Overview

overview

8

Static

static

3

DeriaLock.exe

windows10-2004-x64

8

DeriaLock.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    90s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/09/2026, 05:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    DeriaLock.exe
  • Size 484KB
  • Sample260930-fw8mvsvxht
  • SHA256 4f5bff64160044d9a769ab277ff85ba954e2a2e182c6da4d0672790cf1d48309
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistenceprivilege_escalation

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 9 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Enumerates connected drives 3 TTPs 29 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 21 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\DeriaLock.exe
    "C:\Users\Admin\AppData\Local\Temp\DeriaLock.exe"
    1⤵
    • Creates a file in the Startup directory
    • Enumerates connected drives
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3372
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:864
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:64
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3544
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3944
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:3440
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4932
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:380
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of SetWindowsHookEx
    PID:752
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:436
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3612
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2368
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4880
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:856
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of SetWindowsHookEx
    PID:1180
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4872
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1340
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3716
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1140
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3856
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of SetWindowsHookEx
    PID:4600
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2072
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3928
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    PID:1148
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:2612
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:60
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:432

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              BACKUPRESIZE.LOCK.DERIA
              • Path C:\USERS\ADMIN\DESKTOP\BACKUPRESIZE.LOCK.DERIA
              • Size 806KB
              • SHA256 1d6e7aca7c3167ad2bd272f14c7c5d8d49956d5a6e155744fbe1c3a927b8725d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              COMPARELIMIT.DOCX.DERIA
              • Path C:\USERS\ADMIN\DESKTOP\COMPARELIMIT.DOCX.DERIA
              • Size 19KB
              • SHA256 02aa4f78a6401e123ce093bb33b01ca2c2bd4d96948310a8bc7223f45fa91eaf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              CONFIRMREMOVE.DIB.DERIA
              • Path C:\USERS\ADMIN\DESKTOP\CONFIRMREMOVE.DIB.DERIA
              • Size 576KB
              • SHA256 0974b96cfd0e785591c1b4bc0639e5c8593a6c349c1da70abe9ec63e7427cef3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              DESKTOP.INI.DERIA
              • Path C:\USERS\ADMIN\DESKTOP\DESKTOP.INI.DERIA
              • Size 288B
              • SHA256 4d2bcb6303c43153c18ef254ba2da6a2c7a48b72a5143007d79289e36f840acd
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              DISABLEREVOKE.DWG.DERIA
              • Path C:\USERS\ADMIN\DESKTOP\DISABLEREVOKE.DWG.DERIA
              • Size 960KB
              • SHA256 30fcd4da0d196651998e8bbdb8741fdfbd6e173a21ffe8175ff5b03aa88d657a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              DISCONNECTCHECKPOINT.XLSX.DERIA
              • Path C:\USERS\ADMIN\DESKTOP\DISCONNECTCHECKPOINT.XLSX.DERIA
              • Size 15KB
              • SHA256 616e3a83854b4e37044ba91cab1e8662ef4e1a8a631beedf42bb95cccea8bc79
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              EXPANDCLOSE.VDX.DERIA
              • Path C:\USERS\ADMIN\DESKTOP\EXPANDCLOSE.VDX.DERIA
              • Size 499KB
              • SHA256 e1d7b0fa1c5c8e40bf95ed3bde6281612148db197a73191498a4cb99eb4ecf45
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              EXPORTSPLIT.EASMX.DERIA
              • Path C:\USERS\ADMIN\DESKTOP\EXPORTSPLIT.EASMX.DERIA
              • Size 768KB
              • SHA256 2aca8b495e4f532a6ad5636deb7f88b30f01f2d1c80616e8eed56ed8cab8beaa
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              INITIALIZESHOW.DOCX.DERIA
              • Path C:\USERS\ADMIN\DESKTOP\INITIALIZESHOW.DOCX.DERIA
              • Size 16KB
              • SHA256 f919b2504db5e274284f79dea3aaa3b9c1c3fb595387d75c457a4b339877fae0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MEASURERESOLVE.DOCX.DERIA
              • Path C:\USERS\ADMIN\DESKTOP\MEASURERESOLVE.DOCX.DERIA
              • Size 614KB
              • SHA256 527e8e3291d51c1b69b68e293b7ce1b59a89ecd5a26c14f0da9e77ebd6507c39
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MERGERESOLVE.RLE.DERIA
              • Path C:\USERS\ADMIN\DESKTOP\MERGERESOLVE.RLE.DERIA
              • Size 1.5MB
              • SHA256 0957628a4cda4e9f4855686260f54ba999575d69168e195a1fc089e4db04df33
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MICROSOFT EDGE.LNK.DERIA
              • Path C:\USERS\ADMIN\DESKTOP\MICROSOFT EDGE.LNK.DERIA
              • Size 2KB
              • SHA256 d200c7fde6b4ec82675853666eab78bfbd74b0fe8477fe2bd449fcd2542f3482
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              OPTIMIZEGET.ODP.DERIA
              • Path C:\USERS\ADMIN\DESKTOP\OPTIMIZEGET.ODP.DERIA
              • Size 460KB
              • SHA256 756c3814dbc822f2449744b755bf10f1a4c100d7a5825dc46107205d76cb6896
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              RECEIVEEXPORT.PPS.DERIA
              • Path C:\USERS\ADMIN\DESKTOP\RECEIVEEXPORT.PPS.DERIA
              • Size 652KB
              • SHA256 f0e1764a57095f0e6092785335a3a010b4e057d5adf235b1e1656309f8dd7425
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              REDOUNBLOCK.VSSM.DERIA
              • Path C:\USERS\ADMIN\DESKTOP\REDOUNBLOCK.VSSM.DERIA
              • Size 844KB
              • SHA256 44da4f7547b89dba2d3f7235c946d6fe86102c816f48f7887bed3e981818b0b4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              RENAMESET.DOCX.DERIA
              • Path C:\USERS\ADMIN\DESKTOP\RENAMESET.DOCX.DERIA
              • Size 16KB
              • SHA256 defd0bf6cd72e1b5bfa156f75447992b5d32a732d8e976397a6b36ce50f9207a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              RESTARTEXPAND.DVR.DERIA
              • Path C:\USERS\ADMIN\DESKTOP\RESTARTEXPAND.DVR.DERIA
              • Size 998KB
              • SHA256 a3d0e0592c622c8759372c49b8716600942d044ccd80ebf949e3b46ea226fa00
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SAVERESIZE.JFIF.DERIA
              • Path C:\USERS\ADMIN\DESKTOP\SAVERESIZE.JFIF.DERIA
              • Size 537KB
              • SHA256 4552a9c69af80176542914aadcb76ac83ab379756a3734ef8fe43a27ae073d81
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SPLITSEARCH.MHTML.DERIA
              • Path C:\USERS\ADMIN\DESKTOP\SPLITSEARCH.MHTML.DERIA
              • Size 691KB
              • SHA256 6190f87d548487be6b112f5e0930b5b71004ac39ef82d62a105b2788ff72d0e7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              STARTRESTORE.MPP.DERIA
              • Path C:\USERS\ADMIN\DESKTOP\STARTRESTORE.MPP.DERIA
              • Size 729KB
              • SHA256 07453f36a2f7a9e9b23b5b0894047d9ade9ad2e21541d94f07eb4cd8a36a2d9d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              TESTSTART.XLSX.DERIA
              • Path C:\USERS\ADMIN\DESKTOP\TESTSTART.XLSX.DERIA
              • Size 10KB
              • SHA256 598f0a1fca1469ba81e07e2179bdaea4fa9c8c26ceca32895ae366d19e4afa79
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              UNBLOCKREVOKE.XLSX.DERIA
              • Path C:\USERS\ADMIN\DESKTOP\UNBLOCKREVOKE.XLSX.DERIA
              • Size 10KB
              • SHA256 10398df454b36a7051e6a04e9adc4be6e14cd9696a51e8f3b1dcd810e659e09e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              UNDOFIND.DOCX.DERIA
              • Path C:\USERS\ADMIN\DESKTOP\UNDOFIND.DOCX.DERIA
              • Size 17KB
              • SHA256 8fea97a84c407087934404769917fd77e6f8ebaa4f4b7219a1ef9f2241c4d1ae
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              UNINSTALLGET.OCX.DERIA
              • Path C:\USERS\ADMIN\DESKTOP\UNINSTALLGET.OCX.DERIA
              • Size 921KB
              • SHA256 76a668294b3736da8fbc464c201c26f1e8ae89963f23d7088b24d35ffcb572e5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              UNPROTECTOPTIMIZE.CAB.DERIA
              • Path C:\USERS\ADMIN\DESKTOP\UNPROTECTOPTIMIZE.CAB.DERIA
              • Size 1.1MB
              • SHA256 2fc883fd77caac884a858e9ca19aeb70752df8999c718a152072608362c8370f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              UNPROTECTREAD.WMX.DERIA
              • Path C:\USERS\ADMIN\DESKTOP\UNPROTECTREAD.WMX.DERIA
              • Size 1.0MB
              • SHA256 dd0005d76dd34a614803027d98303f0bd3eaf7ccd8656a60a690447a6d37cab4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              UNREGISTERINSTALL.MPP.DERIA
              • Path C:\USERS\ADMIN\DESKTOP\UNREGISTERINSTALL.MPP.DERIA
              • Size 422KB
              • SHA256 e44b8025e62ce77cc355c5794dc80e652bce6bc64ef0b2d5079b78eedaf829d1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              UPDATESPLIT.LOCK.DERIA
              • Path C:\USERS\ADMIN\DESKTOP\UPDATESPLIT.LOCK.DERIA
              • Size 384KB
              • SHA256 9a86073d73b873faaf7769b47f1059cc7e5df63d72c8c94d577d52e163daf630
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WAITCONFIRM.RAM.DERIA
              • Path C:\USERS\ADMIN\DESKTOP\WAITCONFIRM.RAM.DERIA
              • Size 883KB
              • SHA256 309c6d42542bf305edf80403c186856aee0f445f169e40149e655defd9f9c0bb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3
              • Size 1KB
              • SHA256 fcd2675149ef418d27858c44316321178c8f08716545bf449f158e3c8c9a566f
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
              • Size 471B
              • SHA256 80092d2a71def1d90a2e0cf784962c4962a5cdbb6e89ad9dc428a9b06a04e790
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3
              • Size 422B
              • SHA256 5a06a1a81378d5a7eb453d210057d4c92bf6546e910381bba0f4534f73df4de4
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
              • Size 412B
              • SHA256 0967cd629ae32ef1590c041ad43d8c73088938220ee1b858b306520f025adc2e
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              thumbcache_idx.db
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
              • Size 28KB
              • SHA256 07326d5ab9bc2ae807dde4ff54616fefa3c5dd5a4588d3ccfb6509acffd5ee48
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
              • Size 2KB
              • SHA256 d5da30bd247276ca593c6bbf09f850a17c57f9878331a89d8da6876fb68bfb18
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AppCache134352188946043150.txt
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134352188946043150.txt
              • Size 86KB
              • SHA256 8eb85d343a32a1e1fa39c516dad3b203932f4fde46a72ff1f0b4a4f3aea1caf3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              microsoft.windows[1].xml
              • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\T0YVTMWS\microsoft.windows[1].xml
              • Size 97B
              • SHA256 0a3882b40ace02096c82c3d31cd00544f2a1c3bb5dd37bfc693c2067137fb838
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              memory/60-1236-0x00000235B96F0000-0x00000235B9710000-memory.dmp
              Download

              memory/60-1248-0x00000235B96B0000-0x00000235B96D0000-memory.dmp
              Download

              memory/60-1258-0x00000235B9AC0000-0x00000235B9AE0000-memory.dmp
              Download

              memory/64-143-0x0000000004DA0000-0x0000000004DA1000-memory.dmp
              Download

              memory/380-364-0x0000026D84660000-0x0000026D84680000-memory.dmp
              Download

              memory/380-382-0x0000026D84C80000-0x0000026D84CA0000-memory.dmp
              Download

              memory/380-355-0x0000026D846A0000-0x0000026D846C0000-memory.dmp
              Download

              memory/380-350-0x0000026D83700000-0x0000026D83800000-memory.dmp
              Download

              memory/752-501-0x0000000004FE0000-0x0000000004FE1000-memory.dmp
              Download

              memory/856-667-0x0000022A1B8D0000-0x0000022A1B8F0000-memory.dmp
              Download

              memory/856-648-0x0000022A1A7B0000-0x0000022A1A8B0000-memory.dmp
              Download

              memory/856-653-0x0000022A1B910000-0x0000022A1B930000-memory.dmp
              Download

              memory/856-684-0x0000022A1BCE0000-0x0000022A1BD00000-memory.dmp
              Download

              memory/1148-1229-0x0000000004F50000-0x0000000004F51000-memory.dmp
              Download

              memory/1180-796-0x0000000004C70000-0x0000000004C71000-memory.dmp
              Download

              memory/1340-816-0x0000017A57FB0000-0x0000017A57FD0000-memory.dmp
              Download

              memory/1340-831-0x0000017A588C0000-0x0000017A588E0000-memory.dmp
              Download

              memory/1340-797-0x0000017A57390000-0x0000017A57490000-memory.dmp
              Download

              memory/1340-802-0x0000017A58300000-0x0000017A58320000-memory.dmp
              Download

              memory/2368-647-0x0000000004680000-0x0000000004681000-memory.dmp
              Download

              memory/3372-0-0x0000000000870000-0x00000000008F2000-memory.dmp
              Download

              memory/3372-301-0x0000000005450000-0x0000000005460000-memory.dmp
              Download

              memory/3372-8-0x0000000005450000-0x0000000005460000-memory.dmp
              Download

              memory/3372-4-0x0000000005450000-0x0000000005460000-memory.dmp
              Download

              memory/3372-3-0x0000000005260000-0x00000000052F2000-memory.dmp
              Download

              memory/3372-2-0x0000000005770000-0x0000000005D14000-memory.dmp
              Download

              memory/3372-1-0x0000000005120000-0x00000000051BC000-memory.dmp
              Download

              memory/3372-5-0x0000000005240000-0x000000000524A000-memory.dmp
              Download

              memory/3372-6-0x0000000005460000-0x00000000054B6000-memory.dmp
              Download

              memory/3372-7-0x0000000005450000-0x0000000005460000-memory.dmp
              Download

              memory/3440-348-0x0000000004FC0000-0x0000000004FC1000-memory.dmp
              Download

              memory/3612-528-0x000001E7D3600000-0x000001E7D3620000-memory.dmp
              Download

              memory/3612-505-0x000001E7D2500000-0x000001E7D2600000-memory.dmp
              Download

              memory/3612-503-0x000001E7D2500000-0x000001E7D2600000-memory.dmp
              Download

              memory/3612-508-0x000001E7D3640000-0x000001E7D3660000-memory.dmp
              Download

              memory/3612-540-0x000001E7D3A10000-0x000001E7D3A30000-memory.dmp
              Download

              memory/3612-504-0x000001E7D2500000-0x000001E7D2600000-memory.dmp
              Download

              memory/3716-947-0x0000000004780000-0x0000000004781000-memory.dmp
              Download

              memory/3856-954-0x000001520D760000-0x000001520D780000-memory.dmp
              Download

              memory/3856-951-0x000001520C3F0000-0x000001520C4F0000-memory.dmp
              Download

              memory/3856-981-0x000001520DB20000-0x000001520DB40000-memory.dmp
              Download

              memory/3856-963-0x000001520D720000-0x000001520D740000-memory.dmp
              Download

              memory/3856-950-0x000001520C3F0000-0x000001520C4F0000-memory.dmp
              Download

              memory/3928-1096-0x0000017D8E4A0000-0x0000017D8E4C0000-memory.dmp
              Download

              memory/3928-1088-0x0000017D8D380000-0x0000017D8D480000-memory.dmp
              Download

              memory/3928-1089-0x0000017D8D380000-0x0000017D8D480000-memory.dmp
              Download

              memory/3928-1093-0x0000017D8E4E0000-0x0000017D8E500000-memory.dmp
              Download

              memory/3928-1110-0x0000017D8E8B0000-0x0000017D8E8D0000-memory.dmp
              Download

              memory/3944-149-0x0000027358C80000-0x0000027358CA0000-memory.dmp
              Download

              memory/3944-161-0x0000027358C40000-0x0000027358C60000-memory.dmp
              Download

              memory/3944-179-0x00000273590D0000-0x00000273590F0000-memory.dmp
              Download

              memory/3944-144-0x0000027357D00000-0x0000027357E00000-memory.dmp
              Download

              memory/4600-1087-0x0000000005180000-0x0000000005181000-memory.dmp
              Download