Overview

overview

10

Static

static

3

2026-04-23...op.exe

windows10-2004-x64

10

2026-04-23...op.exe

windows11-21h2-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    23/04/2026, 02:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-23_5024e0bb40a81c3d30ae0ad1b41d8175_elex_rhadamanthys_stealc_stop.exe
  • Size 300KB
  • Sample260423-cf6xjsf171
  • SHA256 77e295d3a2c17adcef4deb5a0fecc2d37f3d3f2e0f845944dd281a56c16a310f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryevasionexecutionlockbitimpactpersistenceransomware

Malware Config

Extracted

Path

  • C:\Program Files\dotnet\Restore-My-Files.txt

  • lockbit

Ransom Note
  • All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: 1) Through a standard browser(FireFox, Chrome, Edge, Opera) | 1. Open link http://lockbit-decryptor.com/?8DB8A3AE8B247095C4622F7DAF86BAE4 | 2. Follow the instructions on this page 2) Through a Tor Browser - recommended | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?8DB8A3AE8B247095C4622F7DAF86BAE4 This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # lockbit-decryptor.com may be blocked. We recommend using a Tor browser to access the site # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our). # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. # Tor Browser user manual https://tb-manual.torproject.org/about
URLs

  • http://lockbit-decryptor.com/?8DB8A3AE8B247095C4622F7DAF86BAE4

  • http://lockbitks2tvnmwk.onion/?8DB8A3AE8B247095C4622F7DAF86BAE4

Signatures

  • Family: Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Clears Windows event logs 1 TTPs 6 IoCs
    defense_evasionransomware
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Custom signature
    Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 11 IoCs
  • Custom signature
    Detects command variations typically used by ransomware 13 IoCs
  • Custom signature
    Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r 11 IoCs
  • Custom signature
    Detects executables containing commands for clearing Windows Event Logs 11 IoCs
  • Custom signature
    Detects executables containing many references to VEEAM. Observed in ransomware 11 IoCs
  • Modifies boot configuration data using bcdedit 1 TTPs 8 IoCs
    ransomwareevasion
  • Renames multiple (3455) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes System State backups 3 TTPs 4 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Deletes backup catalog 3 TTPs 2 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 4 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-23_5024e0bb40a81c3d30ae0ad1b41d8175_elex_rhadamanthys_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-23_5024e0bb40a81c3d30ae0ad1b41d8175_elex_rhadamanthys_stealc_stop.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4752
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2196
      • C:\Windows\system32\vssadmin.exe
        vssadmin delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:5308
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic shadowcopy delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1872
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:3644
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} recoveryenabled no
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:4144
      • C:\Windows\system32\wbadmin.exe
        wbadmin delete catalog -quiet
        3⤵
        • Deletes backup catalog
        PID:1188
  • C:\Users\Admin\AppData\Local\Temp\2026-04-23_5024e0bb40a81c3d30ae0ad1b41d8175_elex_rhadamanthys_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-23_5024e0bb40a81c3d30ae0ad1b41d8175_elex_rhadamanthys_stealc_stop.exe"
    1⤵
    • Checks computer location settings
    • Enumerates connected drives
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5584
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2980
      • C:\Windows\system32\vssadmin.exe
        vssadmin delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:4984
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic shadowcopy delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:5728
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:5268
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} recoveryenabled no
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:5392
      • C:\Windows\system32\wbadmin.exe
        wbadmin delete catalog -quiet
        3⤵
        • Deletes backup catalog
        PID:3000
    • C:\Windows\system32\cmd.exe
      /c vssadmin Delete Shadows /All /Quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3868
      • C:\Windows\system32\vssadmin.exe
        vssadmin Delete Shadows /All /Quiet
        3⤵
        • Interacts with shadow copies
        PID:2336
    • C:\Windows\system32\cmd.exe
      /c bcdedit /set {default} recoveryenabled No
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5500
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} recoveryenabled No
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:6120
    • C:\Windows\system32\cmd.exe
      /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5428
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:4328
    • C:\Windows\system32\cmd.exe
      /c wbadmin DELETE SYSTEMSTATEBACKUP
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1428
      • C:\Windows\system32\wbadmin.exe
        wbadmin DELETE SYSTEMSTATEBACKUP
        3⤵
        • Deletes System State backups
        • Drops file in Windows directory
        PID:5352
    • C:\Windows\system32\cmd.exe
      /c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:6028
      • C:\Windows\system32\wbadmin.exe
        wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
        3⤵
        • Deletes System State backups
        • Drops file in Windows directory
        PID:3452
    • C:\Windows\system32\cmd.exe
      /c wmic SHADOWCOPY /nointeractive
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3412
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic SHADOWCOPY /nointeractive
        3⤵
          PID:2160
      • C:\Windows\system32\cmd.exe
        /c wevtutil cl security
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:5716
        • C:\Windows\system32\wevtutil.exe
          wevtutil cl security
          3⤵
          • Clears Windows event logs
          PID:5208
      • C:\Windows\system32\cmd.exe
        /c wevtutil cl system
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4092
        • C:\Windows\system32\wevtutil.exe
          wevtutil cl system
          3⤵
          • Clears Windows event logs
          PID:1004
      • C:\Windows\system32\cmd.exe
        /c wevtutil cl application
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3032
        • C:\Windows\system32\wevtutil.exe
          wevtutil cl application
          3⤵
          • Clears Windows event logs
          PID:1652
      • C:\Windows\system32\cmd.exe
        /c vssadmin Delete Shadows /All /Quiet
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2464
        • C:\Windows\system32\vssadmin.exe
          vssadmin Delete Shadows /All /Quiet
          3⤵
          • Interacts with shadow copies
          PID:4612
      • C:\Windows\system32\cmd.exe
        /c bcdedit /set {default} recoveryenabled No
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:5576
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} recoveryenabled No
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:1392
      • C:\Windows\system32\cmd.exe
        /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2296
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} bootstatuspolicy ignoreallfailures
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:1112
      • C:\Windows\system32\cmd.exe
        /c wbadmin DELETE SYSTEMSTATEBACKUP
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4768
        • C:\Windows\system32\wbadmin.exe
          wbadmin DELETE SYSTEMSTATEBACKUP
          3⤵
          • Deletes System State backups
          • Drops file in Windows directory
          PID:5020
      • C:\Windows\system32\cmd.exe
        /c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:6124
        • C:\Windows\system32\wbadmin.exe
          wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
          3⤵
          • Deletes System State backups
          • Drops file in Windows directory
          PID:1524
      • C:\Windows\system32\cmd.exe
        /c wmic SHADOWCOPY /nointeractive
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:5412
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic SHADOWCOPY /nointeractive
          3⤵
            PID:4920
        • C:\Windows\system32\cmd.exe
          /c wevtutil cl security
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2064
          • C:\Windows\system32\wevtutil.exe
            wevtutil cl security
            3⤵
            • Clears Windows event logs
            PID:5148
        • C:\Windows\system32\cmd.exe
          /c wevtutil cl system
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:812
          • C:\Windows\system32\wevtutil.exe
            wevtutil cl system
            3⤵
            • Clears Windows event logs
            PID:3756
        • C:\Windows\system32\cmd.exe
          /c wevtutil cl application
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5216
          • C:\Windows\system32\wevtutil.exe
            wevtutil cl application
            3⤵
            • Clears Windows event logs
            PID:1384
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:5032
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:772
      • C:\Windows\System32\vdsldr.exe
        C:\Windows\System32\vdsldr.exe -Embedding
        1⤵
          PID:1772
        • C:\Windows\System32\vds.exe
          C:\Windows\System32\vds.exe
          1⤵
          • Checks SCSI registry key(s)
          PID:4296
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4172

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              AppxBlockMap.xml
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-150_8wekyb3d8bbwe\AppxBlockMap.xml
              • Size 2KB
              • SHA256 288e5a815ebe05d363515ee9bdda7ebed57ac8b08d4f6c95353985cb8f2062e1
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AppxSignature.p7x
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-150_8wekyb3d8bbwe\AppxSignature.p7x
              • Size 12KB
              • SHA256 9756cc8b0ad232306a844e2c0d2a870dd18397d1cc7d804df6d8d421c45b6289
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxBlockMap.xml
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml
              • Size 5KB
              • SHA256 19ce89f7399d4a89c525c5e7a42d0fbc86eb2726a62bfe87879433ffcd1199c5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxSignature.p7x
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x
              • Size 12KB
              • SHA256 c6c56395f31d96e77b7030e921c4f72ae7d7758e906dca0a3e6b2b6fef5b9751
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxBlockMap.xml
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml
              • Size 5KB
              • SHA256 289190396973243ecaf87e5b94309cde789888b99ffb262e4c3a87305a7e2491
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxSignature.p7x
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x
              • Size 12KB
              • SHA256 418fd998518ab05ad9ff3289404c7c05288a86d73a2c0abac545c453ac728822
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxBlockMap.xml
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml
              • Size 4KB
              • SHA256 341e45cdaf0396cc615a9620221ba5a37e9b2a8d9dca58a26674da31310c29e9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxSignature.p7x
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x
              • Size 12KB
              • SHA256 bbf2bad34fc9cc53b139b9389fd597b4428010b9ad674629241503c186a635ac
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxBlockMap.xml
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxBlockMap.xml
              • Size 4KB
              • SHA256 44ca58ee47c7303592c059c2c634f1684ffb49419aa1f4e7736266b9d3ac3d10
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxSignature.p7x
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxSignature.p7x
              • Size 12KB
              • SHA256 4ffdca14d141611b86509e81b1bc50267f189097a3279196630d56c5a213947f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxBlockMap.xml
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml
              • Size 3KB
              • SHA256 b2fb9feef89da75071fb73294a7672c88dff0eb4d12581c56ad7ce3681feb71d
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AppxSignature.p7x
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x
              • Size 12KB
              • SHA256 9b1517bc7a7dc4b84ba4fd05adbeba40d0814eb6ee1070cff3df12d796a5b73d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxBlockMap.xml
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml
              • Size 2KB
              • SHA256 5441f290013bfe233bac71a1144080c199957bb437fdd320b37cbd0b618c845d
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AppxSignature.p7x
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x
              • Size 12KB
              • SHA256 8a64c99ed6f64de78bc6f1b1eab1f5f4228a9f227933ef8cf59ce9a7be3d4fd3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxBlockMap.xml
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxBlockMap.xml
              • Size 2KB
              • SHA256 e0c0a35e4dc8de6af84df7fec722808357bc7d696c093f74fbfb3f90213c3f04
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AppxSignature.p7x
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxSignature.p7x
              • Size 12KB
              • SHA256 295df42e2b2798b08b5fbd99df796828bf5bd3222c3ccb8c09c23f8459b7cceb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxBlockMap.xml
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml
              • Size 3KB
              • SHA256 3e50dab56774073e3a1722b1831aff303ff483d351b01df6af8e15aeac91bf4c
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AppxSignature.p7x
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x
              • Size 12KB
              • SHA256 304290cb6c2250b9707ff1bd742740e67654c3fb50ee65e8d127e16edf7aaf68
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxBlockMap.xml
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml
              • Size 4KB
              • SHA256 4943e7c0783d0542c375b12597be147c1caf4e756d1d4cf231eaf9572d3d97e4
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AppxSignature.p7x
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x
              • Size 12KB
              • SHA256 cf62827719e45a0431f667804052d5326f54e3f70dfa83c988948760ca140778
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxBlockMap.xml
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml
              • Size 4KB
              • SHA256 39337b2f2ce7d949cd62bfd4896cdc5c3d5902e93adefd963875d6983a594919
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxSignature.p7x
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x
              • Size 12KB
              • SHA256 e7bd0039061248343ff01acb8d4695134cbb35079ffa7ff8f51946d764dbe27b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxBlockMap.xml
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml
              • Size 4KB
              • SHA256 1e00043a9bac92e0a935ec32dec7fc93dc637e98e6d14af845100f115627a039
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxSignature.p7x
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x
              • Size 12KB
              • SHA256 902f8b7136a4b7ee7feb01a69d09c00534666aa83e41704d1f6eb08c15db817b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxBlockMap.xml
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\AppxBlockMap.xml
              • Size 4KB
              • SHA256 d78260de5b06aab7f99b4da642f6a2cb03fe7ecb17c9b818c8683cecc6782cf2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxSignature.p7x
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\AppxSignature.p7x
              • Size 12KB
              • SHA256 be0f31c5d449f15380f3c9751a80ef6c2d61a1590983e1b7925e622d03e3b28b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxBlockMap.xml
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml
              • Size 5KB
              • SHA256 77c9a1d45cc4c8f4c809fd103ac79a739335129ee288fddbe8b6fee6cc7178f9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxSignature.p7x
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x
              • Size 12KB
              • SHA256 a9e26a55243346485af506716337ffb8f98c83225cff7b423ee6d8671fac99dd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxBlockMap.xml
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml
              • Size 4KB
              • SHA256 074f899e3327844818992daf412fd7b867faaab00748087be8316feb92084619
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxSignature.p7x
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x
              • Size 12KB
              • SHA256 3436ca9bb26eb2362c8544765e8f4e84e1ba2ec1295f5f7e644b6050595e1d66
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxBlockMap.xml
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml
              • Size 4KB
              • SHA256 89455e3c6bef8f7d07823bb520886c73a909800d65946b8a9f912b46edfe349b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxSignature.p7x
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x
              • Size 12KB
              • SHA256 6581cd3f773af2c0cd74898fe51f1bf47ff47ff46b1517cbfdf4dfa9459fa49a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxBlockMap.xml
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml
              • Size 7KB
              • SHA256 e517695e3032d45bfd7fa28844de54b38b71de7a49f90b8d8a672f6fa24861c3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxSignature.p7x
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x
              • Size 12KB
              • SHA256 144fb6238887bffe51162ada66fba4ebe168e7393ad9646962d63cf0629b0750
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxBlockMap.xml
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml
              • Size 3KB
              • SHA256 6f8ced874e2b121bb98624e117328f92648a2f20cccbd90b85179d8633ab7220
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AppxSignature.p7x
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x
              • Size 12KB
              • SHA256 53c76fc5caeaf9ead9274c0f0217890f99534186294d803371a0a370732f6a78
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxBlockMap.xml
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml
              • Size 4KB
              • SHA256 b3f00a1c8adb75965da749efd906be5ef989592121d4e09dca2d74c92a6a3f31
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxSignature.p7x
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x
              • Size 12KB
              • SHA256 2b3145e35684625ec9eab1a25d29b33f985e255e37de85948f470162adeabe01
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxBlockMap.xml
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxBlockMap.xml
              • Size 4KB
              • SHA256 a0e88a7540f8a0d5666d755a71be7366c5af9020d38a787b79f419df544aa415
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxSignature.p7x
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxSignature.p7x
              • Size 12KB
              • SHA256 0efae181b722817aa60824171f8c26c1d49da06204426c97d33100cad610ef71
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxBlockMap.xml
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml
              • Size 5KB
              • SHA256 621a05c65b44ff8875653e4449452753340d8dc22ab8bcf531ba46d23745780d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxSignature.p7x
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x
              • Size 12KB
              • SHA256 3ffb998cb7a58de48c6525fb709539e662802ad986ba75ad73fa40764eae4ef5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxBlockMap.xml
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml
              • Size 27KB
              • SHA256 d654ac17234babca76407307303408d6a9ba58683654fe44480510195bd9ce24
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxSignature.p7x
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x
              • Size 12KB
              • SHA256 14e02f4bcdcd65f699b981e0c6f9aff0c084c69b54d69e17bccb9b0289774130
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxBlockMap.xml
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml
              • Size 3KB
              • SHA256 8e00dd47414736cf6ae540ca14f176d39e8e7e43d393a80e18d236ed0b44ca58
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AppxSignature.p7x
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x
              • Size 12KB
              • SHA256 7126339de2491a15a49f845889d64792f622ba594c25eb31f81a787b29841948
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxBlockMap.xml
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxBlockMap.xml
              • Size 3KB
              • SHA256 b19dca3d200a88a533a91b00ebccdca51aee78d7484f943a57e07d12519f748f
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AppxSignature.p7x
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxSignature.p7x
              • Size 12KB
              • SHA256 bb062a680ab4e567759c880f16795669ae143ca790ed7085a2824e6d84e7f886
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxBlockMap.xml
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml
              • Size 6KB
              • SHA256 162e36d71d5560cc2cf150c5389f61cf0ff8c131bc6d3ef45b17ccdd4645c309
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxSignature.p7x
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x
              • Size 12KB
              • SHA256 4e9c7b85d8e3458b468a076d0d5c0d14c9a214c459c6400862efa4ee4378a38b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxBlockMap.xml
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml
              • Size 3KB
              • SHA256 4630ba851b12cc3f77018c16f8ad90a30a288c3ecb8b918519c5cb4d093aa720
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AppxSignature.p7x
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x
              • Size 12KB
              • SHA256 0cb8060378fd39d40835b5a0d37acb5300b2591b3dd89dd03ae68151b7fd8fa9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxBlockMap.xml
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml
              • Size 5KB
              • SHA256 f887597098e648ba2cd5561853606b8f5533368650a46fd209d1ccd4db141240
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxSignature.p7x
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x
              • Size 12KB
              • SHA256 883b5d3bbcb4ac5893fb0a426e8bf1fec3458b91f647aff0fb3f94407a58e6aa
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxBlockMap.xml
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxBlockMap.xml
              • Size 5KB
              • SHA256 9c6ef015c25480bece4c5b163bdd4945a224d55f81d5db2804e7787194ccc4cd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxSignature.p7x
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxSignature.p7x
              • Size 12KB
              • SHA256 c97eb342ab1b6cd1792adb165f3db328b8e95c1585f0935adf5abc91bc0c71f7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxBlockMap.xml
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml
              • Size 2KB
              • SHA256 62e0f0d482520cd0eb5cd4496b9bc529cfe5bf00ed25927683d8908ec97ef75b
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AppxSignature.p7x
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x
              • Size 12KB
              • SHA256 d458eee26e8a3b3acef58689e20b27085cb4dfe7dd0514aa3b8cb94b05f762f8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxBlockMap.xml
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml
              • Size 5KB
              • SHA256 28fb1bfd356eba56c277d514d1aa3bb45a0742cf89f4a98f9e1ce3eeee336592
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxSignature.p7x
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x
              • Size 12KB
              • SHA256 4ccff962e424e380e0ba19afa17902369924f207f36651718139eb2fae71adb6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxBlockMap.xml
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml
              • Size 4KB
              • SHA256 7f195d060435c27e637d753f189f3b6bbc643c50565864098b8a29fcd1500dcc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxSignature.p7x
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x
              • Size 12KB
              • SHA256 0f27ee3964b6c77533f5d751c5947d3fea467723b1cb7a30669c8f71f6872685
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppxBlockMap.xml
              • Path C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml
              • Size 4KB
              • SHA256 00eb83b634aea03533fc635e424293c1bccc2230dcbb709636254a04e9b374f9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Restore-My-Files.txt
              • Path C:\Program Files\dotnet\Restore-My-Files.txt
              • Size 1KB
              • SHA256 db80375dd7b96bad42dd63e3ee5cb7a883df06221b00f7facafe2244965c3ab9
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              desktop.ini
              • Path \??\Z:\$RECYCLE.BIN\S-1-5-21-1609746302-1884177235-1125644204-1000\desktop.ini
              • Size 129B
              • SHA256 e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              memory/4296-3666-0x000002CB2B960000-0x000002CB2BA0C000-memory.dmp
              Download

              memory/4296-3591-0x000002CB2B960000-0x000002CB2BA0C000-memory.dmp
              Download

              memory/4752-3807-0x0000000000400000-0x0000000000A6C000-memory.dmp
              Download

              memory/4752-3571-0x0000000000400000-0x0000000000A6C000-memory.dmp
              Download

              memory/4752-2688-0x0000000002930000-0x0000000002BB1000-memory.dmp
              Download

              memory/4752-2-0x0000000000B70000-0x0000000000B96000-memory.dmp
              Download

              memory/4752-3895-0x0000000000400000-0x0000000000A6C000-memory.dmp
              Download

              memory/4752-2670-0x0000000000400000-0x0000000000A6C000-memory.dmp
              Download

              memory/4752-3514-0x0000000000B70000-0x0000000000B96000-memory.dmp
              Download

              memory/4752-1-0x0000000000D50000-0x0000000000E50000-memory.dmp
              Download

              memory/4752-3404-0x0000000000D50000-0x0000000000E50000-memory.dmp
              Download

              memory/4752-3664-0x0000000000400000-0x0000000000A6C000-memory.dmp
              Download

              memory/4752-3866-0x0000000000400000-0x0000000000A6C000-memory.dmp
              Download

              memory/4752-3740-0x0000000000400000-0x0000000000A6C000-memory.dmp
              Download

              memory/4752-3741-0x0000000002930000-0x0000000002BB1000-memory.dmp
              Download

              memory/5584-3729-0x0000000000400000-0x0000000000A6C000-memory.dmp
              Download

              memory/5584-3805-0x0000000000400000-0x0000000000A6C000-memory.dmp
              Download

              memory/5584-3843-0x0000000002950000-0x0000000002BD1000-memory.dmp
              Download

              memory/5584-3842-0x0000000000400000-0x0000000000A6C000-memory.dmp
              Download

              memory/5584-3616-0x0000000000400000-0x0000000000A6C000-memory.dmp
              Download

              memory/5584-3617-0x0000000002950000-0x0000000002BD1000-memory.dmp
              Download