dearcry | 617a0ef26dacf4c492487684212684360431f39c8e69748ba74dab77109b4a1e

Analysis

max time kernel
126s
max time network
187s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
24/07/2024, 16:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
Size

1.3MB
MD5

0e55ead3b8fd305d9a54f78c7b56741a
SHA1

f7b084e581a8dcea450c2652f8058d93797413c3
SHA256

2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff
SHA512

5c3d58d1001dce6f2d23f33861e9c7fef766b7fe0a86972e9f1eeb70bfad970b02561da6b6d193cf24bc3c1aaf2a42a950fa6e5dff36386653b8aa725c9abaaa
SSDEEP

24576:LU5NX2yJOiUXmEICxu2WAP0NIzkQM+KpPRQ9StIUDpl1fpxkHVZgMCS+:L7XP7P9o5QzUtl1fpxkHVZgMC3

Score

10^/10

dearcry discovery persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ar-ae\readme.txt

Family

dearcry

Ransom Note

Your file has been encrypted! If you want to decrypt, please contact us. [email protected] or [email protected] And please send me the following hash! 638428e5021d4ae247b21acf9c0bf6f6

Emails

[email protected]

Signatures

DearCry
DearCry is a ransomware first seen after the 2021 Microsoft Exchange hacks.
ransomware dearcry
Renames multiple (5822) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Boot or Logon Autostart Execution: Active Setup 2 TTPs 3 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 61 IoCs

description	ioc	Process
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1453213197-474736321-1741884505-1000\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	explorer.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1453213197-474736321-1741884505-1000\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\$RECYCLE.BIN\S-1-5-21-1453213197-474736321-1741884505-1000\desktop.ini	explorer.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Public\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu Places\desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe

Enumerates connected drives 3 TTPs 6 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookMedTile.scale-150.png	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\eu-es\ui-strings.js.CRYPT	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-crt-convert-l1-1-0.dll.CRYPT	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\eu-es\ui-strings.js.CRYPT	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\cs-cz\ui-strings.js	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sk-sk\ui-strings.js	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_ko.dll	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteSplashLogo.scale-400.png	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Utilities.v3.5.resources.dll	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\WelcomeCardRdr-2x.png.CRYPT	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE.CRYPT	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupWideTile.scale-200.png	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\sm_16x11.png	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\TimerWideTile.contrast-black_scale-100.png	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\WindowsCamera.exe	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsBadgeLogo.scale-100.png	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\ui-strings.js.CRYPT	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l2-1-0.dll	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-crt-time-l1-1-0.dll	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-conio-l1-1-0.dll.CRYPT	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\75.jpg	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Logos\SplashScreen\PaintSplashScreen.scale-150.png	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\ipp.dll	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxBlockMap.xml	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupLargeTile.scale-125.png	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\uy_16x11.png	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.CRYPT	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\7656_24x24x32.png	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\mraut.dll	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\bartlett.png	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-30_altform-unplated.png	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallLogo.scale-100_contrast-white.png	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\cs-cz\ui-strings.js	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Win.UltraWinTabControl.v8.1.dll.CRYPT	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-process-l1-1-0.dll	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuy2_i422_plugin.dll.CRYPT	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupLargeTile.scale-100.png	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fi-fi\ui-strings.js.CRYPT	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msdaprst.dll	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-stdio-l1-1-0.dll.CRYPT	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\2_32x32x32.png	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\8201_24x24x32.png	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip.CRYPT	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libdxva2_plugin.dll	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-30.png	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\5601_40x40x32.png	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-16_altform-unplated_contrast-white.png	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ru-ru\ui-strings.js	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\nub.png.CRYPT	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Utilities.v3.5.dll	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe.CRYPT	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-100.png.CRYPT	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-80.png	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\msvcr120.dll	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEERR.DLL.CRYPT	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-36.png	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxMediumTile.scale-400.png	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\ui-strings.js	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe.CRYPT	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\2717123927\1590785016.pri	explorer.exe
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\2717123927\1590785016.pri	explorer.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	SearchUI.exe
File created	C:\Windows\rescache\_merged\2717123927\1590785016.pri	explorer.exe
File created	C:\Windows\rescache\_merged\4032412167\4002656488.pri	explorer.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe

Checks SCSI registry key(s) 3 TTPs 33 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities	explorer.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
828	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
896	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	896	taskmgr.exe
Token: SeSystemProfilePrivilege	896	taskmgr.exe
Token: SeCreateGlobalPrivilege	896	taskmgr.exe
Token: SeShutdownPrivilege	1080	explorer.exe
Token: SeCreatePagefilePrivilege	1080	explorer.exe
Token: SeShutdownPrivilege	1080	explorer.exe
Token: SeCreatePagefilePrivilege	1080	explorer.exe
Token: SeShutdownPrivilege	1080	explorer.exe
Token: SeCreatePagefilePrivilege	1080	explorer.exe
Token: SeShutdownPrivilege	1080	explorer.exe
Token: SeCreatePagefilePrivilege	1080	explorer.exe
Token: SeShutdownPrivilege	1080	explorer.exe
Token: SeCreatePagefilePrivilege	1080	explorer.exe
Token: SeShutdownPrivilege	1080	explorer.exe
Token: SeCreatePagefilePrivilege	1080	explorer.exe
Token: SeShutdownPrivilege	1080	explorer.exe
Token: SeCreatePagefilePrivilege	1080	explorer.exe
Token: SeShutdownPrivilege	1080	explorer.exe
Token: SeCreatePagefilePrivilege	1080	explorer.exe
Token: SeShutdownPrivilege	1080	explorer.exe
Token: SeCreatePagefilePrivilege	1080	explorer.exe
Token: SeShutdownPrivilege	1080	explorer.exe
Token: SeCreatePagefilePrivilege	1080	explorer.exe
Token: SeShutdownPrivilege	1080	explorer.exe
Token: SeCreatePagefilePrivilege	1080	explorer.exe
Token: SeShutdownPrivilege	1080	explorer.exe
Token: SeCreatePagefilePrivilege	1080	explorer.exe
Token: SeShutdownPrivilege	4000	explorer.exe
Token: SeCreatePagefilePrivilege	4000	explorer.exe
Token: SeShutdownPrivilege	4000	explorer.exe
Token: SeCreatePagefilePrivilege	4000	explorer.exe
Token: SeShutdownPrivilege	4000	explorer.exe
Token: SeCreatePagefilePrivilege	4000	explorer.exe
Token: SeShutdownPrivilege	4000	explorer.exe
Token: SeCreatePagefilePrivilege	4000	explorer.exe
Token: SeShutdownPrivilege	4000	explorer.exe
Token: SeCreatePagefilePrivilege	4000	explorer.exe
Token: SeShutdownPrivilege	4000	explorer.exe
Token: SeCreatePagefilePrivilege	4000	explorer.exe
Token: SeShutdownPrivilege	4000	explorer.exe
Token: SeCreatePagefilePrivilege	4000	explorer.exe
Token: SeShutdownPrivilege	4000	explorer.exe
Token: SeCreatePagefilePrivilege	4000	explorer.exe
Token: SeShutdownPrivilege	4000	explorer.exe
Token: SeCreatePagefilePrivilege	4000	explorer.exe
Token: SeShutdownPrivilege	4000	explorer.exe
Token: SeCreatePagefilePrivilege	4000	explorer.exe
Token: SeShutdownPrivilege	4000	explorer.exe
Token: SeCreatePagefilePrivilege	4000	explorer.exe
Token: SeShutdownPrivilege	4000	explorer.exe
Token: SeCreatePagefilePrivilege	4000	explorer.exe
Token: SeShutdownPrivilege	4000	explorer.exe
Token: SeCreatePagefilePrivilege	4000	explorer.exe
Token: SeShutdownPrivilege	4000	explorer.exe
Token: SeCreatePagefilePrivilege	4000	explorer.exe
Token: SeShutdownPrivilege	4000	explorer.exe
Token: SeCreatePagefilePrivilege	4000	explorer.exe
Token: SeShutdownPrivilege	4000	explorer.exe
Token: SeCreatePagefilePrivilege	4000	explorer.exe
Token: SeShutdownPrivilege	1488	explorer.exe
Token: SeCreatePagefilePrivilege	1488	explorer.exe
Token: SeShutdownPrivilege	1488	explorer.exe
Token: SeCreatePagefilePrivilege	1488	explorer.exe
Token: SeShutdownPrivilege	1488	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe
896	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2072	SearchUI.exe

C:\Users\Admin\AppData\Local\Temp\2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
"C:\Users\Admin\AppData\Local\Temp\2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4396

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:896

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1080

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2072

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4000

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1488
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\readme.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:828

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
PID:4804

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\rhp_world_icon_hover.png

Filesize
388B

MD5
1dc5d31ef9205f1034b64d635d59cb32

SHA1
c172576576c5ac5a3c2912bdfd0c8365b5365513

SHA256
676d1f912a22a12ad4c80bf552355a7e0995c56e6ef7527aaa9b77e513efc065

SHA512
bc334638acb1416787df04cbaebde99cd15d96c5b96b6f950cbdfb54177fcd2f2ecce4dc9212a9a3f2f85269ac901aef147ec6297c31c5ee6cc39ee4cdac17c1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\rhp_world_icon_2x.png

Filesize
552B

MD5
7d00bc0d46dcb90890a4fe6b76bc5c3a

SHA1
7159b1e1c264a6863708a971eaeca32cff864aa1

SHA256
2fcd2848cbcab1a3b8154138288cc659cd2c187412cb887eec6554b6165b8c33

SHA512
2f113cb27028aa0fa0f028b09ddcddb4a1ede6ae0823909d99763db6e5be57b1b4ae6977537ec17808cd622bc548e1ba3122e35b58de9d856400d33042234a35

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\ui-strings.js

Filesize
1KB

MD5
6e8d259daabf1168ae5136a3de48ee80

SHA1
b015257e3ae0810ddbda53c0b12991161a863ffb

SHA256
13370a65ca7e31fbf3a133156c208bf99c01a54880d55a8a4500495683e3a47f

SHA512
cf3c564c18c6b0965a431cda1ed8fa97cbeeb839d992e48f77c073bc8054ead03b4823df381c5179d3d398877da3473b92d70ae905a2bd0c7e5fc45505340113

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\ui-strings.js

Filesize
1KB

MD5
88151ac4ebd7f5ff2d381c65e68cece7

SHA1
f979db4063d15ef2e32db3c38890899bb87c78e5

SHA256
c1ea4ada9462abd4ec352dfaf670575e9caff1e55d303db96a2f2500d50d92e8

SHA512
326195f5176beed6cc39849b8d6e87a5136c41a04aa76f53c30bbed1ff74391e16a6114e236f39d403c7f82fda032c00a9ee1df583412dfea224047e51f4c3bb

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\root\ui-strings.js

Filesize
1KB

MD5
60f1a26612dc049ce3e00fe917b6475d

SHA1
05791d089cbcd759088adbbd9483433dc9a10206

SHA256
8ced84488e1ea81e8cc3ec1a25f5b849de902601bef557b6ec65f9de2982bece

SHA512
06f080a9df9081a2bfd557165f9c21cf2bce3ee161c0896a9f9a6e0f8a3ae545b1cfaaca9ce1d46757dbe0163ddd0421bdb51558ef092dd0a6e5c2052ead4706

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ar-ae\readme.txt

Filesize
223B

MD5
dbac9649c4bd702f55fbd1afafe87c44

SHA1
0d914f4a809cfe400ca111ebfbd0ad552d500785

SHA256
b9dfa3b30224bd5eef298531c945d5f2f6bb978b7ef42e5ef09715a535172127

SHA512
86d7786b400303b1fb722689aba7e8ef6a01ad7e2776194c5d545a7d7357dd91e7079296790587210683db7f4385f98f281272fd3d1ad6770dabf401709a6415

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons.png

Filesize
683B

MD5
ea321d33cfeb1d029794bd01c5b78e85

SHA1
4e04b2d8f7f23f44f96f4bbf134233e1feb5e28b

SHA256
3add439f478220ce8001abf2543810144a0d80f8116bc0ca13947c9745983c55

SHA512
f574d12330a668d89402265cf5a859a76325ed548e1730e02f51dfd36e3d5dccf2c8b75a76a8c931597bfc130a42364c73eef0200523d4eefbcf4fa5ccacddea

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons2x.png

Filesize
1KB

MD5
a660ce180dea34b4944d83569f4789bc

SHA1
e3ca7b90c8bd299c49585bd29bc3fb7494c0fa4e

SHA256
03ab6f2f396e0531f1b1299b61485408cff93f183942910a7d0d5f0c7a666bd8

SHA512
9de185c0e6a8cc49852ebb454a00a7a19f5382b358327d393a6952b32099036147c1eb799cc60078bf24477e9607a1b4c88288a213a8ffcafd8d60caab0f0720

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\root\ui-strings.js

Filesize
1KB

MD5
cdc58b2bf0a1a34f96af8fdcb62dc30b

SHA1
69eb0d674e9830e81cecdd610792225a2a5dc265

SHA256
3b5888b652cd86408bdd59e86405d3f171d23132059228544fbe693cfcb2b73c

SHA512
d8ef3220b8984f759347a0e83eb75939c914bf865db492d28e226f113b469a97325befa008886743aeae2e0f32c74c0a1e7ce8b60eaf5949b51058a618daa502

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png

Filesize
445B

MD5
55c2b47c9aea50661a855fe91eb8ac32

SHA1
13ea23a51394ea2c13420ddac1294eae6f82f846

SHA256
ba5a59d879c1f6543b46085d02f5c90fdb22e663487d3586b6533cd887c83b72

SHA512
947da2e85f5c21e7847f10d727729915973c911a47de233ef1fb97f60ae41db05f4c8c0ee655e3aa264db2067763e4134b76279f1d3ea8ad43640a64176522a3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png

Filesize
611B

MD5
808e7aedbb1da793b86c92816309035e

SHA1
b4a2fca53290a35ae222f2cdf80f68ec7eab51e6

SHA256
a90f0edb8324760029a5db9f641b05694f8717c25514b2d6abde7662c827e0cb

SHA512
0af4e6a83661378b618c40de02c6cb7244be544dcb02f1f14c83b6abd791fa0330b6d508c86f0ba8e345608639d8505a2f26d3a6d3ae201bb01319c10c212d4a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-il\ui-strings.js

Filesize
1KB

MD5
5c1dc195043bdea8525930a9882c10d7

SHA1
17415e551255ab016f7682d7b33451cfcb91e687

SHA256
019bad9e72430b758828953e3310007695c55fed1d25fdd707c76fec561f2bc5

SHA512
e912b84e9b4856864d302154b68adf6822189aa78859265cf8f529279e77a9d7c086452b4527ebb75d9c910ad9a6a1e95e1f45498fc168628da80739acff742e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected]

Filesize
162B

MD5
8db5f9dff9d857a8827ea6d66fea4880

SHA1
ef5de087109543e49ee7fe70adb49efe27e15121

SHA256
e8c6ae3d3f05d53d58200db3f31383861d434c6abbf66f82e925321029058a10

SHA512
70723910b4bf8814f848e10390378d53d9fb67e8a319edb708edc41b5c858c1d2cfc0b86a2909e33f72062df8b32e70554fa5ebe7aad7ec474ad78087560069b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\ui-strings.js

Filesize
1KB

MD5
4e6de5201d795432e75c0628dd306b26

SHA1
80ae62145f6bc55c2a25f68ad9d6bc9fcae496db

SHA256
1265f683d27701f95b545e6201577fb4eadf5dcfbc1fc8cedb8dd39635515788

SHA512
950227253fb845bd9a4519a209d72404760492473bda8101d846ded18aef1a2f6f6ab99b1b1b2186c0eed423c151c089316e124384f214644632e6a0f4dbece3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\tr-tr\ui-strings.js

Filesize
856B

MD5
fc4cdc00064f47d2eedf58bd02068fe1

SHA1
cbb7157d8c560e9b2cdffac3a2b831202d76d2e6

SHA256
0e8fb0e6e1dd239a2a1996059914a5ec5e753782527c1a07c62d808eb77df3e0

SHA512
753d312596fdd24d3ad87b7916c5d108d185b42beff7c750099aecb38c7a321ff04260c19492d18cc27cf8f8843c6b3facde0934e67a46e9ce4291c3646abbe8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ui-strings.js

Filesize
1KB

MD5
c5596fa17e59cbf92a2ea2e1ad5c6f8b

SHA1
4153a71b5750685afba568403ed7522e83a9894f

SHA256
5812ebbc6311c0ff9919a27137b22435cbca3cb9fd56959b44ddb82f93609b99

SHA512
762580962300f0e0501054450772ed59cdfec76d7aa6b1944f557ccd74ec2fcd171ffd67765f2b367c526d0193eabd184f0d4ac1dadb7a0d25f00f9866f670bc

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\zh-cn\ui-strings.js

Filesize
850B

MD5
26645133c9de7799e35cee0e47b82ee0

SHA1
bb6be735f6814d765bbe6b3f3ce034d1767366c5

SHA256
1180e5728ff28a49eec43c61f15d49541419e79397ae58479db67b533d292d36

SHA512
c466dc886b25fea5a0e16aec28a4e784afe797f3937c7863788d0e5fa41414346bb17546d49178a48815debcca50aec3acabadc1f508fe0a3207008bc722608e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\main-selector.css

Filesize
802B

MD5
89728f1ec13231dd11d2ea20afe39d67

SHA1
b4350cd128350483be389b2c865633bd1ae0f78b

SHA256
aff85e66d5b690dc0188f4c2348ca78abdc14605286128407242a4e91a684754

SHA512
58203e9c3898367c78c6d10fa629c0bd2356b2ae54e225afbcee83be1d5d297977a5a9633e773ffc2b8079a6e2eb2aa0afc530c27d29f512af40d8c9ae539adb

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_pattern_RHP.png

Filesize
179B

MD5
a93c09c1a326a8733b4eceb713ca7457

SHA1
90ba7a4c24bb0d424abda46b736170ea3b43e541

SHA256
d03f54aaa9216f4e32053928ce87a317341232f107140c84f73b2b6490b5a81a

SHA512
432c3400257d00391baa255d32fd03e0b8c97231d684ef35534868a38bcbf9cb70b433eacfe154c25fd3376e69592a7000a823535700f353975572c5101a56af

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png

Filesize
703B

MD5
cc62ce00dfbe76fd8affad9c89fced8c

SHA1
75d64cc57ff45a50c066f882bfd8e3845f8fa323

SHA256
e324ff224bfa2baf51d4ab75f686195a76b8c984676c450ed660eb9ca2b36f4e

SHA512
028056e42f0eb02646752b351bb04a6b9f87ff27a2e1060b4fe4d4867118fe90f42f555ea8c645361963405583005ec4f3802c7c57729fc8616df1af09cc94dd

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-gb\ui-strings.js

Filesize
823B

MD5
fa904cdf440c6743078637992d58489f

SHA1
6969f407be2a1b52c5a41be256433026cabf9917

SHA256
152f6d0325802be61521bff49a8dd07063feaffeb2447d3ae6f47adf214cbffb

SHA512
c6237e56225d36d26ed594406a5bc08987bc34fac8d425dac8f909512ff19e6a27e1566651c591a38c0a5476e74dca09beb53ec15d4f08b6de2843fa064cbd3f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ui-strings.js

Filesize
1KB

MD5
573dd292166f86741bb965ee068c3793

SHA1
169fcf0880c7a2c5993f5bf28ff64cd9ed441dd9

SHA256
ab2b7de642b66db6e6b610dab8fb3c94c972465e07b7f681127c40a6629d8c2e

SHA512
0217d582d827a7b6faa950bc726d41c4c7644ba11b19689b9e5eb60cf54df4afaefcf4eac3649e8315dc1134988dc71abcb94bd9a640829bf9d68a6ffa17241b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\ui-strings.js

Filesize
924B

MD5
bf70043c03230a91bb5b402e7ee67e63

SHA1
2ec8302c3ebe1e34abb5e0c813abceaadfc5073c

SHA256
a8b45a4c0a3adae007e8ef6b3a0e9966d2ad0c552320210a778109e2799f6c75

SHA512
ecdf54cc56de9c49dec1e9e65aefa736201904e609474b13d089f188bf35ae46b62d1ba492f4c25ad3fd7ff584a1532be18c0115598c2deaa834b22e6e52a601

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\tr-tr\ui-strings.js

Filesize
931B

MD5
7adbce4bec815b574ab3fc6d85eb1937

SHA1
7d14e52fc6aa5796996988e9feab97c31eab1e0b

SHA256
efec14a7f219aff9e96c136933c0316abbabfa082b5755a86b2745c0a8423a79

SHA512
4218fc7991ef7ab93b1fab696432fc0130f07c534b2da244ce3370e6092213db657505af8380e7a07576b16b19d7c1b58f6a5498122d73061a362162b31f5b18

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fi-fi\ui-strings.js

Filesize
1KB

MD5
478f0065e127108d705114b29fb9170a

SHA1
3d954983b0594275bdbe444336baad9517129b79

SHA256
1beae6b25a652882189f27e3b52232bc3451a54eeedf3e5cb0eb827fe15032f9

SHA512
4affd4e7c23c555d99a5a1a4ff929228af723961c6cc1c320358998fbba2528e2d84d5c64a5c28fd6420ba3132fad056f2388538086d061510d80e244f7b3990

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\eu-es\ui-strings.js

Filesize
851B

MD5
661fea8b99a08e2422d8b5b9bcfd9921

SHA1
54a78f38a3599aed6d27c6fc711d7af7a205c524

SHA256
60624904ad10defbfcafa3acd5dac4c7c5040edde23bff489b6b32ea5a1403ad

SHA512
69b58c6c99f494ca1b6f2788cd17b63cc9f583b0abca870f666aedb9c504f660b03df699b69828c8ecc43a747297042eeca7e197de96dd43defb7871e2289b9c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\he-il\ui-strings.js

Filesize
855B

MD5
3dd77972f6558af4969a57eb4f19f2d0

SHA1
d56f6ebeaf408c667bb9491845a33ddc19d18947

SHA256
cde2dda4b1709d6591356e21717833ecf9802dc119d719e9dbbc97b090158644

SHA512
68f15867e6b29cce5415ce31203cc3f1790869f85d1b1ba8b2912e9b1b570f61485e5e9aac96d9bcc069e81d298b56d8941cd94a1df72d07c7508c7fdcc7ef1b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\hr-hr\ui-strings.js

Filesize
849B

MD5
95e6ecbe44dc4ab34323c697c6568b56

SHA1
0ca5debc2a7b53245ae6b7d6594ba93b3152bdee

SHA256
d3bdbdce059d04ec6e336179e6262bc694def0fcc5fe4b006953dbf178dbb30c

SHA512
af6262bf0a2b16fbd1dff7051eb0373336781c105b63631080ed2b6d38f54adbdbd16d794917fb9ad08c9ee238e0d4df732b7ef3e4c6d521a6b347eb8c2e9804

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ru-ru\ui-strings.js

Filesize
852B

MD5
4fcc8af63d8fea1581c1e96e9436e913

SHA1
5c09be5c84dba1172a2503a3406223baed06f8bc

SHA256
bbce03b612d22d42e40207a0ac4b6492ab0ad8c2cf4690377929f4cad738954d

SHA512
4bb1df7206f7fee79df361d678cd250399efff9d13d3435448170efd515abb425fcbf3b6ad9d0c6da1b4a7860d33dfd15daaa199e96dcdd701afb3b80234f2d6

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ko-kr\ui-strings.js

Filesize
1KB

MD5
21a5d65fbcf76ed1b8e9489d3bb051f7

SHA1
dcfde89bb81642e0b1bcb2b4d8c0fe574e912950

SHA256
f054ff5e3f41e79c647bd03dc9ad1bad42f8292c7e7b839088faeb8abc182ff4

SHA512
566bc1f2c5f4b2b9888c8e414552c25609d2562e10a8abddf6f036a6cbe2bc7644cbe850311224c25db96380c0e11fb07800f965305f41e068968bee530c320a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\root\ui-strings.js

Filesize
1KB

MD5
0e038344281f0aa0a74103dd77048888

SHA1
163a5a2d3888eb23ecc17b53865742f3eb7aa3c1

SHA256
f3a76de64a79cd7afa5438bb0a4f4330a97497246fe00f7b29fb690e2ffe32cd

SHA512
5988b04142669c005728510cc0a0c7507a9b8561b9d3178e3ef06b77a725e5e3ab7c13faf2998522c601285e823d3f72edbe7b93ba6b14a9c5afefbacb974560

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sv-se\ui-strings.js

Filesize
1KB

MD5
c4b091c93a4910ecfc619efdf3c56111

SHA1
4147f571dfd1d77b6a6943c57784820bd0cba24c

SHA256
d30e4139d68728b1c0b7c0fdccf649fc98c269f0d57c08e1d2033c13f162c29a

SHA512
b276ec16ba3a0737c8958a7373c3b5b53d384432535e65ee5651dce90da0eaf7dad1a02479243efb0b5ea78234c0f423ebc10c82b6e28db557106b8a21db1964

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\dd_arrow_small.png

Filesize
289B

MD5
65afdbfd57a964a5525ef68ca68cb5f4

SHA1
986fd9886e54eaa35b90561c94b00f85eb758711

SHA256
322fa7539ee1552758dbb051fe1199a7b4b247ec8335fb35cabf043d8947466d

SHA512
88b2d9c205d6fa4fb7823fa118fb95c651977cbaf1b54445ced380d34541e5367a218de4335a341b3994839386b487fcc33718b749ab2e05678ae87e0da1dbd7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\share_icons.png

Filesize
1KB

MD5
2870d12e27e8a50bf66493145c06939a

SHA1
f4319fc28ae1f99e359b5cfbd4c8c69af67dc03e

SHA256
dd6fda1bd17d115065254a8af134a7906d8e15e2725b01223582c3add3240272

SHA512
39b2281464998cd9f3d87659cdf7f3f2690a82bb8093ac64d5141d837dd4f951514cf0fcbfc02a0102f3d8ce780805886a361c649d6df2347db60b383442e5d0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\dark\adc_logo.png

Filesize
1KB

MD5
d1dfee6d7b14e63f64c349b2cae8ad27

SHA1
fd382215ff99c0993d8924f18ff7912b4835f4ad

SHA256
b63bba00ed3b7a86b6ed36ab7d6eede57656454e0a583b875d34ee19466714e4

SHA512
220e189bc67b20bef3f92da6dd063b12fd53436c6fa9e728553669e4d42dbe595c52801e68a929797c48dc56fa4ff47919aa3d065363ce881e207abc83f7de77

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png

Filesize
2KB

MD5
598b166da1d843121d50f9593073a15e

SHA1
e41c87d8fa9aa263dfe783bdd692556fb8e24f43

SHA256
c46d21ff4c32097f172b4e99b5794374ed4a1cb025040d157f611f43929e98d5

SHA512
107ceb56129c1baade5930cea77fdc9c53264ff06b92936a5823c483235ffce8ab4ca3efef5001c5cc16eb3351b663877e1e4184749ba33d785b4927fe2f2db1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png

Filesize
2KB

MD5
48a2c150eaa7d9fe84e7e31163e67495

SHA1
cfd5375b61328af47b784d2e1229c95c9355ce06

SHA256
ff1d90818c6ec24ad8dc4334bed7e72b3ceb9460cdfe3b25ec24d2b31b4c9288

SHA512
e6abeeb5ed043270c9148b58fa359d8536e0a9606aaed86446f3cc3ef14a855b711a86869d02fe27f50ef79b91895c77bc970c6ccf962caeb8311984c4778410

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png

Filesize
385B

MD5
34300ee4cd847a5329747c2294699c1f

SHA1
5e1086c8ebeaf9205517c82d8ae1711931ec48e1

SHA256
122650bd6eea6dc3c3cde5c472c78fe200967b33c6e3f3d2f394d8fb66c3acfe

SHA512
ecea239cb49cc1b9018e9d5bc34fa0d501cd9dc6bd7a8c01b8a2bfe9cb8d9baf805081d3705f0f986903a93a35a3ddcb852463bc2698606b556999cd0608ad6e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png

Filesize
1003B

MD5
d82b1439dcd0ea62ce3edcf6d36eac1e

SHA1
f5216b9a0c6b294584b24a5fd50b43e79d46310e

SHA256
44f25bfcbff16b8e7c81ac93d6dcbc312035c81ba6d62e61d4177e23ef62dbff

SHA512
bc789786f1261ce50116190f56ce7da3063fb944af6e5da17fd0a61e51d3d25b11fc09a83d2fd1805e16f33c2c469bd28d05366b8fff7faa85d3dd498e5e3d1a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png

Filesize
2KB

MD5
7d1b0ec51595563c9214ddfdec36f303

SHA1
bbb988973a8281943b5bfacb8ab03d97c0f0f398

SHA256
c915635ac032617e1acf87810abd8e8d9825c7e40a74245bc9efcf31d6da9da9

SHA512
709deed649d6062cf8c1ada7207b9c871d51a69a4bc7dc3c1408bd6a38d211ff53ce19a091cc4bb68a62eb00aa512afd07a33d314393812716391f04faea93d3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\ui-strings.js

Filesize
840B

MD5
ac24e253ff384d8523af43f5a93688f7

SHA1
beb4ffa972185300803e9a1f6a16ec062cec1015

SHA256
f49327d72a4888fee8721962d13a94571e349ba666a0e1354c4f49331e858cff

SHA512
9c559a1bdaae9172fbe9e6a9b907390041fd16d0382a202423e0d9d19bb0f2c06a7228d6bc17df943d4e927c0420f302982e0463755bfd5c0d6e4ecb65504a61

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\ui-strings.js

Filesize
1KB

MD5
cb05ff26ffcb30838de16f659f8d93c9

SHA1
f9e977e1f60be49be8a17cf75d31f4a7620827ab

SHA256
ef97178fce43f78773e1c57cebaadd55904a1e5d810f8f75219b23e92c00687d

SHA512
26fc3838e5ef5b638d974be02b6d8f76f7f4778b1b612ea9031c5a5b1cf4a421e48c7a667a1f8db55270c1c86c4e1ec469c8078dd0edaeec2df02fddff27a999

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
930KB

MD5
45d3d62890fa98b808e4379a0a399baf

SHA1
5b5459717f961d20f002e3c5d3268906a71e7f73

SHA256
de96183d3d1e3c5a790c8fb31df0c6879d3bf1ca64b10be23452b58ee8e2b69e

SHA512
748cdde074183fe2780a236a9cf3e8141c5a79f492cad5656e44f706a74a58575015181d32d39bc177a4b68a045f7f0b836ba9d66e73fefe9877efb5744d6f2f

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
190B

MD5
f0be99f92d8b8ad3d79c9aa580fc2f08

SHA1
a9ab5160208575c2c19277491406d5c95690a5f0

SHA256
e290cb91a6aaf54bb397c8f72d0bf5e8a70935ca00abde862e3d13fdf75fdbb0

SHA512
c9c2002d0f14f1d92924f80105c4b092bcb8de5bcb838179f2129b125fbcdf83f78ee80f44b0e26bab451c6fa5d6a29547a4933a92858e310dfbbdcee32f8cae

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
950ac8e007b49ed7acf1646758393817

SHA1
3a795f27aac36ba92f33165a6550cc7f201b3254

SHA256
4ab0585ac1cc953813901847e774a0a6e2542bedd0e5964cacf31e421455223e

SHA512
6bf7c6bdc1f802cdc8cea1d5a22de2e2cdf307411504499351fa5e9bdb7d1826c1968c4cc8bbb2fc17ea69850d69e0e2d77b76d29ad991813b598fc18ea0982e

Download Submit
C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Slipstream.xml

Filesize
744B

MD5
c181d62d13f055127f354bb60cdfa03b

SHA1
6cbfcbcdb417807d7ce1ffeeaa2eaaf9b548885a

SHA256
d8dc1b9aa2aefd658fae2d9b6bf36318bdda72fcecba0538a1f121592b44e3b6

SHA512
62dd4c375f5e3299843c78dc86026da551a8a66c2c4cfac4003b8e4774ddd1cc36c130611c15182b61a472169305b75c845f17ec899e53250461867cc82abd36

Download Submit
C:\ProgramData\Microsoft\Provisioning\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\MasterDatastore.xml

Filesize
271B

MD5
8a60a7ce7e68b0817cd3c8b86d138532

SHA1
b2585ad3639584f809cd4357a30f9b60b2e087ff

SHA256
de13ad3b28f0f1517dcebd290f646f04d9b864c226cb3611d55975516e663fe2

SHA512
d7e59d4d719111ed9826f08badc6bcaf13f21844dfe2f55fb5e50b607e9a0779858e36c555c8cb038d23e82c1d1298226c93005859ba0d1e5fef1b6b3fbea1d2

Download Submit
C:\ProgramData\Microsoft\Windows\Caches\cversions.2.db

Filesize
16KB

MD5
4534f12102d235344cf8dda748f0cabf

SHA1
7db67baceeecb3a420bf37a7beca4a45185f8f3c

SHA256
1bd4db450abc8914c2fac721cace2704ff4c16028e6d07293154dad289835694

SHA512
7b4dacdbc6a2fccdd3818eb41b7fa23eeec51f333af0e842d9185c7ae45eba1623369b1caa27b824cba10c4cd6a2cdbf7f127ab2c6f7656eedce5fe25a0b84a2

Download Submit
C:\ProgramData\Microsoft\Windows\Caches\{37A920B3-2637-4127-884A-1D72A4F756F9}.2.ver0x0000000000000001.db

Filesize
1KB

MD5
d846dfbc02378d2abc6f1bfe15fcbb41

SHA1
7c2258eeef30b2332f8078443aaad2dd03330450

SHA256
3982088d0f4ad78ba7e0c2d55a171c42a95541e18fa8caddba0a43931aace384

SHA512
ba96848d686625b8045312390a164bca810383f5018221fd05892e5905f624d4ce2b0f98283fc7ca74c0b2f6ab65071efce31e96a54a552fc14dd9ec69284a9e

Download Submit
C:\ProgramData\Microsoft\Windows\Caches\{37A920B3-2637-4127-884A-1D72A4F756F9}.2.ver0x0000000000000001.db

Filesize
1KB

MD5
9bf279e3ce66488b2c826652e4f944f8

SHA1
a25ee5f1034e0e601384a5c6edb750c2a01292d9

SHA256
09bbbe9accb4dd558bca3b95e80df3ae0433fe0291796e36113d90e8a8ae9f07

SHA512
c9b952f1ef8d87d75d221e436c7bd95115f41426d9dd59acb585670e5c4dcc79432a0c9febc98ddd06f49e8d3edb96e57ac2769c178e2bc441d739261fe51ad4

Download Submit
C:\ProgramData\Microsoft\Windows\Caches\{37A920B3-2637-4127-884A-1D72A4F756F9}.2.ver0x0000000000000001.db.CRYPT

Filesize
1KB

MD5
cdf838d8207a34ee6850546c8fd63e99

SHA1
b024a8ba71e7aea32f120ef6da677a125ee3f498

SHA256
018f8d1b2384c3cf5ee05dd03f1ac7851e03d9c6cbfaf1c6df889f2ef1d22b6d

SHA512
48967e3934650977f6009eb005083938fbc9e8f80ef5b1ed440eaf9769c7367ed02607e679024f538211e25d73492c598a544003e77a3f3cf359d833e6de9d7d

Download Submit
C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db.CRYPT

Filesize
279KB

MD5
aa83005ffc9dfbecf79572a885f97ca4

SHA1
984a64931dea590b7518c40cbdf4ae15bbe5b613

SHA256
d01e673b08ff50294c7432c28fcd3e005510525daf7273aedc6a1efe951a8592

SHA512
b797c34c081ff14673ce4adce5ef8d4e1eec1bfc44b1e090f9eda49a3630af0da1b00c495d04df75692d04f65220f1406a3163e932990b879a349cb68f3cb1bc

Download Submit
C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db

Filesize
279KB

MD5
ca83a90720886b2e7bd0e7d344b20706

SHA1
dceb1dbdf2ef825a25671f0621525b2061f45335

SHA256
0707ef2476c6275c7d88d5ab878109eb4297172306af1f225db0f799d74da386

SHA512
83ecd28744aaafc556156ff05b62f6291fe8d7ff63d7b9c6b026ac1aa04fdadd869af44fa7c473493d4021315492ed804281a3256575f9cdc4100e8df8686725

Download Submit
C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db.CRYPT

Filesize
280KB

MD5
92b086c6307507bd009052dbfc2e5909

SHA1
e3fb8450b556079acd44a1bdc6e1bf6617fef588

SHA256
5f194bec25b20ac3b1879d5b712d54a92eca20165694f16fe9b79b55ba78d764

SHA512
6c59de5149e7028847dddd7e398af66b2bbffaf01ac5727051ae1a6106817b106f62d3c91b8a7bca09ec8e274ddcb7b246ba69450056ce053ca6d9012e05066d

Download Submit
C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db

Filesize
580KB

MD5
6706caf5ce7db7e637ae6680e0fe5a53

SHA1
c2b82187d48a231a439df5b7ef260fb6828eecfd

SHA256
ae685a8fcb7ac161299a12721a4b57224096804c033b1261d1e63d4ff3dd0437

SHA512
e6ebcfdce465de62bf429cc0e2b989308b13ddd9f78f9a0cfd471024f07b73ed70533c0cf40750749c84cc7d89276db8b3579a83276c2960a83b832e15bb07d1

Download Submit
C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db

Filesize
580KB

MD5
3f90a770b49b4ba662ee9b0f4ea97078

SHA1
56c29488222901ae837321bf7acc86a7fa34b5ff

SHA256
cc9a184811b7a09454c7d840fa45dd8402b2e3002e09e2ab3008fc124f02d702

SHA512
721066b901dec78c5a532aeaab954f864423707dfdc7d2880eb5a02717ab8ed7756911d8986d220b46d9b1445c8b3e01d2b228539c177aa423155e59cb853f50

Download Submit
C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.CRYPT

Filesize
581KB

MD5
03228d9b419562b3e1e8deba02d41a1c

SHA1
4223f779b2b44e9da9805cc06b288eebc033d941

SHA256
12aa4e090cea4ec1117751955cef2732e939dd0d005ee39baa8f6d7001e2dcf3

SHA512
cad12b7cb0c7f94a186932fcef5a38786f71b4790e8782d8cd51ff0a7f9ec814452d1363fe924458c72da61b17ccc8d249e7e5ae98fadee07eb3d18e1748e9e1

Download Submit
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\eee47229-947d-2ac7-e8a3-49bafee251d1.xml

Filesize
2KB

MD5
29eb0301f92bda0d67f79582acadf847

SHA1
2c2ac90238793f699322833c2f8bd043cc29ddec

SHA256
221ce3a8c269f4dff433a9a8a9807f65d8fa7b302e640b245f7293a0998363d6

SHA512
61f47426e5dff09a432a7848f3d07cfb5f85cab6b327fb416c31223e6a5ecaaf3a3f065a6c4bf0a352fb4fd3c7199ae481c929c43da3d596000f87d7f6bd52c1

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.CRYPT

Filesize
456B

MD5
7b4010591633af61a8fa27a2fa01afda

SHA1
47e79180e14df110f7065d55a750c94eaf19d60d

SHA256
cc015335b4d800d90088050f3e29a3ddc3f4f7e80251b9a6eb1049b4f5e66e23

SHA512
58208cde42de8567f9b315d67dd225d1631258a21a45c48ba40749786c341fc355e1feb2361f1e7b039b757b1c3a6afda500c8c0f9b07deb927f908dfe38dafc

Download Submit
C:\USERS\ADMIN\DESKTOP\APPROVEPOP.XLT.CRYPT

Filesize
480KB

MD5
c6f2249cc9a862483ac2d0e503796322

SHA1
9f89d9f2c1201ba8bcf4413fbbfe16dea9ece067

SHA256
a74cbfee195800a5f51021c75d1cc694674af848332b32a9138335398d554ae6

SHA512
d15a56043849c5a4a4364f4fae82c49650b1fb9ddc0b3fc0368badacd396c68c0745c2ff9b6396e07ea9189b7a38363661fa5b4940a3810148832cec3fb10ae1

Download Submit
C:\USERS\ADMIN\DESKTOP\CONVERTFROMASSERT.TIF.CRYPT

Filesize
940KB

MD5
41d1e1ffb2d8bb6ab22068c85752d809

SHA1
1f94dfc1e5ef9cc31007eab7fe684ab90923b4da

SHA256
477a73e0151abad878044954da89392e7ed2212421b9281cc3f634e962536fd5

SHA512
1bda19200f1f78a4dc0b1916e8d44f751eab9ef2669bd04ab2689f6cb296519258b3b47a719385bc24645ff8bb784c5fc84384afe8dd7a47ff15e8dd54a8164b

Download Submit
C:\USERS\ADMIN\DESKTOP\DESKTOP.INI.CRYPT

Filesize
568B

MD5
77da1451f67ed3bb7922f19e2a9a1f07

SHA1
d7585869cd4916c9a7a729e5a9417e7609ba7982

SHA256
28a7d6f3c388fd4faebd3c5965ffc9271fe6fba9ef845c716d19df2556f55280

SHA512
3b4d5cc073243e661c92f44dcee54e2100f3de41f11a94b1672e1c7ad9fe3728478ff10cce054957776bfdaa8d7f0fff5b6cd15f2833d40f35064b697e22ce56

Download Submit
C:\USERS\ADMIN\DESKTOP\INSTALLSUBMIT.HTM.CRYPT

Filesize
1.0MB

MD5
c646fc769c64dbe5f7b33497e8924bbc

SHA1
ce3f2317c09f01e8274e5e1bc24811386e4171cd

SHA256
faad448a936518d411d24143237ed1e36784f0a293740c5dd02d8b97ee208151

SHA512
308951df5755e9554703aaf565b6de752cfd18770079ded35b09c760b0bf8abcec72ac2a42cfe4d152930292ac83d9440c6d4f4d24c8ff2c4ef739647acb1aa7

Download Submit
C:\USERS\ADMIN\DESKTOP\MOVEREQUEST.XML.CRYPT

Filesize
731KB

MD5
fc58eb800f38d3b69778a11e7a112b88

SHA1
729ffa3329d1e50db95721beaab9f6558bc0f518

SHA256
af28bffdc76e19609ad81c2eeb3479357614197c7bc1e536b54526ebce7b8724

SHA512
40b920e650e6fbe28cf12c181406b482d414bd373dbe20c6d61f5433f5e70653abc2e5f2ee9920750acf33303d0dec62b22c80ee24e5fef1f266705357414477

Download Submit
C:\USERS\ADMIN\DESKTOP\REQUESTMOVE.TIF.CRYPT

Filesize
689KB

MD5
3d726a32d54aaa927d72866578e8d3c0

SHA1
ccca1cd0b51973e463753640c2b1f33e352b6aca

SHA256
b5be7b12e950788f4b90f806d5e903953824ad06a66228541646fbbb86fb3fa5

SHA512
5ff2292cbe543338936718c1a0ff2c4311d9c9c990feca0a624e5ff4a2413fe5e778a26c5651503c95a0fb5f886a463b6637d105aef300d8393ae325ad164a8a

Download Submit
C:\USERS\ADMIN\DESKTOP\RESIZECOPY.JPG.CRYPT

Filesize
857KB

MD5
0cb0c9446477464d93f0c7f447bbcb48

SHA1
90274545ce1af6f08253ad0badcb0c5e664836c0

SHA256
89cceccd13136840eed89b188d978671d1aeaf245af6799d087cc8bb80f1a14e

SHA512
efa094fac2f4f5bab3badc4985c8723e540a5663c50a45c9a26b29f94e88622f9292758335bf993c6fbdb18e83abbedbbeef71d205f32adf9ac6688a4abcbfe1

Download Submit
C:\USERS\ADMIN\DESKTOP\RESTOREASSERT.HTML.CRYPT

Filesize
898KB

MD5
170e44d992b3a32839d952558d1cfb46

SHA1
ef872f2d3f476847be5e1437bfe873a7e0d5ecf0

SHA256
33ae72fd7fcfdb00787a70992924d7e869741435f1a344e0c7a57d1e58041ee3

SHA512
d8c734ef9a2a6e99ac571f7dc3e991dbb17e51d968024c8a0c0d5ad436e232876e540fe17fcf36b1be7243c5accb3bab3ca8d89109cf021329340edbda0c9872

Download Submit
C:\USERS\ADMIN\DESKTOP\UNDOFIND.XLTM.CRYPT

Filesize
1.1MB

MD5
26f14618f3e8537f1a82579bdf5c93cb

SHA1
395e51b434bfc87cf7e3f4e8a1d52e395d686e1f

SHA256
372d6af16cb31c6557a5c0a274cd963c2850882a18a3f2bd8dc8a396cec2cbce

SHA512
aaaa515e3caa52f95e89fb10e2771c0a67e2dc9108906befe62ca16c4d604cf36a1534cf3675690fccf5cc84c6fe1552688f77ad8381c2e49d24e5d7fa3ce16a

Download Submit
C:\USERS\ADMIN\DESKTOP\WATCHUNPUBLISH.SQL.CRYPT

Filesize
1.1MB

MD5
fef184c8e4fedb521216b01b8560c682

SHA1
f219783be9c772cc3542956d77e8d48442df9ef8

SHA256
175e7a06839fa484bff28936136cdd52810c2c75e86b83e1f50ec579a1f35417

SHA512
afd3e51a12477faa7e4a38f068035530f36768d67272778df3de4e3938e6c5a1d1c3152c177f2d090cc4446ea79983aa3b801ac2f1fc720c32cf9c83a88621be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini

Filesize
174B

MD5
ace3165e852adb8aedbeda2aa3be570b

SHA1
4577ff7e92850e2723008f6c269129bd06d017ea

SHA256
237f73d46d3501de63eae1f85fdf37e65ddced70f013b7f178d1ee52b08f051f

SHA512
cf77563b9295b191ce2f309e03618d1ab4d317f65b87dbecc4904ee2d058db06d23c20c199571b0fafb67ae5ec5166b76af0b7d8bfe3996b0dde9751e28f8c03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini

Filesize
174B

MD5
e0fd7e6b4853592ac9ac73df9d83783f

SHA1
2834e77dfa1269ddad948b87d88887e84179594a

SHA256
feea416e5e5c8aa81416b81fb25132d1c18b010b02663a253338dbdfb066e122

SHA512
289de77ffbe328388ad080129b7460712985d42076e78a3a545124881c30f564c5ef8fb4024d98903d88a6a187c60431a600f6ecbbe2888ee69e40a67ce77b55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{37A920B3-2637-4127-884A-1D72A4F756F9}.3.ver0x0000000000000001.db.CRYPT

Filesize
1KB

MD5
b123ff65df4424ced52facde30d7fe22

SHA1
9e15bf1453e53d43c8ca30ff24bcc93ea11fa3b3

SHA256
d5f55825eddcbe3de9c093134d389316a74241f7ae1e49f32e70bf4b055732af

SHA512
a02dad24f6c46c369cfeb63dd016b59e44079056e85bf13b1e58dd016e37afc604f499fd48e9c4cf636fd0091a26920398b8b58f85a94e3047d4ac6cbd9e88ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000016.db.CRYPT

Filesize
96KB

MD5
001952d7363dd43c75bd5f45afbe8559

SHA1
86a2ad049f53d3788d694791e3cf29edf8994e47

SHA256
74225168afb300ea17a0231faf57769404b1dcf35271ca674d8b9321aa791082

SHA512
95f82675af9f8b22cee0cf2ffc81d30e0b240174863fac8d1605ec654a62aad961b2181514c42c1284e9769b7971dc4f352b4dfbd8694b387579535c006f57c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000017.db

Filesize
91KB

MD5
b17e245ac25f3841a590c5393470172b

SHA1
64a03e37edc2b0ee10f54b816a532c5543d155af

SHA256
f29f2f84220dcbd58c0c07a1083e1dc99e1446721c92440d8a6ce47ded8ab2ea

SHA512
2a014444bc279e9dfeff19bc27e2c7649c3da9677491470be0677f595244bfaf47e8a4230d2bc39e4f7eaf80f1519d378c420506c83e51ca8944276b1a776f4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000017.db.CRYPT

Filesize
92KB

MD5
6eb8b55632c1265099e78eba37961856

SHA1
e2b12144e738246cf43f995b8d712f3d0072cf2a

SHA256
2852a75a302b3fb46a16b1c6e483dea69568fb5093f3058c07571d41310b4b0b

SHA512
e2e080e26c48d8c77e4116c3b404e5b9f747cc6dc4cbcd5a81f1dfaa2eb88183e7b40e030c89433443ab8970c7443d94f72fc1150d8d010b790a1a6d95bc2a5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.3.ver0x0000000000000001.db

Filesize
279KB

MD5
0bbe0288a9d69e64ccb51448b993666f

SHA1
65880237a81b779b0f1df4c9979235c759de64bb

SHA256
cd91e2bc10f01ba3b850685445db8a0b8e2dedebdec009ecd802b0c3d9914a20

SHA512
b35846b135e848435b429643fd15f714886af04fbda5d58474fd7c8042246cd906ea46345ddb8d910a9ccb412413c49502704a013070195c14f7ce52adc23185

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.3.ver0x0000000000000001.db.CRYPT

Filesize
280KB

MD5
d5b7179b696e3136e5d87a8cbf774272

SHA1
fdd786ce017a045a45746969e725325cc38212a7

SHA256
cd1d3e4c8ef37acc8a7f582b865c6dba99c6dab619fc719e135b8733297a5fef

SHA512
6203f56c94f818766ea53807aba76c4f617218065287e1c38a2cd386dafd6603734d7e794185952b6da4d66ba61f78a22aa49a5d22f84d2609eea110b6a7293b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.3.ver0x0000000000000001.db.CRYPT

Filesize
581KB

MD5
03d2b201f7c6d67be84a479a9067d4cb

SHA1
b64b62c9da5d874d1072be2f5fbacf45b5225312

SHA256
786c12f6b9df510f75209a7b5b5db44c907dba1725af627a748e1467d23cbb51

SHA512
7c206ab4cfffc5af62549eb5ea91141eb17d017d1a3cf8ab9d2e58cc9efc79e1715da19bbd314545181e2238b152efc1fcf09bdc54d112d8c3ac8addb1d98a0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db

Filesize
24B

MD5
2dd3f3c33e7100ec0d4dbbca9774b044

SHA1
b254d47f2b9769f13b033cae2b0571d68d42e5eb

SHA256
5a00cc998e0d0285b729964afd20618cbaecfa7791fecdb843b535491a83ae21

SHA512
c719d8c54a3a749a41b8fc430405db7fcde829c150f27c89015793ca06018ad9d6833f20ab7e0cfda99e16322b52a19c080e8c618f996fc8923488819e6e14bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db

Filesize
1024KB

MD5
6ffb9c9c47f62d2ae2d120c507267f88

SHA1
6d42a4a714904dc1fc686206f851162f5daee0cf

SHA256
39408c62bab46c6f9cdda4587b578de6ebe6db6344505f03a84b48546652fb4b

SHA512
46e06382aa3a178b05bf0b7c9c5e1fc9bf7a029fcdd045747716faedcbe6c400d2783601e64f5fd9917fadd28eec60891fd86e6e7ed9469522dcf3d5282de06f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db

Filesize
24B

MD5
635e15cb045ff4cf0e6a31c827225767

SHA1
f1eaaa628678441481309261fabc9d155c0dd6cb

SHA256
67219e5ad98a31e8fa8593323cd2024c1ca54d65985d895e8830ae356c7bdf1d

SHA512
81172ae72153b24391c19556982a316e16e638f5322b11569d76b28e154250d0d2f31e83e9e832180e34add0d63b24d36dd8a0cee80e8b46d96639bff811fa58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db

Filesize
24B

MD5
f6b463be7b50f3cc5d911b76002a6b36

SHA1
c94920d1e0207b0f53d623a96f48d635314924d2

SHA256
16e4d1b41517b48ce562349e3895013c6d6a0df4fcffc2da752498e33c4d9078

SHA512
4d155dfedd3d44edfbbe7ac84d3e81141d4bb665399c2a5cf01605c24bd12e6faf87bb5b666ea392e1b246005dfabde2208ed515cd612d34bac7f965fd6cc57e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db

Filesize
24B

MD5
2d84ad5cfdf57bd4e3656bcfd9a864ea

SHA1
b7b82e72891e16d837a54f94960f9b3c83dc5552

SHA256
d241584a3fd4a91976fafd5ec427e88f6e60998954dec39e388af88316af3552

SHA512
0d9bc1ee51a4fb91b24e37f85afbf88376c88345483d686c6cff84066544287c98534aa701d7d4d52e53f10a3bea73ee8bc38d18425fde6d66352f8b76c0cbb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db

Filesize
24B

MD5
60476a101249aedff09a43e047040191

SHA1
de5b6a0adc7de7180e19286cf0f13567278cdb64

SHA256
35bc77a06bfdde8c8f3a474c88520262b88c7b8992ee6b2d5cf41dddc77a83fb

SHA512
f1d2dcc562a36434c6c6405ec4eac7ecfa76fc5a940114da6f94495b77584a132d5d82ad3556df749490be096cfd238fa8b484b7c734cbc4d074e963e5d451f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db

Filesize
1024KB

MD5
7b6bac5e191c03a00b5f414359e09094

SHA1
e603ee57b71573a9c9b6ad915451ef19dd58007f

SHA256
23494a4e256613696f944986e7cad4078b9877cb847fe5ff606dc01fb6069a68

SHA512
77bf0a11c5d5e80e262aa236d1c01f1d27f1f8e671b306da9f553e7204f3c4a4ff7637024437fc3639fae5df6a30270f6a58ec519c48a85d65ed1583d37a312f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db

Filesize
1024KB

MD5
45780e7a7272a93d79ffcb62299ac764

SHA1
35269860aa2fc01b004ef58c7f28daca783b06bb

SHA256
d5e9a5186a2f800e2e34b083c7d24ffe57d48a7044b18a479420b624e7a28c59

SHA512
e9debfdc7badd8b88c4bb155071c58ec0a020a92d329e616916e1d52abc0c7e4b218005cdf4b26fcd150f1e993c77d5c1f37445b8a056e38575e1e494858b5d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db

Filesize
1024KB

MD5
759bc2c183a55d13dae3702b2cbd81ce

SHA1
a70e15dc7fc8702cbc1fd4bc16529cacdbc4c399

SHA256
5cdbd06a09ffe5ce16c338830549b9953578c0c3f0dcffe99939151294949579

SHA512
57a03015136b7c68c66ebd1d57482e90e1f043ad226c70cd6223f27517375a88b828ebb3f338282b8c227ac661211cc6d1e635ac6c7c5fce0f792f49105363d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db

Filesize
24B

MD5
c7c6abfa9cb508f7fc178d4045313a94

SHA1
4f130f23896bd6d0e95f2a42b2cb83d17ac8f1a2

SHA256
1bda9f0aed80857d43c9329457f28b1ca29f736a0c539901e1ba16a909eb07b4

SHA512
9f1c1e438b8cceda02663a61a64c1c5fc6fb6238aa92d30e6d8d1a7b0cb29a8a6f26b63b9964ad876617f71ee7dc3c05205158c4ed4be327149652b1c6900825

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db

Filesize
24B

MD5
d192f7c343602d02e3e020807707006e

SHA1
82259c6cb5b1f31cc2079a083bc93c726bfc4fbf

SHA256
bb4d233c90bdbee6ef83e40bff1149ea884efa790b3bef496164df6f90297c48

SHA512
aec90cf52646b5b0ef00ceb2a8d739befe456d08551c031e8dec6e1f549a6535c1870adb62eec0a292787ae6a7876388dd1b2c884cba8cc6e2d7993790102f43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db

Filesize
24B

MD5
2a8875d2af46255db8324aad9687d0b7

SHA1
7a066fa7b69fb5450c26a1718b79ad27a9021ca9

SHA256
54097cccae0cfce5608466ba5a5ca2a3dfeac536964eec532540f3b837f5a7c7

SHA512
2c39f05a4dffd30800bb7fbb3ff2018cf4cc96398460b7492f05ce6afd59079fd6e3eb7c4f8384a35a954a22b4934c162a38534ad76cfb2fd772bcf10e211f7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db

Filesize
24B

MD5
f732bf1006b6529cffba2b9f50c4b07f

SHA1
d3e8d4af812bbc4f4013c53c4ffab992d1d714e3

SHA256
77739084a27cb320f208ac1927d3d9c3cac42748dbdf6229684ef18352d95067

SHA512
064d56217aeb2980a3bfaa1e252404613624d600c3a08b5cf0adcb259596a1c60ee903fdc2650972785e5ae9b7b51890ded01ec4da7b4de94ebda08aeaf662df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db

Filesize
24B

MD5
fc94fe7bd3975e75cefad79f5908f7b3

SHA1
78e7da8d08e8898e956521d3b1babbf6524e1dca

SHA256
ee1ed3b49720b22d5fda63d3c46d62a96ca8838c76ab2d2f580b1e7745521aa5

SHA512
4ceaf9021b30734f4ce8b4d4a057539472e68c0add199cf9c3d1c1c95320da3884caf46943fc9f7281607ab7fa6476027860ebed8bbaa9c44b3f4056b5e074d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
7KB

MD5
dc5b3ce252f2b233958f03ea3bb12a07

SHA1
6d91575f8da4e1f407c7082c538af24544adac2a

SHA256
8316147893d16addd1cf077df64b9d227a69886e842ac828cd2bfb8c591471e5

SHA512
a3574ef68d6270eab20c77b71c9d4e7eb775599dc382eef4376fb196e044168633cacbdfe6c88363edb72b2a7c936e8f4abe47857b2c790024478e6ddceaa0c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
7KB

MD5
41659524fca209ee0ba331727242757c

SHA1
b46fe38554f05a2653b6ac0cccc1b41d0bb077ba

SHA256
c0c2a7b07d1b873afa0cdd89abe0f04c621d2fe9fd6880fac9f84e7de022198c

SHA512
8cb8e90342966b7ef6498231719673465ed1f78d59a826668c420af20e037a0a58ff083791e90bb4c06c16a18c629f69be20e164e89390a1713e36b89687f567

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db

Filesize
24B

MD5
379523b9f5d5b954e719b664846dbf8f

SHA1
930823ec80b85edd22baf555cad21cdf48f066aa

SHA256
3c9002caedf0c007134a7e632c72588945a4892b6d7ad3977224a6a5a7457bf4

SHA512
eca44de86bbc3309fa6eab400154d123dcd97dc1db79554ce58ce2426854197e2365f5eee42bac6e6e9455561b206f592e159ef82faf229212864894e6021e98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db

Filesize
24B

MD5
5f243bf7cc0a348b6d31460a91173e71

SHA1
5696b34625f027ec01765fc2be49efcfd882bf8e

SHA256
1b1aed169f2acfae4cf230701bda91229cb582ff2ce29a413c5b8fe3b890d289

SHA512
9e08dfbbf20668b86df696a0d5969e04e6ee4a67e997ff392099bc7ff184b1b8965502215744be7fe423668b69099242bba54df3f0bfe4e70acdc7cad8195b02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db

Filesize
24B

MD5
db7c049e5e4e336d76d5a744c28c54c8

SHA1
a4db9c8586b9e4fa24416eb0d00f06a9ebd16b02

SHA256
e8830e7ac4088cf3dd464caec33a0035d966a7de5ae4efc3580d59a41916ff7b

SHA512
b614037fb1c7d19d704bf15f355672114d25080223e7ee4424ad2cb7b89782219e7877b373bbc7fa44f3ad8df8a27eef4e8ccc765d44ec02a61e3b7fae88ae69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db

Filesize
1024KB

MD5
a4288fea9a6b7e9b6447d6a4b531072d

SHA1
2ff369fa6cd13ad30da848117d0df8a963fcbce8

SHA256
bbbfeea6fe327fe6da3ae235a1ba2361b6cd5af8893a7f9111deb649d55151da

SHA512
f443ab7ef2de43f4cc633c64050f032f58fc360b9c70e600195409b4325af8fe7d09b931e65bcaca05d6b82fbdefbfa59d1b7a164d699e2b439a0a0321ce622d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db

Filesize
1024KB

MD5
e0b4b6cd8300a2a528869a1eaee4ef18

SHA1
21c2d348732c5d2b3c170cbb9ea16dd921b5b529

SHA256
fa0a32639b38bda273e8e0c48880255d0df984b82de69186781e8a4384f10553

SHA512
ab3276615424cd83e614909342c98cf12359946506c06c63778da4eadc9044735098cae09c8b27c453da755b18b13483795f25ea36d490282e9a2bdba6b48b62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db

Filesize
1024KB

MD5
aef80bf744e6d4e0ca410ba2e1354661

SHA1
fa115e023407b4ce58594a07981cf2c73855f480

SHA256
e1ae4ec759b729cba4528cda7db25f2c9b092751a18e73068d4497ac6397c671

SHA512
544969adaa9f6375ac8d3cb84580941009c6fe6bd9ac13e6a7e5f13502f8207fd0dda7f4c754494a68f92f912a2563d374bd1e5b82a08b4f8141009bae1d7489

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db

Filesize
24B

MD5
ae6fbded57f9f7d048b95468ddee47ca

SHA1
c4473ea845be2fb5d28a61efd72f19d74d5fc82e

SHA256
d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9

SHA512
f119d5ad9162f0f5d376e03a9ea15e30658780e18dd86e81812dda8ddf59addd1daa0706b2f5486df8f17429c2c60aa05d4f041a2082fd2ec6ea8cc9469fade3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db

Filesize
7KB

MD5
7f79f61e3ff6a59b0db4cbb97de9bbdd

SHA1
26819071c87210e61e71881af7b4ac1f335969f3

SHA256
83788b4a8d8981d0d5771db2250b293c1fd0338fee5c9e4cd9b5108de95fece8

SHA512
6a8ceda4f55a0c04482468f7666b83f5c4acf4dc6059fb347b766f26a1d6958a447e71bfa54cdcc25c2371fcc381fdbc4f3ead7918b08c2786c30e5dbf6348c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db

Filesize
7KB

MD5
afa1c81fdf519671eec3d477c5d9bfe5

SHA1
b8682eda8f23bf9cf128d9cfb2a7e2de10f14202

SHA256
586efb0b167c2c68bdf84b2d72e4c3be460fe6167289f518f5ff54cf4858a381

SHA512
01832dabdc7a3ec60b158407a264e3c5276e070fa3fcb217f2c03ca2661f09bb341f34350102e9c61a6660bab3d0e70b030dead66d8ba0f2558d54282bb91285

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\0ZZTQJ8I\microsoft.windows[1].xml

Filesize
97B

MD5
608648b4bcbc5b9a88c9a861fb64b015

SHA1
7f4e5adb59a292229cd308e47cf82590c15ece7c

SHA256
a9592cc61381a49f6584e75892c707aee1f5f540dfe3cb6237e4a47377a079a3

SHA512
d5211919c32643a9530d5dfb0a8f9fe410e5a11c2d8e9487580558518be25113b8a89febfc304e7b624858f968f5e12d02b4da7a4a45eaabd8e264cd2e6b1972

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{52395f06-aec5-47cf-987c-801031ad5bc8}\0.1.filtertrie.intermediate.txt

Filesize
5B

MD5
f6a6263167c92de8644ac998b3c4e4d1

SHA1
c1fe3a7b487f66a6ac8c7e4794bc55c31b0ef403

SHA256
11770b3ea657fe68cba19675143e4715c8de9d763d3c21a85af6b7513d43997d

SHA512
232d43e52834558e9457b0901ee65c86196bf8777c8ff4fc61fdd5e69fd1d24f964fed1bf481b6ef52a69d17372554fecb098fb07f839e64916bdd0d2abf018a

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-1453213197-474736321-1741884505-1000\desktop.ini

Filesize
129B

MD5
a526b9e7c716b3489d8cc062fbce4005

SHA1
2df502a944ff721241be20a9e449d2acd07e0312

SHA256
e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

SHA512
d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

Download Submit
memory/1488-17726-0x0000000002B70000-0x0000000002B80000-memory.dmp

Filesize
64KB

Download
memory/1488-17741-0x0000000002B70000-0x0000000002B80000-memory.dmp

Filesize
64KB

Download
memory/1488-17722-0x0000000002B70000-0x0000000002B80000-memory.dmp

Filesize
64KB

Download
memory/1488-17724-0x0000000002B70000-0x0000000002B80000-memory.dmp

Filesize
64KB

Download
memory/1488-17725-0x0000000002B70000-0x0000000002B80000-memory.dmp

Filesize
64KB

Download
memory/1488-17727-0x0000000002B70000-0x0000000002B80000-memory.dmp

Filesize
64KB

Download
memory/1488-17698-0x00000000022D0000-0x00000000022D1000-memory.dmp

Filesize
4KB

Download
memory/1488-17730-0x0000000002B70000-0x0000000002B80000-memory.dmp

Filesize
64KB

Download
memory/1488-17732-0x0000000002B70000-0x0000000002B80000-memory.dmp

Filesize
64KB

Download
memory/1488-17734-0x0000000002B70000-0x0000000002B80000-memory.dmp

Filesize
64KB

Download
memory/1488-17733-0x0000000002B70000-0x0000000002B80000-memory.dmp

Filesize
64KB

Download
memory/1488-17731-0x0000000002B70000-0x0000000002B80000-memory.dmp

Filesize
64KB

Download
memory/1488-17735-0x0000000002B70000-0x0000000002B80000-memory.dmp

Filesize
64KB

Download
memory/1488-17739-0x0000000002B70000-0x0000000002B80000-memory.dmp

Filesize
64KB

Download
memory/1488-17738-0x0000000002B70000-0x0000000002B80000-memory.dmp

Filesize
64KB

Download
memory/1488-17740-0x0000000002B70000-0x0000000002B80000-memory.dmp

Filesize
64KB

Download
memory/1488-17721-0x0000000002B70000-0x0000000002B80000-memory.dmp

Filesize
64KB

Download
memory/1488-17719-0x0000000002990000-0x00000000029A0000-memory.dmp

Filesize
64KB

Download
memory/4000-17300-0x0000000001380000-0x0000000001381000-memory.dmp

Filesize
4KB

Download
memory/4804-17767-0x000002AE63A00000-0x000002AE63B00000-memory.dmp

Filesize
1024KB

Download
memory/4804-17766-0x000002AE63A00000-0x000002AE63B00000-memory.dmp

Filesize
1024KB

Download
memory/4804-17774-0x000002AE63FE0000-0x000002AE64000000-memory.dmp

Filesize
128KB

Download
memory/4804-17768-0x000002AE63A00000-0x000002AE63B00000-memory.dmp

Filesize
1024KB

Download
memory/4804-17798-0x000002AE64300000-0x000002AE64320000-memory.dmp

Filesize
128KB

Download