Overview

overview

9

Static

static

3

WindowsSec...th.exe

windows10-ltsc_2021-x64

9

WindowsSec...th.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    151s
  • max time network
    129s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/10/2026, 22:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    WindowsSecurityHealth.exe
  • Size 89.0MB
  • Sample261011-2ctv9aab32
  • SHA256 8246d5bdc55b7a427c331d80dfc0521820a9fbc0f40e88e6d2e793a8c3f0370b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
credential_accessdefense_evasiondiscoveryexecutionimpactpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Signatures

  • Clears Windows event logs 1 TTPs 6 IoCs
    defense_evasionransomware
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (1903) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Executes a file named after a Windows system binary 1 TTPs 2 IoCs

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s) 16 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Executes a command shell one-liner 1 TTPs 8 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Interacts with shadow copies 3 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\WindowsSecurityHealth.exe
    "C:\Users\Admin\AppData\Local\Temp\WindowsSecurityHealth.exe"
    1⤵
    • Creates a file in the Startup directory
    • Executes a file named after a Windows system binary
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Reads the TCP/IP host and domain name from the registry
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5792
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /d /c vssadmin delete shadows /all /quiet
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5044
      • C:\Windows\system32\vssadmin.exe
        vssadmin delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:3000
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /d /c wmic shadowcopy delete
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5388
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic shadowcopy delete
        3⤵
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4192
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /d /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4604
      • C:\Windows\system32\reg.exe
        reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
        3⤵
          PID:2544
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /d /c wevtutil cl System & wevtutil cl Security & wevtutil cl Application
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5992
        • C:\Windows\system32\wevtutil.exe
          wevtutil cl System
          3⤵
          • Clears Windows event logs
          • Suspicious use of AdjustPrivilegeToken
          PID:480
        • C:\Windows\system32\wevtutil.exe
          wevtutil cl Security
          3⤵
          • Clears Windows event logs
          • Suspicious use of AdjustPrivilegeToken
          PID:4380
        • C:\Windows\system32\wevtutil.exe
          wevtutil cl Application
          3⤵
          • Clears Windows event logs
          • Suspicious use of AdjustPrivilegeToken
          PID:2624
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5464
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SecurityHealthService.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SecurityHealthService.exe
      1⤵
      • Creates a file in the Startup directory
      • Executes a file named after a Windows system binary
      • Executes dropped EXE
      • Adds Run key to start application
      • Sets desktop wallpaper using registry
      • Reads the TCP/IP host and domain name from the registry
      • Modifies registry class
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4456
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /d /c vssadmin delete shadows /all /quiet
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4768
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:984
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /d /c wmic shadowcopy delete
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1028
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic shadowcopy delete
          3⤵
          • Reads the TCP/IP host and domain name from the registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2400
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /d /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4776
        • C:\Windows\system32\reg.exe
          reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
          3⤵
            PID:248
        • C:\Windows\SYSTEM32\cmd.exe
          cmd.exe /d /c wevtutil cl System & wevtutil cl Security & wevtutil cl Application
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4556
          • C:\Windows\system32\wevtutil.exe
            wevtutil cl System
            3⤵
            • Clears Windows event logs
            PID:3512
          • C:\Windows\system32\wevtutil.exe
            wevtutil cl Security
            3⤵
            • Clears Windows event logs
            PID:396
          • C:\Windows\system32\wevtutil.exe
            wevtutil cl Application
            3⤵
            • Clears Windows event logs
            PID:3520

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            1
            T1059

            Windows Command Shell

            1
            T1059.003

            Windows Management Instrumentation

            1
            T1047

            Persistence

            Boot or Logon Autostart Execution

            2
            T1547

            Registry Run Keys / Startup Folder

            2
            T1547.001

            Privilege Escalation

            Boot or Logon Autostart Execution

            2
            T1547

            Registry Run Keys / Startup Folder

            2
            T1547.001

            Defense Evasion

            Direct Volume Access

            1
            T1006

            Indicator Removal

            3
            T1070

            Clear Windows Event Logs

            1
            T1070.001

            File Deletion

            2
            T1070.004

            Masquerading

            1
            T1036

            Match Legitimate Name or Location

            1
            T1036.005

            Modify Registry

            2
            T1112

            Credential Access

            Credentials from Password Stores

            2
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Windows Credential Manager

            1
            T1555.004

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Browser Information Discovery

            1
            T1217

            Peripheral Device Discovery

            1
            T1120

            Query Registry

            1
            T1012

            System Information Discovery

            1
            T1082

            System Network Configuration Discovery

            2
            T1016

            Internet Connection Discovery

            1
            T1016.001

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Web Service

            1
            T1102

            Exfiltration

            Impact

            Defacement

            1
            T1491

            Inhibit System Recovery

            2
            T1490

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            timer.dat
            • Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
            • Size 8B
            • SHA256 23dfa099a9176733ef10b88df0182ebd24c5ffc5e009507863bcf42eb5be6e70
            • MD5 SHA1 SHA512
            Submit Download

            timer.dat
            • Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
            • Size 8B
            • SHA256 447efddc51851f75593058b4989713afb0ddc010446c6d1debe27cf3c0327271
            • MD5 SHA1 SHA512
            Submit Download

            timer.dat
            • Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
            • Size 8B
            • SHA256 9be6f87c8a6fcc3bcc9b55e1eda772e597b2c4b4b64253ede574cb3a58f99718
            • MD5 SHA1 SHA512
            Submit Download

            timer.dat
            • Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
            • Size 8B
            • SHA256 caed7d86ddb9ee8cdce30db3013e5dbf353ef0d2db8448fa0d388459484411fe
            • MD5 SHA1 SHA512
            Submit Download

            timer.dat
            • Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
            • Size 8B
            • SHA256 617678668fbbf937de636f1aef3b585c89b6e0d47442ebdd4dc164e5ba012bae
            • MD5 SHA1 SHA512
            Submit Download

            timer.dat
            • Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
            • Size 8B
            • SHA256 eca9d6bf87fbc38af49d9982d35758ed0f53bd4fe102d823f66923989beeba15
            • MD5 SHA1 SHA512
            Submit Download

            timer.dat
            • Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
            • Size 8B
            • SHA256 30a842a107cc4f39c717f6a4dc13d2682bcce39a4127a5cb2bdd0eab663853fe
            • MD5 SHA1 SHA512
            Submit Download

            timer.dat
            • Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
            • Size 8B
            • SHA256 3fcff8d2f34f8756c957f2397f52832cd51a72250d9918de2039979cbcc43987
            • MD5 SHA1 SHA512
            Submit Download

            timer.dat
            • Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
            • Size 8B
            • SHA256 1f587b940296269e29a66f1b8af084ce51b899be31664758baaf7f458246bfea
            • MD5 SHA1 SHA512
            Submit Download

            timer.dat
            • Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
            • Size 8B
            • SHA256 52932421ddc8111e27eafc30043a4439378570562c101a44e2366280c6de8447
            • MD5 SHA1 SHA512
            Submit Download

            timer.dat
            • Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
            • Size 8B
            • SHA256 549469f9c99ed4d40c22735915546c21e30f56701c2c72cb24f9c8f3254b50db
            • MD5 SHA1 SHA512
            Submit Download

            timer.dat
            • Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
            • Size 8B
            • SHA256 03d51215ccbc3935d31f0de124c8770f6b3a5991660e93f5be644914d4574940
            • MD5 SHA1 SHA512
            Submit Download

            timer.dat
            • Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
            • Size 8B
            • SHA256 e35d2f1a38abf9ca89f01b4fbce918924c3f71abc0561fcde3f9bdd8463199f5
            • MD5 SHA1 SHA512
            Submit Download

            timer.dat
            • Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
            • Size 8B
            • SHA256 4e0eb3b999455da0ca84eebfde27f6410d84adfaf99c20b75e44cb43dd3a140c
            • MD5 SHA1 SHA512
            Submit Download

            timer.dat
            • Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
            • Size 8B
            • SHA256 70d6e228985aea7cfb0ce7f16fbbe0a717774406a0ab471391c792e22621f5a6
            • MD5 SHA1 SHA512
            Submit Download

            timer.dat
            • Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
            • Size 8B
            • SHA256 49d03aa6d1b59fccd71454d4df9e5740d564cbd4850219b2a1119d4b1e0ea40f
            • MD5 SHA1 SHA512
            Submit Download

            timer.dat
            • Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
            • Size 8B
            • SHA256 4140c364a54167825bea59949f3109ce10232d4d7f81dd97010ab63fd960e5bb
            • MD5 SHA1 SHA512
            Submit Download

            timer.dat
            • Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
            • Size 8B
            • SHA256 4d7efeffe771e0795a168b8464404081f30c94aabd20ac8b567392f2c1c41c85
            • MD5 SHA1 SHA512
            Submit Download

            timer.dat
            • Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
            • Size 8B
            • SHA256 765260a9e5378890677cb27ed8ee40fe49c06fb6dadb50461aeba1d3b6226750
            • MD5 SHA1 SHA512
            Submit Download

            timer.dat
            • Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
            • Size 8B
            • SHA256 dbb5b9dfe72d4055bbc7b0753b447d12162031a9017d17f8b37244623b3a730f
            • MD5 SHA1 SHA512
            Submit Download

            timer.dat
            • Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
            • Size 8B
            • SHA256 c4a6cd79856992b695c46723e660d43ab077d9d2e4cc1ac18b75d54d58a8cef0
            • MD5 SHA1 SHA512
            Submit Download

            timer.dat
            • Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
            • Size 8B
            • SHA256 db89b0db28edc47201f6ba287185b6ba4355a27bffef71866c6b821890539375
            • MD5 SHA1 SHA512
            Submit Download

            timer.dat
            • Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
            • Size 8B
            • SHA256 8ee46a3906363a5d2df4783673767fbd2a958b04ddb679bf1ac6ebeb75f51b5f
            • MD5 SHA1 SHA512
            Submit Download

            timer.dat
            • Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
            • Size 8B
            • SHA256 f3b8ab66e52b435f3f6887b675d5cb5d6e173b761048629a1967788ce5ef3ad8
            • MD5 SHA1 SHA512
            Submit Download

            timer.dat
            • Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
            • Size 8B
            • SHA256 3a003729fbc553bac9cf04d5fbe91e8da42021b6e939b3b4528134a908afbc8c
            • MD5 SHA1 SHA512
            Submit Download

            timer.dat
            • Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
            • Size 8B
            • SHA256 b64f50de2b39e13f1dc495fddb2520df1eaee56516c5b094a215d16cc7186fe5
            • MD5 SHA1 SHA512
            Submit Download

            timer.dat
            • Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
            • Size 8B
            • SHA256 bb9b633a6d6703bfbd78372f66f41d023bc220b407eb45609f65510437e9d763
            • MD5 SHA1 SHA512
            Submit Download

            timer.dat
            • Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
            • Size 8B
            • SHA256 57d4f8081b5db12612b6e1c57bdff882ff4d93a7ee701e09f492adb9eb5a9393
            • MD5 SHA1 SHA512
            Submit Download

            timer.dat
            • Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
            • Size 8B
            • SHA256 0e14ae15e839407cf77ef05f08d54b02a9cd35d9a1d03faeac5ba219807f5b91
            • MD5 SHA1 SHA512
            Submit Download

            77EC63BDA74BD0D0E0426DC8F8008506
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
            • Size 290B
            • SHA256 90558d1e3a0ecb9febbb4d7abe8e9281bef8ad0e2a42fee83d3d837eb74b7f3a
            • MD5 SHA1 SHA512
            Submit Download

            index
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index
            • Size 24B
            • SHA256 9d908ecfb6b256def8b49a7c504e6c889c4b0e41fe6ce3e01863dd7b61a20aa0
            • MD5 SHA1 SHA512
            Submit Download

            CURRENT
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT
            • Size 16B
            • SHA256 374708fff7719dd5979ec875d56cd2286f6d3cf7ec317a3b25632aab28ec37bb
            • MD5 SHA1 SHA512
            Submit Download

            MANIFEST-000001
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001
            • Size 41B
            • SHA256 9e1736c43d19118e6ce4302118af337109491ecc52757dfb949bad6a7940b0c2
            • MD5 SHA1 SHA512
            Submit Download

            SCT Auditing Pending Reports
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
            • Size 2B
            • SHA256 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
            • MD5 SHA1 SHA512
            Submit Download

            LOG.old
            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old
            • Size 279B
            • SHA256 74ca16b1138459ef2afb19324097332626ee7c897687c5adc5488f93bf0c11ff
            • MD5 SHA1 SHA512
            Submit Download

            267a2dbd979d11e3_0
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\267a2dbd979d11e3_0
            • Size 380B
            • SHA256 08c3e5bbea4fba57201a69d4bf70a0d255df921fdef4924c22da087f9338c2bc
            • MD5 SHA1 SHA512
            Submit Download

            3b00feaef0ca139f_0
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3b00feaef0ca139f_0
            • Size 307B
            • SHA256 839f64d0f1bd2dc115b60769a379c336daf5369eb4d2641ea86c7a3b716a6122
            • MD5 SHA1 SHA512
            Submit Download

            000003.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log
            • Size 33B
            • SHA256 7f9c9e31ac8256ca2f258583df262dbc7d6f68f2a03043d5c99a4ae5a7396ce9
            • MD5 SHA1 SHA512
            Submit Download

            LOG
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
            • Size 334B
            • SHA256 c87a7e9ae92e9652dd12d266f4eb2e12dc3e3715105dc108092c5b67553dc8ec
            • MD5 SHA1 SHA512
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8ab2ee95-5925-4848-bb92-347725115d5e\index-dir\the-real-index
            • Size 48B
            • SHA256 17b0761f87b081d5cf10757ccc89f12be355c70e2e29df288b65b30710dcbcd1
            • MD5 SHA1 SHA512
            Submit Download

            000003.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
            • Size 40B
            • SHA256 2c34ce1df23b838c5abf2a7f6437cca3d3067ed509ff25f11df6b11b582b51eb
            • MD5 SHA1 SHA512
            Submit Download

            LOG
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
            • Size 319B
            • SHA256 5ae57b4b565d5727d851bc4deabc291fb9b7e4d06967324d9a7897da6a8c40b8
            • MD5 SHA1 SHA512
            Submit Download

            OneDriveMedTile.scale-125.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-125.png
            • Size 848B
            • SHA256 4925b9b6329f24346bce043f2cdabb940199fd87188f3ae77c9559bf7cfa9f43
            • MD5 SHA1 SHA512
            Submit Download

            social-track-digest256.sbstore
            • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\safebrowsing\social-track-digest256.sbstore
            • Size 298B
            • SHA256 314f47cf9b9e4e05c5e965e82dd2751a934c094b481a00291e9e11f21d0ec4ee
            • MD5 SHA1 SHA512
            Submit Download

            ~fs_intro.gif
            • Path C:\Users\Admin\AppData\Local\Temp\~fs_intro.gif
            • Size 1.3MB
            • SHA256 dcd311417fd1e97f1d37bee133cb0f1700c0169484af27e57aa619003b5d0a3a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ~fs_l.bmp
            • Path C:\Users\Admin\AppData\Local\Temp\~fs_l.bmp
            • Size 57KB
            • SHA256 966987027f6a9e0d9320a0f081514a546fed2367ad783557aae24edd33f68149
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ~fs_sn01.bmp
            • Path C:\Users\Admin\AppData\Local\Temp\~fs_sn01.bmp
            • Size 32KB
            • SHA256 20b897a399ffe95695b78d6ffdeb150d852e291430fb24f791d5bd95534b29f7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ~fs_sn02.bmp
            • Path C:\Users\Admin\AppData\Local\Temp\~fs_sn02.bmp
            • Size 32KB
            • SHA256 2c1d61293e5a29034b4a2bc99a34f01a805da62a83d00c6f916baac21cead473
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ~fs_sn03.bmp
            • Path C:\Users\Admin\AppData\Local\Temp\~fs_sn03.bmp
            • Size 32KB
            • SHA256 bc6d36102b9cd5a8ad8f0942c68dbcacf49b1b8dd5f53df46720bc42ef44c308
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ~fs_sn04.bmp
            • Path C:\Users\Admin\AppData\Local\Temp\~fs_sn04.bmp
            • Size 32KB
            • SHA256 54360c9bb5945a8e46c2fdb443f95113583b92b8458e36b72b095731c411cfd1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ~fs_sn05.bmp
            • Path C:\Users\Admin\AppData\Local\Temp\~fs_sn05.bmp
            • Size 32KB
            • SHA256 2771c0154dff4659662bf311073d3d1cadd1fc6740487cd6eba50f6f415095c2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ~fs_sn06.bmp
            • Path C:\Users\Admin\AppData\Local\Temp\~fs_sn06.bmp
            • Size 32KB
            • SHA256 1fa6a0681fd3d23907b5e9d9e3f3be68ba4cacc3f43c20e647bc1aa93d9d62eb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ~fs_snake.bmp
            • Path C:\Users\Admin\AppData\Local\Temp\~fs_snake.bmp
            • Size 38KB
            • SHA256 d83584b0cbcb8d1ecabcf7f5b0a25350708f265f9b4998bea84b609285827f64
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ~fs_tgqr.bmp
            • Path C:\Users\Admin\AppData\Local\Temp\~fs_tgqr.bmp
            • Size 732KB
            • SHA256 9bd660583c2c8e8a7fc70a28ade3dcd767ab86dce6ba10d331ca5aaa6771281c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ~fs_w.jpg
            • Path C:\Users\Admin\AppData\Local\Temp\~fs_w.jpg
            • Size 114KB
            • SHA256 568f0df84121a079c74e93fdd6fda99764e33332e306e21edd372a8ad34f0c4b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DenyConvert.xlsx
            • Path C:\Users\Admin\Desktop\DenyConvert.xlsx
            • Size 15KB
            • SHA256 3e99fff592f0a7b9506a2e3676605505b3e2ab9b123398ba5e79e020f50ffe7f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AddCompare.midi.lockbit
            • Path C:\Users\Admin\Downloads\AddCompare.midi.lockbit
            • Size 904KB
            • SHA256 0cf911e20456dc6b929c5505e2cc21f7b880a2d228872d488f93fb33b9b81b42
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            desktop.ini
            • Path C:\Users\Admin\Downloads\desktop.ini
            • Size 282B
            • SHA256 4afd6e7f6ef862c727cf5780abfde2094eb56e93383b6e9d4cb7fae81dd17cd1
            • MD5 SHA1 SHA512
            Submit Download

            desktop.ini.lockbit
            • Path C:\Users\Admin\Downloads\desktop.ini.lockbit
            • Size 310B
            • SHA256 a3390bd7770e3e1f6a271e6f1147f087f58aa92fb05b2848dc12e2e1a021acba
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            desktop.ini
            • Path C:\Users\Admin\Links\desktop.ini
            • Size 504B
            • SHA256 696bda342649ec9268da57b6a279df6f24b0e857d5e6d0605fd25af95adc3cee
            • MD5 SHA1 SHA512
            Submit Download

            memory/4456-4022-0x00007FF661090000-0x00007FF6611E3000-memory.dmp
            Download

            memory/4456-4743-0x00007FF661090000-0x00007FF6611E3000-memory.dmp
            Download

            memory/4456-4678-0x00007FF661090000-0x00007FF6611E3000-memory.dmp
            Download

            memory/4456-4352-0x00007FF661090000-0x00007FF6611E3000-memory.dmp
            Download

            memory/4456-4614-0x00007FF661090000-0x00007FF6611E3000-memory.dmp
            Download

            memory/4456-4097-0x00007FF661090000-0x00007FF6611E3000-memory.dmp
            Download

            memory/4456-4548-0x00007FF661090000-0x00007FF6611E3000-memory.dmp
            Download

            memory/4456-4161-0x00007FF661090000-0x00007FF6611E3000-memory.dmp
            Download

            memory/4456-4483-0x00007FF661090000-0x00007FF6611E3000-memory.dmp
            Download

            memory/4456-4221-0x00007FF661090000-0x00007FF6611E3000-memory.dmp
            Download

            memory/4456-4418-0x00007FF661090000-0x00007FF6611E3000-memory.dmp
            Download

            memory/4456-4287-0x00007FF661090000-0x00007FF6611E3000-memory.dmp
            Download

            memory/5792-4083-0x00007FF651960000-0x00007FF651AB3000-memory.dmp
            Download

            memory/5792-4345-0x00007FF651960000-0x00007FF651AB3000-memory.dmp
            Download

            memory/5792-4411-0x00007FF651960000-0x00007FF651AB3000-memory.dmp
            Download

            memory/5792-4280-0x00007FF651960000-0x00007FF651AB3000-memory.dmp
            Download

            memory/5792-4476-0x00007FF651960000-0x00007FF651AB3000-memory.dmp
            Download

            memory/5792-4214-0x00007FF651960000-0x00007FF651AB3000-memory.dmp
            Download

            memory/5792-4541-0x00007FF651960000-0x00007FF651AB3000-memory.dmp
            Download

            memory/5792-4149-0x00007FF651960000-0x00007FF651AB3000-memory.dmp
            Download

            memory/5792-4607-0x00007FF651960000-0x00007FF651AB3000-memory.dmp
            Download

            memory/5792-3896-0x00007FF651960000-0x00007FF651AB3000-memory.dmp
            Download

            memory/5792-4671-0x00007FF651960000-0x00007FF651AB3000-memory.dmp
            Download

            memory/5792-11-0x00007FF651960000-0x00007FF651AB3000-memory.dmp
            Download

            memory/5792-4730-0x00007FF651960000-0x00007FF651AB3000-memory.dmp
            Download

            memory/5792-3995-0x00007FF651960000-0x00007FF651AB3000-memory.dmp
            Download