Overview
overview
10Static
static
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows11-21h2-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows11-21h2-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows11-21h2-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows11-21h2-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows11-21h2-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows11-21h2-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows11-21h2-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows11-21h2-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows11-21h2-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows11-21h2-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows11-21h2-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows11-21h2-x64
10Ransomware...KB.exe
windows10-2004-x64
7Ransomware...KB.exe
windows11-21h2-x64
7Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows11-21h2-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows11-21h2-x64
10Ransomware...KB.exe
windows10-2004-x64
9Ransomware...KB.exe
windows11-21h2-x64
9Resubmissions
30/11/2025, 12:12
251130-pc6htsvpft1030/11/2025, 12:00
251130-n6lvvahl711009/11/2025, 19:58
251109-ypxk5asqhm1006/11/2025, 21:43
251106-1kxrfatrhp1003/11/2025, 21:39
251103-1hxzesak9z1004/10/2025, 20:19
251004-y355es1qy91009/04/2025, 13:37
250409-qwzeas1rx931/03/2025, 05:19
250331-fz687stwdz31/03/2025, 05:18
250331-fzse2swn1331/03/2025, 05:18
250331-fzmvkawnz8Analysis
- max time kernel
300s - max time network
203s - platform
windows10-2004_x64 - resource
win10v2004-20251016-en - resource tags
arch:x64arch:x86image:win10v2004-20251016-enlocale:en-usos:windows10-2004-x64system - submitted
30/11/2025, 12:12
Static task
static1
14 signatures
Behavioral task
behavioral1
Sample
RansomwareSamples/Avaddon_09_06_2020_1054KB.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
16 signatures
300 seconds
Behavioral task
behavioral2
Sample
RansomwareSamples/Avaddon_09_06_2020_1054KB.exe
Resource
win11-20251015-en
windows11-21h2-x64
16 signatures
300 seconds
Behavioral task
behavioral3
Sample
RansomwareSamples/Avos_18_07_2021_403KB.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
5 signatures
300 seconds
Behavioral task
behavioral4
Sample
RansomwareSamples/Avos_18_07_2021_403KB.exe
Resource
win11-20250619-en
windows11-21h2-x64
11 signatures
300 seconds
Behavioral task
behavioral5
Sample
RansomwareSamples/Babik_04_01_2021_31KB.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
19 signatures
300 seconds
Behavioral task
behavioral6
Sample
RansomwareSamples/Babik_04_01_2021_31KB.exe
Resource
win11-20251015-en
windows11-21h2-x64
20 signatures
300 seconds
Behavioral task
behavioral7
Sample
RansomwareSamples/Babuk_20_04_2021_79KB.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
13 signatures
300 seconds
Behavioral task
behavioral8
Sample
RansomwareSamples/Babuk_20_04_2021_79KB.exe
Resource
win11-20251015-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral9
Sample
RansomwareSamples/BlackKingdom_23_03_2021_12460KB.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
7 signatures
300 seconds
Behavioral task
behavioral10
Sample
RansomwareSamples/BlackKingdom_23_03_2021_12460KB.exe
Resource
win11-20251015-en
windows11-21h2-x64
7 signatures
300 seconds
Behavioral task
behavioral11
Sample
RansomwareSamples/BlackMatter_02_08_2021_67KB.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
11 signatures
300 seconds
Behavioral task
behavioral12
Sample
RansomwareSamples/BlackMatter_02_08_2021_67KB.exe
Resource
win11-20250619-en
windows11-21h2-x64
10 signatures
300 seconds
Behavioral task
behavioral13
Sample
RansomwareSamples/Conti_22_12_2020_186KB.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
14 signatures
300 seconds
Behavioral task
behavioral14
Sample
RansomwareSamples/Conti_22_12_2020_186KB.exe
Resource
win11-20251015-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral15
Sample
RansomwareSamples/Cuba_08_03_2021_1130KB.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
6 signatures
300 seconds
Behavioral task
behavioral16
Sample
RansomwareSamples/Cuba_08_03_2021_1130KB.exe
Resource
win11-20251015-en
windows11-21h2-x64
6 signatures
300 seconds
Behavioral task
behavioral17
Sample
RansomwareSamples/DarkSide_18_11_2020_17KB.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
13 signatures
300 seconds
Behavioral task
behavioral18
Sample
RansomwareSamples/DarkSide_18_11_2020_17KB.exe
Resource
win11-20250610-en
windows11-21h2-x64
13 signatures
300 seconds
Behavioral task
behavioral19
Sample
RansomwareSamples/DearCry_13_03_2021_1292KB.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
18 signatures
300 seconds
Behavioral task
behavioral20
Sample
RansomwareSamples/DearCry_13_03_2021_1292KB.exe
Resource
win11-20250619-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral21
Sample
RansomwareSamples/Hades_29_03_2021_1909KB.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
8 signatures
300 seconds
Behavioral task
behavioral22
Sample
RansomwareSamples/Hades_29_03_2021_1909KB.exe
Resource
win11-20251015-en
windows11-21h2-x64
8 signatures
300 seconds
Behavioral task
behavioral23
Sample
RansomwareSamples/LockBit_14_02_2021_146KB.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
37 signatures
300 seconds
Behavioral task
behavioral24
Sample
RansomwareSamples/LockBit_14_02_2021_146KB.exe
Resource
win11-20251015-en
windows11-21h2-x64
27 signatures
300 seconds
Behavioral task
behavioral25
Sample
RansomwareSamples/MAKOP_27_10_2020_115KB.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
5 signatures
300 seconds
Behavioral task
behavioral26
Sample
RansomwareSamples/MAKOP_27_10_2020_115KB.exe
Resource
win11-20251015-en
windows11-21h2-x64
5 signatures
300 seconds
Behavioral task
behavioral27
Sample
RansomwareSamples/MedusaLocker_24_04_2020_661KB.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
16 signatures
300 seconds
Behavioral task
behavioral28
Sample
RansomwareSamples/MedusaLocker_24_04_2020_661KB.exe
Resource
win11-20251015-en
windows11-21h2-x64
16 signatures
300 seconds
Behavioral task
behavioral29
Sample
RansomwareSamples/MountLocker_20_11_2020_200KB.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
13 signatures
300 seconds
Behavioral task
behavioral30
Sample
RansomwareSamples/MountLocker_20_11_2020_200KB.exe
Resource
win11-20250502-en
windows11-21h2-x64
20 signatures
300 seconds
Behavioral task
behavioral31
Sample
RansomwareSamples/Nefilim_31_08_2020_3061KB.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
1 signatures
300 seconds
Behavioral task
behavioral32
Sample
RansomwareSamples/Nefilim_31_08_2020_3061KB.exe
Resource
win11-20250619-en
windows11-21h2-x64
1 signatures
300 seconds
General
- Target RansomwareSamples/DearCry_13_03_2021_1292KB.exe
- Size 1.3MB
- Sample251130-pc6htsvpft
- SHA256 2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff
- MD5 0e55ead3b8fd305d9a54f78c7b56741a
- SHA1 f7b084e581a8dcea450c2652f8058d93797413c3
- SHA512 5c3d58d1001dce6f2d23f33861e9c7fef766b7fe0a86972e9f1eeb70bfad970b02561da6b6d193cf24bc3c1aaf2a42a950fa6e5dff36386653b8aa725c9abaaa
- SSDEEP 24576:LU5NX2yJOiUXmEICxu2WAP0NIzkQM+KpPRQ9StIUDpl1fpxkHVZgMCS+:L7XP7P9o5QzUtl1fpxkHVZgMC3
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Path
-
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\readme.txt
-
dearcry
Ransom Note
- Your file has been encrypted! If you want to decrypt, please contact us. [email protected] or [email protected] And please send me the following hash! 638428e5021d4ae247b21acf9c0bf6f6
Signatures
- DearCry
DearCry is a ransomware first seen after the 2021 Microsoft Exchange hacks.
- Dearcry family
- Renames multiple (7650) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 61 IoCs
description ioc Process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Public\Documents\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Public\Music\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Admin\Videos\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Public\Videos\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Public\Pictures\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini explorer.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Admin\Links\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-635849552-4224125634-3671944134-1000\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-635849552-4224125634-3671944134-1000\desktop.ini explorer.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-635849552-4224125634-3671944134-1000\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Public\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Public\Libraries\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files (x86)\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Public\Desktop\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\$RECYCLE.BIN\S-1-5-21-635849552-4224125634-3671944134-1000\desktop.ini explorer.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Admin\Music\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Admin\Documents\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Admin\Searches\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files\desktop.ini DearCry_13_03_2021_1292KB.exe File opened for modification C:\Users\Public\Downloads\desktop.ini DearCry_13_03_2021_1292KB.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\text_2x.png.CRYPT DearCry_13_03_2021_1292KB.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_bho.dll.CRYPT DearCry_13_03_2021_1292KB.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.CRYPT DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\msedgeupdateres_as.dll DearCry_13_03_2021_1292KB.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\PresentationFramework.resources.dll.CRYPT DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\manifests\BuiltinTranslator.xml DearCry_13_03_2021_1292KB.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\bun.png.CRYPT DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Client.resources.dll DearCry_13_03_2021_1292KB.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\System.Windows.Forms.resources.dll.CRYPT DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-400_contrast-black.png DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailSmallTile.scale-125.png DearCry_13_03_2021_1292KB.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\ui-strings.js.CRYPT DearCry_13_03_2021_1292KB.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\ui-strings.js.CRYPT DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\jscripts\wefgallerywinrt.js DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailLargeTile.scale-100.png DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-64.png DearCry_13_03_2021_1292KB.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\tr-tr\ui-strings.js.CRYPT DearCry_13_03_2021_1292KB.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png.CRYPT DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat DearCry_13_03_2021_1292KB.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.IsolatedStorage.dll.CRYPT DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.scale-400_contrast-white.png DearCry_13_03_2021_1292KB.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeXMP.dll.CRYPT DearCry_13_03_2021_1292KB.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\uk-ua\ui-strings.js.CRYPT DearCry_13_03_2021_1292KB.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClient.resources.dll.CRYPT DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationProvider.resources.dll DearCry_13_03_2021_1292KB.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-140.png.CRYPT DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteMediumTile.scale-125.png DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarMediumTile.scale-125.png DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-32_altform-lightunplated.png DearCry_13_03_2021_1292KB.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.Common.dll.CRYPT DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MedTile.scale-200_contrast-black.png DearCry_13_03_2021_1292KB.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.Overlapped.dll.CRYPT DearCry_13_03_2021_1292KB.exe File created C:\Program Files\Microsoft Office\root\rsod\proof.fr-fr.msi.16.fr-fr.boot.tree.dat.CRYPT DearCry_13_03_2021_1292KB.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ru-ru\ui-strings.js.CRYPT DearCry_13_03_2021_1292KB.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner-4x.png.CRYPT DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\uk-ua\ui-strings.js DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Metadata.dll DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\WindowsAccessBridge-64.dll DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.scale-150.png DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyView.scale-150.png DearCry_13_03_2021_1292KB.exe File created C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\WEBRESOURCES\RESOURCE0\STATIC\JS\PLUGINS\DESKTOP-CONNECTOR-FILES\JS\NLS\NL-NL\readme.txt DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-gb\ui-strings.js DearCry_13_03_2021_1292KB.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Primitives.dll.CRYPT DearCry_13_03_2021_1292KB.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\BRANDING.XML.CRYPT DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\WideLogo.scale-125_contrast-white.png DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\AppxManifest.xml DearCry_13_03_2021_1292KB.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\it-it\ui-strings.js.CRYPT DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\plugin.js DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7ES.DLL DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters\msgfilt.dll DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-tw\ui-strings.js DearCry_13_03_2021_1292KB.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\Microsoft.VisualBasic.Forms.resources.dll DearCry_13_03_2021_1292KB.exe File created C:\Program Files\Microsoft Office\root\Office16\WebView2Loader.dll.CRYPT DearCry_13_03_2021_1292KB.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe.CRYPT DearCry_13_03_2021_1292KB.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ko-kr\ui-strings.js.CRYPT DearCry_13_03_2021_1292KB.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DearCry_13_03_2021_1292KB.exe - Checks SCSI registry key(s) 3 TTPs 58 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "411" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR fr-FR Locale Handler" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "L1041" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR it-IT Lookup Lexicon" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "spell=NativeSupported; cardinal=GlobalSupported; ordinal=NativeSupported; date=GlobalSupported; time=GlobalSupported; telephone=NativeSupported; computer=NativeSupported; address=NativeSupported; currency=NativeSupported; message=NativeSupported; url=NativeSupported; alphanumeric=NativeSupported" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "1" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR es-ES Lts Lexicon" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\fr-FR-N\\L1036" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Julie" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Ayumi" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{C6FABB24-E332-46FB-BC91-FF331B2D51F0}" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "- 0001 ! 0002 & 0003 , 0004 . 0005 ? 0006 _ 0007 1 0008 2 0009 aa 000a ae 000b ah 000c ao 000d aw 000e ax 000f ay 0010 b 0011 ch 0012 d 0013 dh 0014 eh 0015 er 0016 ey 0017 f 0018 g 0019 h 001a ih 001b iy 001c jh 001d k 001e l 001f m 0020 n 0021 ng 0022 ow 0023 oy 0024 p 0025 r 0026 s 0027 sh 0028 t 0029 th 002a uh 002b uw 002c v 002d w 002e y 002f z 0030 zh 0031" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{2984A9DB-5689-43AD-877D-14999A15DD46}" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Ayumi - Japanese (Japan)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\lsr1040.lxa" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "- 0001 ! 0002 & 0003 , 0004 . 0005 ? 0006 _ 0007 ^ 0008 1 0009 2 000a ~ 000b : 000c a 000d aw 000e ax 000f ay 0010 b 0011 d 0012 ch 0013 eh 0014 eu 0015 ey 0016 f 0017 g 0018 h 0019 ih 001a iy 001b jh 001c k 001d l 001e m 001f n 0020 ng 0021 oe 0022 oh 0023 ow 0024 oy 0025 p 0026 pf 0027 r 0028 s 0029 sh 002a t 002b ts 002c ue 002d uh 002e uw 002f uy 0030 v 0031 x 0032 y 0033 z 0034 zh 0035" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR de-DE Lookup Lexicon" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Hedda - German (Germany)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech SW Voice Activation - English (United States)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\fr-FR\\MSTTSLocfrFR.dat" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Vous avez sélectionné %1 comme voix par défaut." SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\ja-JP-N\\L1041" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\it-IT\\M1040Elsa" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{6BFCACDC-A6A6-4343-9CF6-83A83727367B}" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\AI041033" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "L3082" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = 49553b76dbc112bcd96e2ce32f82aa3750d88abb05779f5fac65e84c5363077e SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "134051260179102067" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "804" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "French Phone Converter" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "40A;C0A" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "436;41c;401;801;c01;1001;1401;1801;1c01;2001;2401;2801;2c01;3001;3401;3801;3c01;4001;42b;42c;82c;42d;423;402;455;403;c04;1004;1404;41a;405;406;465;413;813;809;c09;1009;1409;1809;1c09;2009;2409;2809;2c09;3009;3409;425;438;429;40b;80c;c0c;100c;140c;180c;456;437;807;c07;1007;1407;408;447;40d;439;40e;40f;421;410;810;44b;457;412;812;440;426;427;827;42f;43e;83e;44e;450;414;814;415;416;816;446;418;419;44f;c1a;81a;41b;424;80a;100a;140a;180a;1c0a;200a;240a;280a;2c0a;300a;340a;380a;3c0a;400a;440a;480a;4c0a;500a;430;441;41d;81d;45a;449;444;44a;41e;41f;422;420;820;443;843;42a;540a" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "You have selected %1 as the default voice." SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Laura" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "002D 002D 0021 0021 0026 0026 002C 002C 002E 002E 003F 003F 005F 005F 002B 002B 002A 002A 02C9 02C9 02CA 02CA 02C7 02C7 02CB 02CB 02D9 02D9 3000 3000 3105 3105 3106 3106 3107 3107 3108 3108 3109 3109 310A 310A 310B 310B 310C 310C 310D 310D 310E 310E 310F 310F 3110 3110 3111 3111 3112 3112 3113 3113 3114 3114 3115 3115 3116 3116 3117 3117 3118 3118 3119 3119 3127 3127 3128 3128 3129 3129 311A 311A 311B 311B 311C 311C 311D 311D 311E 311E 311F 311F 3120 3120 3121 3121 3122 3122 3123 3123 3124 3124 3125 3125 3126 3126" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "5218064" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Elsa" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\it-IT\\VoiceActivation_it-IT.dat" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "4398" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR Engine (11.0) Text Normalization" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Sie haben %1 als Standardstimme ausgewählt." SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "11.0.2016.0129" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech Recognition Engine - ja-JP Embedded DNN v11.1" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\ja-JP\\VoiceActivation_HW_ja-JP.dat" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "- 0001 ! 0002 & 0003 , 0004 . 0005 ? 0006 _ 0007 + 0008 * 0009 1 000A 2 000B 3 000C 4 000D 5 000E a 000F ai 0010 an 0011 ang 0012 ao 0013 ba 0014 bai 0015 ban 0016 bang 0017 bao 0018 bei 0019 ben 001A beng 001B bi 001C bian 001D biao 001E bie 001F bin 0020 bing 0021 bo 0022 bu 0023 ca 0024 cai 0025 can 0026 cang 0027 cao 0028 ce 0029 cen 002A ceng 002B cha 002C chai 002D chan 002E chang 002F chao 0030 che 0031 chen 0032 cheng 0033 chi 0034 chong 0035 chou 0036 chu 0037 chuai 0038 chuan 0039 chuang 003A chui 003B chun 003C chuo 003D ci 003E cong 003F cou 0040 cu 0041 cuan 0042 cui 0043 cun 0044 cuo 0045 da 0046 dai 0047 dan 0048 dang 0049 dao 004A de 004B dei 004C den 004D deng 004E di 004F dia 0050 dian 0051 diao 0052 die 0053 ding 0054 diu 0055 dong 0056 dou 0057 du 0058 duan 0059 dui 005A dun 005B duo 005C e 005D ei 005E en 005F er 0060 fa 0061 fan 0062 fang 0063 fei 0064 fen 0065 feng 0066 fo 0067 fou 0068 fu 0069 ga 006A gai 006B gan 006C gang 006D gao 006E ge 006F gei 0070 gen 0071 geng 0072 gong 0073 gou 0074 gu 0075 gua 0076 guai 0077 guan 0078 guang 0079 gui 007A gun 007B guo 007C ha 007D hai 007E han 007F hang 0080 hao 0081 he 0082 hei 0083 hen 0084 heng 0085 hong 0086 hou 0087 hu 0088 hua 0089 huai 008A huan 008B huang 008C hui 008D hun 008E huo 008F ji 0090 jia 0091 jian 0092 jiang 0093 jiao 0094 jie 0095 jin 0096 jing 0097 jiong 0098 jiu 0099 ju 009A juan 009B jue 009C jun 009D ka 009E kai 009F kan 00A0 kang 00A1 kao 00A2 ke 00A3 kei 00A4 ken 00A5 keng 00A6 kong 00A7 kou 00A8 ku 00A9 kua 00AA kuai 00AB kuan 00AC kuang 00AD kui 00AE kun 00AF kuo 00B0 la 00B1 lai 00B2 lan 00B3 lang 00B4 lao 00B5 le 00B6 lei 00B7 leng 00B8 li 00B9 lia 00BA lian 00BB liang 00BC liao 00BD lie 00BE lin 00BF ling 00C0 liu 00C1 lo 00C2 long 00C3 lou 00C4 lu 00C5 luan 00C6 lue 00C7 lun 00C8 luo 00C9 lv 00CA ma 00CB mai 00CC man 00CD mang 00CE mao 00CF me 00D0 mei 00D1 men 00D2 meng 00D3 mi 00D4 mian 00D5 miao 00D6 mie 00D7 min 00D8 ming 00D9 miu 00DA mo 00DB mou 00DC mu 00DD na 00DE nai 00DF nan 00E0 nang 00E1 nao 00E2 ne 00E3 nei 00E4 nen 00E5 neng 00E6 ni 00E7 nian 00E8 niang 00E9 niao 00EA nie 00EB nin 00EC ning 00ED niu 00EE nong 00EF nou 00F0 nu 00F1 nuan 00F2 nue 00F3 nuo 00F4 nv 00F5 o 00F6 ou 00F7 pa 00F8 pai 00F9 pan 00FA pang 00FB pao 00FC pei 00FD pen 00FE peng 00FF pi 0100 pian 0101 piao 0102 pie 0103 pin 0104 ping 0105 po 0106 pou 0107 pu 0108 qi 0109 qia 010A qian 010B qiang 010C qiao 010D qie 010E qin 010F qing 0110 qiong 0111 qiu 0112 qu 0113 quan 0114 que 0115 qun 0116 ran 0117 rang 0118 rao 0119 re 011A ren 011B reng 011C ri 011D rong 011E rou 011F ru 0120 ruan 0121 rui 0122 run 0123 ruo 0124 sa 0125 sai 0126 san 0127 sang 0128 sao 0129 se 012A sen 012B seng 012C sha 012D shai 012E shan 012F shang 0130 shao 0131 she 0132 shei 0133 shen 0134 sheng 0135 shi 0136 shou 0137 shu 0138 shua 0139 shuai 013A shuan 013B shuang 013C shui 013D shun 013E shuo 013F si 0140 song 0141 sou 0142 su 0143 suan 0144 sui 0145 sun 0146 suo 0147 ta 0148 tai 0149 tan 014A tang 014B tao 014C te 014D tei 014E teng 014F ti 0150 tian 0151 tiao 0152 tie 0153 ting 0154 tong 0155 tou 0156 tu 0157 tuan 0158 tui 0159 tun 015A tuo 015B wa 015C wai 015D wan 015E wang 015F wei 0160 wen 0161 weng 0162 wo 0163 wu 0164 xi 0165 xia 0166 xian 0167 xiang 0168 xiao 0169 xie 016A xin 016B xing 016C xiong 016D xiu 016E xu 016F xuan 0170 xue 0171 xun 0172 ya 0173 yan 0174 yang 0175 yao 0176 ye 0177 yi 0178 yin 0179 ying 017A yo 017B yong 017C you 017D yu 017E yuan 017F yue 0180 yun 0181 za 0182 zai 0183 zan 0184 zang 0185 zao 0186 ze 0187 zei 0188 zen 0189 zeng 018A zha 018B zhai 018C zhan 018D zhang 018E zhao 018F zhe 0190 zhei 0191 zhen 0192 zheng 0193 zhi 0194 zhong 0195 zhou 0196 zhu 0197 zhua 0198 zhuai 0199 zhuan 019A zhuang 019B zhui 019C zhun 019D zhuo 019E zi 019F zong 01A0 zou 01A1 zu 01A2 zuan 01A3 zui 01A4 zun 01A5 zuo 01A6" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "DebugPlugin" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "CC" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\de-DE-N\\lsr1031.lxa" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "L1033" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech SW Voice Activation - Spanish (Spain)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\fr-FR\\VoiceActivation_HW_fr-FR.dat" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "È stata selezionata la voce predefinita %1." SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{14E74C62-DC97-43B0-8F2F-581496A65D60}" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "1033" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\fr-FR-N\\AI041036" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\fr-FR\\M1036Julie" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\ja-JP\\sidubm.table" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-635849552-4224125634-3671944134-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4684 explorer.exe Token: SeCreatePagefilePrivilege 4684 explorer.exe Token: SeShutdownPrivilege 4684 explorer.exe Token: SeCreatePagefilePrivilege 4684 explorer.exe Token: SeShutdownPrivilege 4684 explorer.exe Token: SeCreatePagefilePrivilege 4684 explorer.exe Token: SeShutdownPrivilege 4684 explorer.exe Token: SeCreatePagefilePrivilege 4684 explorer.exe Token: SeShutdownPrivilege 4684 explorer.exe Token: SeCreatePagefilePrivilege 4684 explorer.exe Token: SeShutdownPrivilege 4684 explorer.exe Token: SeCreatePagefilePrivilege 4684 explorer.exe Token: SeShutdownPrivilege 4684 explorer.exe Token: SeCreatePagefilePrivilege 4684 explorer.exe Token: SeShutdownPrivilege 4684 explorer.exe Token: SeCreatePagefilePrivilege 4684 explorer.exe Token: SeShutdownPrivilege 4684 explorer.exe Token: SeCreatePagefilePrivilege 4684 explorer.exe Token: SeShutdownPrivilege 4684 explorer.exe Token: SeCreatePagefilePrivilege 4684 explorer.exe Token: SeShutdownPrivilege 4684 explorer.exe Token: SeCreatePagefilePrivilege 4684 explorer.exe Token: SeShutdownPrivilege 4684 explorer.exe Token: SeCreatePagefilePrivilege 4684 explorer.exe Token: SeShutdownPrivilege 4684 explorer.exe Token: SeCreatePagefilePrivilege 4684 explorer.exe Token: SeShutdownPrivilege 4684 explorer.exe Token: SeCreatePagefilePrivilege 4684 explorer.exe Token: SeShutdownPrivilege 4684 explorer.exe Token: SeCreatePagefilePrivilege 4684 explorer.exe Token: SeShutdownPrivilege 4684 explorer.exe Token: SeCreatePagefilePrivilege 4684 explorer.exe Token: SeShutdownPrivilege 4684 explorer.exe Token: SeCreatePagefilePrivilege 4684 explorer.exe Token: SeShutdownPrivilege 4684 explorer.exe Token: SeCreatePagefilePrivilege 4684 explorer.exe Token: SeShutdownPrivilege 4684 explorer.exe Token: SeCreatePagefilePrivilege 4684 explorer.exe Token: SeShutdownPrivilege 4684 explorer.exe Token: SeCreatePagefilePrivilege 4684 explorer.exe Token: SeShutdownPrivilege 4684 explorer.exe Token: SeCreatePagefilePrivilege 4684 explorer.exe Token: SeShutdownPrivilege 4684 explorer.exe Token: SeCreatePagefilePrivilege 4684 explorer.exe Token: SeShutdownPrivilege 4684 explorer.exe Token: SeCreatePagefilePrivilege 4684 explorer.exe Token: SeShutdownPrivilege 4684 explorer.exe Token: SeCreatePagefilePrivilege 4684 explorer.exe Token: SeShutdownPrivilege 4684 explorer.exe Token: SeCreatePagefilePrivilege 4684 explorer.exe Token: SeShutdownPrivilege 4684 explorer.exe Token: SeCreatePagefilePrivilege 4684 explorer.exe Token: SeShutdownPrivilege 4684 explorer.exe Token: SeCreatePagefilePrivilege 4684 explorer.exe Token: SeShutdownPrivilege 4684 explorer.exe Token: SeCreatePagefilePrivilege 4684 explorer.exe Token: SeShutdownPrivilege 4684 explorer.exe Token: SeCreatePagefilePrivilege 4684 explorer.exe Token: SeShutdownPrivilege 4684 explorer.exe Token: SeCreatePagefilePrivilege 4684 explorer.exe Token: SeShutdownPrivilege 4684 explorer.exe Token: SeCreatePagefilePrivilege 4684 explorer.exe Token: SeShutdownPrivilege 4684 explorer.exe Token: SeCreatePagefilePrivilege 4684 explorer.exe - Suspicious use of FindShellTrayWindow 59 IoCs
pid Process 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe - Suspicious use of SendNotifyMessage 28 IoCs
pid Process 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe 4684 explorer.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2684 StartMenuExperienceHost.exe 4684 explorer.exe 2144 SearchApp.exe 4684 explorer.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\DearCry_13_03_2021_1292KB.exe"C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\DearCry_13_03_2021_1292KB.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2300
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops desktop.ini file(s)
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4684
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:2684
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2144
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\rhp_world_icon_hover.png
- Size 388B
- SHA256 676d1f912a22a12ad4c80bf552355a7e0995c56e6ef7527aaa9b77e513efc065
- MD5 1dc5d31ef9205f1034b64d635d59cb32
- SHA1 c172576576c5ac5a3c2912bdfd0c8365b5365513
- SHA512 bc334638acb1416787df04cbaebde99cd15d96c5b96b6f950cbdfb54177fcd2f2ecce4dc9212a9a3f2f85269ac901aef147ec6297c31c5ee6cc39ee4cdac17c1
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\rhp_world_icon_2x.png
- Size 552B
- SHA256 2fcd2848cbcab1a3b8154138288cc659cd2c187412cb887eec6554b6165b8c33
- MD5 7d00bc0d46dcb90890a4fe6b76bc5c3a
- SHA1 7159b1e1c264a6863708a971eaeca32cff864aa1
- SHA512 2f113cb27028aa0fa0f028b09ddcddb4a1ede6ae0823909d99763db6e5be57b1b4ae6977537ec17808cd622bc548e1ba3122e35b58de9d856400d33042234a35
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\ui-strings.js
- Size 1KB
- SHA256 13370a65ca7e31fbf3a133156c208bf99c01a54880d55a8a4500495683e3a47f
- MD5 6e8d259daabf1168ae5136a3de48ee80
- SHA1 b015257e3ae0810ddbda53c0b12991161a863ffb
- SHA512 cf3c564c18c6b0965a431cda1ed8fa97cbeeb839d992e48f77c073bc8054ead03b4823df381c5179d3d398877da3473b92d70ae905a2bd0c7e5fc45505340113
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\ui-strings.js
- Size 1KB
- SHA256 c1ea4ada9462abd4ec352dfaf670575e9caff1e55d303db96a2f2500d50d92e8
- MD5 88151ac4ebd7f5ff2d381c65e68cece7
- SHA1 f979db4063d15ef2e32db3c38890899bb87c78e5
- SHA512 326195f5176beed6cc39849b8d6e87a5136c41a04aa76f53c30bbed1ff74391e16a6114e236f39d403c7f82fda032c00a9ee1df583412dfea224047e51f4c3bb
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\root\ui-strings.js
- Size 1KB
- SHA256 8ced84488e1ea81e8cc3ec1a25f5b849de902601bef557b6ec65f9de2982bece
- MD5 60f1a26612dc049ce3e00fe917b6475d
- SHA1 05791d089cbcd759088adbbd9483433dc9a10206
- SHA512 06f080a9df9081a2bfd557165f9c21cf2bce3ee161c0896a9f9a6e0f8a3ae545b1cfaaca9ce1d46757dbe0163ddd0421bdb51558ef092dd0a6e5c2052ead4706
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons.png
- Size 683B
- SHA256 3add439f478220ce8001abf2543810144a0d80f8116bc0ca13947c9745983c55
- MD5 ea321d33cfeb1d029794bd01c5b78e85
- SHA1 4e04b2d8f7f23f44f96f4bbf134233e1feb5e28b
- SHA512 f574d12330a668d89402265cf5a859a76325ed548e1730e02f51dfd36e3d5dccf2c8b75a76a8c931597bfc130a42364c73eef0200523d4eefbcf4fa5ccacddea
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons2x.png
- Size 1KB
- SHA256 03ab6f2f396e0531f1b1299b61485408cff93f183942910a7d0d5f0c7a666bd8
- MD5 a660ce180dea34b4944d83569f4789bc
- SHA1 e3ca7b90c8bd299c49585bd29bc3fb7494c0fa4e
- SHA512 9de185c0e6a8cc49852ebb454a00a7a19f5382b358327d393a6952b32099036147c1eb799cc60078bf24477e9607a1b4c88288a213a8ffcafd8d60caab0f0720
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\root\ui-strings.js
- Size 1KB
- SHA256 3b5888b652cd86408bdd59e86405d3f171d23132059228544fbe693cfcb2b73c
- MD5 cdc58b2bf0a1a34f96af8fdcb62dc30b
- SHA1 69eb0d674e9830e81cecdd610792225a2a5dc265
- SHA512 d8ef3220b8984f759347a0e83eb75939c914bf865db492d28e226f113b469a97325befa008886743aeae2e0f32c74c0a1e7ce8b60eaf5949b51058a618daa502
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png
- Size 445B
- SHA256 ba5a59d879c1f6543b46085d02f5c90fdb22e663487d3586b6533cd887c83b72
- MD5 55c2b47c9aea50661a855fe91eb8ac32
- SHA1 13ea23a51394ea2c13420ddac1294eae6f82f846
- SHA512 947da2e85f5c21e7847f10d727729915973c911a47de233ef1fb97f60ae41db05f4c8c0ee655e3aa264db2067763e4134b76279f1d3ea8ad43640a64176522a3
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png
- Size 611B
- SHA256 a90f0edb8324760029a5db9f641b05694f8717c25514b2d6abde7662c827e0cb
- MD5 808e7aedbb1da793b86c92816309035e
- SHA1 b4a2fca53290a35ae222f2cdf80f68ec7eab51e6
- SHA512 0af4e6a83661378b618c40de02c6cb7244be544dcb02f1f14c83b6abd791fa0330b6d508c86f0ba8e345608639d8505a2f26d3a6d3ae201bb01319c10c212d4a
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-il\ui-strings.js
- Size 1KB
- SHA256 019bad9e72430b758828953e3310007695c55fed1d25fdd707c76fec561f2bc5
- MD5 5c1dc195043bdea8525930a9882c10d7
- SHA1 17415e551255ab016f7682d7b33451cfcb91e687
- SHA512 e912b84e9b4856864d302154b68adf6822189aa78859265cf8f529279e77a9d7c086452b4527ebb75d9c910ad9a6a1e95e1f45498fc168628da80739acff742e
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected]
- Size 162B
- SHA256 e8c6ae3d3f05d53d58200db3f31383861d434c6abbf66f82e925321029058a10
- MD5 8db5f9dff9d857a8827ea6d66fea4880
- SHA1 ef5de087109543e49ee7fe70adb49efe27e15121
- SHA512 70723910b4bf8814f848e10390378d53d9fb67e8a319edb708edc41b5c858c1d2cfc0b86a2909e33f72062df8b32e70554fa5ebe7aad7ec474ad78087560069b
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\ui-strings.js
- Size 1KB
- SHA256 1265f683d27701f95b545e6201577fb4eadf5dcfbc1fc8cedb8dd39635515788
- MD5 4e6de5201d795432e75c0628dd306b26
- SHA1 80ae62145f6bc55c2a25f68ad9d6bc9fcae496db
- SHA512 950227253fb845bd9a4519a209d72404760492473bda8101d846ded18aef1a2f6f6ab99b1b1b2186c0eed423c151c089316e124384f214644632e6a0f4dbece3
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\tr-tr\ui-strings.js
- Size 856B
- SHA256 0e8fb0e6e1dd239a2a1996059914a5ec5e753782527c1a07c62d808eb77df3e0
- MD5 fc4cdc00064f47d2eedf58bd02068fe1
- SHA1 cbb7157d8c560e9b2cdffac3a2b831202d76d2e6
- SHA512 753d312596fdd24d3ad87b7916c5d108d185b42beff7c750099aecb38c7a321ff04260c19492d18cc27cf8f8843c6b3facde0934e67a46e9ce4291c3646abbe8
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ui-strings.js
- Size 1KB
- SHA256 5812ebbc6311c0ff9919a27137b22435cbca3cb9fd56959b44ddb82f93609b99
- MD5 c5596fa17e59cbf92a2ea2e1ad5c6f8b
- SHA1 4153a71b5750685afba568403ed7522e83a9894f
- SHA512 762580962300f0e0501054450772ed59cdfec76d7aa6b1944f557ccd74ec2fcd171ffd67765f2b367c526d0193eabd184f0d4ac1dadb7a0d25f00f9866f670bc
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\zh-cn\ui-strings.js
- Size 850B
- SHA256 1180e5728ff28a49eec43c61f15d49541419e79397ae58479db67b533d292d36
- MD5 26645133c9de7799e35cee0e47b82ee0
- SHA1 bb6be735f6814d765bbe6b3f3ce034d1767366c5
- SHA512 c466dc886b25fea5a0e16aec28a4e784afe797f3937c7863788d0e5fa41414346bb17546d49178a48815debcca50aec3acabadc1f508fe0a3207008bc722608e
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\main-selector.css
- Size 802B
- SHA256 aff85e66d5b690dc0188f4c2348ca78abdc14605286128407242a4e91a684754
- MD5 89728f1ec13231dd11d2ea20afe39d67
- SHA1 b4350cd128350483be389b2c865633bd1ae0f78b
- SHA512 58203e9c3898367c78c6d10fa629c0bd2356b2ae54e225afbcee83be1d5d297977a5a9633e773ffc2b8079a6e2eb2aa0afc530c27d29f512af40d8c9ae539adb
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_pattern_RHP.png
- Size 179B
- SHA256 d03f54aaa9216f4e32053928ce87a317341232f107140c84f73b2b6490b5a81a
- MD5 a93c09c1a326a8733b4eceb713ca7457
- SHA1 90ba7a4c24bb0d424abda46b736170ea3b43e541
- SHA512 432c3400257d00391baa255d32fd03e0b8c97231d684ef35534868a38bcbf9cb70b433eacfe154c25fd3376e69592a7000a823535700f353975572c5101a56af
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png
- Size 703B
- SHA256 e324ff224bfa2baf51d4ab75f686195a76b8c984676c450ed660eb9ca2b36f4e
- MD5 cc62ce00dfbe76fd8affad9c89fced8c
- SHA1 75d64cc57ff45a50c066f882bfd8e3845f8fa323
- SHA512 028056e42f0eb02646752b351bb04a6b9f87ff27a2e1060b4fe4d4867118fe90f42f555ea8c645361963405583005ec4f3802c7c57729fc8616df1af09cc94dd
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-gb\ui-strings.js
- Size 823B
- SHA256 152f6d0325802be61521bff49a8dd07063feaffeb2447d3ae6f47adf214cbffb
- MD5 fa904cdf440c6743078637992d58489f
- SHA1 6969f407be2a1b52c5a41be256433026cabf9917
- SHA512 c6237e56225d36d26ed594406a5bc08987bc34fac8d425dac8f909512ff19e6a27e1566651c591a38c0a5476e74dca09beb53ec15d4f08b6de2843fa064cbd3f
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ui-strings.js
- Size 1KB
- SHA256 ab2b7de642b66db6e6b610dab8fb3c94c972465e07b7f681127c40a6629d8c2e
- MD5 573dd292166f86741bb965ee068c3793
- SHA1 169fcf0880c7a2c5993f5bf28ff64cd9ed441dd9
- SHA512 0217d582d827a7b6faa950bc726d41c4c7644ba11b19689b9e5eb60cf54df4afaefcf4eac3649e8315dc1134988dc71abcb94bd9a640829bf9d68a6ffa17241b
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\ui-strings.js
- Size 924B
- SHA256 a8b45a4c0a3adae007e8ef6b3a0e9966d2ad0c552320210a778109e2799f6c75
- MD5 bf70043c03230a91bb5b402e7ee67e63
- SHA1 2ec8302c3ebe1e34abb5e0c813abceaadfc5073c
- SHA512 ecdf54cc56de9c49dec1e9e65aefa736201904e609474b13d089f188bf35ae46b62d1ba492f4c25ad3fd7ff584a1532be18c0115598c2deaa834b22e6e52a601
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\tr-tr\ui-strings.js
- Size 931B
- SHA256 efec14a7f219aff9e96c136933c0316abbabfa082b5755a86b2745c0a8423a79
- MD5 7adbce4bec815b574ab3fc6d85eb1937
- SHA1 7d14e52fc6aa5796996988e9feab97c31eab1e0b
- SHA512 4218fc7991ef7ab93b1fab696432fc0130f07c534b2da244ce3370e6092213db657505af8380e7a07576b16b19d7c1b58f6a5498122d73061a362162b31f5b18
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fi-fi\ui-strings.js
- Size 1KB
- SHA256 1beae6b25a652882189f27e3b52232bc3451a54eeedf3e5cb0eb827fe15032f9
- MD5 478f0065e127108d705114b29fb9170a
- SHA1 3d954983b0594275bdbe444336baad9517129b79
- SHA512 4affd4e7c23c555d99a5a1a4ff929228af723961c6cc1c320358998fbba2528e2d84d5c64a5c28fd6420ba3132fad056f2388538086d061510d80e244f7b3990
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\eu-es\ui-strings.js
- Size 851B
- SHA256 60624904ad10defbfcafa3acd5dac4c7c5040edde23bff489b6b32ea5a1403ad
- MD5 661fea8b99a08e2422d8b5b9bcfd9921
- SHA1 54a78f38a3599aed6d27c6fc711d7af7a205c524
- SHA512 69b58c6c99f494ca1b6f2788cd17b63cc9f583b0abca870f666aedb9c504f660b03df699b69828c8ecc43a747297042eeca7e197de96dd43defb7871e2289b9c
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\he-il\ui-strings.js
- Size 855B
- SHA256 cde2dda4b1709d6591356e21717833ecf9802dc119d719e9dbbc97b090158644
- MD5 3dd77972f6558af4969a57eb4f19f2d0
- SHA1 d56f6ebeaf408c667bb9491845a33ddc19d18947
- SHA512 68f15867e6b29cce5415ce31203cc3f1790869f85d1b1ba8b2912e9b1b570f61485e5e9aac96d9bcc069e81d298b56d8941cd94a1df72d07c7508c7fdcc7ef1b
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\hr-hr\ui-strings.js
- Size 849B
- SHA256 d3bdbdce059d04ec6e336179e6262bc694def0fcc5fe4b006953dbf178dbb30c
- MD5 95e6ecbe44dc4ab34323c697c6568b56
- SHA1 0ca5debc2a7b53245ae6b7d6594ba93b3152bdee
- SHA512 af6262bf0a2b16fbd1dff7051eb0373336781c105b63631080ed2b6d38f54adbdbd16d794917fb9ad08c9ee238e0d4df732b7ef3e4c6d521a6b347eb8c2e9804
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ru-ru\ui-strings.js
- Size 852B
- SHA256 bbce03b612d22d42e40207a0ac4b6492ab0ad8c2cf4690377929f4cad738954d
- MD5 4fcc8af63d8fea1581c1e96e9436e913
- SHA1 5c09be5c84dba1172a2503a3406223baed06f8bc
- SHA512 4bb1df7206f7fee79df361d678cd250399efff9d13d3435448170efd515abb425fcbf3b6ad9d0c6da1b4a7860d33dfd15daaa199e96dcdd701afb3b80234f2d6
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ko-kr\ui-strings.js
- Size 1KB
- SHA256 f054ff5e3f41e79c647bd03dc9ad1bad42f8292c7e7b839088faeb8abc182ff4
- MD5 21a5d65fbcf76ed1b8e9489d3bb051f7
- SHA1 dcfde89bb81642e0b1bcb2b4d8c0fe574e912950
- SHA512 566bc1f2c5f4b2b9888c8e414552c25609d2562e10a8abddf6f036a6cbe2bc7644cbe850311224c25db96380c0e11fb07800f965305f41e068968bee530c320a
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\root\ui-strings.js
- Size 1KB
- SHA256 f3a76de64a79cd7afa5438bb0a4f4330a97497246fe00f7b29fb690e2ffe32cd
- MD5 0e038344281f0aa0a74103dd77048888
- SHA1 163a5a2d3888eb23ecc17b53865742f3eb7aa3c1
- SHA512 5988b04142669c005728510cc0a0c7507a9b8561b9d3178e3ef06b77a725e5e3ab7c13faf2998522c601285e823d3f72edbe7b93ba6b14a9c5afefbacb974560
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sv-se\ui-strings.js
- Size 1KB
- SHA256 d30e4139d68728b1c0b7c0fdccf649fc98c269f0d57c08e1d2033c13f162c29a
- MD5 c4b091c93a4910ecfc619efdf3c56111
- SHA1 4147f571dfd1d77b6a6943c57784820bd0cba24c
- SHA512 b276ec16ba3a0737c8958a7373c3b5b53d384432535e65ee5651dce90da0eaf7dad1a02479243efb0b5ea78234c0f423ebc10c82b6e28db557106b8a21db1964
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\dd_arrow_small.png
- Size 289B
- SHA256 322fa7539ee1552758dbb051fe1199a7b4b247ec8335fb35cabf043d8947466d
- MD5 65afdbfd57a964a5525ef68ca68cb5f4
- SHA1 986fd9886e54eaa35b90561c94b00f85eb758711
- SHA512 88b2d9c205d6fa4fb7823fa118fb95c651977cbaf1b54445ced380d34541e5367a218de4335a341b3994839386b487fcc33718b749ab2e05678ae87e0da1dbd7
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\share_icons.png
- Size 1KB
- SHA256 dd6fda1bd17d115065254a8af134a7906d8e15e2725b01223582c3add3240272
- MD5 2870d12e27e8a50bf66493145c06939a
- SHA1 f4319fc28ae1f99e359b5cfbd4c8c69af67dc03e
- SHA512 39b2281464998cd9f3d87659cdf7f3f2690a82bb8093ac64d5141d837dd4f951514cf0fcbfc02a0102f3d8ce780805886a361c649d6df2347db60b383442e5d0
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\dark\adc_logo.png
- Size 1KB
- SHA256 b63bba00ed3b7a86b6ed36ab7d6eede57656454e0a583b875d34ee19466714e4
- MD5 d1dfee6d7b14e63f64c349b2cae8ad27
- SHA1 fd382215ff99c0993d8924f18ff7912b4835f4ad
- SHA512 220e189bc67b20bef3f92da6dd063b12fd53436c6fa9e728553669e4d42dbe595c52801e68a929797c48dc56fa4ff47919aa3d065363ce881e207abc83f7de77
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png
- Size 2KB
- SHA256 c46d21ff4c32097f172b4e99b5794374ed4a1cb025040d157f611f43929e98d5
- MD5 598b166da1d843121d50f9593073a15e
- SHA1 e41c87d8fa9aa263dfe783bdd692556fb8e24f43
- SHA512 107ceb56129c1baade5930cea77fdc9c53264ff06b92936a5823c483235ffce8ab4ca3efef5001c5cc16eb3351b663877e1e4184749ba33d785b4927fe2f2db1
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png
- Size 2KB
- SHA256 ff1d90818c6ec24ad8dc4334bed7e72b3ceb9460cdfe3b25ec24d2b31b4c9288
- MD5 48a2c150eaa7d9fe84e7e31163e67495
- SHA1 cfd5375b61328af47b784d2e1229c95c9355ce06
- SHA512 e6abeeb5ed043270c9148b58fa359d8536e0a9606aaed86446f3cc3ef14a855b711a86869d02fe27f50ef79b91895c77bc970c6ccf962caeb8311984c4778410
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png
- Size 385B
- SHA256 122650bd6eea6dc3c3cde5c472c78fe200967b33c6e3f3d2f394d8fb66c3acfe
- MD5 34300ee4cd847a5329747c2294699c1f
- SHA1 5e1086c8ebeaf9205517c82d8ae1711931ec48e1
- SHA512 ecea239cb49cc1b9018e9d5bc34fa0d501cd9dc6bd7a8c01b8a2bfe9cb8d9baf805081d3705f0f986903a93a35a3ddcb852463bc2698606b556999cd0608ad6e
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png
- Size 1003B
- SHA256 44f25bfcbff16b8e7c81ac93d6dcbc312035c81ba6d62e61d4177e23ef62dbff
- MD5 d82b1439dcd0ea62ce3edcf6d36eac1e
- SHA1 f5216b9a0c6b294584b24a5fd50b43e79d46310e
- SHA512 bc789786f1261ce50116190f56ce7da3063fb944af6e5da17fd0a61e51d3d25b11fc09a83d2fd1805e16f33c2c469bd28d05366b8fff7faa85d3dd498e5e3d1a
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png
- Size 2KB
- SHA256 c915635ac032617e1acf87810abd8e8d9825c7e40a74245bc9efcf31d6da9da9
- MD5 7d1b0ec51595563c9214ddfdec36f303
- SHA1 bbb988973a8281943b5bfacb8ab03d97c0f0f398
- SHA512 709deed649d6062cf8c1ada7207b9c871d51a69a4bc7dc3c1408bd6a38d211ff53ce19a091cc4bb68a62eb00aa512afd07a33d314393812716391f04faea93d3
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\ui-strings.js
- Size 840B
- SHA256 f49327d72a4888fee8721962d13a94571e349ba666a0e1354c4f49331e858cff
- MD5 ac24e253ff384d8523af43f5a93688f7
- SHA1 beb4ffa972185300803e9a1f6a16ec062cec1015
- SHA512 9c559a1bdaae9172fbe9e6a9b907390041fd16d0382a202423e0d9d19bb0f2c06a7228d6bc17df943d4e927c0420f302982e0463755bfd5c0d6e4ecb65504a61
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\ui-strings.js
- Size 1KB
- SHA256 ef97178fce43f78773e1c57cebaadd55904a1e5d810f8f75219b23e92c00687d
- MD5 cb05ff26ffcb30838de16f659f8d93c9
- SHA1 f9e977e1f60be49be8a17cf75d31f4a7620827ab
- SHA512 26fc3838e5ef5b638d974be02b6d8f76f7f4778b1b612ea9031c5a5b1cf4a421e48c7a667a1f8db55270c1c86c4e1ec469c8078dd0edaeec2df02fddff27a999
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\AdSelectionAttestationsPreloaded\ad-selection-attestations.dat
- Size 63B
- SHA256 1b58d00f5b1fbd2a1884d666a2be33c2fa7463dff32cd60ef200c0f750a6b70f
- MD5 5f1c4bb2970471a5c75b7ba1dc9ee3ed
- SHA1 0ec86b3f3ac34ad860fa8da56bcca03a54018049
- SHA512 b973335129e4a8dd92d0984e16cff30899de8829be3c87df30d61a88e6bba8fe1767ffed6ee9a9e2665269cd6c7f3f0bfe8f9449cf16b924db57edfee8f12877
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\show_third_party_software_licenses.bat
- Size 270B
- SHA256 0cef594c2af7dfc584e30d1813f901aaa5f67c13f7b2141b2220d167abc651d3
- MD5 44405fefe5799ad2b15f58cada9105d4
- SHA1 9172b64b5fcce03c2798322d2fde6cb36726f0fb
- SHA512 dfb392a59f57dc184e13ef5f759e0e21bbd36d253fed04971c8fdb42770433aeb778956e3df8625b10544d2fbff3b6ea666c68fe6fd63b3e48353c33f993bb89
- MD5 SHA1 SHA512
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 963KB
- SHA256 48e807cb1e415407871cf370de8429319912d853e10c97d4009d9022100a1615
- MD5 44ac1c9766a9625c842522fedcb74121
- SHA1 a9f3048f7683d335abf7041dcbde1824f1ec4089
- SHA512 738f35c6fb4a6c0e10d10032d0aeafeafbfb85b86719bbbcb8661ca4e713b4d0ce49506b26e474f8bae18133d8af04160322b2c1482a603e5ce40ea6e2c53a26
- SSDEEP 3:Wttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkw:Yu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
- Size 190B
- SHA256 e290cb91a6aaf54bb397c8f72d0bf5e8a70935ca00abde862e3d13fdf75fdbb0
- MD5 f0be99f92d8b8ad3d79c9aa580fc2f08
- SHA1 a9ab5160208575c2c19277491406d5c95690a5f0
- SHA512 c9c2002d0f14f1d92924f80105c4b092bcb8de5bcb838179f2129b125fbcdf83f78ee80f44b0e26bab451c6fa5d6a29547a4933a92858e310dfbbdcee32f8cae
- MD5 SHA1 SHA512
- Path C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md
- Size 2KB
- SHA256 4ab0585ac1cc953813901847e774a0a6e2542bedd0e5964cacf31e421455223e
- MD5 950ac8e007b49ed7acf1646758393817
- SHA1 3a795f27aac36ba92f33165a6550cc7f201b3254
- SHA512 6bf7c6bdc1f802cdc8cea1d5a22de2e2cdf307411504499351fa5e9bdb7d1826c1968c4cc8bbb2fc17ea69850d69e0e2d77b76d29ad991813b598fc18ea0982e
- MD5 SHA1 SHA512
- Path C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Slipstream.xml
- Size 744B
- SHA256 d8dc1b9aa2aefd658fae2d9b6bf36318bdda72fcecba0538a1f121592b44e3b6
- MD5 c181d62d13f055127f354bb60cdfa03b
- SHA1 6cbfcbcdb417807d7ce1ffeeaa2eaaf9b548885a
- SHA512 62dd4c375f5e3299843c78dc86026da551a8a66c2c4cfac4003b8e4774ddd1cc36c130611c15182b61a472169305b75c845f17ec899e53250461867cc82abd36
- MD5 SHA1 SHA512
- Path C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\readme.txt
- Size 223B
- SHA256 b9dfa3b30224bd5eef298531c945d5f2f6bb978b7ef42e5ef09715a535172127
- MD5 dbac9649c4bd702f55fbd1afafe87c44
- SHA1 0d914f4a809cfe400ca111ebfbd0ad552d500785
- SHA512 86d7786b400303b1fb722689aba7e8ef6a01ad7e2776194c5d545a7d7357dd91e7079296790587210683db7f4385f98f281272fd3d1ad6770dabf401709a6415
- MD5 SHA1 SHA512
- Path C:\ProgramData\Microsoft\Windows\Caches\{A18ABF0A-B8F2-493C-9302-C1DA1439C46D}.2.ver0x0000000000000001.db
- Size 1KB
- SHA256 ac944397bb7351bf439ea8b7e6cf5863fed078383f3da0b7c92b53408fe680d5
- MD5 8b836d8d3ea988668ddae3311f514a57
- SHA1 af3199496b831b74bde630f871615ce5848f9857
- SHA512 f205183db25237a58c6a33b9c83af86df3210fc7cc411d4638af9c856fb39a2795c99d612601bdf183101402ed6455b7949a9deabfb2b2262afe47dff0c17cc2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.96.1_0\page_embed_script.js
- Size 338B
- SHA256 a4c65a576c9848bd6438ba704e90be3d2ea275f83de420608343f6a27691640d
- MD5 e54914068570928febe65c8dc7fde287
- SHA1 46d0a3754b75fafad74cfa0912ccf2d9457c14b4
- SHA512 0a34db8e8a6ff3e67e1af3e63f062a2e7b8f43f8d74a620f130ed25bda34a3300003ea95c3a1ed86d4348a34e450548075fb3d914b87beb25caf4b430f84db00
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
- Size 40B
- SHA256 f0a2fb80ac0699075fb6c7b0ee2bcc204a1d909ee3149571216ec9cc1d4b9f8e
- MD5 a9451e544b3ae4ad6baad228d5a46198
- SHA1 5cdbb64242d8551a7cf583903fd7d5b72b277537
- SHA512 394d36c395614a42195260d808e7e0b441af004d4a8e7613315343368ac3de43dea8f300e1b2369766bf45a178247b3d4111a65def8e83e2e823919eaf99a0ee
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini
- Size 174B
- SHA256 237f73d46d3501de63eae1f85fdf37e65ddced70f013b7f178d1ee52b08f051f
- MD5 ace3165e852adb8aedbeda2aa3be570b
- SHA1 4577ff7e92850e2723008f6c269129bd06d017ea
- SHA512 cf77563b9295b191ce2f309e03618d1ab4d317f65b87dbecc4904ee2d058db06d23c20c199571b0fafb67ae5ec5166b76af0b7d8bfe3996b0dde9751e28f8c03
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini
- Size 174B
- SHA256 feea416e5e5c8aa81416b81fb25132d1c18b010b02663a253338dbdfb066e122
- MD5 e0fd7e6b4853592ac9ac73df9d83783f
- SHA1 2834e77dfa1269ddad948b87d88887e84179594a
- SHA512 289de77ffbe328388ad080129b7460712985d42076e78a3a545124881c30f564c5ef8fb4024d98903d88a6a187c60431a600f6ecbbe2888ee69e40a67ce77b55
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\cversions.3.db
- Size 16KB
- SHA256 1bd4db450abc8914c2fac721cace2704ff4c16028e6d07293154dad289835694
- MD5 4534f12102d235344cf8dda748f0cabf
- SHA1 7db67baceeecb3a420bf37a7beca4a45185f8f3c
- SHA512 7b4dacdbc6a2fccdd3818eb41b7fa23eeec51f333af0e842d9185c7ae45eba1623369b1caa27b824cba10c4cd6a2cdbf7f127ab2c6f7656eedce5fe25a0b84a2
- SSDEEP 3:Wttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkw:Yu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{03BA58C4-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.CRYPT
- Size 414KB
- SHA256 fb5134bad9f456fd6d5917952a5809713f6bd6c0f65ee5607da536e6d1d49124
- MD5 0597e68a6b6817cb03e95efdc00b0037
- SHA1 3991840569f1699afe26b4ba03e31bb8ed69c3ca
- SHA512 230de4d59180a53b77b7c6252e38ee476dc51cb8eb8ae487aaf8b47660351528fd411548c246965b2f67239f459df1b9c6e2b2e15a714ed2f84ba1c0acdbcf4c
- SSDEEP 12288:O3I7X47XGIEx2F6PG0CaWL6GHuGoYuRbjP+ri2TQkm:O4T86PyaqHulRbjP+iUQkm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001c.db
- Size 97KB
- SHA256 515e5fbd341c58ab597c78adce3cd3bc7d4db90fa62c3258a60585d6c115b47a
- MD5 59fcdde0f31379f0a0001be7b010c2d4
- SHA1 2c888bfc209014738ec2aa6451a9a49df8d3eea7
- SHA512 c8dd04b6533e7402bdbf222a3b0b6de4000049e4f057239e400b54fe7d44275b2daf92ab753810a5372a5f5104f8c9a35d8a3dea6018f6e492626b80ceae0191
- SSDEEP 3:Wttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkg:Ye
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001c.db.CRYPT
- Size 97KB
- SHA256 4bb412b40fcf438ec5efd5ef50bf4b1ac2749f8ed3dd4868777aa029dc1cc534
- MD5 fe2fa59c20b8f65a6f3ac31e04e67293
- SHA1 a4c0d82a952f97f229efcc24a58883723b3c00c6
- SHA512 8aab3a9db106ba0958bc851b27ebcff33937b70356badf026227aad74e1461ce858d27ed82e00d44647dd418873c2152ee27b4b0467efb506ab691e59613837c
- SSDEEP 3072:DnjjCMdQI8IcvGMIupJh24RfzZLlc69FCV:DCcQB7Iup/24h1+wy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db
- Size 1024KB
- SHA256 0a21d4b25a0b5ccd5d22a07039c26eb5f9456f66a21b3dec1ce57d4b7fc21c3d
- MD5 ebd78a806e94ae892dcffd48a89ff40a
- SHA1 23318746803134629228e6104cf562d60d13fe70
- SHA512 b67a008a4a969bad3037c33ef378a2cbbcc0b5a9bece689b4b2dd83220296b5c9d1577527036f3460b8974ad555c65567e24326a0cdc39569abb059117ca8e1c
- SSDEEP 768:eO1CCCCCCCwaFOS3fO1CCCCCCCwaFZpXkf:Gc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
- Size 1024KB
- SHA256 e41f5839bdbd764b445b585d0dee3e20e9eafc4c6ce5e442155eb8045908f8ae
- MD5 ae81a997b2b09e7f0dead9de9903b410
- SHA1 cee16b7b17fd8ec1a86e4dcaa2318de6aa290c33
- SHA512 bb76dce8e71e471ab8508eb520a101c0b6cf87b976ae35ab2480e850fccde3a7a679d66b43fcb6a7fe439c0ece6f3a19e45eecacb0951c5d01eeda73683c6771
- SSDEEP 192:05J19Q/8Awcrzu20ZCsBzvjILn3KU3r2VzF:0R8Hwc/p0ZxFjVU72JF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db
- Size 24B
- SHA256 1bda9f0aed80857d43c9329457f28b1ca29f736a0c539901e1ba16a909eb07b4
- MD5 c7c6abfa9cb508f7fc178d4045313a94
- SHA1 4f130f23896bd6d0e95f2a42b2cb83d17ac8f1a2
- SHA512 9f1c1e438b8cceda02663a61a64c1c5fc6fb6238aa92d30e6d8d1a7b0cb29a8a6f26b63b9964ad876617f71ee7dc3c05205158c4ed4be327149652b1c6900825
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
- Size 7KB
- SHA256 4b0fc2a90f37b0320ac98fcd1849c13db1061932062904538d1b0354ad077d03
- MD5 8dec1691a7dd5ac1f256aab52bd060df
- SHA1 74b2719e01035040ce44cc1782aade855e807dc5
- SHA512 726bd481d4d123acebc9a20cdced906d4159aad5f0043c6c9bdeeef373268029716b2608c1f464385ab8d4a7ad5548c14bb05787065e3d6c7547a499da205e99
- SSDEEP 3:tnsllqlFnl9fVVlmPRC/Ld//mLVcilWHRZSRd//rszxMmlBRJ/AaRd//:alY1VVoC/LdXmLiZxZ0dX45l7JxdX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
- Size 7KB
- SHA256 8b50bea8d8cea4b61d135d78f5704eb27260988e5bf7ec78800ee09e8b41341b
- MD5 6fac2c421136aef156a8b9e68042b446
- SHA1 c1718dd70d840eed95f65cc6403dcca8bb96b31a
- SHA512 9cb58f25ae7ac84f024f131ba51e9b74fb7a3b3074fe9652bc1990c0265266352973d06a5b115b2fbd7efa71caaf3a8183b1a20e5737f285884d23a7df374d13
- SSDEEP 12:WxSuq4eNoovYBvsmYc31SioKp+y/ZtdYDUt56MnS1atXZG40tKSlZ:WUu6Npv4xx/ZFku0sSl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db
- Size 1024KB
- SHA256 182e462a47614b5e859718ea0e6ee02db4a9afd1aaadc7cf7c407535af96e372
- MD5 818ca27dd2ac7a7e97457c00af856c92
- SHA1 a34828b8804627050e2ab39867f9779ee35b5d1f
- SHA512 edb588383e7b3086219737c9d5fe8a9f33907f9a6754986ed4bef0a66f6d1a89df64478a5591df876bb07bf46875b70a1207617053382ad088d1ab8c07b6ff40
- SSDEEP 12:gLmlvSk0UqYrnVJ45yRPHMLEN7jQN8abnFISxC3nRKW8s+Jl:Cm30UqupMXNJbFISGKW8sIl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db
- Size 24B
- SHA256 d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9
- MD5 ae6fbded57f9f7d048b95468ddee47ca
- SHA1 c4473ea845be2fb5d28a61efd72f19d74d5fc82e
- SHA512 f119d5ad9162f0f5d376e03a9ea15e30658780e18dd86e81812dda8ddf59addd1daa0706b2f5486df8f17429c2c60aa05d4f041a2082fd2ec6ea8cc9469fade3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
- Size 14KB
- SHA256 5443a81a010bc1ff7da14947d3737287a2045bac55e5a7057ce5d17171989c58
- MD5 d62de45260290993ab8f379c928263eb
- SHA1 1a885ddfea2427607247084565bf7b547005b7cc
- SHA512 66228c968e4691940ec8e3265de44ca328e7787dcd04fd4a6a0142a63164f70aaada515221e2a9654d7790e90ed1b73cf63024f65c72b3313b05c82c3ee67ec3
- SSDEEP 3:WttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkQ:YO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
- Size 7KB
- SHA256 5e8ee8db081fe321a722333d442bf6c86bf514c2bfffca2585e9b7cff74f12c1
- MD5 3d7106a3a61255939f09198c5d0b726f
- SHA1 d99d2c2d4649412c8092dc41f3fbf11a2b5f8ac0
- SHA512 4ed67fd871f31d68a33609a8392f09dc20dbe66845ea111e6ea649f317d4ec3d62c74e76ded70d17d4b12b11bab1c3d65c33000662daa0e41e526fd2dafb3a30
- SSDEEP 3:tnulIlll9/l9elq+WvM/JR1//:YlItE/WvM/D1X
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
- Size 7KB
- SHA256 28d83130fc6e7d2a988dc6fcb374318994744ebc64e823fd715c5387cf8a876a
- MD5 ce652904b280764df8e64228653cc5e3
- SHA1 3bec0509a54822180d04532b774b4e0e8e6f7428
- SHA512 e9797518abe0fec0fad117970a6463da466ba4633e051708deb1aad682fdaaf4a5f04f9dc0b9cd057105b02fba9b35e5bf2262a50127931a5c6daa1cb4647574
- SSDEEP 12:Gx981D8VqroBBnOe67DGe0FkgVvlbUdt19EoJBkysLBi0MyEaVN2sZCmapPmWtRy:Gc1D8UCTjnkgRIDNsLP2ZmaRmWcA30d
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DJV7XA27\microsoft.windows[1].xml
- Size 97B
- SHA256 4f069f804c53faeb15ed1336825574f88ffaebff5a223e43ca5c7a40b8909707
- MD5 3b78b62b4d88f281fbbec7d576715807
- SHA1 4136a055abb175ab0bd6b0583dc5aa91691ebb3f
- SHA512 7b46a11419bf0bd98cf5ec9f690c20cd6afaf47c0588f43fdecad3e88a5fb340e0f0b10a00dec4cd7aecf032a6137e4d600f3ca0e8e9431a3bd7bd73b436e008
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d29332cc-a831-47f2-a99d-98ddf416ced4}\0.1.filtertrie.intermediate.txt
- Size 5B
- SHA256 11770b3ea657fe68cba19675143e4715c8de9d763d3c21a85af6b7513d43997d
- MD5 f6a6263167c92de8644ac998b3c4e4d1
- SHA1 c1fe3a7b487f66a6ac8c7e4794bc55c31b0ef403
- SHA512 232d43e52834558e9457b0901ee65c86196bf8777c8ff4fc61fdd5e69fd1d24f964fed1bf481b6ef52a69d17372554fecb098fb07f839e64916bdd0d2abf018a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134089784393544498.txt
- Size 84KB
- SHA256 17edc84820aaf8b07face43963e47ab28137db9c86688f6ca633c5d733a7ad53
- MD5 adeeee4a25750f0c5e85e8b2520d5b20
- SHA1 14131e75c7bcc4a86aae1aefdbe46f867318e90c
- SHA512 bc0a8ffc9a2a0aa9333f5abc718a338fba153c323c0e841d4eafb8ccf4e18cf03cf38550752423a112eefd1ed4818e83b3b36dd4a3eb277ab8cc9262f6f07cee
- SSDEEP 384:V/vH/n5RH//g/ymL/aNU/gT2/Hl/M1/h8r/hW/CW/Zk/Ey/eX/MA/N3/1k/eh/Yn:RK9zozu6XMqtROI1I
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
- Size 16KB
- SHA256 d3ece991d6f1f628a9eea1d1e6154db31ba520d0ae72fbb2ab7b6d5d76ea643a
- MD5 281615f91d7d9e3135bbac4d77f19683
- SHA1 3bae6efbc79b2fe7d117460103807da18b6078d5
- SHA512 cd0803ee9444b5dcc681daeed09fa7ff096ee3e792d208390f0fce2e09abd4f0f97b86a4b36f7e2fa2bf1cfcf4dc5a66180b37f0d306d1ae60cff1e132f5d6ec
- SSDEEP 384:NJqpJsyzkHcLBAZpm+4r5aYefQOVjeQ8RJoZ3uyRE9cbXPXQJ2+i3+ac:basTc1r5Sl8RJSuyRE9cM2+i3+ac
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
- Size 18KB
- SHA256 78cdd3b522052557d97076b7c8c5f1227d87f2726a6c6b6c430c9761ecd5d4ab
- MD5 70308f4ea7060ebabd401cf4e2ef35a1
- SHA1 5472346c426d751ec429c43e4557f8ac776d8c3c
- SHA512 fa80e57d011b26a515682fcaa443fb7eba30ee563e47d1fb8651aa486639dd37d098c279956f715999368577b9dcc7674edd706924517a79a7e4a7ce1503b98d
- SSDEEP 384:IJqpJsyzkHcLBAZpm+Zr5aYefQOVjeQ8RJoJjuyRRKceXPXQJ2+i3+6Wc:EasTc0r5Sl8RJ+uyRRKch2+i3+6Wc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
- Size 12KB
- SHA256 95bbd15adad2cabaf24af4ece8b3077defe93985b7d92b0dc8144e5b42d8e5e0
- MD5 6ed56c237c9a465b6f53437b09e63c27
- SHA1 9ba0f1cdc0107b1440d6c6b3a64747459d6c2a5d
- SHA512 05e062a019b39bdb28fdc981e148591874999baa51882cb78b867a889998b4195bc5295db9bc5e793c9ae0cdb0d2da0a33d8c9759a5f62851e73b52d51b368eb
- SSDEEP 192:+oLyhnvLfES1fWn8PQk5cDuJNkXPXQRFr574DX/q2+yc+OQTShBGU/0kN0meMU1:+uyRzL9cbXPXQXr5ai2+i3+aAO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
- Size 14KB
- SHA256 5426f1190003fc6725316401e924c3e45a1c0ec158e0a5f84dc6db5d901bbadf
- MD5 b48b4264583e6f2eb82f2abc1e236704
- SHA1 2a71364fc9a65aa49f2e802e9e39136f8607c622
- SHA512 29095fa833d27a4faf9c8aa6a542a7ec74ab543359a5f9e4df968174515e3316357d5ab85b91e3459750f98c3a048094001d3d7609c83000865db594d31867fc
- SSDEEP 192:BRuoLyhnmfES1CWWn8PQkMcDuJNOiPNNQHFr574DX/y+yc+OQTShFf+U/0kN0mel:OuyRmi04c9iPNNQlr5a6+i3+mAO
- MD5 SHA1 SHA512 SSDEEP
- Path F:\$RECYCLE.BIN\S-1-5-21-635849552-4224125634-3671944134-1000\desktop.ini
- Size 129B
- SHA256 e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066
- MD5 a526b9e7c716b3489d8cc062fbce4005
- SHA1 2df502a944ff721241be20a9e449d2acd07e0312
- SHA512 d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88
- MD5 SHA1 SHA512