692d91829f721d300cb509269c5c3083177ae48b6bb891dd324cf2865d9cb291

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/04/2026, 19:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
svchost.exe
Size 85KB
Sample260421-xpcehsay7r
SHA256 692d91829f721d300cb509269c5c3083177ae48b6bb891dd324cf2865d9cb291
MD5 b9c1eb62f06dae2825294a956f72fcae
SHA1 ebc4b6be81fd34ee9346a14ea6590c1943aaf16a
SHA512 7063db3cff7ea455e15c494f74746e03f390938f0bf0ed292f97127f207e59b7b3083d9c3c4a800cf2a1ef5cef0653ee41b673900acc5287b37137aa39747fed
SSDEEP 768:trM5wOGvYg/zjMpwbea79Y0hz/T+9nV+OS+ztE+cKdUU0ZUQf8qyOHegyaVU:dGzGvYgrjMpwbL/hbObzIRRZUQUqyfIU
TLSH
T1118393E576E91CC9EA11933C85D6C3312A3CF9D0D7631B4B162076311F22ED1BEE662A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

credential_access discovery execution persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (3361) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 7 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.encrypted	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe.encrypted	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\svchost.exe	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\svchost.exe	svchost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdater = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdater = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe"	svchost.exe

Contacts third-party web service commonly abused for C2 1 TTPs 37 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
70	discord.com
73	discord.com
82	discord.com
89	discord.com
16	discord.com
21	discord.com
67	discord.com
87	discord.com
91	discord.com
88	discord.com
90	discord.com
3	discord.com
8	discord.com
61	discord.com
71	discord.com
72	discord.com
84	discord.com
86	discord.com
80	discord.com
66	discord.com
68	discord.com
75	discord.com
85	discord.com
4	discord.com
31	discord.com
33	discord.com
42	discord.com
63	discord.com
69	discord.com
78	discord.com
77	discord.com
81	discord.com
83	discord.com
79	discord.com
15	discord.com
47	discord.com
60	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4124	powershell.exe
3012	powershell.exe
5108	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4124	powershell.exe
4124	powershell.exe
3012	powershell.exe
3012	powershell.exe
5108	powershell.exe
5108	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4124	powershell.exe
Token: SeDebugPrivilege	3012	powershell.exe
Token: SeDebugPrivilege	5108	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 1068	1416	svchost.exe	95
PID 1068 wrote to memory of 4124	1068	cmd.exe	96
PID 1416 wrote to memory of 4264	1416	svchost.exe	99
PID 4264 wrote to memory of 3012	4264	cmd.exe	100
PID 1028 wrote to memory of 1264	1028	svchost.exe	101
PID 1264 wrote to memory of 5108	1264	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Add-Type -AssemblyName System.Windows.Forms; Add-Type -AssemblyName System.Drawing; $form = New-Object System.Windows.Forms.Form; $form.WindowState = 'Maximized'; $form.BackColor = 'Black'; $form.Text = 'FILES ENCRYPTED'; $form.TopMost = $true; $label = New-Object System.Windows.Forms.Label; $label.Text = 'ENCRYPTING FILES...'; $label.Font = New-Object System.Drawing.Font('Arial', 48, [System.Drawing.FontStyle]::Bold); $label.ForeColor = 'Red'; $label.AutoSize = $true; $form.Controls.Add($label); $form.Show(); Start-Sleep 5; $form.Close();"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-Type -AssemblyName System.Windows.Forms; Add-Type -AssemblyName System.Drawing; $form = New-Object System.Windows.Forms.Form; $form.WindowState = 'Maximized'; $form.BackColor = 'Black'; $form.Text = 'FILES ENCRYPTED'; $form.TopMost = $true; $label = New-Object System.Windows.Forms.Label; $label.Text = 'ENCRYPTING FILES...'; $label.Font = New-Object System.Drawing.Font('Arial', 48, [System.Drawing.FontStyle]::Bold); $label.ForeColor = 'Red'; $label.AutoSize = $true; $form.Controls.Add($label); $form.Show(); Start-Sleep 5; $form.Close();"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Add-Type -AssemblyName System.Windows.Forms; Add-Type -AssemblyName System.Drawing; $form = New-Object System.Windows.Forms.Form; $form.WindowState = 'Maximized'; $form.BackColor = 'Black'; $form.Text = 'FILES ENCRYPTED'; $form.TopMost = $true; $label = New-Object System.Windows.Forms.Label; $label.Text = 'ENCRYPTING FILES...'; $label.Font = New-Object System.Drawing.Font('Arial', 48, [System.Drawing.FontStyle]::Bold); $label.ForeColor = 'Red'; $label.AutoSize = $true; $form.Controls.Add($label); $form.Show(); Start-Sleep 5; $form.Close();"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-Type -AssemblyName System.Windows.Forms; Add-Type -AssemblyName System.Drawing; $form = New-Object System.Windows.Forms.Form; $form.WindowState = 'Maximized'; $form.BackColor = 'Black'; $form.Text = 'FILES ENCRYPTED'; $form.TopMost = $true; $label = New-Object System.Windows.Forms.Label; $label.Text = 'ENCRYPTING FILES...'; $label.Font = New-Object System.Drawing.Font('Arial', 48, [System.Drawing.FontStyle]::Bold); $label.ForeColor = 'Red'; $label.AutoSize = $true; $form.Controls.Add($label); $form.Show(); Start-Sleep 5; $form.Close();"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3012

C:\Users\Admin\AppData\Local\Temp\svchost.exe
C:\Users\Admin\AppData\Local\Temp\svchost.exe
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Add-Type -AssemblyName System.Windows.Forms; Add-Type -AssemblyName System.Drawing; $form = New-Object System.Windows.Forms.Form; $form.WindowState = 'Maximized'; $form.BackColor = 'Black'; $form.Text = 'FILES ENCRYPTED'; $form.TopMost = $true; $label = New-Object System.Windows.Forms.Label; $label.Text = 'ENCRYPTING FILES...'; $label.Font = New-Object System.Drawing.Font('Arial', 48, [System.Drawing.FontStyle]::Bold); $label.ForeColor = 'Red'; $label.AutoSize = $true; $form.Controls.Add($label); $form.Show(); Start-Sleep 5; $form.Close();"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-Type -AssemblyName System.Windows.Forms; Add-Type -AssemblyName System.Drawing; $form = New-Object System.Windows.Forms.Form; $form.WindowState = 'Maximized'; $form.BackColor = 'Black'; $form.Text = 'FILES ENCRYPTED'; $form.TopMost = $true; $label = New-Object System.Windows.Forms.Label; $label.Text = 'ENCRYPTING FILES...'; $label.Font = New-Object System.Drawing.Font('Arial', 48, [System.Drawing.FontStyle]::Bold); $label.ForeColor = 'Red'; $label.AutoSize = $true; $form.Controls.Add($label); $form.Show(); Start-Sleep 5; $form.Close();"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
Size 85KB
SHA256 692d91829f721d300cb509269c5c3083177ae48b6bb891dd324cf2865d9cb291
MD5 b9c1eb62f06dae2825294a956f72fcae
SHA1 ebc4b6be81fd34ee9346a14ea6590c1943aaf16a
SHA512 7063db3cff7ea455e15c494f74746e03f390938f0bf0ed292f97127f207e59b7b3083d9c3c4a800cf2a1ef5cef0653ee41b673900acc5287b37137aa39747fed
SSDEEP 768:trM5wOGvYg/zjMpwbea79Y0hz/T+9nV+OS+ztE+cKdUU0ZUQf8qyOHegyaVU:dGzGvYgrjMpwbL/hbObzIRRZUQUqyfIU
TLSH
T1118393E576E91CC9EA11933C85D6C3312A3CF9D0D7631B4B162076311F22ED1BEE662A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 71ccd39de69ec147afd8ad4337a36829dcababbf40897250380c7770de551242
MD5 2595e903fcb3b99996adb2cc2bf504c8
SHA1 89954e0577e83e0008d58a2dc6cd0aaad2972a62
SHA512 71a76aa25ce3ea545922ad9cee54cd3fff4c971ee4e5ddf6aa4832743db48da795ae8e76883cf5e5acab6818e8aba44515c72848579c476c54bda2e43e0cac35
TLSH
T1CA31CE4EA2113027D686BF72D8CEBE93CDB033476BCAD05B18455E8229AAFD11FC81C5
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 5e1e5d752033af92661c4ac0288122bfeff1430e690dd8774a0030125672b64c
MD5 a032982bcf5b454b45e3bc6559b8e579
SHA1 f938b32507336c5624c0a31f871c48f0796018f0
SHA512 a731e8ded7765e77a11b8fd25101b823f76760cd238bea1430233b9314837d69576036fbd2db43da00550ad2bebc80a15f2cddd5ec980d041503e6cc5f0ab25d
TLSH
T114C09B1177315736F1504ABF159659550FF5D7838F92835C0F74312C641B9818DF0D06
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 d7e3b739a45709ad3eed35822b05a9a598f5a1beaf47934012d8aaeee0dc5c39
MD5 9f7eb7c7847e7a8625a8cf1eb8c9b105
SHA1 262c06a0684ffb52700982488addda9e0767692d
SHA512 6e6ddad573de754ce9fdb62cd7a7b9e76622b46555607e2b7a7178e78e15f685f20ffa2a65eeae37606c5bb691514495fba55c88ea4f2ecabdda29d99b786101
TLSH
T15DC09B14736D4715F10D253D7AD5160417B54105F6D7C7054B78513485146404C71D06
MD5 SHA1 SHA512 TLSH

Submit Download

ActivitiesCache.db.encrypted

Path C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db.encrypted
Size 1024KB
SHA256 19a8b97a0e29f990aab3930a8516cd7b4936704ca34d55a27a9bd7d7cd831c03
MD5 72f9d4d74ba4e172de6bc81c5d827bc5
SHA1 25d0786f12a1b3ae2d96e8c3f7bd4cdc062dc53a
SHA512 1fe4d973ea8e15b4b75f3eb4c861a1150f24ea37b050a217988215fcee4684a1d6d4c9194257a644105a7175b9773cadfe9ce80db20c8235dc7231c91c59bcb1
SSDEEP 768:VsSCmHmrZKW1IwsmazRPSocV6UmYSdKJUrYijryXmHmrhmUkm+:VcnXLMRW6UmYSdKJUrYijryO
TLSH
T1B825B88BC481D774DC2C185F69625F20F2A6FA8CC645DC9E04F8A53AA87E6C2C471B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT.encrypted

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT.encrypted
Size 16B
SHA256 ff7bd8a126b08696b4c14bca0f03b96f693a0138647cfd88952fde2673b97b7a
MD5 0a0da93f2be9f5987e663b3c02a7c6ec
SHA1 e28d195dc4c9f26d1efe8f318bb01a5f5138c97c
SHA512 17139cb00ec5ddc86910bfbf74a13d5e420ec5123cea55a884df43ef3ff254e6e50a62c18b144eb32a72f12a7592d9e8c8422b459406df62d6913887d9c707b7
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001.encrypted

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001.encrypted
Size 41B
SHA256 8a0826710e586ee6d8654de3b8754c975bef34f9be9de145d55f75f0832db062
MD5 2c553978f70ae5777bbebaf7f830fd85
SHA1 b2cc3a14c15802b6c0c182386d6aff26da85f60e
SHA512 01b62234a07a22978058665c2e5d65bd9a4a41b70827c1f3174171bc0c0d5830ea8fd64f1d6b6004b51bd458371797ca69ec2051bff2ebcd5719fb68aae96324
MD5 SHA1 SHA512

Submit Download

index.encrypted

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index.encrypted
Size 24B
SHA256 0772aea927428d94dbd32a28deae07dbd6817f25c0c4e857acff4bdd341e9da7
MD5 96c37c0e8999707aed1769c98148dbba
SHA1 020890453bd5ae60232c88f06b6a7b93b54d078a
SHA512 ca3b44b858cb6e839c315d72403bf36c21193d4c6efc1887069645cab780622d27d8cab8362120cc4ed7d5de7ff02c566247a6815a5d73333d8205b4fca10329
MD5 SHA1 SHA512

Submit Download

data_0.encrypted

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_0.encrypted
Size 8KB
SHA256 abb4794397bc74465f4ea1d358894d60471e13a573a9547203f3a9d3124b3e10
MD5 c09f57c64a7af980f8ab6972e875cf7f
SHA1 2766c4f80602fe20dd09b852eb33859f59a3aa9f
SHA512 f7981fdc256fe82a1257e44ad9c033d5304f722d6d1059d37ee1a1a8b676c9f0c6a89df21dde38cb77c8e46aaf0af8b90ac0343bda37daa4f78c1c6f51a50c95
SSDEEP 3:tNz////////////////////////////////////////////////////////////X:b
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1.encrypted

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_1.encrypted
Size 264KB
SHA256 81a6e470eaaf11d025637018e59c350f60964a728c89130b7f34d98b4002b79e
MD5 4c63a1915d54047a4bd604aa90ea4fbc
SHA1 0ad023108344a4fc170f47ded3cc29f3276768a7
SHA512 3089f2950bbaf87dc8aa56165e5c8ba5b9afb2fc2c07117014268c5f475edde10522625e8e55b70402a8282f769bc588bc101786517c36c93326b739a102aab7
SSDEEP 3:t0ASLW/f/a///3/////////////////////////////////////83P3////////9:xSK/q38fN
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2.encrypted

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_2.encrypted
Size 8KB
SHA256 bcbbd5975ee1670b04621156688777c05ae111116adad5e708b41266f7cbe93c
MD5 2264bb9cbf6269c1f2167ead4a0a39c4
SHA1 10990bad26fc6581bacedc07cfe05022f432f1a9
SHA512 305cf083e6192649cce23440d8e44b7d42eafe52b1782596c04b2f36fde70fb86c440413180b7215e5d31775cfe175c4b88ceee92ce384b7d77f815c7df5712f
SSDEEP 3:tD/////////////////////////////////////////////////////////////X:p
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3.encrypted

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_3.encrypted
Size 8KB
SHA256 4f87e30ebaf698ae58e6007a82d478a134fd9e0a3a33b60e87f4f01a0c4940e8
MD5 3be7e6f75f29d244a19ae46dcc16d90e
SHA1 53f5eb7b6f86d242e1348368364a323586a6edad
SHA512 9bfc7fc884f0938b70758f1cb0cfc1be47bf8b52ba0a07db8a6bc535453bf96b6669dcdd9c4bd75d06f731709d2db53222e0767c34c8983710c1e601e0296719
SSDEEP 3:tq3vv///////////////////////////////////////////////////////////:G3
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 d84f53499110d4dfe73bf1cc9e6a0a167d5c02a18bd07e90d053b9f475eb70e5
MD5 a8abfac46fecead606749e07ddd5fde3
SHA1 b016ccf671ed81f4d1687c5614169bfc516b36db
SHA512 0d135b229051d857c360cdae26f974bbf70256c0743d0b1b56f9d2bc9b6e1671e6ab0e9711326f69563943f00d79d8a3b2ca3e1551a40046026d7a3e34fbc4bf
TLSH
T12D71EE323276B0D8C9163F071E2919C053BF4355EAA4AF0CB698625EDD2640B9F222F7
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log.encrypted
Size 3KB
SHA256 42d7e9cdaad26bdfed527012e6fa9b490caaa485a916db51d3ae41106b3257a6
MD5 dbd6cf953b0ba9ad5854712c200377b2
SHA1 55cd715d887b840828d839264d96050583ec2809
SHA512 57ce86d149476d9a22faeb08a446c4a59eb1eeba9a0621a95e13098b00a336ab4e77828f955fb8cf3648db2e10ffe211759305e47bb933747d6b04e89285c423
TLSH
T1B471AC2FF6CCAC34B45EB9CCEA02D566588233E53941DB062110BB7769419BB964FF88
MD5 SHA1 SHA512 TLSH

Submit Download

KnownGameList.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin.encrypted
Size 568KB
SHA256 58ad326876baeb50c720156b563cce296df437367268f09a767e75ec613dcf22
MD5 488713f71a47ba0a883df4dc66ed4b7f
SHA1 b4abaf97260dd66372930403c2048a7fd601d38c
SHA512 d296c9e814c2a2c1c2862ccd106a4a0e289f6269a9bdef400412ad61c893e1deb054aacf6a6388cf98d9711620859f939a940e40c8b26c99a9ceaa92b7166bc4
SSDEEP 6144:3JtsPTUdm9sXRTaOGC3UXwZ6rEy19ztRpVq:vaOLqwZqZ3Pq
TLSH
T18FC4528E4B3EF8F88475316C842D22E3D6B4E496C955E379AED74923F63841DA0DB321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00000004.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000004.bin.encrypted
Size 14KB
SHA256 4b400300e35e20762ebaf2e8c6801dabfa77d08f7490018cd1cc0d503673974d
MD5 6fdb6c1f1842c43581f8fac620c97946
SHA1 c106dec9c68fe69d60edf301cf960d1639103216
SHA512 25deaf70b8faf8b1f0b9404379b4b0eca4532491e5b1cfd0d673a62af7aff97b9686964ea3f957caf7013aa9a76417d5cf7acd6e49116bc6dbd8351a2e3e7433
SSDEEP 384:YsxJyqDHrcRhb/24/+cIzSH7xOCMZLg/z1KMGWrHbej3Vm:YI0qjrou46zSH7xR4gr1Ni3Vm
TLSH
T18652C0B29421EBFF409D06BE76150983A32137B4669678B3D7D39D2F57A5B10222C08F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00000005.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000005.bin.encrypted
Size 18KB
SHA256 497de92831f157e03063b5af5603277e2052033fc0db9448d29aab4b31da7496
MD5 38500238bfa0cf13fe53479e5adc77f5
SHA1 e9f0c9ae1470b00e932dc69477e3ba44c612f0f6
SHA512 da3447e122e36afbe0f469449eddbc27afaaa053a96b8c35b5fa3c32932d11ecdc09dac862e2c0bf71be04e4fbd22b4f83505245ce840da6c66e1c4fdc5df81e
SSDEEP 384:YSVGqobFcor3G5iZ3P4aMq43hvnge/FGnVisGcqRjOePtAlFP:YS5oJcoDl3P8RvnD0ksGcqRn2FP
TLSH
T11282C0A18F5B42BF6A64ADD8A9ADD2C0DB2E1374C2C90094E4CC4CFA995C1DB7847727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00000006.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000006.bin.encrypted
Size 1KB
SHA256 f677e63d8bcf7046c57377ef37cee150f590ec6839522a49b788c1e12de8b91d
MD5 064efadfa59936686139f0186cb71be2
SHA1 f91de00667ea26d46e3a52ecd8300333d784d348
SHA512 4de902de0ec3b57d1dad556e3a30f4c78017d51d53e28ce1af8016da352f8ff44b7ff9709af923c47451b79c4e4acc0cd6386283ba19d06e222c835cdbfcc4ab
TLSH
T1CC31EA3FD4925079D82BEF483B535861241211F9E56D81E47EA404CE537AC482957AF5
MD5 SHA1 SHA512 TLSH

Submit Download

00000007.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000007.bin.encrypted
Size 2KB
SHA256 0f21230a13283d0608490ec0af2c851929aba38ee3b961854707b8f9f1a2d217
MD5 f9baea5517bac7316b179516f7fc5d33
SHA1 c8cc104ace88d802b5d5cfd2c052a2689cee8669
SHA512 470bb2fe53e98a3b5ab32a4a15078fbd908d0d365c271e11d83a60f847f83c32408f833ec07da68670555d689b49a3926660feac220dc19c9d8e3e50d634b559
TLSH
T1F5411967C41D2EF090FB81554B10C4DC25B41AE8E08ECEE2B0E81B62AA441DD5DC8D15
MD5 SHA1 SHA512 TLSH

Submit Download

00000008.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000008.bin.encrypted
Size 3KB
SHA256 21840e462f0ac618eacdf5277fa90107d4d154dc40a164c5c2ba86ffd9d8c6c4
MD5 c51a9c986c6e273bb419483b663e3cce
SHA1 92868ec60707523a371395090b7474f1befb0b57
SHA512 9b6d409bc74f59f36c370d110e3c2ba8ce094ab6819791ee3083fbe7090e52278cf2c6bbe310a0ef96c3ace771a5d8852ae2119eee5c56b6e05466514d65213e
TLSH
T12F717EC38B0654B7683B0C3E9228A639967D75288C50D3708056F9120BFC85D1BF1FC6
MD5 SHA1 SHA512 TLSH

Submit Download

00000009.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000009.bin.encrypted
Size 12KB
SHA256 1b4a2d7bd0dbfeb99ccb974ef8e4853377232b0f5fbe006c775b48cb65367f80
MD5 cce85329bac006075ca292d487437970
SHA1 1eb49311dfbbaaa70314cb0fc1d39210caa184e7
SHA512 623432d564447eb1c4ee74968aa9696700d023603dc5676c1eb133714b2b54f8dd53a7d5f18e3fe015c07b25bd85b77c4a720df3dfece1aa1d96f4e0ed8d94e3
SSDEEP 192:YyQ31wtYFykZLCKObBx76iJFycRtT7d6O8Ir0G1hQ3qQJeJAwWz7yPLFMO8MNd9J:YyQ3qtYFykJCNB3tPd6gr9hQ3qQgWz7K
TLSH
T1D442B04B069AEE1C30E6A47C9739F1D7A988203B945BBC559C894D897C370BEC30FA1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0000000C.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000C.bin.encrypted
Size 5KB
SHA256 83049f447424e43ccc7c14395e7b17d4d5ace6a7088017c5437ca70ab41eec4a
MD5 25e16ddf9f6b4718a815cc243c8af390
SHA1 b9f2c192adfb07e8a505aa39edf1f293fe3c4adb
SHA512 379096ed4d5b8ddf0081ccf919e705aac4e8df2275b3c8fedbb58a4eac16e02bfe186d1917d763b7c6f6eb58bb4f2046bfcd9e6bf99da4d3950e1f085c474be7
SSDEEP 96:YaGZPlFULx8pYyvfBiVEIlJmEJ89x9eMwMKNOrpAEq5C75:Y/FULx8OyvJrcFQH/gTEqs
TLSH
T1F6B16E970372CA5BADB9C408129717B5360491EEDC384A6ED7E332B4D8C73671409387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0000000D.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000D.bin.encrypted
Size 7KB
SHA256 ea82fdf51d871a1a402950e054b17e8a3a986d171fcb19c7da52a2828e45424a
MD5 d7f536d03a5bddbafe2bdeb692ad6764
SHA1 3d665f80315e5bf5fde1f2ddfcd37b1c3a9809ae
SHA512 551a27002f755b7a408775a6be0c5d99e509ef2e8c9839beca1c70da831aa6967af651c93fb1d54d6bf8e4e2cab77a904fa65995f42308bf3e76f6b64636b1c8
SSDEEP 192:YwUYmqpq/dhEPJrrHih0UDOr9C0ESKrZivn:YwPmPvEBrGhpDw9TESaUvn
TLSH
T11AE1B02BCD915D844535BDE93D870B9E1BC2D397D82789EABF8540F63E411CE82C1AB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0000000F.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000F.bin.encrypted
Size 4KB
SHA256 379e47738710bec5a1c07adb0c137b5e8d74aea50be636a4153640ede85511c2
MD5 9db399f56be7d029d9ae50afc9835101
SHA1 07901134df2b2f843154b6deac8bc349571280c9
SHA512 19e44025a0ccfe8dfa29bab8341afe78af77773318e7fa2876ffcf7c07461712754732716592b37e1fbf9081125610db9db1202be9a71bcab1137219ac0d1281
SSDEEP 96:YIiQ2p9jcK/PLk2vRXjZqfhcaueJg+fPSbIk29a1gAaIdAq3hCF:YpQ2p9Y2Dfo59ueK+XSbAkNaUAWCF
TLSH
T1E8A17E4ADB9ED1A6584F6E75A419F3D046509D9E3B77C6C4FC296A74FAB4CD8400090C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0000000G.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000G.bin.encrypted
Size 2KB
SHA256 343ae90c5e0f23f025265973459929cde596dac524204fa5226684ba387750ae
MD5 c4a6c9f7b265fe1df2abdbcf504a9d4c
SHA1 3058cfa9b8f596cf79588d33a6c09dd5f37a8c89
SHA512 ea0a536ff6dd7e851d21c134a90e6af1ab31d477171fd55bea65ba102e493c7bd0f2686ca777bf8c9606a22bfddb485ad80884ab09ad68d40f20c8943cf181ee
TLSH
T1D6413B848000CA486BB62F9CA07C1BC203D34A978342CA546F4CB0F993A0D08E9ED0AF
MD5 SHA1 SHA512 TLSH

Submit Download

0000000H.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000H.bin.encrypted
Size 1KB
SHA256 d986bfcbcc7a778b09d44738e4abea595241e6626f749f4334194237712524e9
MD5 79bbc3790984d04a3d85960ad1fbff5f
SHA1 bcc6aebbdbd88b6b08754c2f4a0d272d19f07c94
SHA512 e9f648db1cb8ffeb94f89f575da659bdea13ba843554fee389187ec96f6f1f6f8da21dee44b05475f01a222612a9518390cf939f02df1b97e7ff3aff7b14cd3d
TLSH
T16D31D6236E47ECBB09B48F51D65F8B0A7D190E24F54FA00049D976ABD2B30AD1D01E5C
MD5 SHA1 SHA512 TLSH

Submit Download

0000000I.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000I.bin.encrypted
Size 3KB
SHA256 e7a6577759adaebd186753dec7d634fab6a274f9a82e1a0dc690906eb97574ab
MD5 51fad0f2c7dab411638b6cdaa6ec3075
SHA1 bfcf4789880aa37de934abe1adf80c6067897f36
SHA512 cae41b5185287c5a8258ff128175131637f2c1a333111a686ac9322178a723a8e42c7c8b47173f1f7e8683e361569804221e0f4b011c1db10733465e36d350be
TLSH
T157818FA591614F0DC1D357D8C4040EA20B17032F6A51C3FC1E1828B91DE76C6E3BE9CC
MD5 SHA1 SHA512 TLSH

Submit Download

0000000J.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000J.bin.encrypted
Size 12KB
SHA256 120ac5b1d6cb022a4b459a706a93264fddba1509e2804f5210e04ec11e2fb93f
MD5 95ec20c6f242a7dc70644b33d4e87aec
SHA1 70b3a8325e40d5bff92d960699d3e54d36809023
SHA512 da463ca961d54d9615a5c33438ce711c3620883d2ec99c8316ac781f5061053286edc7b5267c6e9d3c17641c5a3f86f04c16ade11d977f189a3c2dcaf7f6a058
SSDEEP 192:YH7q+uHACyz2EZ3rgR8H8b6ibsMtat5y+clBRF7F8B4Hubr6uZcaX6wkU4:YHTugBz3ERcRiePsjRi4Hu/6uHb4
TLSH
T18742BE38A3850F040CCA29BB17B3E3F1CDA16B6F88C74465987DF08AF865186E3970D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0000000L.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000L.bin.encrypted
Size 2KB
SHA256 1f3a270f147db5866ac0d79e403122039918710049bd46154e582ff4c2157258
MD5 7053b8ef95ca3f104c8b7949bf82d0ce
SHA1 3fce3f6c24ceb7063cfe160fbc7ba8cfbe4a3e7c
SHA512 f720f4201116f9126112079d6214fbcee1b90f199422ff0de3ec01e7f6ab8dccda49eba70cb02db8cc7adde95863d9534000df1650c773772003273bf1ed04c8
TLSH
T1C04108A0DBA56C55A9377A44350002FBE41004F9E42E838C2CAAD4237F68BEEA1B6475
MD5 SHA1 SHA512 TLSH

Submit Download

0000000M.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000M.bin.encrypted
Size 4KB
SHA256 eacb787259684592035bf05439fbd2be8b3ca68c9cfdf902ae510494b196d15b
MD5 0abe8bb50577d014411f3bd9944468da
SHA1 6a82eb876de1d91212e6bdec4b95cf3ccb4263f5
SHA512 79968dd9114b9b5560c9a1ef14647d9bec587a3b81380f6ed0e85d3a692c7f6674724f4a4ce30623cf74c4c37eacd0c6dffc17dfef3d25cc9890f0119ae78365
SSDEEP 96:YCYr1WTO5fyGFWO4jEVzGaq/kniyM+j/2A5QP2yS4SLnuiwEt:YI2fyEWO4YVzGZ/knTR2KqRK
TLSH
T188816E305C4540BCAB588A1C22B019C66F6558B3D8D28E067ED04B6A1A9C90F57FDFF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0000000N.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000N.bin.encrypted
Size 22KB
SHA256 bfd6cf27f4282f7810b35fc8bb0405d683bb0f8af32940010d18e5a89cfd4b99
MD5 47cb84620dc15ebf1332b4580a9d8c90
SHA1 91fed545ae1b0827a1c88097c0555104480c919c
SHA512 7e9c3353d7f1928b2f62e7189444dadac7c9e6e7cf4a686d8afefb2105e25b6847bacdb0a1753c96f0be178a95d26dcdf23047c9a904d711109a599c3ae49afb
SSDEEP 384:YqEqlAPxmTA75iBOKm0b01IUGkWOiweaS650o2oeyGb7dcks47Dzvd5QbcSXmVq:YZSAJpoBO9gRUHUUeyGb7dn7V2Io
TLSH
T1A8A2E0FAF7C7D9160495AF93FC63CDAC15D64D8C72D6B02A804D20AB46AD110E805D79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0000000O.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000O.bin.encrypted
Size 15KB
SHA256 e7e71c45437333762c0bdd03beae81335d06c4c7c58bbffef1f520bdec1a073f
MD5 390242cd52cce42f75fe63eb9e5ed79e
SHA1 49265b38c49947940ce785028de94b10d35a0748
SHA512 31d8b40615de47d0aab59720899d719e5134b38acc083ca7274e3eb1883935d91a6a0e789a46edac65c8b3a95f809589a61ac1186c60ef5e32dae6bef5939f09
SSDEEP 384:YPdz40GdijuZaBhYI1B1/VzO3M9GqNJSaRl8PV9KBJa:YPbxjuZaBmI31/VqaGsSaRlM8Ja
TLSH
T10C72D0A494755B2B0C29FF9078365766AA2EE5F10A057387CC35304F9BE792F6284192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0000000P.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000P.bin.encrypted
Size 16KB
SHA256 f5b1d0f6b8efe88faac64a3238c9e5a2bc75a4366616912a4491956a46a4b584
MD5 3d475692a23051facfc48f456ba46394
SHA1 fbfd73725eabbcd2d5a8a802ae1954478ac62092
SHA512 8e43c1c40f6cda2114fb5f37feb08cb32df902d5370ada8ef913f77bc7070f3310a4c75d2f06ba6ad46aa9c626fe514d8a414aac604e29e8d986156d405f37d6
SSDEEP 384:YINWQrXxN97SsvdJ6+33xumPviHN4CaW3e4iawCTQrQjULkwLTEg8Wic:YINbdN97SshnHcN4CNZqC6QjULZHEs
TLSH
T13172C0E6E70509BA4C65ED54510F3DA29C93BD7422FA249A0F06EEB3969FC909C24D33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0000000Q.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000Q.bin.encrypted
Size 4KB
SHA256 ec842b38fbc306099cb342f8098e532acdaaa025cfb2a634288ee3ebe3081157
MD5 d53fb2c7c00ebd14c2c8679806b17291
SHA1 3efdeb746ca7ba6ecba5836a7afff3e21b595607
SHA512 a870382e74a014b20646bdd6f965632ec3a6690e3e69aa065e4b17056a8ac62de5e3b8d2f163be87d5a56741cc11f9802bbe261fa46fa1fa07ba96d13e8e170b
SSDEEP 96:YC1665TPS9GhHQHIyD4Wabys4sbA+tPVjRlDn97yHxmVBabn:YoPEGhwHIE9qys4sbA+tPVjTp+HxgBaj
TLSH
T1F5919EF4E5833895BCF6E2DDCE2368C5F0129C5CE735BA04234062D0E25150B9EAE09E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0000000R.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000R.bin.encrypted
Size 7KB
SHA256 0cbfd955533cbb12cb53d30444971b18a6d919f803b14ffd5e375efb39d6fbff
MD5 754c1c4fc1d3e12b39043fa186c7c513
SHA1 9538e04af03802687c53962eaff44865de1306f8
SHA512 f1d8eb7b4f779740776d94bdaef6e97a533abdd534a71c4079fcfede12e39e627ac8be909989a8f08a5337d8910785f055a050352f909cfffa10df2a43fc9107
SSDEEP 96:YRbcnC+c+cklyamML8glbejhDiiE5e8UeSfCvO+h9nMAANFHPs+0c3RWuuX3b1kS:Yxq7rzke4Cv7QHFYuuXrijW
TLSH
T18EF17D3A6B43FB7D07128949125F46EE858168CF620FD93919ECF3A1351559EFC1C06D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0000000S.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000S.bin.encrypted
Size 4KB
SHA256 5a6b7bcffeba89069a793efdcb60fb94f452d39cd87e472be39170ae859f8c03
MD5 37c8e32bbe207350314ae8fbd8af2df4
SHA1 d2ec6d3aecfea6afc49bd4d5bc8b8c5a936d8e2a
SHA512 1a1180d8c223daea0bb15baf60c8e7601b800c18c39bad5ac1f0517aeb97c362d39456d834e155e56c45ae19424ef6c4cac732efbbd28339afe43699241e0846
SSDEEP 96:Yurp4rAmlmeGTKj/Z5rE+UaLb240cJNcTvcgy45Wc6Srth:YbvI6/rrEaCeNQfP6Qh
TLSH
T1D7818D51C087C7CC0E6BABFB3B1E96058E4660813EDFA9607DD36D148F25E881823E9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0000000T.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000T.bin.encrypted
Size 4KB
SHA256 dfc2e2852477b559ceab82f18aa965199498feb04d160cd0e686b73fd47526c2
MD5 3b230f04b24920f5a78069b791527203
SHA1 65a97cc4e5bb98e0f2bebbc360318632e8099627
SHA512 3f73ccde706d89ff36e14b130dc8705548b6cc62f9ea7af7d01000517f6859571b4432472df2f7958c9fc163f2692b59a807d51a7cec8bb7418f6bb5284a62e3
SSDEEP 96:Y/Bjt8Mm3c3yKaANz3uVOlRPHF0TC3We6c4fnP8JbdNZGn:YZjtfmnK7z+SRPloHe6cSnUPNM
TLSH
T1CE816E7F3C99F525003DA813E213EAB8402335BFD57B630F68111EE614C0295AE37AA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0000000U.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000U.bin.encrypted
Size 13KB
SHA256 85c53b394c713d4a6a6fd4f812489b19d8020d8b7ecbdd831213f7024f7c5ddb
MD5 3b3b10206d307e2606dd1d5384244736
SHA1 e16fa1359348806c5c477e533e9c02e4344d2062
SHA512 3f87f9534e7f52a4d883918f0acc78703ea74e66bdfaf5e067016d52e8204be5c99883e7909f47c07d3f382b896ca5c2590206642b9ac5c4645a08943650c537
SSDEEP 384:YU6nlw0FYzedrsTP6JK1J1FQ6k6j1pp6CmlP7:YU6lRMsrEPiWk6jlr4P7
TLSH
T14252A0A95B9F38DC54C1C0A61C56AC472CF0B330AEEA0699F385DD060EAE34CF65856E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0000000V.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000V.bin.encrypted
Size 3KB
SHA256 606234454a6709f2f4bda83c01226a7e947912588281b3f7dccd283471e0e058
MD5 efe84eb8d63660ca5d608fe89dbe1525
SHA1 59fe35cb31e7f6b63d9e209b5c646d473fce1583
SHA512 33025cf459bd77654f91b7d8093c1e254f4d31aa83ae2e5e6453e9a244466bcf21d7c28de2c3498edf0bbfe9f3e4f7a20f6cdefcfa78a0375f83a875dffa9d4e
TLSH
T10E816C68C12FA1142BB4805C8BF9508D896276FBE2D83131DD50D16EBB88AEB7176434
MD5 SHA1 SHA512 TLSH

Submit Download

00000010.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000010.bin.encrypted
Size 1KB
SHA256 15bf1323c9c0d5df245a4ca8fc4a799062fd05aa33775c6fd20b49da4c67257a
MD5 adbd3e3353a53a2a4c1118d7c091bdd5
SHA1 6223fd7034892b2177b6b9162c5304018708b3bb
SHA512 0e57c84bc8cdf465bba5b74380998b242b9edcc2fddd97f9223254137ae1cb508759c0a0eafe0b1e1e34d64e0e026fab738a57dba0cf4909ecec61ba4376fec9
TLSH
T168411BCEAD09DCE4594CF48695AB06AD399E8333D50740FC28957C83AF28176BC324CD
MD5 SHA1 SHA512 TLSH

Submit Download

00000011.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000011.bin.encrypted
Size 2KB
SHA256 84143cc197d9fe13b00474c8b43b55fc98320abaabedb0e8a12404973910cc3f
MD5 1cc3ded638e218108d9d9c20d7ff5cf7
SHA1 f6fc44360356e1f023395707d5241b405b08dd0b
SHA512 037de40a233bf8f78acd266a1bac670c6409f063ebba3818270113539d183492ef09acb6e4d43e1bffb2b3c0b3a73b1c9f24b93c390e90a348c89bfa4ff74984
TLSH
T1CE513C4A4E8926A457FD0D50260F66E64355642CC6DB513273B1CC27C5B1A311CEFA70
MD5 SHA1 SHA512 TLSH

Submit Download

00000012.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000012.bin.encrypted
Size 11KB
SHA256 0ee2a4a12c63224d2b6f2c4352684b2055b568cefeb2dd8b0b5c6893c19a4dc3
MD5 c343663a0660275cdc82356dcd56cf75
SHA1 22e391700051360a89e5ad309250c153caeb41ba
SHA512 bd6d5d4f1a525b3dfa418fb64dc5f1f2325ab1fa7f3faaab874e7af25790d3e9c18ea49bf339d586283c05a80228a30da9e5115029b9c993e60d7ede6e093aed
SSDEEP 192:YD+srpWdXqm2bSHmeV8dXfu48+/wn88888888/tpQzuWCes1bha70jHG/eaFrnPY:YDFpiXVDfVSL8/AAe76HG2yPY
TLSH
T10932B083FB3BBEAE5EAB3D43E5F79550518207491CC8B6B7C634884E0051E14EB607D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00000013.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000013.bin.encrypted
Size 14KB
SHA256 5f950506bc6a8044ee5fa83c161884f25a0628e0bbf3cb44343ef37016eba6ae
MD5 00a9917d8963b07f80b6409fa76494b0
SHA1 9a3435d737473e72e62313e325bb036f32bec321
SHA512 4202cbf23ad1803f25ccb37e6efc179cc73b7f446a105b161ef52ac13e437f5d4775e3b696ad5608c6d618e20812c8524b6cc3494dd361cc48703010925e13ca
SSDEEP 384:Ypf1AjgfjO1yxpD8kYkQH0gEsuenBjhWm4o9:Ypf1A4jOcxpDlYvH0eHLP
TLSH
T1C862D0DBB7A09E3E6485019FA4CDD7E8610644C4DBC6B11A60B2C912DE7F384AB477F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00000014.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000014.bin.encrypted
Size 11KB
SHA256 5ea5e99156ae6394ffd4d1b2553499a359e814e2ac923e5ab48eb04a115ce8a8
MD5 53e8bea81049c2ba49edaa7332f47e7a
SHA1 5a4c4b5d248f05ebefd463e04d48a70dbb218a82
SHA512 ae6403182ca07a3d5c5ffd8fa259c8ec0b95b473dbeba0d8b4c2e295b2f28466086b86acb4756ed457027c39191e46b56c8e7b5d465837f8e066f6d0a924b49f
SSDEEP 192:YNZ1mKANG6kJTuHDJjT6HYEPlt5wTBQs3X8vmrtCoR6ef/V9O1rgtA:YVmr4TqHx6HzD5wT+28vMooR6carz
TLSH
T1A232AF5EA56FE4BD84112D6F7A99FF7D4644D09CC1C9BDDAD638DD32736A0F0080A288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00000015.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000015.bin.encrypted
Size 12KB
SHA256 2434c6698b685498dc5377767e289ef5e3152d05bf07e094065b68b18b823175
MD5 8f150eb6d62e7099a773a0d8dfdc7196
SHA1 200e2a65fdf0fb385d71c7aae78f339f41126de6
SHA512 4d5dec4e33a33458b1736a94f0925e05476d5cea525d6ce1775b393d42afb642e8b8afb3abca2c7bfbf27dd1dd1cb8f20ac27cb8b1891b395194b524af0fbee1
SSDEEP 384:YLhkPFy9WDaKDOowOyFYqEguT3F/wGZwGT:YqPDFDXfqXuTNfZfT
TLSH
T14D52AF8BE2DB107099D8E53398F620A7C5E09FACD40942E0194FE6B3149A1DEBC753D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00000016.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000016.bin.encrypted
Size 1KB
SHA256 d3541cb15b9c033dd1641a746d405e1d5faa4532542f6b3ae41ef8888432a375
MD5 dad87c545ba262e9dbc38562d443c625
SHA1 6298f15b45295eb823caed5fdb51358ae9aa4950
SHA512 534dc82a545636ba29d99b7ba05965192156c3b4be78888560faa4aba03475873fb8d29c481afed729226062303392ce41569867ae123410d5c222c07c2341c1
TLSH
T11531EA7B9434C06472237B0FAE2E6825874307B45D70AC2B52DB1C5F08711F1A81CB9D
MD5 SHA1 SHA512 TLSH

Submit Download

00000017.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000017.bin.encrypted
Size 11KB
SHA256 785e05fcfef37839a696fe84c3d1ad2d894ab998b21ef028886bb73edae742ae
MD5 e338125eb86a43e8359e21439644991e
SHA1 12942319f77f95a3243f56967c28adb843fcf86f
SHA512 079a8ac2c6413522135824fa6d746a06bf86a93190cace133be3efb50d75c935636506a4986f41492047c348b348260abaf1482596d3f4e7ebbfcc62898d740f
SSDEEP 192:Yp7KQK3hhxhklTd4aIpqAGf5BjU1TYW72XlMi4oqn7OgQzB/jhnVGcAPwc7QR:YpjK3zenIERBjiqXlMiHIqT/dVJaj7QR
TLSH
T15032C02EB5DFDE05C4BF2FD286017D7D81911145C3585AAB4A2B2C3C960493AC2BE383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00000018.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000018.bin.encrypted
Size 2KB
SHA256 e4b0d466c17131f57b1ae5817448c936d8c99df7eb29b05ad760a50eeb5980ad
MD5 74f032da5dd256b3794f69469faa601d
SHA1 d78a398ee33252561999f6140147c66121ee0e79
SHA512 0177c355a672a97eb6da7689362e07f82c8a7a223d102779280c14ed5ad17ba95867480c56a4ee3d26a3a83b876bd05cc92b2417035fb29aabac0d465a77b789
TLSH
T1464139F6870495C58439960AF867C4C1D654B7FCF1838EA3A6043D7B6A011ABB0029B9
MD5 SHA1 SHA512 TLSH

Submit Download

00000050.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000050.bin.encrypted
Size 39KB
SHA256 fead14b6f90e5bbd42553c373710c9b3b4ea706db28662a15d40fe48fcf15439
MD5 c5d419047be7001b49429904a4fb553e
SHA1 ad9fe0979deb1433752ff3687cc7c430ab190bec
SHA512 e1afb773581108d81f26c5493da157ff4dda92f66438173c7f741c5fc4927713ab87f5cdbb084b6e0dae6ac7cdafeea87eef3214cdabc6e2586bf6965e9e4b7e
SSDEEP 768:NgdL+LKYdx0lVBCUAbGlFGWhusOeNbWkYaoKD6JJ:pr/0784UWV5EvanD6JJ
TLSH
T19B03F103F243B001A9E73D7E19363C89A7C69851E562EA09BF52AC317B34DE86DD90E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00000052.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000052.bin.encrypted
Size 23KB
SHA256 c10ce84a19749c838c25020208d1ac9b3cc1d6be4a6cf82064118d036a9b3ace
MD5 00fc5e8ae26017a0e0b1c6b7c4d84d5f
SHA1 59563689dd2c29ab4598b729f32b5d1161d11c1d
SHA512 16b2a07548652bca58ca680af620ddedb12a23e245f85dc90cd7395326707e6513c4225878f2d7718c1e712ef72d4503aa3f5bd17a6085349bbc14807d97c47c
SSDEEP 384:VZNnmEY/xV+ncWccJcXYxPxEZkFGFRlCND5zE4bAFweJLTELmtYY6pB6/olq06Lj:VGvMccJqYcZ6+lCB5zVLLm96pE/oktLj
TLSH
T13FB26D6B74E8FEC8D509AF2CB17A21E57FD25402CB8CC75811B924145E3047AB2FAB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00000054.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000054.bin.encrypted
Size 38KB
SHA256 2ca178007d081f702f615133945b82fa7631b516d1c35754933ae5c7423f17d0
MD5 fef9e63f5bc06806e88e4190bb1b2dcf
SHA1 89990c9a020c3239c33feb2128fdc4911e23647e
SHA512 81ff0349958b3b121da9c67ec41022d6210138577df4b6d51b67747906453851bae6c5a3ac628150de0803b2effeff3903c947c488e0b176239a93ee7d209bdc
SSDEEP 768:3k2HS4yozpENcDgoAvNYBISdaas58HM97pAKkmN:O67g3vNYCX58sJ9f
TLSH
T1B203E12F39ED1850B325FC2C0BBE87380019BD42DB45D296745369599DB87AF0E6ECD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00000056.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000056.bin.encrypted
Size 58KB
SHA256 a7ed9afdd149feb1d0f6ba14e047a2e81ba2e7422b36328a0864750b486ee13e
MD5 01cf1cb079fe771c5083aeb8a1fc86b5
SHA1 01050a503f373bd0cd132f81dc46edcbad15ff9b
SHA512 d6f114fd82f6bfbe24cedea9e5bc2a67e90028d19fd35717097365e16110abea34b76bd1b1e3c085063bb8e2b3c45a83cabcd6bf019254de2363521e7b574735
SSDEEP 768:WjnFy+w4Q7HAC92prqTd74CPDrWvjZeMAFY3V3pL1XBCXFS8eYTLUFHwI9Z9mN:WzFYUCbRUQuvjWFojG5TLUFff9m
TLSH
T1E743F1A2A0DB7F8587817C7C08C38871D2E1754BCA597AC8B632A4BC4E674F152B763C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00000058.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000058.bin.encrypted
Size 27KB
SHA256 bbf22666fc70bce35e23c54f810f165f8dc21c0928dfa729cf86965129af85ce
MD5 0ecca99dd74475dd1a25e840807169d8
SHA1 9abf0f3eaf3c606860c6718a787dc75667674bf3
SHA512 9b0131bec8e832e5d7a34229b67718e6345538a778a7ebb4d589949a55e86c4b66d2298905a99c3006bd978ca582f8c12d3b6f997e546a5db175922e04e1d191
SSDEEP 768:plBrE9NxLhLAQPz+cYOtmkWJ1CzDyXWqMBT:plBrcxLhr6cYO390bc
TLSH
T1B0C2BF76B498C725C5C4FD3C38B15495A7941E07DAE8D7ACE6B08C293DB0AB921B930E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0000006D.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006D.bin.encrypted
Size 21KB
SHA256 da34b7c09c03db2f8c0564f587e47eb69a5bffca1680ce02d6a5df1eade47879
MD5 6939d23ea1366eb4fd1364226cede1c8
SHA1 b05e6b8796a6e3530d604b4a04b0919046b5368a
SHA512 565b1c6a8f915020674d1574affc98c49b6058cbc5362d955cc16be19fde74d4815ab8e944698335980662cea309c36ad9858c24f39e37ede0750395d971f794
SSDEEP 384:7RH/r+hSxVg/rOD8L26r/+MePloz+KJteIII+yck2smf:7RJ0OD8VrW5Ploz+KOIII+yNfmf
TLSH
T1CBA27D76349BE708D6C6BDBC1432549A33E9A046DAC4D76F3BB02D101E750B0C9FA7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0000006F.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006F.bin.encrypted
Size 51KB
SHA256 9fe8c9fbac7ca315562fbcae1ca2fd45966ffe9cdcd58834588613b38eaae70d
MD5 33687af1447b5601fea7b8745a6eae1c
SHA1 381cf0f6753ce43e09bf9d36982bdc616dd000b1
SHA512 4944cb837d070fbaff9ab4faa2cede06ff66c78ab546917cfe354c9f25946eb07d50126b84ca3cbdc57d0c3b3a8ae656eb83b2b64afdb54fd029be832b1f12c5
SSDEEP 768:3Ie6B+WE9D5fcFpGMdgj/SO6+obfk9jD8BmufH+LxK8Zx+RptT/j6PXhDRMOWOF:3IzBPeDSfHIuGDFufsFZxUj6P2OF
TLSH
T1D33302B611E19A0DC868534D8F92DC227580628DC8D1C539773AEDE8AFB28E0AE545F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0000006H.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006H.bin.encrypted
Size 25KB
SHA256 fcf7e737018fac28b0e8cf96a5a8208fc967030f6b2af4ae7e416292a8dc4545
MD5 7ece881e63406e31f2fa312610413e86
SHA1 b95e9c88250f851c247763351d5510fa6288b8c6
SHA512 958810247e3e57a9353a31693efdc1724a412409aa2130575c5cfb0a03fdab7c4bef4921baab27ed6f16980c9ba9b58528dafad3d71a11f26c078e4c7ce3f9d6
SSDEEP 768:DdRtTM1XHOLtxl74+W0hZfYcSl+ZEPzXlUjl57:DdRo4J7pW03YcyLTlKn
TLSH
T178B2C017FBA1D816C2A3FE9C4AE6930575605D9ACB10C5C539E60DC3783A8E573CE430
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0000006J.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006J.bin.encrypted
Size 15KB
SHA256 27abe0bf357f41f874cb088d1510835104e0056486e0e64b32ba415719b4f5c2
MD5 2e9c7751bdea4dcccf408ab3c2c07be1
SHA1 5bf661a795daa22a1ae430117dbe32f81b612f87
SHA512 a9ace4ff4860daac1d0d48d6df00dc7a4c42737944637cb4abf4f2d1788c01598ed00c8f1956f4dc0d070dac7f2dd69fce3830ef5d3d3288296650850b8e9fd3
SSDEEP 384:y47oUknKNxMxrYW4UX2HDLy98+j9Tj5Em:gUuMmYlUGHDI8KnZ
TLSH
T1C7622BB7AE274C644477317E86F22AB5D8603282F140CD0A3F14EC06DBB2DA28EA545B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0000006L.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006L.bin.encrypted
Size 54KB
SHA256 0378025c0e584199feb950c39bff4b29ccf65bd1954800e46fa62fe3a00702de
MD5 c5aa9a4b9bf1551cb4184ac95ae71eee
SHA1 34a54d2c7c9496a69cf435b87e3fcc838a8d1778
SHA512 c45d98355ae6c4eafff9a106aee0a24a7761815d497e1b5c00a789e2fb102b6ca4bd0e04208f79febe68d2f3f696449c20fdd028c56f221114ee010ac23f7530
SSDEEP 768:zCMSuyqIeTBegdCRAAX7K5vDvzGYIvl2I6fP4WfcARL/o7If4xiiNFH/odMSn:zbs4egdCqAX7K5vTC5A+AF/CENn
TLSH
T14243F16E7815C06E1008B70EB89CB5251A1FE894EE4BF1CCFB5C479D863D6C4F0AAA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0000006N.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006N.bin.encrypted
Size 40KB
SHA256 41254fa6bf2ff3b12fc5dde26150b6dc483b34de7478d158080c41d84bf63ad0
MD5 4224d81b70c04a0db77e966851f397cb
SHA1 63dc042df8c30521d5bf633371f0531179198fdd
SHA512 5cf5ed1595e5ee0ca903f6c03a20d0b6f4b22634961b3d547b425aa25679cabd7e000d8e1dfa139312f7e3ed792c960a00f014c3cf44435e0e56acfa45499df5
SSDEEP 768:my7B/cux9UoH+c6uSY5PPYPW6l90npJNlueGAks/oqohjyUauhuc:melx1+luSY5XY+6l9gNlEPVqojj1h5
TLSH
T1FA13E153818FFE02C639665D4600693932D6F536C482FDCC72667C36A9FA4F9A3E8941
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0000006P.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006P.bin.encrypted
Size 13KB
SHA256 44535fccdc4ec50f8498f3077a009e5e52b8809709abc62a91855a1d81398359
MD5 746aea2fd6138656d1d4b4afe9ab1ae4
SHA1 c6e92f385018f0a656b89188fbc3b6754551a959
SHA512 984b7637ca1530a7eb729e6f60fa437f7e6ced6eb24953fcb3157bec2f7371556132c8e455488182bf65cf636097b1d1b59d5e0667c3feb70de155c9ca913ebd
SSDEEP 192:y+vLeKY+xbT7yhRjQ7qsgCgTdHXIZ2FPPjKfTOumeqVS4QSpH:y+vx9YRkTrgR4Z2FPrKr+XQ6H
TLSH
T16D52AF6E7BBDE82D2234BE9D4849F04542167B5CDAE6E60CF7651C21CDF98E60C4038B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0000006S.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006S.bin.encrypted
Size 12KB
SHA256 502023199a34a72b56b1d61a3f823392e7fddc0759c7b8b5b5201bf1017717a1
MD5 f5ec784f4f24bbd84640eb6364270eba
SHA1 6b87e0cf14a98c3b3262bbfd6430fa2554f6e056
SHA512 c4a6f62e39a40872328f0f5655924ba98f1fa07ab2f3f46d68a5b83daf14f98afcc64f1dce85abea599cc1b4044dcbf0cb9107f56fe21d3a427095f7a5826565
SSDEEP 192:9XOTdDa/KKMgC46MgC4Luaa/K/OTd/sNQu6OTdLFo9Z9Z9fuU/ea4JneHzbZsN:tOVK787/9OCNwOBFo9Z9Z9fZWa+eTbZU
TLSH
T12F42F657C1C2ACD987E234F6AA79169F772C68B1D9F7AACA3B09608121083C16E37194
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0000006U.bin.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006U.bin.encrypted
Size 2KB
SHA256 0a965c99940e8cdbfffce7af98ee318bf58e9a8c2e94289406129ad82271cdf3
MD5 075d8d71d09a773571760a6bd093e27a
SHA1 1013e5f5f90065b8d72c1f5f30fa07c74b3c88a2
SHA512 51f9d995ade37856c131e5d3f904aefc6907eaeee456fddb3384e3918b632850721c523db409cec630f5176bdd11bd2fdcb6f514eb30c7f5c4dff36ebeadf33c
TLSH
T16E512A2B412BC2B5F095BD1F8220AC0CF19CE8E8CF8BC545AB2641524CB5254F0EB726
MD5 SHA1 SHA512 TLSH

Submit Download

iconcache_1280.db.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db.encrypted
Size 24B
SHA256 7e9474954430b1499eddae6cd75f65b624403fb24e68f1a65caff3e08fad6411
MD5 b289f5b7b62eeb9bbd5359e123088328
SHA1 10a83ec3bf23cf1dbf6d59c730b0fe60e637d9e4
SHA512 a0e267a7d6ada80c238d75af3c445edbec80011d02034fed5f774d4b315d132982703b79753dc7c4a1d88e3cac20e1a4fc0a1e9f954af7aa46a5f96a14095599
MD5 SHA1 SHA512

Submit Download

iconcache_1920.db.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db.encrypted
Size 24B
SHA256 8a240b79c4384c090a74e7ba5632a89194f6dba0d836191cd46ea9d8cff44e75
MD5 56015aa864913fe959d6d7616aedac1d
SHA1 3faee1a0cadb9dc5704d4adc7e2948cfeed0e34b
SHA512 6b2dec3d4ffff0fc4704809895ffae5ae70fad2742f652de7c8df3ff727baeb25184c462578c8106450bf38ff38dcaaeba0063541bd56f1909eb0c6baf9f3c64
MD5 SHA1 SHA512

Submit Download

iconcache_2560.db.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db.encrypted
Size 24B
SHA256 66716e7785bb5aa702f0bad57c12e361dc8f0b02026c13e100c04d48de4ad3e4
MD5 e9e91303bfab8f674d62f69809bb8cd3
SHA1 764c2f8ab77a952e4ee5b15bc4ec527a50a71a72
SHA512 0c085dc914fa22d819777fbbad1321b1b85b962870d19c68e99c3d85ccfffa17408e251f0819c50cfa6fe4ab30cbc92919a16f155ea0cf1461e361b07b594ac3
MD5 SHA1 SHA512

Submit Download

iconcache_768.db.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db.encrypted
Size 24B
SHA256 0b436af20f2cb0f91627f9c2491975de217eda260090991b83f22ad8d40ab236
MD5 b9a7e8c6d1b9074d5417dfa16f4b4d32
SHA1 4eab11718c35674361ba700cbb39f4debcd83cb6
SHA512 c1572ca7e129a803cb4e86cbc9e3d225d1466b5869e3b7b9ac0d710cf6d9448e812a2d966bf21d4e56ae17f70655bfd0072ade88d182979fad04b5081320a8a9
MD5 SHA1 SHA512

Submit Download

iconcache_custom_stream.db.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db.encrypted
Size 24B
SHA256 60bb0d0156809b08c5f87f05098c2706d58123849b615a7fc2bd2fa947ad80ef
MD5 be3a2080d1f33c63d28d22471fc36ee8
SHA1 c8e63415ecedb64a8bd38987c04496b6ff920477
SHA512 08a5bb105e2f943a258e90595c9ce9c1194cab5b17d9629eade33956b30c70925bc259ed3146ee02c86893de65f5c6329a6a69566931377e149ced125bcc9fe0
MD5 SHA1 SHA512

Submit Download

iconcache_exif.db.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db.encrypted
Size 24B
SHA256 14a2cde7a79a51856d544632aa2fc3ca4c8ae1471560c24014ed95b8fe7c4eb6
MD5 29da6f0652794ce32354257572d23d27
SHA1 1a42d73c986a746edd6fdea1486315115626811d
SHA512 d61abf7e9b356340f6b578cbf99d75966ca960bce327bfdd450b266d7f7c70b0579de30d559c6ffe68da3eb2d2c8be184ba8a3bc08e99ba16373ce09c8525b8c
MD5 SHA1 SHA512

Submit Download

iconcache_sr.db.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db.encrypted
Size 24B
SHA256 0e6396e3f229350a548a2b0decb7115de9629557ea24cd3fa4bdcbcd88b7bca7
MD5 9b6a332653454cf7939b2a28169406e3
SHA1 8bc8ef92021d5447dd58d99dcb73540765f99e7b
SHA512 554c87c7a74a427d9a0f92ebb265d29d71749919633720431b1dbc119474b5a054a03a0b6d3055a925a783d420b0f2e40388440d0a9edf3a042502a4312621f5
MD5 SHA1 SHA512

Submit Download

iconcache_wide.db.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db.encrypted
Size 24B
SHA256 9acfc787ca5cc291eefc4d52df7645e0da8b4e59e1f3dc7086e3c88c40a3ad1b
MD5 35f2e816638cbe8e37f63866e4d22cc3
SHA1 0d8e5a2755c2a9ec70445c8c54e76f1312362b67
SHA512 8e0482f3b431048d593f9c4a3024ece27164541e03af6a4e902418e58bca2c6248b052672fbb672c85f430890343b70663a2e5e9cab61e99633eb127882575f8
MD5 SHA1 SHA512

Submit Download

iconcache_wide_alternate.db.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db.encrypted
Size 24B
SHA256 0a7764bc1ff7823ecf19333059c177761e67fee94d3787c2d3967b6bd6385b25
MD5 d635d1bc3255d842daa65ac96e2a426d
SHA1 5e826fea006cba9891eeee599ec340f80f1a82f9
SHA512 42afe133bf6a49cda4258790f7cb6394528864ced143598e4c1cf93bc60baaa0abf5fd9aecf010a10b437700a68599334050ed2741c4f170124c002b82bbaf62
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c29017dc8991d3a61f3dba277ad454b455df950b9b6fa56459d09f669bbbbfa3
MD5 212de2887ca86ad370a8a4f216d4d9b3
SHA1 87d024a86dccefae7faef166edd048e872ca2b91
SHA512 15ba5ae34c1e069647bb7c5d303129d8119051a62df4650542b090c5d61babaf953d6c7cb9f7bad3f124bcc341337aceace09d972125ad16d7ac2dfe4f4c9e71
TLSH
T1E2219823F39C8522CC8A113A408DAC1072B596D740EECE8FAFC5D205E17F484CB72594
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 793f2c9c18d22fb8417f751a6fef9d7d20cd9dae4c688db88b35ff4ae015ce74
MD5 d1fc2dc2d982e0b5330c4b627ad7772e
SHA1 208825a75a4b5bab0d60b49a78eb39c6dcdbf8ed
SHA512 10711a6c441a7d555d7c6fc149346210bdca0b3750145b0a5b1f21d643d0c11c7f0632adb9859ef0d74433694f78027161f3999b92178a93e207eaf5ba0ae0b9
TLSH
T1BB216823F39C8562CC8A113A509DAC1072B696D740EEDE8FAFC5C605E17F594CB72594
MD5 SHA1 SHA512 TLSH

Submit Download

V01res00001.jrs.encrypted

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\V01res00001.jrs.encrypted
Size 512KB
SHA256 0d57ce7e6f299b77f1aa75b8b0198aaaa910b6fd2ea09bfc4a5fcc4d2023f5d2
MD5 9ae01a8cf536f8898630029e6cf6e699
SHA1 ad48f049137c3fd5aef02cc3a32a988caee025e3
SHA512 672767a35524e6efcfec863d5bfa97645a319c6dbda7216cf4b926dbcfa41b1aab78a02ff3c3374df640500859c947930bcd762f176c1878b688c17f0937c688
SSDEEP 3:v//////////////////////////////////////////////////////////////P:n
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat.encrypted

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.encrypted
Size 8KB
SHA256 0dcc6d6f717c80803a21e7a85d235f9dda86b858d83d0339b11471747cf7b154
MD5 2a5ab7b5e2d553471cb76b0684f689e0
SHA1 c80127cca5aefb88693c7265abb08f417f424976
SHA512 a931d8765b4d80bc4445ae0cc6caa534c2ba2d94e2b57f85f551c03661fd3a2d1bddb2ef0f5363114f37cd1c59d3c9f71bac06d041815fc374851f2d68d20bac
SSDEEP 12:6VPIAwxNekyA/einH3Q6W/q4PpcbLy3qm/q4PpcmMjO5l+jfk:ayakb/PH354qepTqIqepZMjOf6fk
TLSH
T1B3F14964365AC20AF06CC25E88264036E3115A88CFC7CFAD4E406D1B7E70B6851FEF41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_AutoGenerated_{51325390-AE6A-68FC-A315-0950CC83A166}.encrypted

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{51325390-AE6A-68FC-A315-0950CC83A166}.encrypted
Size 36KB
SHA256 e564f33cbf80b03cc3a8d6e3b8368ee4ad3f868fb330973752f2064e3fb01422
MD5 8fb6910e56db3f0c634018194fbcb96a
SHA1 7157a5fed2f514ab9f3b2f09ba3688c7b3416f68
SHA512 8bd37bec5fac707d4fa88fd1346cc71d525dd00a85c8893a6208cfbc8a16d80ed6ff815215a68e060b0f6121ba6b0c1a812c1aa64e9c1c2084720bebf0acb854
SSDEEP 384:VGA62YXQct+fd6+3BpC6e3I3CQUzM0s98JY4XtIbwMFh:VGAcId6GYNkCQFzuyctID
TLSH
T1A6F2F621324A8A070DF8E15E19B4A66BDB5183E1CD43C5819BF535BCA3BFE3349B4369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_AutoGenerated_{A5E73466-E220-8EF4-B956-A582187356D9}.encrypted

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{A5E73466-E220-8EF4-B956-A582187356D9}.encrypted
Size 36KB
SHA256 36d0c67ae0e4b5342327544a0e46d45fccc50533669561c3df2fc49e01e51a33
MD5 0a653e1f6c464bd738b7cf201d9e90a5
SHA1 8eacec6ef1c2b51bd90201be7a1452afd7d7652d
SHA512 8375b70e8d63144c2df91627d817c07cebb8a3c0b953dc1e41bf031629aa334926a06c04cbbbbee6d3dee3cd0e7436a78c7befefd275b74f8e5eb00cfd870e75
SSDEEP 96:luuABL128RxASG8Pe5NTefu8MMMmi+wqBBqsZdshGbK4n/8XznB:kL1JAA2MBBLdjK4/snB
TLSH
T1ACF202B9FC2AC664616BD46DB272D33B03B70211ED53E61E001C80265971DB7ABBF49E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_comexp_msc.encrypted

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_comexp_msc.encrypted
Size 36KB
SHA256 57af42f99ea56fc3e73d85ee1a2fe6ad0ed370e3e75261b91c7273ae4d26f211
MD5 5073b12d7846b5870b67e194d475d6e4
SHA1 84c3a47c8f8cc31ec7aa4d1473cf293de2b2a7fb
SHA512 18eedeefd5f40369adc48e3ade6072c7001d903c16dd01360d4041c4d4e0729aaf33554faf71d441d6869b9c1cec987f879386b36ed3900f6862668bc0d610a1
SSDEEP 384:B1vLUWjXwxpWetwHGwLAsU+ONmc2b76XCv7tG1OAuWn4DEB/q9apu:B1F6w/fbR7iOA9nYEs9apu
TLSH
T1E3F28D81EE70B5B754018D3E224523FAE28286C5F602D42E77D9E11ABE39708291FD9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{6D809377-6AF0-444B-8957-A3773F02200E}_VideoLAN_VLC_NEWS_txt.encrypted

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_VideoLAN_VLC_NEWS_txt.encrypted
Size 36KB
SHA256 15f1028744572926b19c0838765a9c1c7228ce5e0d14fb68228e3cd60c9b8a2f
MD5 13443903f6c45a0c71db1cd2abe33437
SHA1 0b2cb8e357909ff032c029af5690473f4b42a6a1
SHA512 c4af74a02a57424710c5c793f4eeca4e7e8773f76d3d1600aa80aa75fc8fa0286c528f8e0b0af04a9158d05ead62411dfa4d91b2aa23572d039d526915d9a52a
SSDEEP 768:zN9vvuvvlmRvvvv5vvvvvvvdvvcvvvvvvvvvvvivvvvvvvvvvvvnevvvvvvvuvvx:v
TLSH
T11EF2391C4C4BCCE03C26D7FC746922A8096FCB2CDE9AF41946AA7CAD4B7019EDD50676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppCache134142060405947367.txt.encrypted

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134142060405947367.txt.encrypted
Size 77KB
SHA256 12a6c591e6868646ecf65afdad2d75235da73a039b6dfc0ded61860f52c5eac3
MD5 1e54e4d2bb886f0981841be9d820b925
SHA1 622e48af4ceeed65ea34525cf9ce89bea2db351a
SHA512 afc6026b6b75fd837866ef148b11509139dd5f8e84c2584e4a36cdf4b4e78f69b4082b3342175ea765f4fd255d5310cdb5968d05cbafa6916be568fc28871661
SSDEEP 384:FlbNwIE0d+LA08bjerkzU/buaK1OROod6Buk4fqqfMBxAl7tcSc7kbM0yrk+vaOI:gaj1zYoEMES5pYxj
TLSH
T18673A9FBB1C47C3F8A4960817806EB7AC6C653C07A876EE74618D70A551B2BF8827537
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppCache134142061674211889.txt.encrypted

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134142061674211889.txt.encrypted
Size 47KB
SHA256 05ae7c714ad79f482b5b93bef3dd6308a8ff58f78c55d3125d9873decb01953b
MD5 a812d7ff3cc0e19d5a43a3d83d589cc6
SHA1 7e88cb1f8641df67d6664dfb66903bbe58ce3b67
SHA512 f5d9aacd858692480968ba9ae72a3ec282024c07fa7e75fdb00b51b1a24a52fb9f5902527ff3947fc27215f0f38a3a5995941dcf113144beb6269823eec6c03b
SSDEEP 384:YbNwIE0d+L8M6Buk4fq1MBaCDCWLrrUv/anZDOBLoRwfy9xBpNJSZD/T+JAJ5SQQ:mWS5pYxj
TLSH
T1262392FBB1C47C3F864860817C16EB7AC6D643C07A976EE64619D70A151B2BF8823937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppCache134142069676295108.txt.encrypted

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134142069676295108.txt.encrypted
Size 65KB
SHA256 caaf4a2bb4fa50dc5cb1e670a0df25fee189c415ec7fbdedcfa166e5e1455445
MD5 9067657fb3505ea2219fef9d1da24383
SHA1 f832bff36f39195a36e21ab3f60241a9e360c40d
SHA512 90045ffe279d8b70d051c3e04999f20348cc0b07bfbb2c35661423f4123ae9b627d2e5b0d95f811827e96b97968b1aaa5528a28829372bd2f80e4c2f2ac5c053
SSDEEP 384:WAnsXTbNwunE0d+L8SCkO8degAhgq6Buk4fq1MBaCDCWLrrUv/anZDOBLoRwfy9J:7BcS5pYxj
TLSH
T1DC6395FFB1C47C3F864860817816EB7AC2C652C07A976EE64619D70A151B2BF8C27937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_b4jghc1g.frb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b4jghc1g.frb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

wctB972.tmp.encrypted

Path C:\Users\Admin\AppData\Local\Temp\wctB972.tmp.encrypted
Size 63KB
SHA256 8330ab499dc79356e765f3177b1e556d54fac38ee10949e206b5f962638add14
MD5 3f7fd19d3dcc4640c14fcd7b4941c158
SHA1 cd8146bfabbe5ab96ce2414e848c5958066658ba
SHA512 b5a9431e2fb960b3dcd2954c1c9bfa68e6b9abcbe328dc2c14b46180b90ee2dc86a6bf1971b639b213ce167de6bf959f0aec83818d61109e936fb5bf9c3e8c0f
SSDEEP 1536:pqud07gT8aV/o90BJSKi2jn4VVIlTU0PSwSHn7Lo3+XAqaa599+zN1ExDNy862Wu:ntTredO+
TLSH
T1005322D3E0F54B75066E87B0E6225339747372C2953E1AB1C390E8E6B9F624C8E359E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1451318868ntouromlalnodry--epcr.sqlite-shm.encrypted

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm.encrypted
Size 32KB
SHA256 13194c8faaa87475f492ff9cdf6b86ca9b54e74dcadbe0f491020081110db977
MD5 6eefa2b245600f87957e11f6c1e3ffb1
SHA1 731625a2db9507cd207a9532214cfe657f45fae5
SHA512 3e168107cc6ccbeae3bb8f2abfdab50ccb318e67d6088ba5a00afe0aff2f3500d8075b6cdf930c318675513312504a89a87beee486f599f626a44507a0bf5dfa
SSDEEP 3:q3H//+/f/////////////////////H45VM3H//+/f/////////////////////HG:q3u/IEu/Ip
TLSH
T17BE2024131A8A2898010DC2CA0042430439F0E00CAEFC13D06208C201C3AA0000B6B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3561288849sdhlie.sqlite.encrypted

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.encrypted
Size 48KB
SHA256 a7b23ce3342e12d75c641fa75e75ff40ff14f4783710c69450d058d4f66427c6
MD5 04964bd18f6e38de1a87314ec4c5d629
SHA1 c4843a29cd73991a7a0f4c55db9237f65d7a3ee8
SHA512 66bd60bd7977a55eda8495daae27086d517782406ca192a21262c4456abc99f17bc8cc38f966d71cbec50d3bc10af4b05bf9cb5c664f632a1091108a27234f65
SSDEEP 48:p0Caf0Nnzr8l8E8TGwivobTtVsvovV7KYio6cicYEo6yiG3:p0CNr8l8E8T4vobTkvorio6Jcdo6yiS
TLSH
T1662390B8803BD4F4BCDDE58EC2A35C8413839178DE86DBC8574EC669BD3939E5846E24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

victim_id.txt

Path C:\Users\Admin\victim_id.txt
Size 44B
SHA256 038fc07462ca427c82dd88bec641560cd1a99bcc84342f486cd5982f56b4c6c2
MD5 6e64451517a3f341ea7a1551ff289244
SHA1 c7fa249ddaf4308521b3d61e394e584527e7e4af
SHA512 01f3aa67109bbb3a31b5b1ba58ceeb42300d6c9b4b4b515492f6e9555f5e939b66c3b499996567fb8669b061d970b7f371667b1dda65eb933a2efd0dfe0fcda3
MD5 SHA1 SHA512

Submit Download

memory/1028-32-0x00007FF6C7EE0000-0x00007FF6C7EFA000-memory.dmp

Download

memory/1028-3574-0x00007FF6C7EE0000-0x00007FF6C7EFA000-memory.dmp

Download

memory/1028-17-0x00007FF6C7EE0000-0x00007FF6C7EFA000-memory.dmp

Download

memory/1028-3609-0x00007FF6C7EE0000-0x00007FF6C7EFA000-memory.dmp

Download

memory/1028-3603-0x00007FF6C7EE0000-0x00007FF6C7EFA000-memory.dmp

Download

memory/1028-27-0x00007FF6C7EE0000-0x00007FF6C7EFA000-memory.dmp

Download

memory/1028-37-0x00007FF6C7EE0000-0x00007FF6C7EFA000-memory.dmp

Download

memory/1028-3598-0x00007FF6C7EE0000-0x00007FF6C7EFA000-memory.dmp

Download

memory/1028-3591-0x00007FF6C7EE0000-0x00007FF6C7EFA000-memory.dmp

Download

memory/1028-18-0x0000029CB6450000-0x0000029CB645C000-memory.dmp

Download

memory/1028-3582-0x00007FF6C7EE0000-0x00007FF6C7EFA000-memory.dmp

Download

memory/1416-3589-0x00007FF6C7EE0000-0x00007FF6C7EFA000-memory.dmp

Download

memory/1416-58-0x00007FF6C7EE0000-0x00007FF6C7EFA000-memory.dmp

Download

memory/1416-16-0x0000025218060000-0x000002521806C000-memory.dmp

Download

memory/1416-3607-0x00007FF6C7EE0000-0x00007FF6C7EFA000-memory.dmp

Download

memory/1416-3571-0x00007FF6C7EE0000-0x00007FF6C7EFA000-memory.dmp

Download

memory/1416-15-0x00007FF6C7EE0000-0x00007FF6C7EFA000-memory.dmp

Download

memory/1416-3580-0x00007FF6C7EE0000-0x00007FF6C7EFA000-memory.dmp

Download

memory/1416-3601-0x00007FF6C7EE0000-0x00007FF6C7EFA000-memory.dmp

Download

memory/1416-39-0x00007FF6C7EE0000-0x00007FF6C7EFA000-memory.dmp

Download

memory/1416-45-0x00007FF6C7EE0000-0x00007FF6C7EFA000-memory.dmp

Download

memory/1416-3596-0x00007FF6C7EE0000-0x00007FF6C7EFA000-memory.dmp

Download

memory/3012-3128-0x000002D6C98B0000-0x000002D6C98BC000-memory.dmp

Download

memory/4124-55-0x000002263B360000-0x000002263B382000-memory.dmp

Download

memory/4124-62-0x000002263ADA0000-0x000002263ADAC000-memory.dmp

Download

memory/4124-63-0x00000226534A0000-0x00000226534E8000-memory.dmp

Download

memory/5108-3361-0x00000186EE230000-0x00000186EE23C000-memory.dmp

Download