e6c4ae7068e55f507df32936adbdb40edc1863b97e1a3d06c3bc1abcc0a
MD5 28db9af7575929038757e1878948bfa7
SHA1 8b4e5c074f3a2e787f1b6b2714b7811e689885e7
SHA512 780555a88f649200b48a6785a67a42e1e1ad4674fd581e3822405d417ff2e4a6c872cf6da43f7bb07bbd9d19fdb7ea5d22793f901de94537be31d8782c76bf13
MD5 SHA1 SHA512

Submit Download

Windows Fax and Scan.lnk

Path C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.19041.746_none_56f2f7338735a9a6\Windows Fax and Scan.lnk
Size 2KB
SHA256 cf66b64e5997228c95ab334eb98ecf4e9795f2deaf789931a3d32cfee8ba7b4c
MD5 a86fd61c81abc0f352db41641f91c95b
SHA1 e8c10d053ffe6da3c7f2f39b3b599df8f9f5cb6c
SHA512 e1b67b3e6af6fa0e6891ab318e294f05d5a335742c800ec912d1b0424077f6d50c2574e635f97f911f8869b78e12464c85daf63cea37f8466cf692cf2c5b6755
MD5 SHA1 SHA512

Submit Download

Magnify.lnk

Path C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.84_none_65d0f4a4c6cd4975\Magnify.lnk
Size 2KB
SHA256 44c99daa6937dab715afa9e0c9d8d9f9027f698736f479269276c3dba31fe58a
MD5 95469f6193f1083201968924f14ceb25
SHA1 427c4d563f98cfe2afb709ea1ef3d45869e5abfc
SHA512 13353b67be44742f7baf1e84759e21372b2fb47239be5cf7ce918ec00f4696804b4e7deed04d304cecdad699164a46115dd97c74d75d88459782800578211819
MD5 SHA1 SHA512

Submit Download

System Configuration.lnk

Path C:\Windows\WinSxS\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.19041.1_none_906b4c073d1d970c\System Configuration.lnk
Size 2KB
SHA256 aa95e13789da3877f4aea42342698946c034049c4dd9775c8ee0f63860a9a06f
MD5 de674a4d2f1d061b68e24944dc3b3198
SHA1 b1b51411708c54f88cc16f732e16000d2e6f79db
SHA512 9ba464c013db9f4bdf5a62ceaa7108a0c81e225e9dbc136ce203aeb1e0d0f6469c60b5b65462bdecb85e63e809d1c957fd93048a2276abdb1c69cc61214d2f6b
MD5 SHA1 SHA512

Submit Download

System Information.lnk

Path C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1_none_61cd745a990bcfb3\System Information.lnk
Size 2KB
SHA256 ebcf00f93e2e66a6488279111575bb709c0c931b32de14e0d534accac892584f
MD5 bf75dffe5507a6ff65392a30ce4b6350
SHA1 d71abaeb64c3b89fe6395ed79c1cae3101a3741b
SHA512 62b2833d18636a4a72147784f1d1fdfcd339c4c62133adc93f60591fbf9a78b14bbdc245b7e8382a1bac0fbe751c1030a7197f7e63a92e7d7cdcd100456baeaa
MD5 SHA1 SHA512

Submit Download

Paint.lnk

Path C:\Windows\WinSxS\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.19041.746_none_6c16d1714d60fddf\Paint.lnk
Size 2KB
SHA256 03a54217ce5962bfc54be757b146832967413813c29f697fd26a76c0858e47a3
MD5 fe2877a20b1213d5821cb8d322d80bbf
SHA1 0857d116862d9c162e93fbda27ac14eda334fe3a
SHA512 da6ad876a8a18a7f6ca5bd125d7024ac08e89452ca7e2b3b176b543db408a70a438590f6d9c6fc69c999696305344c67d089a8c228fb6724aac479bccae290a9
MD5 SHA1 SHA512

Submit Download

Narrator.lnk

Path C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.19041.84_none_b5c0f628d1d661eb\Narrator.lnk
Size 2KB
SHA256 032557570305d521b9bccce1624a097262a9963dde81ae0cd3d6c2b00a887afa
MD5 bcab25cbaea5fd3f1705722846ac0d28
SHA1 f976f038e5405990df1f0daa61682ba294bdb9ef
SHA512 e279e4858d3925f7be1f47637ff2149229050dbfac5b80a932e2048fdfe0a54d4f65e46f1df994e3b97fdf045a279cfe7e659c665bf2e74025c6334d7ffa3dc9
MD5 SHA1 SHA512

Submit Download

Notepad.lnk

Path C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.117_none_4d353cf1ceb5d6d2\Notepad.lnk
Size 2KB
SHA256 684ea7395a35e062b89f275b35743271c6f3ce102ea11fdcb0f3a6a9f2bc6d3e
MD5 2870c432f1ce6dbfe3237ff70567177e
SHA1 bc6ed5de9bb7f31f7cb02af5f64a19ca117128f6
SHA512 1301c6d62f77771b4a548895751e06d6cccf02c76609ef8539e11d322ea6b6dd0d2cd065c84749200217474aceea7a7216de38964c60f5d136b8310d83aa5a5d
MD5 SHA1 SHA512

Submit Download

Performance Monitor.lnk

Path C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.19041.746_none_7a0308f7ffc334d5\Performance Monitor.lnk
Size 2KB
SHA256 33c268939a5957678343b43a302283489a058e59e5db084d82631e664e5109b9
MD5 f3f2a220558922ce33b8885a3af218dd
SHA1 110a9076b72a783ad47c845eb7133d8ccabc8c3e
SHA512 705eb5768c9417bb7f0ed009c7492b7cd70f2dfbce2f7f486fbe78830fdc025560f0bab4cc5977217b879c34604941ef781e44a0e4c8ad8495fb8d68807bc8de
MD5 SHA1 SHA512

Submit Download

Resource Monitor.lnk

Path C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.19041.746_none_7a0308f7ffc334d5\Resource Monitor.lnk
Size 2KB
SHA256 f4310b20a401218730aa34d55dea4dd388ca36c56c73216309395849b3a8879b
MD5 aa3713c50e9a75a96b0b1c74d1fff746
SHA1 38a062900294fab8ee837749129732949c173903
SHA512 50dd9b21a6c930bb5a76f265ad650fa07a7a9b443f06abbe4495ba72a54dd6f3ea274ebc5e565177bd364fbf366432c89cc871b58ae37f78c99a30645f771686
MD5 SHA1 SHA512

Submit Download

Quick Assist.lnk

Path C:\Windows\WinSxS\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.19041.1_none_b3f1d9ff0e206c99\Quick Assist.lnk
Size 2KB
SHA256 b00fddac515fb431109cfc68ffaa61e05c21ca097405c9aff3736b9339d6fa5e
MD5 9f33bbd6c1a32e2d528d13364c8139a7
SHA1 54d02842a514eec657fece7f165e1e5dc9d0b5b3
SHA512 ddb4ec6b5725b128bc41e1647055479b9bbfdd1bde1d9978704a4a43a2b9f21d6c5972338290fa1dac4acc97bfb1256d931770db52996160e40e19d53dcd0b79
MD5 SHA1 SHA512

Submit Download

RecoveryDrive.lnk

Path C:\Windows\WinSxS\amd64_microsoft-windows-recoverydrive_31bf3856ad364e35_10.0.19041.1_none_de83be952b0afb6a\RecoveryDrive.lnk
Size 2KB
SHA256 032046853578a622cb2df945be0a90bfb3ed4d8385fcbf996a8c237f8b2b62e7
MD5 d47b858285f1252d9811106742b32c93
SHA1 798370075028d7cbaaf8bfd7d5dc9367935e0fd1
SHA512 720e1c09ded5365fe5fa82663909d50b83bbc328453a9652a76cead0408ebec989e72fa2808f1721633cefc268241d7782037eb9a6baf3e328117c61963364ee
MD5 SHA1 SHA512

Submit Download

Registry Editor.lnk

Path C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.19041.746_none_d22800313aa7eb5c\Registry Editor.lnk
Size 2KB
SHA256 b9b3e1f730458c455b638179a65329affb1f4fd9ec75a4a8545534698511fa68
MD5 7b6445ae9c62d10fd7f44c54b911e0d7
SHA1 e82c9420eb4c066ce14d6f263ae79aaec7715475
SHA512 ff51601568c30600a15ac08414a28a4b798e81e0ef753596f867b7f5071838d8700bb6a7ff7a91055c09e34032e091496fcb4963ee38ae66ed1b0799649e38df
MD5 SHA1 SHA512

Submit Download

Snipping Tool.lnk

Path C:\Windows\WinSxS\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.19041.746_none_77bd4cfbe87238a7\Snipping Tool.lnk
Size 2KB
SHA256 f8ac51f934661fa9614163071632c55f670fb787e639ecf5f968d4b53045c68d
MD5 a5ceea9712062d1599a644fa00ab243e
SHA1 083f0ea23b5b40c7a750dfdcd5339e9ce1fc349b
SHA512 0d29cf95200ec7472252a9dcc37963bfee6deb5f7b8dacd273e3dd7dd2a2b5f1331d82cf182fecb0d2c95550abcf4be02b599a65729b551bfb5a55de063f1806
MD5 SHA1 SHA512

Submit Download

Speech Recognition.lnk

Path C:\Windows\WinSxS\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_10.0.19041.746_none_fa033ad7aa9be481\Speech Recognition.lnk
Size 2KB
SHA256 f5730578c9425c592b2f630dd92a5a2d975f92cca7587fe0e4b2648ba365595a
MD5 5f245703f03096835558c18f42eb10ba
SHA1 05605016057d587915b93334d8475a44ce511aa9
SHA512 f29b79ad261c9e30a184704767bf3f6fe20b55f9e0407626a684ad1a797bdecd61c967bcc5781f4f5172b587abe90522e77c115dfd0843d107dabc479cbbb6eb
MD5 SHA1 SHA512

Submit Download

Math Input Panel.lnk

Path C:\Windows\WinSxS\amd64_microsoft-windows-t..etpc-mathinputpanel_31bf3856ad364e35_10.0.19041.746_none_a89acde4afbab635\Math Input Panel.lnk
Size 2KB
SHA256 675b27ffb9a51346f04c0ebce7a1bd38d2ab7e937721e922c1f893067cdd526e
MD5 938b55c2485f051d03e28e0875786f19
SHA1 92ea9b0a6efea9799ef3eb801fea11ac8534c44f
SHA512 fffdd59aa2a0e36effafca26891d15028112fc753648688d5e0ea5941c85e42d7bfa6d4dd259e054b4b6e98de050f07bc43e2f50d55897aa3c157894a2927374
MD5 SHA1 SHA512

Submit Download

Remote Desktop Connection.lnk

Path C:\Windows\WinSxS\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.19041.1_none_03cd5b18c0751679\Remote Desktop Connection.lnk
Size 2KB
SHA256 96378d7197ff743f54758aa1f2a89c2345833f3094a5ba8842c65098740384aa
MD5 b3b991aac4bcbb43c91190a029dc5706
SHA1 55b9c88e1b1ff27feaa8aca5f17254ca0aa62dc8
SHA512 2534f22da6a38a0b01172f5b42875c268fe1b33f57b420dc5b72fbf0eaf47f431eb33e1b1f38e1c73f8499e904def8b988b2b24799caadaad8b60e5cfc5b2fd3
MD5 SHA1 SHA512

Submit Download

Wordpad.lnk

Path C:\Windows\WinSxS\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.19041.1_none_e3ab86b70c430b3c\Wordpad.lnk
Size 2KB
SHA256 1953bc0f7b063a2214f1d6802f862ab8ad6a0447fe2556e1401efa47033579a9
MD5 3853e796c062fa3e506ae13603531af3
SHA1 8782c6e15d353d01a8870c13f13e5d60e7946100
SHA512 88dc252237294e702f2bac08d8e37e1abf929e9192caee6d33f49c4408c0ab9524395e518e7920998972819b7304b76c69bfbad3a2e547a5180db7be941b0b0f
MD5 SHA1 SHA512

Submit Download

memory/2592-15491-0x0000000000400000-0x000000000064A000-memory.dmp

Download

memory/2592-19977-0x0000000000400000-0x000000000064A000-memory.dmp

Download

memory/2592-11666-0x0000000000400000-0x000000000064A000-memory.dmp

Download

memory/2592-19567-0x0000000000400000-0x000000000064A000-memory.dmp

Download

memory/2592-19679-0x0000000000400000-0x000000000064A000-memory.dmp

Download

memory/2592-16892-0x0000000000400000-0x000000000064A000-memory.dmp

Download

memory/2592-16972-0x0000000000400000-0x000000000064A000-memory.dmp

Download

memory/2592-17262-0x0000000000400000-0x000000000064A000-memory.dmp

Download

memory/2592-17791-0x0000000000400000-0x000000000064A000-memory.dmp

Download

memory/2592-7599-0x0000000000400000-0x000000000064A000-memory.dmp

Download

memory/2592-19115-0x0000000000400000-0x000000000064A000-memory.dmp

Download

memory/2592-20000-0x0000000000400000-0x000000000064A000-memory.dmp

Download

memory/2592-20004-0x0000000000400000-0x000000000064A000-memory.dmp

Download

memory/2592-20006-0x0000000000400000-0x000000000064A000-memory.dmp

Download

memory/2592-5265-0x0000000000400000-0x000000000064A000-memory.dmp

Download

memory/2592-20018-0x0000000000400000-0x000000000064A000-memory.dmp

Download

memory/2592-20023-0x0000000000400000-0x000000000064A000-memory.dmp

Download

memory/2592-20024-0x0000000000400000-0x000000000064A000-memory.dmp

Download

memory/2592-2507-0x0000000000400000-0x000000000064A000-memory.dmp

Download