e15188f451c3de8e0514ebb6058f9392b91cee40dc07e5425f471f3543447e13

Analysis

max time kernel
151s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 04:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecurityHealthSystray.exe
Size 89.0MB
Sample261014-fdvnaaee47
SHA256 e15188f451c3de8e0514ebb6058f9392b91cee40dc07e5425f471f3543447e13
MD5 e3e0fe1a396118251f7f7bc78a717a8c
SHA1 de200c6f309e5adc92dd030c98e9778b55f55f6a
SHA512 3858559b87f3ec96c27aef86ff6df446b5950da7d20d27c43c42387229f54eb1155a489c4b696fcec01a0cae91af67c8310764e2a06e173521a7dffb2fbd1e03
SSDEEP 1572864:kzjp7BmO1bET2E6/mWu2m4Cib9ZQ+qnfmkRe6meKih+aKQsP7uWimBkTVonk+YCl:k57BZ1b62Esmpi8tnfm/6mo+Z5BCoYdu
TLSH
T1931833FAD8770AAA7893715CAE487FA14C25F5149D31C40F3699CE49C693B037CA6B8C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

credential_access defense_evasion discovery execution impact persistence privilege_escalation ransomware spyware stealer upx

Malware Config

Signatures

Clears Windows event logs 1 TTPs 3 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
2652	wevtutil.exe
3132	wevtutil.exe
940	wevtutil.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (2051) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecurityHealthService.exe	SecurityHealthSystray.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecurityHealthService.exe	SecurityHealthService.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Executes a file named after a Windows system binary 1 TTPs 2 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SecurityHealthService.exe	SecurityHealthSystray.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SecurityHealthService.exe	SecurityHealthService.exe

Executes dropped EXE 1 IoCs

pid	Process
4988	SecurityHealthService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityHealthService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SecurityHealthService.exe"	SecurityHealthSystray.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityHealthService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SecurityHealthService.exe"	SecurityHealthService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityHealthService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SecurityHealthService.exe"	SecurityHealthService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityHealthService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SecurityHealthService.exe"	SecurityHealthSystray.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
9	discord.com
12	discord.com

Drops desktop.ini file(s) 16 IoCs

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2714045687-1127350534-2056456672-1000\desktop.ini	SecurityHealthSystray.exe
File opened for modification	F:\$Recycle.Bin\S-1-5-21-2714045687-1127350534-2056456672-1000\desktop.ini	SecurityHealthSystray.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	SecurityHealthSystray.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	SecurityHealthSystray.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	SecurityHealthSystray.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	SecurityHealthSystray.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	SecurityHealthSystray.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	SecurityHealthSystray.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	SecurityHealthSystray.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	SecurityHealthSystray.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	SecurityHealthSystray.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	SecurityHealthSystray.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	SecurityHealthSystray.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	SecurityHealthSystray.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	SecurityHealthSystray.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	SecurityHealthSystray.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	SecurityHealthSystray.exe
File opened (read-only)	\??\Z:	SecurityHealthSystray.exe
File opened (read-only)	\??\H:	SecurityHealthSystray.exe
File opened (read-only)	\??\I:	SecurityHealthSystray.exe
File opened (read-only)	\??\N:	SecurityHealthSystray.exe
File opened (read-only)	\??\R:	SecurityHealthSystray.exe
File opened (read-only)	\??\U:	SecurityHealthSystray.exe
File opened (read-only)	\??\D:	SecurityHealthSystray.exe
File opened (read-only)	\??\J:	SecurityHealthSystray.exe
File opened (read-only)	\??\K:	SecurityHealthSystray.exe
File opened (read-only)	\??\L:	SecurityHealthSystray.exe
File opened (read-only)	\??\M:	SecurityHealthSystray.exe
File opened (read-only)	\??\T:	SecurityHealthSystray.exe
File opened (read-only)	\??\X:	SecurityHealthSystray.exe
File opened (read-only)	\??\P:	SecurityHealthSystray.exe
File opened (read-only)	\??\V:	SecurityHealthSystray.exe
File opened (read-only)	\??\W:	SecurityHealthSystray.exe
File opened (read-only)	\??\Y:	SecurityHealthSystray.exe
File opened (read-only)	\??\S:	SecurityHealthSystray.exe
File opened (read-only)	\??\G:	SecurityHealthSystray.exe
File opened (read-only)	\??\O:	SecurityHealthSystray.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
11	api.ipify.org
1	api.ipify.org
7	api.ipify.org

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\~fs_w.jpg"	SecurityHealthSystray.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\~fs_w.jpg"	SecurityHealthService.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4884-0-0x00007FF7A6360000-0x00007FF7A64C8000-memory.dmp	upx
behavioral1/memory/4884-14-0x00007FF7A6360000-0x00007FF7A64C8000-memory.dmp	upx
behavioral1/memory/4884-15-0x00007FF7A6360000-0x00007FF7A64C8000-memory.dmp	upx
behavioral1/memory/4884-4067-0x00007FF7A6360000-0x00007FF7A64C8000-memory.dmp	upx
behavioral1/memory/4988-4193-0x00007FF7DF8A0000-0x00007FF7DFA08000-memory.dmp	upx
behavioral1/memory/4884-4220-0x00007FF7A6360000-0x00007FF7A64C8000-memory.dmp	upx
behavioral1/memory/4988-4231-0x00007FF7DF8A0000-0x00007FF7DFA08000-memory.dmp	upx
behavioral1/memory/4884-4254-0x00007FF7A6360000-0x00007FF7A64C8000-memory.dmp	upx
behavioral1/memory/4884-4309-0x00007FF7A6360000-0x00007FF7A64C8000-memory.dmp	upx
behavioral1/memory/4988-4362-0x00007FF7DF8A0000-0x00007FF7DFA08000-memory.dmp	upx
behavioral1/memory/4884-4418-0x00007FF7A6360000-0x00007FF7A64C8000-memory.dmp	upx
behavioral1/memory/4988-4442-0x00007FF7DF8A0000-0x00007FF7DFA08000-memory.dmp	upx
behavioral1/memory/4884-4481-0x00007FF7A6360000-0x00007FF7A64C8000-memory.dmp	upx
behavioral1/memory/4988-4508-0x00007FF7DF8A0000-0x00007FF7DFA08000-memory.dmp	upx
behavioral1/memory/4884-4547-0x00007FF7A6360000-0x00007FF7A64C8000-memory.dmp	upx
behavioral1/memory/4988-4574-0x00007FF7DF8A0000-0x00007FF7DFA08000-memory.dmp	upx
behavioral1/memory/4884-4613-0x00007FF7A6360000-0x00007FF7A64C8000-memory.dmp	upx
behavioral1/memory/4988-4638-0x00007FF7DF8A0000-0x00007FF7DFA08000-memory.dmp	upx
behavioral1/memory/4884-4676-0x00007FF7A6360000-0x00007FF7A64C8000-memory.dmp	upx
behavioral1/memory/4988-4702-0x00007FF7DF8A0000-0x00007FF7DFA08000-memory.dmp	upx
behavioral1/memory/4884-4741-0x00007FF7A6360000-0x00007FF7A64C8000-memory.dmp	upx
behavioral1/memory/4988-4767-0x00007FF7DF8A0000-0x00007FF7DFA08000-memory.dmp	upx
behavioral1/memory/4884-4806-0x00007FF7A6360000-0x00007FF7A64C8000-memory.dmp	upx
behavioral1/memory/4988-4833-0x00007FF7DF8A0000-0x00007FF7DFA08000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5636	cmd.exe
5316	cmd.exe
5640	cmd.exe
3112	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityHealthService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityHealthSystray.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityHealthSystray.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityHealthService.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4600	vssadmin.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\LockBitEncryptedFile\DefaultIcon	SecurityHealthService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\LockBitEncryptedFile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\xllx_lock.ico,0"	SecurityHealthService.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\.lockbit	SecurityHealthSystray.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\.lockbit\ = "LockBitEncryptedFile"	SecurityHealthSystray.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\LockBitEncryptedFile	SecurityHealthSystray.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\LockBitEncryptedFile\ = "Encrypted File"	SecurityHealthSystray.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\LockBitEncryptedFile\DefaultIcon	SecurityHealthSystray.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\.lockbit	SecurityHealthService.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\LockBitEncryptedFile	SecurityHealthService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\LockBitEncryptedFile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\xllx_lock.ico,0"	SecurityHealthSystray.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\.lockbit\ = "LockBitEncryptedFile"	SecurityHealthService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\LockBitEncryptedFile\ = "Encrypted File"	SecurityHealthService.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2384	WMIC.exe
2384	WMIC.exe
2384	WMIC.exe
2384	WMIC.exe

Suspicious use of AdjustPrivilegeToken 53 IoCs

description	pid	Process
Token: 33	3704	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3704	AUDIODG.EXE
Token: SeBackupPrivilege	2552	vssvc.exe
Token: SeRestorePrivilege	2552	vssvc.exe
Token: SeAuditPrivilege	2552	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2384	WMIC.exe
Token: SeSecurityPrivilege	2384	WMIC.exe
Token: SeTakeOwnershipPrivilege	2384	WMIC.exe
Token: SeLoadDriverPrivilege	2384	WMIC.exe
Token: SeSystemProfilePrivilege	2384	WMIC.exe
Token: SeSystemtimePrivilege	2384	WMIC.exe
Token: SeProfSingleProcessPrivilege	2384	WMIC.exe
Token: SeIncBasePriorityPrivilege	2384	WMIC.exe
Token: SeCreatePagefilePrivilege	2384	WMIC.exe
Token: SeBackupPrivilege	2384	WMIC.exe
Token: SeRestorePrivilege	2384	WMIC.exe
Token: SeShutdownPrivilege	2384	WMIC.exe
Token: SeDebugPrivilege	2384	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2384	WMIC.exe
Token: SeRemoteShutdownPrivilege	2384	WMIC.exe
Token: SeUndockPrivilege	2384	WMIC.exe
Token: SeManageVolumePrivilege	2384	WMIC.exe
Token: 33	2384	WMIC.exe
Token: 34	2384	WMIC.exe
Token: 35	2384	WMIC.exe
Token: 36	2384	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2384	WMIC.exe
Token: SeSecurityPrivilege	2384	WMIC.exe
Token: SeTakeOwnershipPrivilege	2384	WMIC.exe
Token: SeLoadDriverPrivilege	2384	WMIC.exe
Token: SeSystemProfilePrivilege	2384	WMIC.exe
Token: SeSystemtimePrivilege	2384	WMIC.exe
Token: SeProfSingleProcessPrivilege	2384	WMIC.exe
Token: SeIncBasePriorityPrivilege	2384	WMIC.exe
Token: SeCreatePagefilePrivilege	2384	WMIC.exe
Token: SeBackupPrivilege	2384	WMIC.exe
Token: SeRestorePrivilege	2384	WMIC.exe
Token: SeShutdownPrivilege	2384	WMIC.exe
Token: SeDebugPrivilege	2384	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2384	WMIC.exe
Token: SeRemoteShutdownPrivilege	2384	WMIC.exe
Token: SeUndockPrivilege	2384	WMIC.exe
Token: SeManageVolumePrivilege	2384	WMIC.exe
Token: 33	2384	WMIC.exe
Token: 34	2384	WMIC.exe
Token: 35	2384	WMIC.exe
Token: 36	2384	WMIC.exe
Token: SeSecurityPrivilege	2652	wevtutil.exe
Token: SeBackupPrivilege	2652	wevtutil.exe
Token: SeSecurityPrivilege	3132	wevtutil.exe
Token: SeBackupPrivilege	3132	wevtutil.exe
Token: SeSecurityPrivilege	940	wevtutil.exe
Token: SeBackupPrivilege	940	wevtutil.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4884	SecurityHealthSystray.exe
4884	SecurityHealthSystray.exe
4884	SecurityHealthSystray.exe
4988	SecurityHealthService.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4884	SecurityHealthSystray.exe
4884	SecurityHealthSystray.exe
4988	SecurityHealthService.exe
4988	SecurityHealthService.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 5636	4884	SecurityHealthSystray.exe	92
PID 5636 wrote to memory of 4600	5636	cmd.exe	94
PID 4884 wrote to memory of 5316	4884	SecurityHealthSystray.exe	97
PID 5316 wrote to memory of 2384	5316	cmd.exe	99
PID 4884 wrote to memory of 5640	4884	SecurityHealthSystray.exe	101
PID 5640 wrote to memory of 4504	5640	cmd.exe	103
PID 4884 wrote to memory of 3112	4884	SecurityHealthSystray.exe	104
PID 3112 wrote to memory of 2652	3112	cmd.exe	106
PID 3112 wrote to memory of 3132	3112	cmd.exe	107
PID 3112 wrote to memory of 940	3112	cmd.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
"C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe"
1⤵
- Creates a file in the Startup directory
- Executes a file named after a Windows system binary
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /d /q /c vssadmin delete shadows /all /quiet
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5636
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:4600
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /d /q /c wmic shadowcopy delete
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5316
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2384
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /d /q /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5640
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
    3⤵
    PID:4504
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /d /q /c wevtutil cl System & wevtutil cl Security & wevtutil cl Application
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3112
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl System
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:2652
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl Security
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:3132
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl Application
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:940

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004BC 0x00000000000004C8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3704

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2552

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SecurityHealthService.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SecurityHealthService.exe
1⤵
- Creates a file in the Startup directory
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 0ff646d897e3154fb58a578598f2792f084be0c212426ebfbe972b387538073d
MD5 8ec7f0649926851fe90115d9c604b8d1
SHA1 375e8d68f72c53ec4f971772e24fdc725c2309fe
SHA512 3b2c5ea527e518fbe8d378239f274649a3f897b3aaa7f96a8b27f5a2ca4d1ada8046b70b47f8043a43283e3f36aea0b22a59888912ac67b64e759b3bc80d24f8
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 febcb6718f090d57f612fab26b27840b2f2e745fb3e2971800c437b7c31fe571
MD5 40f18b6c575d6350e9d23c4f559eac7a
SHA1 4c7db04491acf86889c133a20f9d5d5f999dfde8
SHA512 ec0316ce7e6f2dfd9f5b759a2f07aad1bf9aa6786e233e12c3bd24e48b4f85f583eb450a78e6229f3cf9d494560ffb2d42d81aa78ce851a42152639ca4325a5c
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 11e7f5564ef398e9b7378a4e8693c806022d55f6ad29bf9356fa1e9a2caf8a9d
MD5 7d4d0896dc465ec892160292c4b78ea8
SHA1 2ccee10ba7c92481d282b88adcbb9fed4170a4bc
SHA512 78bb1c513908dadd007354ba8019d2f978d033b117d28795b34234f75e4b6f1ae08037428dfbc347837068b8497d7d7f13b92dbc29ffe4e481aff40be1aa4129
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 0b992468ae0d7f6642322cf4af978cf84ff4fac7789ccef4fff2aeeb95b370e8
MD5 fc3c068eecdb1757572efd7d4c93b6a2
SHA1 c9571afb29a80e119fdee280e74fef56cf50032c
SHA512 6b4c23895e2b2f558fe308ff0ca39f5fcbabba212b9efd714ee4c94f94849cb7f4084441e2b6fc409d44da7f779479828624d51d8ab8cf72e668aa7625c136f7
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 5bb024c232e40e92b29a0a0133771e141bdf75e707aa75f1d3fafc9cc270af7e
MD5 cc429f8c76eeac2305992c93c61d91e6
SHA1 106dda5a94d22120c464f6de07df0f092abb30d8
SHA512 f3fcf3f4e9090c9f94dbc2877e6b5509bc4ca3bf9358148558ddca069e0a608938f6a761a47fa3e05f1db172ca98ae8236359707359c4772f2b0f797a099ecb1
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 dbcb8d48a672bea43d140304c7b09590e8a6cab256aa2289efc7b50e01b79471
MD5 c15df34f267c507034e6add68137aecc
SHA1 7477656659461ef2217a9deaa7c40ce660793117
SHA512 70e8754602714de910bfa92f8e33c0095e407a9aabf052ba5e4ba0dfdb6532f4572e1f8305566c75815a4ef25bcfd42241cdab2f2c94c63356b8d68ceb3861e0
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 a8fcbf4b83c73edcb9e1112d130be5b9e79931fd2ecaa8a3468c9ad294dd2c25
MD5 0fa8d1dea9802901099ec899534b1b10
SHA1 fc790f20548eb9818c8229760bb8a7ee3adf157a
SHA512 058021362eb9f5b6b18d1ae7a9077464326fbcbac0e423d99ad6c0628bf88ea89cfb5536ea8c801a60519486f02e0193c2735e40f245afcf2590a781c3159d36
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 7acedc0ae367bb44877784071b3716fff65e85ce3614300acc7a8473f0e15460
MD5 ba70721648edbb44aa9150f6c9f14efb
SHA1 43d19350f7f9aa38c541f5e7abc44583f586390c
SHA512 9e6fe539153541a5526b1fd1cc3d3e30597fb54568a04f8b8694145ca8f6b29bcc82bd6425e793467ce5aa35ae78d898b7742443c5cd7b6307ab1ab25fca9d94
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 7bdeaf76aad430369af7b30ef05fc1c8e4ccbc931bfd2cdb253c0fd9ce484c0e
MD5 23b5f6f0cda5a1a1fb4cdedc6e656ea8
SHA1 37fc5486e13b4529fd0abd1973d7824c8c61b9fa
SHA512 b4d6d95b38978871a6abb46d667702dc9ba65fc093ce824ab69a668e0683d299c4d796adba038371480a926a11e274ea0eb002d9538e8f2ed4d2f7db1b419f5b
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 4c485fab156137fe73654bb4a21dfcb1f098333e7128dace8eb8c1f2ff61d693
MD5 f550685c3fd2ae43fe7181a6a8078b20
SHA1 a07d97af3b507763d5cb798947894971a05f779d
SHA512 4db6277b8accde85e24f70789adcd9a7959290e2b5bd2da14dfe7b4d86c45de39c4d66061148b441fe27adb699abf09f3241c66fb9714028eca23b74a30caecb
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 03f30ffeed91f2b60af755eca65c559e2a102d51e5fc50bec567c830739aafc3
MD5 b792b7ffffeb7a61162d356387180fb7
SHA1 70f9b6b42182cec95d9ab51c59a523561b4901b3
SHA512 22ebf015ee5171110eb70b32787167d171e7103b527db170ab3bfd1993e9c1bfd37fe8d4f5b11d82d79a9e7d8ae438f18a5d1ee2e9cadf072c7cf4e3aba0e993
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 5108db502004b1381f60c52a111b7cb1ec6bdc1a5a9d320ef24fbe94a8eb7319
MD5 b7de1ddb5cb0db03a1542636867ec849
SHA1 52936524b3870e213cb4ec2e9be2c40723212a53
SHA512 34c4e0069f72b453e2a1ecddf51b294885944a6c15d040c099c9bb2b3f458de075976311691d58030b6aafba9fe59cbe98f218f632fd04cc367fabf9316af4d0
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 f6138d764a652fdd5cca65c725f7babe1b26d16f4db520a4d3f4315e99e3809c
MD5 1a0126c3e363a298eeaabc373cb6d374
SHA1 1fc728a6a5e1c377eafd9afaf7319355cba7b21d
SHA512 d6bc5f751292478bc692ec86d987f1c8c579b21c29a515d4c8f1a97f5bc8176c92efbbf201751ef0ff90002f1eca729337081e2a1a8393f3593f4be9435968ef
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 89857c50e63fdd562b59067f3328a0d16c9db2146057071a912cd3f8d71f2a88
MD5 fc6b23f630e91ae7302c380fa70e3d38
SHA1 a5a1169927ff21291d713bab2a5341972196b9ec
SHA512 64e31e065014c3f2eb548772e368601b26004395bec6dea3a2f524a7027877b66a2745914984f8b8d726484ea2b3fb226d2e8648d01ca32da56e7d180aae5ac8
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 84576c5860482ee7130dfb230910775d642d41ba227d3e139dbcc03d5437e510
MD5 9925cac9a90ef7ee9b5b6dc0402c5580
SHA1 468fc2aa8b22d19b6ec881c0672ddfa6a144dc89
SHA512 c900018d3f1330830f55343a8fe8c602aa0df2bf7ba3d903568e9cde49ab677d0003bdccb31cca4536c5f81623c2aef93892fb262c33990df3b1bd2373cc1d60
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 54253c8b77f01bf639e61b9937425a5682bbf74552ee965931dba6a441ca1320
MD5 0b0d17d061c0fe24476f571ba3291ad0
SHA1 85df64b3b81d6d2cba686be8a7e61615b1c22a0e
SHA512 8028f1cc9268c98272c076c17b7f38d47b923e57f4d579891db73129d1a7c04aa011cf21b40abdccb6a404c1291dad69379356f5fa48c74604dd1ca06982ef63
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 66fb5acd4823ab5c9783757548a3b641f00683c4a19820e77fdbdb1fa6318a9a
MD5 940ecb48f3c67dda2f9a8643d20d0c5e
SHA1 3f6cd21f6f9917760fc417b1db0aafece464f4e0
SHA512 a43c01a5dd0697c32fb76d378f885897c8acf11b51d1de8ad9b5f443cb96f3fd548467f4525d3693e114986c32ba9dcf22a9858f37a9da251e141359c44177ae
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 f29316a87a55947a66375de4448d2fb21f61f48f5d71c22569be1a5b22292163
MD5 9501d9980f3507a6fd4cc2c5d4759d91
SHA1 a022b0658efafd1db05784d844a4ab2695ac0eee
SHA512 5aee93e41a27bc1a660c89d13cd72bf828d9312de233c92cb011a7abc214db977254f067f278b750875967b2f7b03dd79b9cd05a36db524d6aaa97f66e82543c
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 69eb7b1f78c2652bbaaa3a3084ac9cc822d58b2eefd49778a96dfd4e45e7cfdc
MD5 105c17bcd4f3734bf01781959ee12c33
SHA1 eb123f3068f5828e52782056860d41c515ef3170
SHA512 1b7c049fa5760b7787ee4592b59ee2d151e7df0288858b2807fd43e0c0d5bb6a1ee3d5344e091b3f4ff14baf571acb96370f47a219a279962e99f3a855ac82a9
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 ccd51f287ab67916c1c5c7bc2f4c16bc9e59549fea0106c8b53d9e8fd5caab65
MD5 3b8ee322f631fe9bf3bb9c8981f46c1b
SHA1 0e6c3deecc58a55693c087979d9d267d8358df2a
SHA512 4ccd0db1a24a66b9df618743f9bf7c546be54a33f0e5e8355b0e18c8082252e87e70c1d0c4326edbdb2185859aad47f85f967a2e6d9b99c721d67bd25df24060
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 905b83fcde8aa32b1e465098a3efba08109950092128ef2bc4166ff4491525c0
MD5 895a4fd36c14ed5fa1cd1ebde4deff2d
SHA1 8311c6bfa0cbb9f1feb9b3a28d09874709e0773b
SHA512 437a4769d910f964b58d058b607837a52b0a34a271796c55348de6ee935d7f4f6b5ef8829c0a60eea05655ac25fc61fc0d75a62a8554b739014e66b924d13604
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 5774d8d1609ad083d22cdcd8c86254eaee7b704371414d19139b9171cba7ab0c
MD5 cdbb19d82a53cd09213f77b4f022f398
SHA1 1d53f1c53d98739e4c4831e3b55fbdd7525adab4
SHA512 dea02cd88eb408618e5aafbf8331f7b3039650fcd89259f1e9e87502da388215b373c5fadf7de6d3036d7f5c7bf7fc90866ce285e841d4284cb316d2e968512a
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 c944befb494501532dd0a2a3ce92afbd1b291cc3bb38e2c216a58a3b525eed8d
MD5 e13af3bc3f7d841fab9b866393428288
SHA1 4ee5a50dff319db138b8a9cb75af264f05483fc5
SHA512 6c976b13c645deb432d6fb715e7ac6f95446a9adcf8285e9ef504c75d33a6beb42ef8d9e55e038bb5f6a00b0dbc6f9a7fe8721391797ccf360ced0dc900cb2ed
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 7c23a95877b42cc3708b76be0ce88e37cdd380bb9190503bd3222adab1d10ee5
MD5 50fccdf3a9f54fad8446986d1ea8afe4
SHA1 7a927ca96b80fb0d295122419efb57e5ebf64548
SHA512 d93195660f77bcfd7dd2a3827d3c8fd89f51ff5a74749fe95e212e119b77e57b41a122365ecd79b0d3a375b2b41486c5aa05fe196a5fb26b7d2a62f2d7e07c91
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 c5961e82854fbe40cbd90107356b762ee6689e3a2e64048ab6f463afa79dcd11
MD5 d3c2067bdf516cfcd0b5f5b79c6bb4a8
SHA1 dd58a240b599ad89c3d39894c8fbd72fbb8f46e7
SHA512 15b14c1750710c3cbbac760e0ced33763666cf1d597140fa51a22cb43ed711de314c6f2d60e4cee42ab85cc78a3bda8f92506bae6423e4669219627f589e9600
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 8d528929bde344ea63b8051745bf58d2560902945e4af504eba0de2ba69f6b00
MD5 c61661ce77b3c09cc4e896f221ada5d0
SHA1 a04410b322c1fe845746f0a6f549c1c84b4c3470
SHA512 8bde35d9fb72dfbeff9d6b8f34828d9ad6791523950be807c17c8d395b22f08faab0734cda9949768d71dd68de856f28a808f8e3323203181b4c3ca4224b8fc0
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 84c58c4ed29e7b41efecd5d9aebe704cbcd7e09b79aa6e71fd9a66b9eef68f98
MD5 678c605189f413da2757d86c98374cf0
SHA1 cd8f8a07dc1cd7937e4589ef49da812e68f84572
SHA512 1acdbbe9959d83fe0114c5036dd9f875d642f6c2079b0f902eb9e5a2f66e1254090bfb55642d520a7d7f88dc9590a7dce29b0a59f34d9aaae9394b3e4f7c2a3b
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 b6fdfa9df57911fab4707223ada2b1b03684587e096a15c52f56d1a1760b6c92
MD5 a55014db47e769847dbdb2d77d779a94
SHA1 12968cc065b6f67cd7af019b45e2f40e543ab0a5
SHA512 198cc48b555b86e74047c5fff4ee374ef27ccc0e0b352f326745f9fb7fd6889982da519e6e43bd97ca2b2f791239d51afc1dbe9e8e02ad10759c38fe744ede09
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 4e174d3915f6d846d19bed97cd881bbde04f100185be7202e6dd6a1bd39a9913
MD5 e09f4e9bb0c09053bfec61390db7b154
SHA1 2ccd3fb86767dbba3c93c9997e654850f42edc6f
SHA512 c7b670eaca7b278e898affb162b00c980d6f389ab7202275db4d208c87757cf412e630d59da561c81ba498c2a755fd5adbbcc69e07cc94ba1f5626af4ca293fd
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 bebccb5b9e86619b809def2e2043e7bdb4f9719c05c3395c1b19ce1a52e03c73
MD5 0f2f579cdd9c35071c772b3b2228f392
SHA1 323ea8f09c777c06854f9c883e1ef95d71ce4601
SHA512 2e697ddca1e26dd7fc810a816ad946f89670b9d17253fca1b8f1cb3c628452dcd64366505c977077a7e2aa3c4cd7725567379a3550d32b0a536ca926ff633136
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 1b33724e7600446a04285d905a35738646f302c38790cda22de2701a9a56c2b9
MD5 22613212bb0b60fe6b03c5638bce4c28
SHA1 74be810f9a95cebe8b906ea05e36ecbc60df3a9f
SHA512 7186fa7ca1f85a848a233c5660fc8c3cf71e686b0d7de870b9eff41a3e7cec11487efc2b4a1d7fef1a7c7b99bd5e2a7e3f2e6ce76f5aff2e0aeb7a4996f08c12
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 5d8a234c138e7e1508fff298e54a916d4e258b23f9a1725f3365d103551be251
MD5 4244c8ede70c2e05afa1fcd315031d77
SHA1 07e93e1456d19953bfbec77bfa706da8e09d7eb8
SHA512 f6fe52a625723477ec64ac56416008afb6eda4d5fdf752d05cde95471147a057bb85051fcea857ade31847671617d910b59f0c9e6063da8b794e49c1cdb0f217
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 7b00aa01d3b274a9032035ee5394e7ba299e830c42664c9185acc280e05dae26
MD5 d4c99d40c8783922ed2b61ed8a1199a3
SHA1 4b1861be7415d9f50eae0ce1d229fbc1e894ce4f
SHA512 f66432e6335f1dba90c1912b4e830e6f6f1bab0784bee0bd5658df268b864a281d9ea75420aac90db22c046c0ea285407d3887d6086b89503d37259f4b52ffba
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 e83d40c56957080cd86198696df3505ae60be2fda7f4e7e50869da5c69b55e2b
MD5 b7c2e0a948f72d6da3e1f4c8bd82f9b3
SHA1 38cad4cb20b59f0e0abea2b9c11ae3d82adce2bf
SHA512 255ce940aa8d863f6bc360b4075517643b43b5213e9e0cca65cc900efba9554194a3f078517c787d8e0b6dd622e14bd6178ffd294af0b0cf346e02d2f6f6b9d1
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 ff652e54c579d903cf99b880266c2a68d9b4708b293a102489c56837e37bfcc8
MD5 e6cc5882c4150cb34b784dbf66b10446
SHA1 59432f1aa01c669c2df0f6d2e628f711e82f0f41
SHA512 8c6e5422cba6169c50b4e540d8de798ef4f229a6893e27baa439bb04c406ef5ae962b59839daa2879a57637525efcf175ac53eae82a3cd900ef6ad3e7c614b2d
MD5 SHA1 SHA512

Submit Download

timer.dat

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\{B4A90B69-F159-43ED-A58D-70755155AA2A}\.cache\timer.dat
Size 8B
SHA256 a0cc2f2bbdd4afeae1005c9c356a1b21f7cb0c0885f80e86f38cbc7ae4755123
MD5 091afcc6e429e26914e713e70d65e8e7
SHA1 d887ad360a7a402f379c3e271ee0436060741a5c
SHA512 c968ff17d01e1031a2bf6c9a03c77f780d1cd14f5430dd750407218c6bed89734e1951f0cfb7443b969797849b7524797f072f71586d6831812f17adbc139c30
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index
Size 24B
SHA256 9d908ecfb6b256def8b49a7c504e6c889c4b0e41fe6ce3e01863dd7b61a20aa0
MD5 1681ffc6e046c7af98c9e6c232a3fe0a
SHA1 d3399b7262fb56cb9ed053d68db9291c410839c4
SHA512 11bb994b5d2eab48b18667c7d8943e82c9011cb1d974304b8f2b6247a7e6b7f55ca2f7c62893644c3728d17dafd74ae3ba46271cf6287bb9e751c779a26fefc5
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT
Size 16B
SHA256 374708fff7719dd5979ec875d56cd2286f6d3cf7ec317a3b25632aab28ec37bb
MD5 4ae71336e44bf9bf79d2752e234818a5
SHA1 e129f27c5103bc5cc44bcdf0a15e160d445066ff
SHA512 0b6cbac838dfe7f47ea1bd0df00ec282fdf45510c92161072ccfb84035390c4da743d9c3b954eaa1b0f86fc9861b23cc6c8667ab232c11c686432ebb5c8c3f27
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 9e1736c43d19118e6ce4302118af337109491ecc52757dfb949bad6a7940b0c2
MD5 f5cfd73023c1eedb6b9569736073f1dd
SHA1 669b1c85ecbafe23c999100f55a23e06bf59ead7
SHA512 5d8c1aa556fc17d6dc28d618f521aee37fc0e1826fdbcf8d106e456fc3bcd3c76e712d23fef3378bd2be17b80eb5bfd884ccd89b67490b63c7bd118eaac471d8
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
MD5 c4103f122d27677c9db144cae1394a66
SHA1 1489f923c4dca729178b3e3233458550d8dddf29
SHA512 5ea71dc6d0b4f57bf39aadd07c208c35f06cd2bac5fde210397f70de11d439c62ec1cdf3183758865fd387fcea0bada2f6c37a4a17851dd1d78fefe6f204ee54
MD5 SHA1 SHA512

Submit Download

4566e5b8743ef984_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4566e5b8743ef984_0
Size 380B
SHA256 08c3e5bbea4fba57201a69d4bf70a0d255df921fdef4924c22da087f9338c2bc
MD5 9ed1bb09f1363bd8feca8a5702f45b5b
SHA1 7b1d042c4522032622690060957dbdbb5eb1b805
SHA512 47e2f52d8233d0429680445cd307d1124dc2236678f0575bc82c811c669790abe8f8161da9c40e1ab45812f3ec1eeb2687f61f0dd7dbf3eb23a22842f49ab8ce
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old
Size 319B
SHA256 5ae57b4b565d5727d851bc4deabc291fb9b7e4d06967324d9a7897da6a8c40b8
MD5 05292ae368555ae1dbde635f071b0369
SHA1 57e083ab3eb5ba9912d9c0f46aa108d0b09c73d1
SHA512 ddcfb299e378bdef1d01cba9814e45238fec7ec65997f305fa7fc086579bf45c67178744d3a902caf624c6eba19aa332b86031ef1c0639fd26fe1db7eace5abf
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old
Size 334B
SHA256 c87a7e9ae92e9652dd12d266f4eb2e12dc3e3715105dc108092c5b67553dc8ec
MD5 f59ae39607f4248f731a3f754ba2bb0f
SHA1 a26699655c8428e9116cf64a5dfbe718fe907e00
SHA512 0393d5a84dc5b603d835d4c5bd3d81b783c9222ec62cd1b3110f0027a6e7deb75a8c66b4e0e51c6f2c99adb7c161ac8768c054c2a17bf3842dd182f6fa306646
MD5 SHA1 SHA512

Submit Download

PreferredApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps
Size 33B
SHA256 7f9c9e31ac8256ca2f258583df262dbc7d6f68f2a03043d5c99a4ae5a7396ce9
MD5 099a150e83972a433492a59c2fbe98e0
SHA1 01ec548baccbe69625b54206ef7100f5ed03719f
SHA512 3d4321d657903224b06051eb2fe69f0e1bd5b1e12f1976f09b39fa5ed2705228b2f384fd98ef1f221081730da2ce1cb2fbbf4854260def49998b429facece3ba
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1a56c3b4-5221-483c-b1c6-b8388feea909\index-dir\the-real-index
Size 48B
SHA256 17b0761f87b081d5cf10757ccc89f12be355c70e2e29df288b65b30710dcbcd1
MD5 b203621a65475445e6fcdca717c667b5
SHA1 c17fd92682ca5b304ac71074b558dda9e8eb4d66
SHA512 ed68f5f49945dcd0d81dfebe2f2fd1fcfe016807d5c64ee0377d046efeb0a7fd9b4b9589b3df8a14194d51dcffbd89c8aaa072cea2ad4e7976bdf53528ea90cc
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 40B
SHA256 2c34ce1df23b838c5abf2a7f6437cca3d3067ed509ff25f11df6b11b582b51eb
MD5 fd4b38e94292e00251b9f39c47ee5710
SHA1 b80de5d138758541c5f05265ad144ab9fa86d1db
SHA512 1080f871e39cc839e5bcc9f852f9a8f3ddc03cf7e72e9fd1d6e4a71d7e74936f58adc646c9a9dc382fde85c5d281c2a44a459caf6afa58272d7fa006152e4cb1
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 480c52f030d9e55cec53a16e454ffe8f12b56b9d93a0dadd28f226af89393195
MD5 f129cbd00a7078a50655d1145feac97b
SHA1 cac04499074ed54e382ee370bd1d39f6f317dbad
SHA512 5ab6bc4ad83f0f393e480e42f95e86c65b9c113392a85c40a2f4d5e8335b602bd6ae373d15775500b20e6199b129d6a0bbfe544dd5f029450026e289a5c18014
MD5 SHA1 SHA512

Submit Download

chevron.svg

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\chevron.svg
Size 295B
SHA256 7ad890fffffbfc85658865ec18f2e988f49b1432a521bf3e0253d382e5ecc00e
MD5 cd712d66af0c4cb9679423c976a2ca45
SHA1 d3dbb809cbc873b4b50d2b6f22423600327549ba
SHA512 92ae2c26460f93f1db561286aab16ed2a0272005e80f72c62f677640ac713be685125b6e6c673883d195c9785ffb50f5d55286ea77f62f7fa9a96a6a40b62317
MD5 SHA1 SHA512

Submit Download

OneDriveMedTile.contrast-black_scale-125.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-125.png
Size 848B
SHA256 4925b9b6329f24346bce043f2cdabb940199fd87188f3ae77c9559bf7cfa9f43
MD5 e66d4ab75e9862302da5825bbf066c5e
SHA1 fd5c26be1c56ae0af5e626741ca5896858e43073
SHA512 ed179e34d1d6f2ddc85fa6cd8b866f192c1c4ff2e2b715d9ddd95bff6e8f45318dad7d4da607960268e1cdfd78d48f04b4ea1a9b01ae70fc1c7da856a178d8c8
MD5 SHA1 SHA512

Submit Download

social-track-digest256.sbstore

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\safebrowsing\social-track-digest256.sbstore
Size 298B
SHA256 314f47cf9b9e4e05c5e965e82dd2751a934c094b481a00291e9e11f21d0ec4ee
MD5 f8604af8f8b94ba9236cadbbcf392cf8
SHA1 7720bd804ab353ae41f553f998fffea14764a79a
SHA512 403c7e18334b038f0943ab55ab9a338b3ce8efd0f25f4520e9a184f1c4948303e535ec9c1d9fef0f27c086281f0ed0112f396e8fb2e289da666f0dc94b4ca6d6
MD5 SHA1 SHA512

Submit Download

~fs_intro.gif

Path C:\Users\Admin\AppData\Local\Temp\~fs_intro.gif
Size 3.7MB
SHA256 361386a4351fdc589f2e396172c711c25581a6de9b58d4bfe325ebf14e585963
MD5 c216af820252313dd6c02090c32eb8f7
SHA1 6709c26b158fdc752f5a3555aeaccc3c0358a414
SHA512 f3d53c6cfc01d43f60bb6bf67d0474982aaa11b09185977eee012e9cb52c4a613448ae893f47fd912d345ed2ecbebf080a2305b2af805052c7236d75914ddce8
SSDEEP 49152:c/18x1dtSwhD1Y3ryvU4kySEXS3zfdPaL3f/Aj5/vUI6RpcHYiA7NAp9i/aK2n/r:cexfe3H4tyzfe3foj5GCHYLNAKavWuF7
TLSH
T1DE0633EE3D3D4A98EC9626783B217F19C72978FD1C11017E4B82E5C4F820A9DA253D4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~fs_l.bmp

Path C:\Users\Admin\AppData\Local\Temp\~fs_l.bmp
Size 57KB
SHA256 966987027f6a9e0d9320a0f081514a546fed2367ad783557aae24edd33f68149
MD5 fde2e95ea1d0a2e351dfe861301fffea
SHA1 3e17cb409feb498a9ffaf714b9916714dfc01ada
SHA512 19271ad92ffc3eaa10c2953af3f8b9a74d4ae2263250806ace6df016863bc1a6b4ed01f18e7b798d4226fb150c58cc2c18ca543ebdec2053e6f79908c1cf5efc
SSDEEP 768:waVUkM//1uzBqsDSOZ4/RNW6g0DFGB+GS:RKvl4ch/R8z+V
TLSH
T1C0436BF8E655CC979869F4A3E3C2ECECD82239364911BCFB112706CC08E53D5996EA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~fs_lock.ico

Path C:\Users\Admin\AppData\Local\Temp\~fs_lock.ico
Size 67KB
SHA256 7d3670f92168b98fd3f7e9768c7d375166e924bfbebe76e35b713ffd6298096a
MD5 e1c3f25eb75e38fa38ff7796a7027d9b
SHA1 6384cfc5cc7664b4a34c59fddd07f4838a7e7c2c
SHA512 fc9bf90017271830ccd2a9860b51f711838ab53da45544ba57726afc7ec3f4a32de0f20bdc57ac98330e65f415cdc19755d897782aa472de7b692a1e6912ba67
SSDEEP 1536:gA2bIhA9RJyDt5PDTydmiYQHSfs/QZXBfiVay/U/nUAk+aaz:H2khqj2/TyoixSf+QZX1AStkU
TLSH
T1E96312A06ECDFC9A95F081A376AB8C7530C187AD97F7281446A357E4234FA22429AF45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~fs_sk.bmp

Path C:\Users\Admin\AppData\Local\Temp\~fs_sk.bmp
Size 27KB
SHA256 4634d298462f6ec7049a76b20fc0a91e69771e743ff8ede3a2f4865adfc6a225
MD5 8b0250fe67ecc94872d8a6099e8ecc43
SHA1 811a189436124a4d10f335c6941e113ef063daf3
SHA512 770f724eb548ef8a79a17dd136d03adfd50085775f2fd937c8ac8eed3e3a72ef9fe1c26ed32c3f0ece402eb3cc3466c5b93828798eadd9f0ac41dd948156f6e2
SSDEEP 192:HME+3dC7NZUrBUO0EZSKdVVLbArG6e7FGScCZKi7c:sEKINZVGdvoy5p0CZ/7c
TLSH
T1BDC2C553FF4AA493DEA81F74615B136A3F70704CBA52CB232A2D3835EC471E23E5A605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~fs_w.jpg

Path C:\Users\Admin\AppData\Local\Temp\~fs_w.jpg
Size 64KB
SHA256 ca4705631f80a219ac7770c705d96c822618ad17ecb38ddb3650d9e403d42f5e
MD5 26c0f2759f7bf57976450cc023865770
SHA1 e11fbcbff30dd2f72b3f6436d715c737ec704e6c
SHA512 f3fc161e866e478decdac0d31f18e902939d692ec59ff577060c834cc2d642e71b5f0d4a28aba08b7b1c76cde325448decc76724dd60181bc8170c4d9a92e947
SSDEEP 768:ICkGC35pOpfNRlR6hRQWaq3ID6yp5fPBnC:ICkzXolR69aeIDzRnC
TLSH
T19153B61788089EC3A02CD7E5BF130ED92F592B48E9863DFF40560FCA7B642635C5E56A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertToMeasure.mp2

Path C:\Users\Admin\Desktop\ConvertToMeasure.mp2
Size 248KB
SHA256 70ef7e172b8531ff3eae9fd462a5469dd0521643fd04eea4b6f80a5608f0adab
MD5 c8dea7aa7bf5555f75761b55fd12801d
SHA1 313c2175ba335a6e49b3a8bb13c054d0ed7ebe2a
SHA512 530e4f9ddec12e152823c9e24ebe5c98518c76402f5d4c433a4591443d25d217ecd6792b3fd1cac49dbab8051c89258fc0965c8deecb49dba779c13d8365c8aa
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

AddHide.aiff.lockbit

Path C:\Users\Admin\Downloads\AddHide.aiff.lockbit
Size 564KB
SHA256 6477879dd23fad6fc058837ac096dac66f2bc6d450834e59fc8495b086b5a979
MD5 cc1148cd8e0727e10ca1115922466fc2
SHA1 cab5fb927436466eec9eff8ff80aa49e1f578abe
SHA512 c920254ce8cb7db8e6b13382134c1d3b6481ec66cdaca86358a483eafd01b5cb0c4ddea4b352d027fdfb112467d03f5cc9263cf211694c50d71eeae3ab3bef47
SSDEEP 12288:HbIySEFyjYDLsG4rqi0f2RTyhTw10VGU81a00VplhPrUtHn:/o/wPRwqVGUp/PrUtH
TLSH
T166C423E22504C242786F5DE7AB5692A35A48CE08337C1E1EC405A7EA1D4FB8F7E0D72D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AddReset.3gp

Path C:\Users\Admin\Downloads\AddReset.3gp
Size 265KB
SHA256 674feca862c5e1fb6864ec3e76c78e6a1ed302f3cb4517b000247fb4c8980f8d
MD5 786cc329fca395b8c012dae29e07cd4e
SHA1 62835059fc2d71116b9f8267582c6d3954b8aa67
SHA512 7b4aa6860941d806c5ab214986b955ef9fb653aefca4bc86a9db237e6c31fb44eefe394e2c05d701b7e35e33a959dd63a05efbcade9061dcd30c5770b0b98e60
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

AddReset.3gp.lockbit

Path C:\Users\Admin\Downloads\AddReset.3gp.lockbit
Size 265KB
SHA256 2595eed901a8de3682905bae75573c1d372645dad3f9cb079a39c9eb2b540fbf
MD5 2886f445c5c7ee6d8eaae832c5fa4f61
SHA1 c68bb17f8e112b8cae191b6e965a955f59239044
SHA512 7cb83a8274c8669887c49e6e3f4e2ddc7dfaff5c188daeee714ce9a22d54c31268fc7e1a54b9e4291d28318ed963556fc43a15d104160925b90b533f85518ac5
SSDEEP 6144:0qdtDyuxrIww8YegeEnb0DHFQ7sycfP6dVK4nW:0qjDJ9wFSFQ1cfyd3W
TLSH
T10444129329AC547ACAC9896616A275FFE4E232531E549FF7206CC1BB503438D18ECEDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Links\desktop.ini
Size 504B
SHA256 696bda342649ec9268da57b6a279df6f24b0e857d5e6d0605fd25af95adc3cee
MD5 5d2a33958ebe530732fd9c258850c5aa
SHA1 8a1d854c73b0a9adb04dc4db317a0b9dd1708b76
SHA512 561c0480b0cc5f75acd24f9ea36f4e6ddee35261a0fd75ec2c495e940b6e7d41fa024110b58aa9bc2f6c69736cceb6cfbbb6198d9c50ad8965d6d30067bb52eb
MD5 SHA1 SHA512

Submit Download

memory/4884-4220-0x00007FF7A6360000-0x00007FF7A64C8000-memory.dmp

Download

memory/4884-4613-0x00007FF7A6360000-0x00007FF7A64C8000-memory.dmp

Download

memory/4884-15-0x00007FF7A6360000-0x00007FF7A64C8000-memory.dmp

Download

memory/4884-0-0x00007FF7A6360000-0x00007FF7A64C8000-memory.dmp

Download

memory/4884-4806-0x00007FF7A6360000-0x00007FF7A64C8000-memory.dmp

Download

memory/4884-4741-0x00007FF7A6360000-0x00007FF7A64C8000-memory.dmp

Download

memory/4884-4309-0x00007FF7A6360000-0x00007FF7A64C8000-memory.dmp

Download

memory/4884-4676-0x00007FF7A6360000-0x00007FF7A64C8000-memory.dmp

Download

memory/4884-4067-0x00007FF7A6360000-0x00007FF7A64C8000-memory.dmp

Download

memory/4884-4254-0x00007FF7A6360000-0x00007FF7A64C8000-memory.dmp

Download

memory/4884-4418-0x00007FF7A6360000-0x00007FF7A64C8000-memory.dmp

Download

memory/4884-14-0x00007FF7A6360000-0x00007FF7A64C8000-memory.dmp

Download

memory/4884-4481-0x00007FF7A6360000-0x00007FF7A64C8000-memory.dmp

Download

memory/4884-4547-0x00007FF7A6360000-0x00007FF7A64C8000-memory.dmp

Download

memory/4988-4508-0x00007FF7DF8A0000-0x00007FF7DFA08000-memory.dmp

Download

memory/4988-4574-0x00007FF7DF8A0000-0x00007FF7DFA08000-memory.dmp

Download

memory/4988-4442-0x00007FF7DF8A0000-0x00007FF7DFA08000-memory.dmp

Download

memory/4988-4638-0x00007FF7DF8A0000-0x00007FF7DFA08000-memory.dmp

Download

memory/4988-4231-0x00007FF7DF8A0000-0x00007FF7DFA08000-memory.dmp

Download

memory/4988-4702-0x00007FF7DF8A0000-0x00007FF7DFA08000-memory.dmp

Download

memory/4988-4362-0x00007FF7DF8A0000-0x00007FF7DFA08000-memory.dmp

Download

memory/4988-4767-0x00007FF7DF8A0000-0x00007FF7DFA08000-memory.dmp

Download

memory/4988-4193-0x00007FF7DF8A0000-0x00007FF7DFA08000-memory.dmp

Download

memory/4988-4833-0x00007FF7DF8A0000-0x00007FF7DFA08000-memory.dmp

Download