Overview

overview

10

Static

static

10

15415145.exe

windows10-ltsc 2021-x64

10

15415145.exe

windows11-21h2-x64

10

Resubmissions

06/03/2025, 15:32

250306-syztyssmz2 10

06/03/2025, 15:00

250306-sdfwca1r18 10

Analysis

  • max time kernel
    900s
  • max time network
    439s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20250218-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250218-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    06/03/2025, 15:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    15415145.exe

  • Size

    59KB

  • MD5

    6c091ad6fae0fa76f44870d1a1b05cb4

  • SHA1

    040f60c0ee3f4902f919025057e34ab4d11b1abd

  • SHA256

    c352c942b6df33510094c7100fb9d48e36b8e1e2af40a60ccc360b58721c2390

  • SHA512

    3a414f40f99e5847d9631c4ac1143c76e77db7ae42dd8c7aed2ebf1742ec73bb802d54d6cbde3b04f6b894a4cf731aa4e9dbad95166bade13f787b489d8e8d86

  • SSDEEP

    1536:skyZtyUQ8sBkROLW+UzbTH3gfm2qt0OgSko7:skItfQ8sBkROUzbTQf+6OgK7

Score
10/10
xwormpersistenceransomwarerattrojan

Malware Config

Extracted

Family

xworm

Version

3.1

C2

known-savage.gl.at.ply.gg:45116

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 8 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 2 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 12 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 43 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: LoadsDriver 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\15415145.exe
    "C:\Users\Admin\AppData\Local\Temp\15415145.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3984
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "15415145" /tr "C:\Users\Admin\AppData\Roaming\15415145.exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2312
    • C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM explorer.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2944
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2700
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
        PID:2880
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /F /IM explorer.exe
        2⤵
        • Kills process with taskkill
        PID:2900
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe"
        2⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:3424
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe"
        2⤵
          PID:4744
        • C:\Windows\explorer.exe
          "C:\Windows\explorer.exe"
          2⤵
            PID:4580
          • C:\Windows\explorer.exe
            "C:\Windows\explorer.exe"
            2⤵
              PID:4392
            • C:\Windows\explorer.exe
              "C:\Windows\explorer.exe"
              2⤵
                PID:1280
              • C:\Windows\explorer.exe
                "C:\Windows\explorer.exe"
                2⤵
                • Modifies registry class
                PID:3684
              • C:\Windows\explorer.exe
                "C:\Windows\explorer.exe"
                2⤵
                  PID:4416
                • C:\Windows\explorer.exe
                  "C:\Windows\explorer.exe"
                  2⤵
                  • Modifies registry class
                  PID:2704
                • C:\Windows\explorer.exe
                  "C:\Windows\explorer.exe"
                  2⤵
                    PID:2688
                  • C:\Windows\explorer.exe
                    "C:\Windows\explorer.exe"
                    2⤵
                      PID:3944
                    • C:\Windows\explorer.exe
                      "C:\Windows\explorer.exe"
                      2⤵
                        PID:2368
                      • C:\Windows\explorer.exe
                        "C:\Windows\explorer.exe"
                        2⤵
                          PID:3940
                        • C:\Windows\explorer.exe
                          "C:\Windows\explorer.exe"
                          2⤵
                            PID:4220
                          • C:\Windows\explorer.exe
                            "C:\Windows\explorer.exe"
                            2⤵
                              PID:2656
                            • C:\Windows\explorer.exe
                              "C:\Windows\explorer.exe"
                              2⤵
                                PID:4508
                              • C:\Windows\explorer.exe
                                "C:\Windows\explorer.exe"
                                2⤵
                                  PID:3748
                                • C:\Windows\explorer.exe
                                  "C:\Windows\explorer.exe"
                                  2⤵
                                    PID:2840
                                  • C:\Windows\explorer.exe
                                    "C:\Windows\explorer.exe"
                                    2⤵
                                      PID:1316
                                    • C:\Windows\explorer.exe
                                      "C:\Windows\explorer.exe"
                                      2⤵
                                        PID:2500
                                      • C:\Windows\explorer.exe
                                        "C:\Windows\explorer.exe"
                                        2⤵
                                          PID:1752
                                        • C:\Windows\explorer.exe
                                          "C:\Windows\explorer.exe"
                                          2⤵
                                          • Modifies registry class
                                          PID:1228
                                        • C:\Windows\explorer.exe
                                          "C:\Windows\explorer.exe"
                                          2⤵
                                            PID:1840
                                          • C:\Windows\explorer.exe
                                            "C:\Windows\explorer.exe"
                                            2⤵
                                              PID:2604
                                            • C:\Windows\explorer.exe
                                              "C:\Windows\explorer.exe"
                                              2⤵
                                              • Modifies registry class
                                              PID:5080
                                            • C:\Windows\explorer.exe
                                              "C:\Windows\explorer.exe"
                                              2⤵
                                                PID:3784
                                              • C:\Windows\explorer.exe
                                                "C:\Windows\explorer.exe"
                                                2⤵
                                                • Modifies registry class
                                                PID:1868
                                              • C:\Windows\explorer.exe
                                                "C:\Windows\explorer.exe"
                                                2⤵
                                                  PID:2512
                                                • C:\Windows\explorer.exe
                                                  "C:\Windows\explorer.exe"
                                                  2⤵
                                                    PID:2804
                                                  • C:\Windows\explorer.exe
                                                    "C:\Windows\explorer.exe"
                                                    2⤵
                                                      PID:4760
                                                    • C:\Windows\explorer.exe
                                                      "C:\Windows\explorer.exe"
                                                      2⤵
                                                        PID:1844
                                                      • C:\Windows\explorer.exe
                                                        "C:\Windows\explorer.exe"
                                                        2⤵
                                                          PID:376
                                                        • C:\Windows\explorer.exe
                                                          "C:\Windows\explorer.exe"
                                                          2⤵
                                                            PID:1872
                                                          • C:\Windows\explorer.exe
                                                            "C:\Windows\explorer.exe"
                                                            2⤵
                                                              PID:5040
                                                            • C:\Windows\explorer.exe
                                                              "C:\Windows\explorer.exe"
                                                              2⤵
                                                                PID:4548
                                                              • C:\Windows\explorer.exe
                                                                "C:\Windows\explorer.exe"
                                                                2⤵
                                                                  PID:2388
                                                                • C:\Windows\explorer.exe
                                                                  "C:\Windows\explorer.exe"
                                                                  2⤵
                                                                    PID:1440
                                                                  • C:\Windows\explorer.exe
                                                                    "C:\Windows\explorer.exe"
                                                                    2⤵
                                                                      PID:4392
                                                                    • C:\Windows\explorer.exe
                                                                      "C:\Windows\explorer.exe"
                                                                      2⤵
                                                                      • Modifies registry class
                                                                      PID:3620
                                                                    • C:\Windows\explorer.exe
                                                                      "C:\Windows\explorer.exe"
                                                                      2⤵
                                                                        PID:3772
                                                                      • C:\Windows\explorer.exe
                                                                        "C:\Windows\explorer.exe"
                                                                        2⤵
                                                                          PID:4868
                                                                        • C:\Windows\explorer.exe
                                                                          "C:\Windows\explorer.exe"
                                                                          2⤵
                                                                            PID:3864
                                                                          • C:\Windows\explorer.exe
                                                                            "C:\Windows\explorer.exe"
                                                                            2⤵
                                                                              PID:2172
                                                                            • C:\Windows\explorer.exe
                                                                              "C:\Windows\explorer.exe"
                                                                              2⤵
                                                                              • Modifies registry class
                                                                              PID:4480
                                                                            • C:\Windows\explorer.exe
                                                                              "C:\Windows\explorer.exe"
                                                                              2⤵
                                                                              • Modifies registry class
                                                                              PID:8
                                                                            • C:\Windows\SYSTEM32\shutdown.exe
                                                                              shutdown.exe -L
                                                                              2⤵
                                                                                PID:3584
                                                                            • C:\Windows\system32\NOTEPAD.EXE
                                                                              "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New Text Document.txt
                                                                              1⤵
                                                                                PID:4696
                                                                              • C:\Users\Admin\AppData\Roaming\15415145.exe
                                                                                "C:\Users\Admin\AppData\Roaming\15415145.exe"
                                                                                1⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:3740
                                                                              • C:\Users\Admin\AppData\Roaming\15415145.exe
                                                                                "C:\Users\Admin\AppData\Roaming\15415145.exe"
                                                                                1⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:2712
                                                                              • C:\Users\Admin\AppData\Roaming\15415145.exe
                                                                                "C:\Users\Admin\AppData\Roaming\15415145.exe"
                                                                                1⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:3416
                                                                              • C:\Users\Admin\AppData\Roaming\15415145.exe
                                                                                "C:\Users\Admin\AppData\Roaming\15415145.exe"
                                                                                1⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:880
                                                                              • C:\Users\Admin\AppData\Roaming\15415145.exe
                                                                                "C:\Users\Admin\AppData\Roaming\15415145.exe"
                                                                                1⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:4696
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:2684
                                                                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
                                                                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
                                                                                1⤵
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:3716
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                • Boot or Logon Autostart Execution: Active Setup
                                                                                • Enumerates connected drives
                                                                                • Checks SCSI registry key(s)
                                                                                • Modifies registry class
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                • Suspicious use of FindShellTrayWindow
                                                                                • Suspicious use of SendNotifyMessage
                                                                                PID:2148
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:2524
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                1⤵
                                                                                • Modifies Internet Explorer settings
                                                                                • Modifies registry class
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:2892
                                                                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
                                                                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
                                                                                1⤵
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:2752
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                • Boot or Logon Autostart Execution: Active Setup
                                                                                • Enumerates connected drives
                                                                                • Checks SCSI registry key(s)
                                                                                • Modifies Internet Explorer settings
                                                                                • Modifies registry class
                                                                                • Suspicious behavior: AddClipboardFormatListener
                                                                                • Suspicious use of SendNotifyMessage
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:3796
                                                                              • C:\Windows\System32\rundll32.exe
                                                                                C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                                                                                1⤵
                                                                                  PID:3004
                                                                                • C:\Windows\System32\rundll32.exe
                                                                                  C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                                                                                  1⤵
                                                                                    PID:2508
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                    1⤵
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:3416
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                    1⤵
                                                                                    • Modifies Internet Explorer settings
                                                                                    • Modifies registry class
                                                                                    PID:4216
                                                                                  • C:\Windows\system32\AUDIODG.EXE
                                                                                    C:\Windows\system32\AUDIODG.EXE 0x504 0x4e0
                                                                                    1⤵
                                                                                      PID:4140
                                                                                    • C:\Users\Admin\AppData\Roaming\15415145.exe
                                                                                      "C:\Users\Admin\AppData\Roaming\15415145.exe"
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:1608
                                                                                    • C:\Windows\system32\LogonUI.exe
                                                                                      "LogonUI.exe" /flags:0x4 /state0:0xa39fe055 /state1:0x41c64e6d
                                                                                      1⤵
                                                                                      • Modifies data under HKEY_USERS
                                                                                      PID:4288
                                                                                    • C:\Windows\system32\DllHost.exe
                                                                                      C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                      1⤵
                                                                                        PID:2704
                                                                                      • C:\Windows\system32\DllHost.exe
                                                                                        C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                        1⤵
                                                                                          PID:2656
                                                                                        • C:\Windows\system32\DllHost.exe
                                                                                          C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                          1⤵
                                                                                            PID:1316
                                                                                          • C:\Windows\System32\smss.exe
                                                                                            \SystemRoot\System32\smss.exe 000000a0 00000084
                                                                                            1⤵
                                                                                            • Suspicious behavior: LoadsDriver
                                                                                            PID:5080
                                                                                          • C:\Windows\System32\smss.exe
                                                                                            \SystemRoot\System32\smss.exe 000000e0 00000084
                                                                                            1⤵
                                                                                            • Suspicious behavior: LoadsDriver
                                                                                            PID:2804
                                                                                          • C:\Windows\System32\smss.exe
                                                                                            \SystemRoot\System32\smss.exe 000000d8 00000084
                                                                                            1⤵
                                                                                            • Suspicious behavior: LoadsDriver
                                                                                            PID:1840
                                                                                          • C:\Windows\System32\smss.exe
                                                                                            \SystemRoot\System32\smss.exe 00000098 00000084
                                                                                            1⤵
                                                                                              PID:1844
                                                                                            • C:\Windows\System32\smss.exe
                                                                                              \SystemRoot\System32\smss.exe 000000f4 00000084
                                                                                              1⤵
                                                                                                PID:4392
                                                                                              • C:\Windows\System32\smss.exe
                                                                                                \SystemRoot\System32\smss.exe 0000010c 00000084
                                                                                                1⤵
                                                                                                  PID:2512
                                                                                                • C:\Windows\System32\smss.exe
                                                                                                  \SystemRoot\System32\smss.exe 00000108 00000084
                                                                                                  1⤵
                                                                                                    PID:3784
                                                                                                  • C:\Windows\System32\smss.exe
                                                                                                    \SystemRoot\System32\smss.exe 000000e0 00000084
                                                                                                    1⤵
                                                                                                      PID:2388
                                                                                                    • C:\Windows\System32\smss.exe
                                                                                                      \SystemRoot\System32\smss.exe 00000100 00000084
                                                                                                      1⤵
                                                                                                        PID:2172
                                                                                                      • C:\Windows\System32\smss.exe
                                                                                                        \SystemRoot\System32\smss.exe 00000100 00000084
                                                                                                        1⤵
                                                                                                          PID:4760
                                                                                                        • C:\Windows\System32\smss.exe
                                                                                                          \SystemRoot\System32\smss.exe 000000d8 00000084
                                                                                                          1⤵
                                                                                                            PID:4548
                                                                                                          • C:\Windows\System32\smss.exe
                                                                                                            \SystemRoot\System32\smss.exe 000000bc 00000084
                                                                                                            1⤵
                                                                                                              PID:4480
                                                                                                            • C:\Windows\System32\smss.exe
                                                                                                              \SystemRoot\System32\smss.exe 000000e0 00000084
                                                                                                              1⤵
                                                                                                                PID:8
                                                                                                              • C:\Windows\System32\smss.exe
                                                                                                                \SystemRoot\System32\smss.exe 000000a4 00000084
                                                                                                                1⤵
                                                                                                                  PID:1872
                                                                                                                • C:\Windows\System32\smss.exe
                                                                                                                  \SystemRoot\System32\smss.exe 00000104 00000084
                                                                                                                  1⤵
                                                                                                                    PID:4868
                                                                                                                  • C:\Windows\System32\smss.exe
                                                                                                                    \SystemRoot\System32\smss.exe 000000e8 00000084
                                                                                                                    1⤵
                                                                                                                      PID:3620
                                                                                                                    • C:\Windows\System32\smss.exe
                                                                                                                      \SystemRoot\System32\smss.exe 0000011c 00000084
                                                                                                                      1⤵
                                                                                                                        PID:3864
                                                                                                                      • C:\Windows\System32\smss.exe
                                                                                                                        \SystemRoot\System32\smss.exe 00000098 00000084
                                                                                                                        1⤵
                                                                                                                          PID:1440
                                                                                                                        • C:\Windows\System32\smss.exe
                                                                                                                          \SystemRoot\System32\smss.exe 00000120 00000084
                                                                                                                          1⤵
                                                                                                                            PID:3584

                                                                                                                          Network

                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                          Replay Monitor

                                                                                                                          Loading Replay Monitor...

                                                                                                                          Downloads

                                                                                                                          • C:\PerfLogs\hq720.jpg
                                                                                                                            Filesize

                                                                                                                            34KB

                                                                                                                            MD5

                                                                                                                            aff47e2ff9fd81e497ad71efbf98b7e4

                                                                                                                            SHA1

                                                                                                                            68b73e03e1091d17bdc6238ee09bbc3921f7763e

                                                                                                                            SHA256

                                                                                                                            ba41153adb3da20812546fd66b993dfe27e26ad8daba0da8f92c9abf5ed146b9

                                                                                                                            SHA512

                                                                                                                            6d8a4c9f3f9899ac16024389f04c8b75c6c9a1f3af06ed8af3e73134a01879cd536b0739ef5b4718e932a889d109a817d7728200f0ef40125821817eef110343

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\15415145.exe.log
                                                                                                                            Filesize

                                                                                                                            654B

                                                                                                                            MD5

                                                                                                                            11c6e74f0561678d2cf7fc075a6cc00c

                                                                                                                            SHA1

                                                                                                                            535ee79ba978554abcb98c566235805e7ea18490

                                                                                                                            SHA256

                                                                                                                            d39a78fabca39532fcb85ce908781a75132e1bd01cc50a3b290dd87127837d63

                                                                                                                            SHA512

                                                                                                                            32c63d67bf512b42e7f57f71287b354200126cb417ef9d869c72e0b9388a7c2f5e3b61f303f1353baa1bf482d0f17e06e23c9f50b2f1babd4d958b6da19c40b0

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                                            Filesize

                                                                                                                            2KB

                                                                                                                            MD5

                                                                                                                            980c97fa1b8ad8d1986fec0865475aea

                                                                                                                            SHA1

                                                                                                                            5fe889d4e9a80b6682be5eaf8eb94ee9ec03e91c

                                                                                                                            SHA256

                                                                                                                            826418ec5112940a99fd65be41cf7ac87bbfe05a9f3e67d7e141883d0e581020

                                                                                                                            SHA512

                                                                                                                            943905f6fb11ddd4a22f5d0efc033383e1fb7ec6f42102dc707b3ce9f899965d9ec523b347035cf6fda494c7265c26250dd1f0b71aa990e023bd1dd7921913df

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133857491134380368.txt
                                                                                                                            Filesize

                                                                                                                            83KB

                                                                                                                            MD5

                                                                                                                            df00e84ce0df8cfe6a0a1fd8484724df

                                                                                                                            SHA1

                                                                                                                            59e172d31edc2f460cf46bc67db6b78c753e0d6f

                                                                                                                            SHA256

                                                                                                                            50807d9106b1354ad8fe091cf42e54bed2c1712a637d5de938e3aeb010aeb46e

                                                                                                                            SHA512

                                                                                                                            08b9a7cff310e12e437c177d2a44d3a1c4bf100abb7009e062979fad6497baeef106007daab7b6a9a0443cbc2074675774420888e74e9a1a3edfec9a8ad9610e

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DD6HIM7T\microsoft.windows[1].xml
                                                                                                                            Filesize

                                                                                                                            96B

                                                                                                                            MD5

                                                                                                                            2cb1a12a1d678f487133f5b921a1e0fc

                                                                                                                            SHA1

                                                                                                                            f8576590afabab645e9c31eca8a81f869355f335

                                                                                                                            SHA256

                                                                                                                            9879d7340f98dcd5913037e160403a9d7c25c71e965ae5094393385f0d7846b7

                                                                                                                            SHA512

                                                                                                                            67d3e8ef3ba9d39aeed04a134097e01c9a807044e134024cd068cd22a8ac0796acba0bba8868c65fbd9fb7827a871e8bd2193a13fca4161ed0980ceb479b1bdc

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\AppData\Roaming\15415145.exe
                                                                                                                            Filesize

                                                                                                                            59KB

                                                                                                                            MD5

                                                                                                                            6c091ad6fae0fa76f44870d1a1b05cb4

                                                                                                                            SHA1

                                                                                                                            040f60c0ee3f4902f919025057e34ab4d11b1abd

                                                                                                                            SHA256

                                                                                                                            c352c942b6df33510094c7100fb9d48e36b8e1e2af40a60ccc360b58721c2390

                                                                                                                            SHA512

                                                                                                                            3a414f40f99e5847d9631c4ac1143c76e77db7ae42dd8c7aed2ebf1742ec73bb802d54d6cbde3b04f6b894a4cf731aa4e9dbad95166bade13f787b489d8e8d86

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_FC5D11F4C7104F0E856A24A0A62817C3.dat
                                                                                                                            Filesize

                                                                                                                            940B

                                                                                                                            MD5

                                                                                                                            c3ff094f558d92cc32dc0c91b8393eb8

                                                                                                                            SHA1

                                                                                                                            bb8e05a029ab813d35d93cb8d1f212bbd522efcd

                                                                                                                            SHA256

                                                                                                                            00d1264c8c0e1c27b2e1e8c868eadb10daed60f96c1448ae748aaac03c6a9fa7

                                                                                                                            SHA512

                                                                                                                            3131a83ff67775bf6bf4f2d527bf40e58c6bee78810752181c8a0015f7256c5f36f27d59a76d200a2fe4d06e58acd2106d56aa80873998c78cab4d8e9b5a59a4

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\Desktop\BlockEdit.xlsx
                                                                                                                            Filesize

                                                                                                                            12KB

                                                                                                                            MD5

                                                                                                                            d464e899cccdf3b708a67f4f1fef3b65

                                                                                                                            SHA1

                                                                                                                            eac79bb432693a611ac81ba3e4c473842209d495

                                                                                                                            SHA256

                                                                                                                            42edd91e3411899bedf0cfba2ea586f62b6bf0434cb656cbe6df2a58f7245d68

                                                                                                                            SHA512

                                                                                                                            1920392aa29ac52ec42d386dcf8e8d143ae7fabfd9f9bf6f18009f5b45d8b6260a80274f38b541eb4173f5a249897c32c1cbb294b8a7710194dc89e1b80dd1ca

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\Desktop\CloseConvertFrom.docx
                                                                                                                            Filesize

                                                                                                                            14KB

                                                                                                                            MD5

                                                                                                                            5507c18d78136c2dd33cdd44d31a60d8

                                                                                                                            SHA1

                                                                                                                            cf0e7311bb5f99341ba0792f06d76df9658924f9

                                                                                                                            SHA256

                                                                                                                            88694166ef6feb41dd583d18f84b352100902291b60123c06a54b6bac732f562

                                                                                                                            SHA512

                                                                                                                            9bf2f38f044576bc29f6670495d100a4d1ba68983b882c128e0d07499d1fae005d2df2b84aa0fc7df1976da0c9565f73af1ad59fbf23fe03d068f069fe033be5

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\Desktop\CloseUnprotect.ttc
                                                                                                                            Filesize

                                                                                                                            499KB

                                                                                                                            MD5

                                                                                                                            2ed6df0465aafceb41be099991044250

                                                                                                                            SHA1

                                                                                                                            abf2bcd6e82fa25b6562b685439294b6195ec973

                                                                                                                            SHA256

                                                                                                                            898afaed2c23a1a9be432987ccbcbd02643279189bd559af6c6f3123b4be2481

                                                                                                                            SHA512

                                                                                                                            9a501e9f43dcc2ff6b995d531ff31d96edf62853c81022cdf8422026ecbee5d792ef0d9691c1a791237c309761a95bcdee62042874051571b64832d8ac40daa0

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\Desktop\CompareConfirm.dot
                                                                                                                            Filesize

                                                                                                                            732KB

                                                                                                                            MD5

                                                                                                                            6c441e5508d3f94810d71efcf49db09a

                                                                                                                            SHA1

                                                                                                                            21bf1d8c0ee931c0373815e9cf5f79a8f20a95a0

                                                                                                                            SHA256

                                                                                                                            ba1983bfeee2b17c752c766058d8bd42aa50acc417cbad4bcbdbcf7ccfa51bf6

                                                                                                                            SHA512

                                                                                                                            66325afe6819ff1d1db31494dd275e3f7572afc2f1c700d6002614bc308cf7508683c78df04281e7b737e1dd747042f9b4f219e50f041dd21adff92fb8d5e0c9

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\Desktop\DisconnectMerge.bmp
                                                                                                                            Filesize

                                                                                                                            599KB

                                                                                                                            MD5

                                                                                                                            287f6c6990a191f30b7cff0ed2469d67

                                                                                                                            SHA1

                                                                                                                            ee165d3f5406f69f16044aa4b15df8bed3d7bd3b

                                                                                                                            SHA256

                                                                                                                            68611c75149c8cb0448a17c520dbbff9040d66b6a2f3cd16dbae1deeee723a88

                                                                                                                            SHA512

                                                                                                                            508469782cbbc29bd79c5dd3e83220805dccf89d8bbf4e09f7254c25841a85ec18afd600a5b4e5c1971955b463b838d0a257ba6cbcc4e31da280e0aae1420c0c

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\Desktop\EditRename.rmi
                                                                                                                            Filesize

                                                                                                                            632KB

                                                                                                                            MD5

                                                                                                                            1d4b2400a9017298920b5481ad4aca4a

                                                                                                                            SHA1

                                                                                                                            65e2c617e5a0bd808e397ccad1cb41fe6e99d29b

                                                                                                                            SHA256

                                                                                                                            2687e2dc1dba3b78a8a8677862229a429dd4779507fcf124020b2c61922175a6

                                                                                                                            SHA512

                                                                                                                            c287250caef0f84a8b2e76a49d73faf36ea1259f9002d3f2b8ebc4e91e212f92cd8b6e3558346d21b463692a30e6a8ed7a9587a77126cdea39e4b1e7bf1238a0

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\Desktop\JoinSend.tmp
                                                                                                                            Filesize

                                                                                                                            399KB

                                                                                                                            MD5

                                                                                                                            4a29f0d8edee050a65f48f53e9da1c2b

                                                                                                                            SHA1

                                                                                                                            3f791d347d799efcaa220544a5b64935f0607a5f

                                                                                                                            SHA256

                                                                                                                            8f69f8169292e7df88800a3de5ed8e6b6e498f7189667f4544a47f6ec6e27525

                                                                                                                            SHA512

                                                                                                                            fd59eebfe7770ad5c3be4697de516582c333c54544ed9fd96c512130945d01c4b0b98c160434c73fe70017aec8a167a430dc85eac566252ffcb830916e9c0152

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\Desktop\MeasureEdit.temp
                                                                                                                            Filesize

                                                                                                                            865KB

                                                                                                                            MD5

                                                                                                                            86694f1789da41eed7b4d359af1860df

                                                                                                                            SHA1

                                                                                                                            8934b3cf6ceb93b1de53fd9e98dba2a1c083a717

                                                                                                                            SHA256

                                                                                                                            84ce7391b81010f87bc7c088b0489235a3ae9761bca79edf98adf846ac91d3e0

                                                                                                                            SHA512

                                                                                                                            cb1db42af51072d5f4cbcb9b80297b90e6b4c2b5626e631bff657e5427816489119487fc7bcbb395a3535a729193776cdeee78deec97f3e6791e346f769e9b8d

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\Desktop\MergeShow.jpg
                                                                                                                            Filesize

                                                                                                                            665KB

                                                                                                                            MD5

                                                                                                                            b2cb4ee0726f03b3e1a9c018582cd24c

                                                                                                                            SHA1

                                                                                                                            028f00568705fcec3377cc187629bd7a6a5a369a

                                                                                                                            SHA256

                                                                                                                            42311c4b40cfb486649048b52eed3c7cb10fd38e03a71e3439af1a37420f4cba

                                                                                                                            SHA512

                                                                                                                            1cfd15edbdd12f06bc1c8663fe65facea334f135302546f1fb014541f1b556e63433be0886f3c57474cbe522bf04c07d348529cc7fec772b3b8d843f2264c39b

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\Desktop\MergeUnlock.vdw
                                                                                                                            Filesize

                                                                                                                            532KB

                                                                                                                            MD5

                                                                                                                            b7c4242b3170b652c6ffdca00a8ea75e

                                                                                                                            SHA1

                                                                                                                            69d7674937d5f2e38fe1a738f47bb81d7fed9008

                                                                                                                            SHA256

                                                                                                                            d28a0e676d62abd9538004d67f32adc4ec0cf9ef9ed0f1b149afce2af67e0777

                                                                                                                            SHA512

                                                                                                                            7a9b4330a03a30576ee56870d3fd7eb926f67c18478389dd5c353836a3490eee8faf46dab8ba9068e9e5fefaa719b671f49a704ed8324add3b2abf638f4d4289

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\Desktop\MoveLimit.TTS
                                                                                                                            Filesize

                                                                                                                            332KB

                                                                                                                            MD5

                                                                                                                            0a81b74d35c114ed5cc547e63d9a891a

                                                                                                                            SHA1

                                                                                                                            e82c27872735e1608efd96f1526a6014c1c6d37d

                                                                                                                            SHA256

                                                                                                                            50ea2bfb0ab9058b2d503e8b092923c3ab58e1b9a34e6e54daa6f22a2442ccf3

                                                                                                                            SHA512

                                                                                                                            ae031710732009ef4cd93bdda76d614fde0799a3e239fa9414e73c0842a3104a93a1280b8ad1d2425215fa95ca4150841e74fc9c50a63508138be9cde2e3fcb8

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\Desktop\PublishFind.docx
                                                                                                                            Filesize

                                                                                                                            18KB

                                                                                                                            MD5

                                                                                                                            10cbf4ccf1db3fa5f6095f6cd5f9c86f

                                                                                                                            SHA1

                                                                                                                            d9ad01792c34d20c6e03ceffda5fd0ce79135bf6

                                                                                                                            SHA256

                                                                                                                            291fc5fbac34894ec29a44b2948dfa7d996164c85f4318571a23bc4bdcfd2d31

                                                                                                                            SHA512

                                                                                                                            7caa8b75d4dac2ea892c950c5de56326691fa47c656a475a3d343276787b67ac8c7f932ec52df3bd55c6e2f7e07b2305a031f2562d75076420e27b91a704f602

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\Desktop\ReadOpen.cab
                                                                                                                            Filesize

                                                                                                                            366KB

                                                                                                                            MD5

                                                                                                                            44b43fa7b378cea4fdc74c290dc887c5

                                                                                                                            SHA1

                                                                                                                            9f94e958d2581a91b5f248b31e9d2b70a76997c3

                                                                                                                            SHA256

                                                                                                                            2cb33088677d0e1c5ae663fed0c423c4fe03d22b4664b505d1458853fe940280

                                                                                                                            SHA512

                                                                                                                            0ebf133e8ed7167aa6ecce0d7262f7158fccd69e90ee2a1cca6714a78345c9908c13e65854228137f36a977356ed3df06c74070266a80ebffb744f06627c68a3

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\Desktop\ReceiveExpand.pptx
                                                                                                                            Filesize

                                                                                                                            1.3MB

                                                                                                                            MD5

                                                                                                                            74fbf682ae387c136259fa0a42463fcd

                                                                                                                            SHA1

                                                                                                                            a37aaeb5424e56fabaa56e86f607213a3db06a5a

                                                                                                                            SHA256

                                                                                                                            50329774148da68dbe171aa974bacbd26d8a813528599077f3906703a2b82686

                                                                                                                            SHA512

                                                                                                                            be8878ad17a731acf7bea2355adca61fbb828c9ac12c6093eeef64a8dd29021779890a383b3429b3e356cef4915b9df2ca4bd175d2ae2985d1eb59fa743b53d5

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\Desktop\RequestReceive.lnk
                                                                                                                            Filesize

                                                                                                                            565KB

                                                                                                                            MD5

                                                                                                                            3ecf62547b6a499fb8daf525cba2d247

                                                                                                                            SHA1

                                                                                                                            6249b7983b4af6f0c7ec31ee0182a1712bdc1abd

                                                                                                                            SHA256

                                                                                                                            b5a45feec7662b469a5314b48805d80355b3b8a3ed5f101940fd40b46d5259b1

                                                                                                                            SHA512

                                                                                                                            fdab51829afce09cd534401db16b9212ce35a8bf040cd98cc70a55e96a09b1060dfdbb272342fff4a0abd24b1382b2f3704490d6fd96620f2a7244370de07299

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\Desktop\ResetTrace.exe
                                                                                                                            Filesize

                                                                                                                            832KB

                                                                                                                            MD5

                                                                                                                            5ca8eee4c4fb2a2e2edefde9dd810d37

                                                                                                                            SHA1

                                                                                                                            36c89b2a5fefb17faa614eefaf181e24030613a6

                                                                                                                            SHA256

                                                                                                                            37f510b24a6d91b5cda624699c73af23b031f2eafadc0aa5a2baad508c39bd64

                                                                                                                            SHA512

                                                                                                                            2b0d9d23af318b7370056e5c5528cae5038ada475dc7af205545b5754f49928b42262ea491c562fad2ea5229dd758bb6f6784e39bb656c247ebc1d4b57e00fdd

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\Desktop\ResizeExpand.xlsx
                                                                                                                            Filesize

                                                                                                                            9KB

                                                                                                                            MD5

                                                                                                                            f0759996fc6704827efae95ff5f17fa7

                                                                                                                            SHA1

                                                                                                                            222f3af5ac1d1a464764fbae5ea273ad621339a9

                                                                                                                            SHA256

                                                                                                                            cae8b3c0d0c9f44b3e3db814efff394ff7d9074cfdaaebf8468f9d992a030af1

                                                                                                                            SHA512

                                                                                                                            675cc920873985164e07646ca2945207d93ae30a1291de9935b4a8ca34c203f2bda81cea27a35a1c6faa8318f3b696ade46e28da923e089872c7ec43e04596ad

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\Desktop\ResumeRedo.ps1
                                                                                                                            Filesize

                                                                                                                            931KB

                                                                                                                            MD5

                                                                                                                            d786f601d0853b20a10feac76ded097e

                                                                                                                            SHA1

                                                                                                                            82f1fd5543730b32019ee591565e3da2808d10b1

                                                                                                                            SHA256

                                                                                                                            d6c0f42d59d555b7bc9fb736387ed189c3ff6802107c235dc5bb7b6e783cecf9

                                                                                                                            SHA512

                                                                                                                            244ef3dd77bd548f9413cab5a1ea1535e296749c4d68f213b9ff605e9599a39edf99aa405ce983868d14f381941848a8b97b82c2203c0c343a460013ee6df4ba

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\Desktop\RevokeUnblock.xml
                                                                                                                            Filesize

                                                                                                                            765KB

                                                                                                                            MD5

                                                                                                                            e55a77998deff77b78dd8c21f07f3305

                                                                                                                            SHA1

                                                                                                                            d799c4108749913cf4f5560976e8e8aed110b9c9

                                                                                                                            SHA256

                                                                                                                            47a4c12a2f60b73f9617ce7024568a0ddb305a08a06001d5bc47be2c742acdef

                                                                                                                            SHA512

                                                                                                                            e4837e0377fb31bb34f9abe6ea8f73337b5f7a53996ce4ebf5eec625db634a9d371fde5c2146332d6571275293e8ceb4a3be21c9d6daee8cf6ee33ae36238b87

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\Desktop\SaveRequest.dib
                                                                                                                            Filesize

                                                                                                                            432KB

                                                                                                                            MD5

                                                                                                                            d75a33968fe3271bcf1886dda53ab0ca

                                                                                                                            SHA1

                                                                                                                            cbfec3538ce91a32ab5621a9467c15fc2455c45f

                                                                                                                            SHA256

                                                                                                                            1690298bf3630420e49c7ed699b2caf4631bf753cc580c1683a92029762d3d64

                                                                                                                            SHA512

                                                                                                                            26d10f82dfaf3619b84ee054e3a1411fca6807e599836846a8b381186df70838b3133606429a3ccfa994db5fdc603d4e7764de5b66a130aba4eaa98f80b81961

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\Desktop\SelectClose.txt
                                                                                                                            Filesize

                                                                                                                            698KB

                                                                                                                            MD5

                                                                                                                            afae0a3fc8807a31c2ec5119d700425c

                                                                                                                            SHA1

                                                                                                                            f3f9ee49e94723f025a4e866c15c91a18f966896

                                                                                                                            SHA256

                                                                                                                            24ca8274177a8f6b857304b8360862aac70fe48d708ef05d2a644c96a5b9a1fe

                                                                                                                            SHA512

                                                                                                                            9b67721d9f2915d542d1ebb79ebf754fa1f1ecc54501c854d86b62a7f26e3c45ad4d36f7e5bf86b5c7a965a44fa8840068b75696121f43ecc7a7d038d065ec36

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\Desktop\SkipInstall.odt
                                                                                                                            Filesize

                                                                                                                            898KB

                                                                                                                            MD5

                                                                                                                            ea3ef58f2ec23ac3ee36ea98d2f94e11

                                                                                                                            SHA1

                                                                                                                            520fa849345d0779a70796b244327238f4d09b3b

                                                                                                                            SHA256

                                                                                                                            b8588e07756b9eac49d6bf343aae2e8b2fb9ade63d71a74ffa2d894f3bbad82c

                                                                                                                            SHA512

                                                                                                                            8cc7845143c4a68e8072bfeb62cf873dc4d35eb51acad78b1ea7edb03e9bfc6868a72c68310e1a881e24a81103b967e049415b2f2935ee73d001c2ec0773feba

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\Desktop\StartOptimize.xlsx
                                                                                                                            Filesize

                                                                                                                            12KB

                                                                                                                            MD5

                                                                                                                            66c8d50b7e1b4c807aec8589348b8d40

                                                                                                                            SHA1

                                                                                                                            658a2a0aa12c56caaf92ccbc1a497ee0b2fd778a

                                                                                                                            SHA256

                                                                                                                            a940b48b9eb16f81625498548eea87d4b53c3812583d59f9bbb54c224c693761

                                                                                                                            SHA512

                                                                                                                            b46c357f4031d6c189ad10ffc52f9c9d522d28bac7eea71b605f92d72f89bcc899104dfdbb3e39b90390af6f25c77cb21968f06e18cc36e148fde6cdb7f4023c

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\Desktop\SuspendRepair.wm
                                                                                                                            Filesize

                                                                                                                            465KB

                                                                                                                            MD5

                                                                                                                            289722d7627af04dabe74c9a95c77663

                                                                                                                            SHA1

                                                                                                                            55c35e102861458005e56c3d9b94cfd8d6aca5c6

                                                                                                                            SHA256

                                                                                                                            37220f17d13a2016fe65c868762975597642ac378a9ce2ba0b4f4fdb248f1b95

                                                                                                                            SHA512

                                                                                                                            6389bc964594984c3621f6927095d68143ce46eb199f13b9207443b2b9d61d7467299ff9e66b6782a08281aa840c27830f2ed1f28069940cfc16b8a60f7588fe

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\Desktop\UnblockConvertTo.M2T
                                                                                                                            Filesize

                                                                                                                            798KB

                                                                                                                            MD5

                                                                                                                            6e09fba7e555b0a54b2a61355a167981

                                                                                                                            SHA1

                                                                                                                            c3bb4d0ebaaba708cda3b9f99c8f2b008bbec2eb

                                                                                                                            SHA256

                                                                                                                            03381adde680be62170f8a67e5bd30b902a09833f458003c732c7bca00517034

                                                                                                                            SHA512

                                                                                                                            8c8454279ef6b3b0efa88c155d4036e7bc010f1684300e81bc23d146551477665244d6f3caf15eb9ba4601a82b6d3f113c115f83d633b2a410a37ac6ce338bcd

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Admin\Desktop\UnregisterDisable.xlsx
                                                                                                                            Filesize

                                                                                                                            9KB

                                                                                                                            MD5

                                                                                                                            d2d429ecf707c3d614e50bbabc3d3083

                                                                                                                            SHA1

                                                                                                                            ab45f5e8843cabb36df626557eb4a04704c14327

                                                                                                                            SHA256

                                                                                                                            7025c2d2574820be12674513bdb978f036db67e268dd07b7af73e5fb301500a5

                                                                                                                            SHA512

                                                                                                                            dd8cd286ed6fd1c0af97d4bae573d6bcc52919008015ab67d5eb13695daa78b754690ff9cd0a7a70b707b3d6682d94593d8b79355a06cfdfba589b6c3a545889

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Public\Desktop\Acrobat Reader DC.lnk
                                                                                                                            Filesize

                                                                                                                            2KB

                                                                                                                            MD5

                                                                                                                            1d207ac7446b884945d1567b5ed29463

                                                                                                                            SHA1

                                                                                                                            4bbc2ee0d846bcc559fd5288b74c6847fd84b829

                                                                                                                            SHA256

                                                                                                                            8aab511b6ca1e271df2f4877194ca04f9ebc26ea6f898fafe23e386d1df74bd6

                                                                                                                            SHA512

                                                                                                                            32357f03a2217d03f3a1e667f5c9eb43c64cefae12c4cdb846e8a961f0319e5046232ad04d987fdb96d0efd0dd65954727882cdcb31c30bd63e10ed12c6fcdb2

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Public\Desktop\Firefox.lnk
                                                                                                                            Filesize

                                                                                                                            1000B

                                                                                                                            MD5

                                                                                                                            a0e14e2358a43fb81f9c102e65001aa4

                                                                                                                            SHA1

                                                                                                                            766a7f063febb009359aa50e064ae9de60f14d55

                                                                                                                            SHA256

                                                                                                                            3cbb608e3aff0898c83b64780ac9195bf7e5409f518ba7567e71813c9bde5e28

                                                                                                                            SHA512

                                                                                                                            4240effea557e46493ef155ee4705b104b9ef7c19160028311d93be89f466950f904432916acfcaaedd988e977248a9132a2fa59c4a6ecdd521f61a882bee0eb

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Public\Desktop\Google Chrome.lnk
                                                                                                                            Filesize

                                                                                                                            2KB

                                                                                                                            MD5

                                                                                                                            6633e2970b93215f6565087255db466b

                                                                                                                            SHA1

                                                                                                                            b48aafa2a6118b17a8c14c81e63f7155b407b380

                                                                                                                            SHA256

                                                                                                                            c1f8ef2f9ff5dbe61e4ec76792610d042157cc0adaad46ca02992c051a13db00

                                                                                                                            SHA512

                                                                                                                            f246e31dea5e8ab1bc2e48b403bb2e9b4034082c85fb5518c834022bbfb4df0db65c2a1930d5d3dddecc454cb037152c2fb5b34aab93fc172376367c4eb2ccef

                                                                                                                            Download Submit

                                                                                                                          • C:\Users\Public\Desktop\VLC media player.lnk
                                                                                                                            Filesize

                                                                                                                            923B

                                                                                                                            MD5

                                                                                                                            f545e8e3f1db1f92f73a9345ad4a5a53

                                                                                                                            SHA1

                                                                                                                            cf453fa6b5985136ddccb6a6f1734eaba6322a79

                                                                                                                            SHA256

                                                                                                                            67f318fc6905956476d00a47836e5c209f8edcd724fa29fb01879e4361ed21d2

                                                                                                                            SHA512

                                                                                                                            f408ded4841f432df44f311ea0562f83e89f9a426161f8952316d6d353c5f8013e61150b8b76d7c1125c98515e49e8d2ddea6a3bc8a25fcf1ece56026cc7a9a2

                                                                                                                            Download Submit

                                                                                                                          • memory/2148-64-0x0000000003660000-0x0000000003661000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                            Download

                                                                                                                          • memory/2892-66-0x0000028378B80000-0x0000028378C80000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                            Download

                                                                                                                          • memory/2892-113-0x000002837D440000-0x000002837D540000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                            Download

                                                                                                                          • memory/2892-77-0x0000028379C30000-0x0000028379C50000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                            Download

                                                                                                                          • memory/2892-95-0x0000028379C70000-0x0000028379C90000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                            Download

                                                                                                                          • memory/2892-98-0x0000028379C50000-0x0000028379C70000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                            Download

                                                                                                                          • memory/2892-67-0x0000028378B80000-0x0000028378C80000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                            Download

                                                                                                                          • memory/3424-176-0x0000000004C20000-0x0000000004C21000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                            Download

                                                                                                                          • memory/3984-13-0x000000001C070000-0x000000001C07A000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            40KB

                                                                                                                            Download

                                                                                                                          • memory/3984-11-0x00007FFF99433000-0x00007FFF99435000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            8KB

                                                                                                                            Download

                                                                                                                          • memory/3984-61-0x0000000000750000-0x0000000000762000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            Download

                                                                                                                          • memory/3984-59-0x0000000000830000-0x000000000083A000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            40KB

                                                                                                                            Download

                                                                                                                          • memory/3984-0-0x00007FFF99433000-0x00007FFF99435000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            8KB

                                                                                                                            Download

                                                                                                                          • memory/3984-14-0x000000001B340000-0x000000001B34E000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            56KB

                                                                                                                            Download

                                                                                                                          • memory/3984-342-0x00007FFF99430000-0x00007FFF99EF2000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            10.8MB

                                                                                                                            Download

                                                                                                                          • memory/3984-340-0x000000001C100000-0x000000001C18E000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            568KB

                                                                                                                            Download

                                                                                                                          • memory/3984-12-0x00007FFF99430000-0x00007FFF99EF2000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            10.8MB

                                                                                                                            Download

                                                                                                                          • memory/3984-1-0x0000000000050000-0x0000000000066000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            88KB

                                                                                                                            Download

                                                                                                                          • memory/3984-15-0x000000001EEA0000-0x000000001F3C8000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            5.2MB

                                                                                                                            Download

                                                                                                                          • memory/3984-62-0x0000000000730000-0x000000000073A000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            40KB

                                                                                                                            Download

                                                                                                                          • memory/3984-10-0x00007FFF99430000-0x00007FFF99EF2000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            10.8MB

                                                                                                                            Download

                                                                                                                          • memory/4216-184-0x0000023D54940000-0x0000023D54960000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                            Download

                                                                                                                          • memory/4216-219-0x0000023D66A70000-0x0000023D66B70000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                            Download

                                                                                                                          • memory/4216-204-0x0000023D65380000-0x0000023D653A0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                            Download

                                                                                                                          • memory/4216-275-0x0000023D66820000-0x0000023D66920000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                            Download

                                                                                                                          • memory/4216-202-0x0000023D54980000-0x0000023D549A0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                            Download

                                                                                                                          • memory/4216-170-0x0000023D53000000-0x0000023D53100000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                            Download

                                                                                                                          • memory/4216-172-0x0000023D53000000-0x0000023D53100000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                            Download

                                                                                                                          • memory/4216-171-0x0000023D53000000-0x0000023D53100000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                            Download