xworm | a5728f8fd33c77818782d3eef567b77d1586b1927696affced63d494691edbe6

Analysis

max time kernel
466s
max time network
605s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 20:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sv.exe
Size

63KB
MD5

c095a62b525e62244cad230e696028cf
SHA1

67232c186d3efe248b540f1f2fe3382770b5074a
SHA256

a5728f8fd33c77818782d3eef567b77d1586b1927696affced63d494691edbe6
SHA512

5ba859d89a9277d9b6243f461991cc6472d001cdea52d9fcfba3cbead88fbc69d9dfce076b1fdeaf0d1cd21fe4cace54f1cefe1c352d70cc8fa2898fe1b61fb0
SSDEEP

1536:unjFXblMp3wgDkbivVSm16KTOKjLIJXc:unrAwgDkbicmbOKj0JM

Score

10^/10

xworm evasion execution persistence ransomware rat trojan

Malware Config

Extracted

Family

xworm

amount-acceptance.gl.at.ply.gg:7420

Attributes

Install_directory
%ProgramData%
install_file
svhost.exe

Signatures

Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource yara_rule

behavioral2/memory/1432-879-0x00000000014B0000-0x00000000014BE000-memory.dmp disable_win_def
Detect Xworm Payload 2 IoCs

Processes:

resource yara_rule

behavioral2/memory/1432-1-0x0000000000C80000-0x0000000000C96000-memory.dmp family_xworm
C:\ProgramData\svhost.exe family_xworm
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

sv.exe

description pid process target process

PID 1432 created 5080 1432 sv.exe TrustedInstaller.exe
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

2724 powershell.exe
4620 powershell.exe
1572 powershell.exe
3636 powershell.exe
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

sv.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation sv.exe

resource	yara_rule
behavioral2/memory/1432-879-0x00000000014B0000-0x00000000014BE000-memory.dmp	disable_win_def

resource	yara_rule
behavioral2/memory/1432-1-0x0000000000C80000-0x0000000000C96000-memory.dmp	family_xworm
C:\ProgramData\svhost.exe	family_xworm

description	pid	process	target process
PID 1432 created 5080	1432	sv.exe	TrustedInstaller.exe

pid	process
2724	powershell.exe
4620	powershell.exe
1572	powershell.exe
3636	powershell.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	sv.exe

Drops startup file 2 IoCs

Processes:

sv.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.lnk	sv.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.lnk	sv.exe

Executes dropped EXE 7 IoCs

Processes:

svhost.exesvhost.exesvhost.exesvhost.exesvhost.exesvhost.exesvhost.exe

pid process

2236 svhost.exe
1000 svhost.exe
4836 svhost.exe
2804 svhost.exe
2532 svhost.exe
5008 svhost.exe
3792 svhost.exe
Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Processes:

sv.exe

description ioc process

Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\ProgramData\\svhost.exe" sv.exe

pid	process
2236	svhost.exe
1000	svhost.exe
4836	svhost.exe
2804	svhost.exe
2532	svhost.exe
5008	svhost.exe
3792	svhost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\ProgramData\\svhost.exe"	sv.exe

Drops desktop.ini file(s) 17 IoCs

Processes:

sv.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	sv.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	sv.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	sv.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	sv.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	sv.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	sv.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	sv.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini	sv.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	sv.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	sv.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	sv.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	sv.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	sv.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	sv.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	sv.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	sv.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	sv.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs
ransomware

Defacement
T1491

Modify Registry
T1112

Processes:

sv.exe

description ioc process

Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XBackground.bmp" sv.exe
Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exe

pid process

1908 sc.exe
924 sc.exe
1488 sc.exe
4280 sc.exe
2380 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

4232 taskkill.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XBackground.bmp"	sv.exe

pid	process
1908	sc.exe
924	sc.exe
1488	sc.exe
4280	sc.exe
2380	sc.exe

pid	process
4232	taskkill.exe

Modifies data under HKEY_USERS 46 IoCs

Processes:

powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3808065738-1666277613-1125846146-1000\{BCDFB9DF-6323-4D09-82C2-DE7C4CFB301C}	msedge.exe

Runs net.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

1732 schtasks.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

vlc.exe

pid process

4748 vlc.exe

pid	process
1732	schtasks.exe

pid	process
4748	vlc.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exesv.exepowershell.exe

pid	process
4620	powershell.exe
4620	powershell.exe
1572	powershell.exe
1572	powershell.exe
3636	powershell.exe
3636	powershell.exe
2724	powershell.exe
2724	powershell.exe
1432	sv.exe
1432	sv.exe
1432	sv.exe
1704	powershell.exe
1704	powershell.exe
1704	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

vlc.exe

pid process

4748 vlc.exe

pid	process
4748	vlc.exe

Suspicious use of AdjustPrivilegeToken 60 IoCs

Processes:

sv.exepowershell.exepowershell.exepowershell.exepowershell.exesvhost.exesvhost.exesvhost.exesvhost.exesvhost.exesvhost.exesvhost.exewhoami.exepowershell.exewhoami.exe

description	pid	process
Token: SeDebugPrivilege	1432	sv.exe
Token: SeDebugPrivilege	4620	powershell.exe
Token: SeDebugPrivilege	1572	powershell.exe
Token: SeDebugPrivilege	3636	powershell.exe
Token: SeDebugPrivilege	2724	powershell.exe
Token: SeDebugPrivilege	1432	sv.exe
Token: SeDebugPrivilege	2236	svhost.exe
Token: SeDebugPrivilege	1000	svhost.exe
Token: SeDebugPrivilege	4836	svhost.exe
Token: SeDebugPrivilege	2804	svhost.exe
Token: SeDebugPrivilege	2532	svhost.exe
Token: SeDebugPrivilege	5008	svhost.exe
Token: SeDebugPrivilege	3792	svhost.exe
Token: SeDebugPrivilege	2804	whoami.exe
Token: SeDebugPrivilege	2804	whoami.exe
Token: SeDebugPrivilege	2804	whoami.exe
Token: SeDebugPrivilege	2804	whoami.exe
Token: SeDebugPrivilege	2804	whoami.exe
Token: SeDebugPrivilege	2804	whoami.exe
Token: SeDebugPrivilege	2804	whoami.exe
Token: SeDebugPrivilege	2804	whoami.exe
Token: SeDebugPrivilege	2804	whoami.exe
Token: SeDebugPrivilege	2804	whoami.exe
Token: SeDebugPrivilege	2804	whoami.exe
Token: SeDebugPrivilege	2804	whoami.exe
Token: SeDebugPrivilege	2804	whoami.exe
Token: SeDebugPrivilege	2804	whoami.exe
Token: SeDebugPrivilege	2804	whoami.exe
Token: SeDebugPrivilege	2804	whoami.exe
Token: SeDebugPrivilege	2804	whoami.exe
Token: SeDebugPrivilege	2804	whoami.exe
Token: SeDebugPrivilege	2804	whoami.exe
Token: SeDebugPrivilege	2804	whoami.exe
Token: SeDebugPrivilege	2804	whoami.exe
Token: SeDebugPrivilege	2804	whoami.exe
Token: SeDebugPrivilege	2804	whoami.exe
Token: SeDebugPrivilege	2804	whoami.exe
Token: SeDebugPrivilege	2804	whoami.exe
Token: SeDebugPrivilege	2804	whoami.exe
Token: SeDebugPrivilege	1704	powershell.exe
Token: SeDebugPrivilege	4844	whoami.exe
Token: SeDebugPrivilege	4844	whoami.exe
Token: SeDebugPrivilege	4844	whoami.exe
Token: SeDebugPrivilege	4844	whoami.exe
Token: SeDebugPrivilege	4844	whoami.exe
Token: SeDebugPrivilege	4844	whoami.exe
Token: SeDebugPrivilege	4844	whoami.exe
Token: SeDebugPrivilege	4844	whoami.exe
Token: SeDebugPrivilege	4844	whoami.exe
Token: SeDebugPrivilege	4844	whoami.exe
Token: SeDebugPrivilege	4844	whoami.exe
Token: SeDebugPrivilege	4844	whoami.exe
Token: SeDebugPrivilege	4844	whoami.exe
Token: SeDebugPrivilege	4844	whoami.exe
Token: SeDebugPrivilege	4844	whoami.exe
Token: SeDebugPrivilege	4844	whoami.exe
Token: SeDebugPrivilege	4844	whoami.exe
Token: SeDebugPrivilege	4844	whoami.exe
Token: SeDebugPrivilege	4844	whoami.exe
Token: SeDebugPrivilege	4844	whoami.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

vlc.exe

pid process

4748 vlc.exe
4748 vlc.exe
4748 vlc.exe
4748 vlc.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

vlc.exe

pid process

4748 vlc.exe
4748 vlc.exe
4748 vlc.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vlc.exe

pid process

4748 vlc.exe

pid	process
4748	vlc.exe
4748	vlc.exe
4748	vlc.exe
4748	vlc.exe

pid	process
4748	vlc.exe
4748	vlc.exe
4748	vlc.exe

pid	process
4748	vlc.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

sv.exepowershell.exe

description	pid	process	target process
PID 1432 wrote to memory of 4620	1432	sv.exe	powershell.exe
PID 1432 wrote to memory of 4620	1432	sv.exe	powershell.exe
PID 1432 wrote to memory of 1572	1432	sv.exe	powershell.exe
PID 1432 wrote to memory of 1572	1432	sv.exe	powershell.exe
PID 1432 wrote to memory of 3636	1432	sv.exe	powershell.exe
PID 1432 wrote to memory of 3636	1432	sv.exe	powershell.exe
PID 1432 wrote to memory of 2724	1432	sv.exe	powershell.exe
PID 1432 wrote to memory of 2724	1432	sv.exe	powershell.exe
PID 1432 wrote to memory of 1732	1432	sv.exe	schtasks.exe
PID 1432 wrote to memory of 1732	1432	sv.exe	schtasks.exe
PID 1432 wrote to memory of 4376	1432	sv.exe	msedge.exe
PID 1432 wrote to memory of 4376	1432	sv.exe	msedge.exe
PID 1432 wrote to memory of 1908	1432	sv.exe	sc.exe
PID 1432 wrote to memory of 1908	1432	sv.exe	sc.exe
PID 1432 wrote to memory of 2936	1432	sv.exe	cmd.exe
PID 1432 wrote to memory of 2936	1432	sv.exe	cmd.exe
PID 1432 wrote to memory of 2804	1432	sv.exe	whoami.exe
PID 1432 wrote to memory of 2804	1432	sv.exe	whoami.exe
PID 1432 wrote to memory of 4148	1432	sv.exe	net1.exe
PID 1432 wrote to memory of 4148	1432	sv.exe	net1.exe
PID 1432 wrote to memory of 1704	1432	sv.exe	powershell.exe
PID 1432 wrote to memory of 1704	1432	sv.exe	powershell.exe
PID 1704 wrote to memory of 924	1704	powershell.exe	sc.exe
PID 1704 wrote to memory of 924	1704	powershell.exe	sc.exe
PID 1704 wrote to memory of 3964	1704	powershell.exe	cmd.exe
PID 1704 wrote to memory of 3964	1704	powershell.exe	cmd.exe
PID 1704 wrote to memory of 4844	1704	powershell.exe	whoami.exe
PID 1704 wrote to memory of 4844	1704	powershell.exe	whoami.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\sv.exe
"C:\Users\Admin\AppData\Local\Temp\sv.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1432

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\sv.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4620

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'sv.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1572

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\svhost.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3636

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2724

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svhost" /tr "C:\ProgramData\svhost.exe"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:1732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html
2⤵
PID:4376

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" qc windefend
2⤵
- Launches sc.exe
PID:1908

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
2⤵
PID:2936

C:\Windows\system32\whoami.exe
"C:\Windows\system32\whoami.exe" /groups
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2804

C:\Windows\system32\net1.exe
"C:\Windows\system32\net1.exe" start TrustedInstaller
2⤵
PID:4148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html
2⤵
PID:1352

C:\Windows\SYSTEM32\taskkill.exe
taskkill /F /IM explorer.exe
2⤵
- Kills process with taskkill
PID:4232

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
2⤵
PID:452

C:\Windows\System32\sc.exe
"C:\Windows\System32\sc.exe" stop wuauserv
2⤵
- Launches sc.exe
PID:4280

C:\Windows\System32\sc.exe
"C:\Windows\System32\sc.exe" config wuauserv start=disabled
2⤵
- Launches sc.exe
PID:2380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:1232

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=4952 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:1
1⤵
PID:4936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --mojo-platform-channel-handle=4740 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:1
1⤵
PID:4984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=5416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:1
1⤵
PID:4072

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3288

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=4240 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:3048

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4748

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6028 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --mojo-platform-channel-handle=6224 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:1
1⤵
PID:4252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5364 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:1524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --mojo-platform-channel-handle=6508 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:1
1⤵
PID:4052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --mojo-platform-channel-handle=4712 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3764 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
- Modifies registry class
PID:1884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --mojo-platform-channel-handle=6236 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:1
1⤵
PID:2476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --mojo-platform-channel-handle=6500 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:1
1⤵
PID:448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --mojo-platform-channel-handle=6476 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:220

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --mojo-platform-channel-handle=6808 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:1
1⤵
PID:4932

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2532

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --mojo-platform-channel-handle=6628 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:1
1⤵
PID:4908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --mojo-platform-channel-handle=6616 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:1
1⤵
PID:1276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --mojo-platform-channel-handle=7008 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:1
1⤵
PID:5008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --mojo-platform-channel-handle=3356 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:1
1⤵
PID:4372

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --mojo-platform-channel-handle=5660 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:1
1⤵
PID:5012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --mojo-platform-channel-handle=6792 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:1
1⤵
PID:2684

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:5080

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -nop -win 1 -c & {rp hkcu:\environment windir -ea 0;$AveYo=' (\ /) ( * . * ) A limited account protects you from UAC exploits ``` ';$env:1=6;iex((gp Registry::HKEY_Users\S-1-5-21*\Volatile* ToggleDefender -ea 0)[0].ToggleDefender)}
2⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1704

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" qc windefend
3⤵
- Launches sc.exe
PID:924

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
3⤵
PID:3964

C:\Windows\system32\whoami.exe
"C:\Windows\system32\whoami.exe" /groups
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4844

C:\Windows\system32\net1.exe
"C:\Windows\system32\net1.exe" stop windefend
3⤵
PID:632

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" config windefend depend= RpcSs-TOGGLE
3⤵
- Launches sc.exe
PID:1488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=6592 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:2428

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
PID:4772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --mojo-platform-channel-handle=7324 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:1
1⤵
PID:4616

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
PID:912

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4ac 0x49c
1⤵
PID:2804

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3700

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3752

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4172

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2140

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

System Services

Service Execution

Scheduled Task/Job

Scheduled Task

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

T1489

Defacement

T1491

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\svhost.exe
Filesize
63KB

MD5
c095a62b525e62244cad230e696028cf

SHA1
67232c186d3efe248b540f1f2fe3382770b5074a

SHA256
a5728f8fd33c77818782d3eef567b77d1586b1927696affced63d494691edbe6

SHA512
5ba859d89a9277d9b6243f461991cc6472d001cdea52d9fcfba3cbead88fbc69d9dfce076b1fdeaf0d1cd21fe4cace54f1cefe1c352d70cc8fa2898fe1b61fb0

Download Submit
C:\USERS\ADMIN\DESKTOP\ASSERTCONVERTTO.SVG.ENC
Filesize
438KB

MD5
7cdbaa52f2db06de63470b29b577b266

SHA1
c8a9c09f724eefbf60fd765c2491c2fe50a6b939

SHA256
7670a76a6211fd3b11adcbba53c434d3306cdce2b9eb8cff517d62481f8d07fb

SHA512
a7a7f88eff63257a43c7d2ddfabd7a34ee559135e86e06ac2958e2cfbf6814e2e28257ad9ec9aa435a29a303169a1f8907642002888725d52032c790399a0ac5

Download Submit
C:\USERS\ADMIN\DESKTOP\BACKUPSTART.SVG.ENC
Filesize
329KB

MD5
c09621b8dd11ee7cbd2a28d70da04c69

SHA1
6ce917581561c90f1e8a8e986f8e04a5b0f9caad

SHA256
583e34ab07327023c4d9500b07c1cce7cf19601f7a3f106cca8e6a9bccd583b5

SHA512
b7db17ed1afac20551227604188dbeb2db40a89da0558cf553f2e1e36a7e3c3c3fe1b74ac22437a06b59dad73f0edbc68f0bd92bd3ec9873eec9aea1bd51ad25

Download Submit
C:\USERS\ADMIN\DESKTOP\CHECKPOINTHIDE.M2TS.ENC
Filesize
282KB

MD5
2595cf6fe397b0340369f991aec777ee

SHA1
7e32811d51dedd19aa0fe3f0af11d31d00273c2d

SHA256
7857fb1bbabeb0cb60c3423ae23b08dabbbecb15268c8a6f2d631b731c4b0152

SHA512
a797374673d8ec28ac0a436cdced9945871f42cfcafbba4d89e547a8a6766fc9315765edff37bf931ccc74d59aa430255a55a1da5e44b1288597c63c09bdd343

Download Submit
C:\USERS\ADMIN\DESKTOP\CLEARDISMOUNT.VSD.ENC
Filesize
517KB

MD5
fbc368da815854f409d95fcb3c210f3c

SHA1
59ed0aaec0534e73ac74119920365567f3310567

SHA256
91be2dd016f704c254ee1ac5af6fa0c67e0396c24216f8e3f63510a1453d11e3

SHA512
20c0f742d90fa5b011e39f6ee044c95467ef9510bc32b47477f6f4b1cf593eb63c71eef5cec2954eef5a3ee057e24833040befbb1a4a281a00fece8df7353afc

Download Submit
C:\USERS\ADMIN\DESKTOP\CONVERTEXPORT.AIFF.ENC
Filesize
485KB

MD5
c2a5fc68b722fbc11ae1e173c8162dc2

SHA1
8370661da0236d516ee297a583e6f46cd9bd87a3

SHA256
3729e6f65f9fb8a1e6c9b3c9199a41785f6ca3416e0878a1fccde9cf9e319961

SHA512
8e36b702adaa187612e0a6ce9e4bf6776b6ec354c0319ea42c359907c9f15f6e28a66d287dd197477f227b42d635d0eb397ac33abf39cbf9a329d89d37819341

Download Submit
C:\USERS\ADMIN\DESKTOP\CONVERTTOCOMPRESS.DWG.ENC
Filesize
266KB

MD5
b03b9662d335536c7b6495f41f7e0299

SHA1
b9e14e016daea2ca540d57d678c5d11dbd7f6e98

SHA256
d3e01369eebaecd1b573ec24f7df41a87c13d173d5c5a3c7cb127cca9f29e2d4

SHA512
d872c415ba2272502f4b13a7929a447334dbe676e1c99f285e5551120e5c69a14cbb20a9e7cbc8bb5459551c43521b4254fe7f892b9d9a64f106fdba229dfa56

Download Submit
C:\USERS\ADMIN\DESKTOP\DESKTOP.INI.ENC
Filesize
288B

MD5
1775695ea4684ad88248174ef7a86650

SHA1
37478f6b09809b15c82b8154792bb147e00f9d07

SHA256
0812a9a191fa1328a52476bc8893fd4f70358301fc075fa949f11703e9e96848

SHA512
39c19fe0a2a9063bffa9271b1f85f3cf2b5e3551073d8b7d9c326f12854e3d88d4fad54c372653dcc068227cb63d37277a8c49132296683cb7823598f4be444f

Download Submit
C:\USERS\ADMIN\DESKTOP\EXITREGISTER.7Z.ENC
Filesize
626KB

MD5
60bce22ad9d22dbfbe77a04f7334eff6

SHA1
8b9bac6cff53a2e6ab39ffc3f3062a15bba45d78

SHA256
da34f28fd2f618446203391c1e0aabde8493770dadf536378f6fa75b54586a0a

SHA512
b25406d29fceec1a552faeda9d5b162b64d6735be8c8a0608ed292364762d2962492eba390e1ae5f85d736396c46ae29db8b7f21effa946012ba58568ae2bb4d

Download Submit
C:\USERS\ADMIN\DESKTOP\FORMATRESTORE.EMZ.ENC
Filesize
219KB

MD5
563b92ba8cc62aedc1999b6e89cfbab6

SHA1
7ed425f0b85d3165716ca47d0cfe7d678b5f8b56

SHA256
29fa1c8f9d52994f9401558034748bbccd0c6992c36a1542eea476e0bf5e8c01

SHA512
be346375a83ab9d51209f7864926c9777a1643b2020bfb12f5c325a013f8990a652073dded24c7c4723aad193c653564c50fe680a6586fd931d692d46100b580

Download Submit
C:\USERS\ADMIN\DESKTOP\GETBACKUP.7Z.ENC
Filesize
407KB

MD5
747e6dd70e69aa5beb548327871417a2

SHA1
c8112e23bbb56130fd8d4404495dbe5c6e2b6691

SHA256
f9500ee1ee23ac66db97649c28a2782299e70906562f6f0db62ad8d461845538

SHA512
d811474458b566b7b2eb5adfe6b37393e507fdb64e5e31a3863addaf9526d5600af3495edece9522b19763ee2a100ab758e52c515036b95270581e8462d8fec7

Download Submit
C:\USERS\ADMIN\DESKTOP\GRANTUNPUBLISH.VSTX.ENC
Filesize
454KB

MD5
382301aa0c981477f8fa0fbb4607d723

SHA1
45d7513d82a3759889b9587fadb05518f82a157b

SHA256
0fec58b13b3d8ab8aebcddf0cb04a7fa0be77b4b560bc5c771c6afdb67e3ba16

SHA512
be039242e06c694c28bf5fab25b9f15f9664a4b475fc5135368d3412f5320eba200f57fbe69a8d260042c02380e45365beea5f4e2b8965ced9a30cac709b529a

Download Submit
C:\USERS\ADMIN\DESKTOP\INSTALLUNPUBLISH.TIFF.ENC
Filesize
548KB

MD5
04d33b8f88f1d9a145802ab9d5555450

SHA1
47b647aea86b78f183f308a6baa25916a6856b28

SHA256
e8a2a6fe6ee9437ad1b6054ecf8f9b01f654d3cd72f8bf1bd8276fe640213a4c

SHA512
b22fe7e418e046865885776606fd87436d938031e2146da35d30e97ed7b2aed72d77999fcf09d2e8ec464545b0b022a75ae40a7e614be37fe2dae2aa6f1688d8

Download Submit
C:\USERS\ADMIN\DESKTOP\LIMITUNPROTECT.CSV.ENC
Filesize
344KB

MD5
1e5a11849cee1ee43e1c4ac58f07e7d7

SHA1
3619fddffa5cc8a3600cfaaa36ac8fbbff5710f6

SHA256
bb314c0144db83e4702059561c0e2a54da696fd608b2fcba580a6ef679b8ffb1

SHA512
f13fcf5c3b62da83841a3cca9975b1c0565aa38feb8b4757f5ab281266b756de2af126d645303794196bc2f8c8f8cbb60469abd1bd3e2e961e26cd1272102ea9

Download Submit
C:\USERS\ADMIN\DESKTOP\MICROSOFT EDGE.LNK.ENC
Filesize
2KB

MD5
446916ef99c00f7ac99c4655ae14052f

SHA1
484583f0bb8229ed3ecf4cef78387f9daa0871f9

SHA256
aeed3cb2fdb9dafab5607e100753d3b11ae9ab2722679eba80d6d2a23513844f

SHA512
9c66793d496934f3b0930618210f85e9a45a5e1a9dabdb4abb11fc3c52531e8786b1ebeefdb9edb73bd882d8b643307f618ff7c1247fb73ab2ace5e33e329b29

Download Submit
C:\USERS\ADMIN\DESKTOP\MOUNTCONFIRM.WMA.ENC
Filesize
611KB

MD5
d99be403fce23759406f7573d7b7774e

SHA1
96872609309b8bd838cdd9fc036754fa884e850a

SHA256
59350e0ae1662a42a9a19f37f97f2803ffc3bcb7c58ae721c4efbd73452742ae

SHA512
f4e5321c468d20383b5ac7878fed79f58015891d2484b5d128b2b989db574d641a2e9fbbd3fc50e29dfd9c6c039327ced0a137d5080b2cedf56cdcba65f0b242

Download Submit
C:\USERS\ADMIN\DESKTOP\POPENTER.7Z.ENC
Filesize
235KB

MD5
52836875126096a377076f3d0afc1589

SHA1
34c908f0451d69af834a87026463d033adefb9c3

SHA256
7ff9f07f93cb1c7e189099cf1c633b0fced9f334f0b942255249bc3cacd24b1e

SHA512
b2795dd3ddc9f727d2d3ecb5ad21b781dfb6a4f8fd3994c7225d20f1dde6ca9ed27c7dce387009d9b69d77f080b3aa66e3c8a70016c3cd3bf5fbebc7cd012a85

Download Submit
C:\USERS\ADMIN\DESKTOP\PUBLISHLOCK.MIDI.ENC
Filesize
579KB

MD5
39203d836116109fdedfb8ea3744884c

SHA1
33b1dadf6d803ccff7b148ac9c6044c7560a9de0

SHA256
06e9436f35dcedea2cbcd161b91a97a996c37089b687f2907e471206f943f128

SHA512
f7a846180cabcd26aa37caebcc6f478622f9ca8ed802c0112ba272b43d50a178a598fa5502e56b69226e22f1d36886abfe406cbd6ec4dd7cf3e01506c6ae55fc

Download Submit
C:\USERS\ADMIN\DESKTOP\PUBLISHPING.XLT.ENC
Filesize
470KB

MD5
013fc371d01abf4e818ae1d91720feed

SHA1
4b72db482ec669827da41b517022ff35e3e9ff56

SHA256
3795a903f29cac2127542fc6e143c83e5c3fb8b3ab4b1d3c9ee5593fe75d7d5b

SHA512
5ebe8cc0cc2dc8e99c4838e7e59dbb6af27a162ffecf462017a21bbb2651346ab0c5e3282b09d7bc1b49b9db42068a0e77e0e763c0eec27a1f59b8d43d6a91c4

Download Submit
C:\USERS\ADMIN\DESKTOP\READTRACE.M2T.ENC
Filesize
391KB

MD5
051cafdc7c6b9af59cfd6572f9f53b04

SHA1
0c5dc8bf520ef5a220e972e8f4c7ddf7eb7090ef

SHA256
3b9ce76a8a6ab1a3129bf74877eb7a2768f6192625bfbc6d5b1e677c32599d1a

SHA512
0b69c4ff96995c249b95bfb9598874fda48eab468faee645c1c4d6b10e8bb3cb910aba78ee8300ff94191e36ce4fd999e2489f308ac163a592fed59203d00a6f

Download Submit
C:\USERS\ADMIN\DESKTOP\REMOVEMOVE.CSS.ENC
Filesize
532KB

MD5
c4d1690d15e8568b452802de41abff28

SHA1
701dad3e762605723cfd02ded926c85f75f590a0

SHA256
7ee49ce53feb6092bc731956ffa46795cbaae54babd6e4f1eb19474a661930f9

SHA512
3a0bd736ef67e9b7fe4c13b617da60aafa6521ed409b810b076e4e8348bec7cdb882eb72a6a6caf2c81e18359131d3ef41d0a6486af83dc8b74f9a5b59968e30

Download Submit
C:\USERS\ADMIN\DESKTOP\RESETMERGE.VDX.ENC
Filesize
501KB

MD5
1b4bd51af27a2443bab855fb171372ca

SHA1
bd143200f7e8c3ca079465553e423662082a8d44

SHA256
112217b93af4aec86d841417c66ac88fb63d67e33ac9ed93ce851ba70e318f7a

SHA512
05ef225040d416164ccfc2f8df6978434ca5058fccfd7edd5f983449566eef4f1997181244b70ae69aa858cc257420459e2e2f470036eeed5d8f2ba887364f74

Download Submit
C:\USERS\ADMIN\DESKTOP\RESTARTUSE.WMV.ENC
Filesize
564KB

MD5
309232808a12e91828279f8a619810ad

SHA1
186bf1ba8cfb7841ca2b24c567acff2408658d4c

SHA256
9a42383386ce453260d0d4bc3b4fffc0edc7351bef7cd1c2d551e9e9b0282730

SHA512
5bcb02bb2db38e88fbb820fa5a40901f42e7506519882b47a323a6fcee9c44703f22a680db3e14b382cf66777b3928a6f0a2d7f2354c7236542c9abf96459c66

Download Submit
C:\USERS\ADMIN\DESKTOP\RESTOREUNPROTECT.AU.ENC
Filesize
376KB

MD5
a2a706f0e04fd43f4c7705a557a444c2

SHA1
701ee6f330c64f3a51ed8fdff07757b6d28db2ee

SHA256
2db103029d603b99dba18a3af3ea00122c1351a1f3ad4b35169f6a9374c4ed6f

SHA512
c809c2b2189987fca0214b582466bab61b78b04761ee97a51892e11df6765a2d7e11c40530d9bea9926c1991499b205e1e85d55a930e4ca099127619c4d39b96

Download Submit
C:\USERS\ADMIN\DESKTOP\SEARCHSAVE.RAR.ENC
Filesize
297KB

MD5
20ec85f7f326220b073e5879512f9925

SHA1
6e97cdc4e7c8feb2cd17f24f468d22b80b802a44

SHA256
6417bf50969d9ff50ee93aef9db43411e8519c47820174f88624ac59d08f348f

SHA512
9d30e419e41310417bba963cfbff56226fdbb444013d8eec14524558a1abb41573c52c91d5d59bfc29d8cb45d4fab36187896bf3fabe6c6f912c0a2809483ed8

Download Submit
C:\USERS\ADMIN\DESKTOP\SETLOCK.MP4.ENC
Filesize
595KB

MD5
6a7ff7fbae8c7710ba35331eec223074

SHA1
33fe07a968b7a9f4a8aca4c58a6c12f779abecdd

SHA256
7dd2fe2f43bba95f7f089041c78a35a4d520095b0f364ce84f8c5fa38d3308d4

SHA512
180a2a452c9fefee78a987ae9274073d03ed6514e9b8ebfad2506dbe403a3ece0b21388061721ca1f7babdff7ac4c47a68c05a35013e8e9ca456ba0e143ca37f

Download Submit
C:\USERS\ADMIN\DESKTOP\STARTEXPORT.MPG.ENC
Filesize
423KB

MD5
e6c4aa4a5053d6072c905f11c0db9708

SHA1
4369a005fac5a9cb0ea7fa0e52f3edf1fd233dc8

SHA256
08a0ec2855cfc0b7ed5b0f4a4bf9e8811238a2b594afd0860c7a11a457f59454

SHA512
59f18b53f0db5f3327bddfdff855d2b13c05036ba111f37dbe532e361575e03988de8aec5f2600a0cd4aed6d6404d21b8f8e8276a4fa280a53f206684665cc37

Download Submit
C:\USERS\ADMIN\DESKTOP\STARTHIDE.MPEG2.ENC
Filesize
360KB

MD5
693aca10b34a34d69e5304f5c29c4602

SHA1
030abb649d6be10aecd9f22aa340c45bf1c3874d

SHA256
01483b543f629d75c6f041f30a5c0433ec35cdbcbabc9ef077541230bd2fe1fc

SHA512
8807beac8976f4895076d46826640965225bca0b14ed8b36bc8fc443eccdc59be784f67f5a1ceaba50ac771fd0c37598e5ca56c730782c100ff5aa10bb3716d9

Download Submit
C:\USERS\ADMIN\DESKTOP\SYNCRESTART.VSTM.ENC
Filesize
313KB

MD5
1a7098487f7547aad37d3bcf937d210e

SHA1
313188f08deb29563ad6cda0ae9eb7ff1cf589ba

SHA256
785da56e0896717f6a1e1239dad1852a055f967fabc06260212a6fd24e4d68a5

SHA512
88d4366707c1537b3521f862fc7c820a3242e2c9f4d90699751645b052d9fe897756ddc3ec252685f7cc4e158ee9f563752aeffca11c98573e1c30f7b9416522

Download Submit
C:\USERS\ADMIN\DESKTOP\WRITEENABLE.SHTML.ENC
Filesize
250KB

MD5
f231cba6639929981974047a0be1a2c4

SHA1
dbd5fbbfc3e8fc95a0b2620e904ca6397cd4d92e

SHA256
26a2c41af1a1e098942e60d8e7449433be06e9eff80ac08287f24bc18bb37486

SHA512
bc2adcb3fffbe2929eaa6e0610fad5e7afb98f4519d0ce2ebd2aaa76a1b4088b82387b58db1b3d2c75b51866e6b6300e5225e0d122ddb72f1f85c624c94689f9

Download Submit
C:\USERS\ADMIN\DESKTOP\WRITEUNPUBLISH.RM.ENC
Filesize
861KB

MD5
6051db15ab996441b699f2c688bda5bb

SHA1
78fb0db5cefe3c69c30ddb6d49b7c911e31f1eff

SHA256
c1957435155cecbeaecc52bb842b76f990c72f9a5526164b1b5ed2873ce1082a

SHA512
ef2775e8607899a7120392ef4d0df28cd8732b227c31894975cd68dd8e2f8478b3dac15b84dd485b6b1339320ae993e822835695f4e6e8656d7126de3ca890e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
Filesize
471B

MD5
9c7e8856a3f456a9f535125a7f3a8020

SHA1
fb11b31bb03d8f314a0addc0df4172a1373ed3a4

SHA256
db21529cef9e84cda7f7a1b144f36afda687388c204ecd501bab1479c90ece63

SHA512
df11fa6bcd4b9ca606fb39e50f0d65b581b4730eb972526ce57da2a807dfd95e092be93ea1f4c4af15c18de2eebd45f7ab65159d666788562e8418632c4a8f23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
Filesize
420B

MD5
a71da463e54e6349d541d06981b3e80d

SHA1
780db4215478b113ca92bfd1d69db3cfed69ff5d

SHA256
fcd5b44a0795e9982b2145617e2a5187c74620420ac5d776ffe375b52a4b1ea7

SHA512
671b5b631a42cd46e263f5c2df292750cd74237af47914b1a0f91a1bc80022eb99fa4b646b115f36a049d328149561af5058702f385aec5d248517670e9f58c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svhost.exe.log
Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9bc110200117a3752313ca2acaf8a9e1

SHA1
fda6b7da2e7b0175b391475ca78d1b4cf2147cd3

SHA256
c88e4bbb64f7fa31429ebe82c1cf07785c44486f37576f783a26ac856e02a4eb

SHA512
1f1af32aa18a8cbfcc65b0d4fb7e6ca2705f125eaa85789e981ee68b90c64522e954825abf460d4b4f97567715dfae8d9b0a25a4d54d10bc4c257c472f2e80fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
e5663972c1caaba7088048911c758bf3

SHA1
3462dea0f9c2c16a9c3afdaef8bbb1f753c1c198

SHA256
9f7f29a4696876cadca3f14d7e43f9ede0c97fd64be3f5d94bda49a91b6a419e

SHA512
ff4e72c46cf083de62baa2ce2661555dd91b5f144294015f7b262fd4500cb67fe80e1871a82da63b607e3e9cef401f4b73c587bf1134637881ecad51aad1eddc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
d3e8199b4634731cf0a0c26c1f14f588

SHA1
7f8fae27eb80055a436a6b5457978f32673d9ad4

SHA256
ef33f487f93c2977e92fb08d6bdcc9d48b5d1864c402f9d3fbf3e1b30e8b3b9a

SHA512
806a123100dbc1ca1b27bbad5b93c3a9a840dc795127af8523333a71259a8c5ef8aefccb83ef390f2644e013f138c4b7b63c584acccb197aada0c70c038032e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ihknj1oi.zjj.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Desktop\How To Decrypt My Files.html
Filesize
639B

MD5
d2dbbc3383add4cbd9ba8e1e35872552

SHA1
020abbc821b2fe22c4b2a89d413d382e48770b6f

SHA256
5ca82cbc4d582a4a425ae328ad12fd198095e2854f4f87b27a4b09e91173a3be

SHA512
bb5e1bbf28c10c077644136b98d8d02bfec3b3e49c0829b4d4570b30e0aea0276eb748f749a491587a5e70141a7653be1d03c463a22e44efecde2e5a6c6e5e66

Download Submit
C:\Users\Admin\Desktop\desktop.ini
Filesize
282B

MD5
9e36cc3537ee9ee1e3b10fa4e761045b

SHA1
7726f55012e1e26cc762c9982e7c6c54ca7bb303

SHA256
4b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026

SHA512
5f92493c533d3add10b4ce2a364624817ebd10e32daa45ee16593e913073602db5e339430a3f7d2c44abf250e96ca4e679f1f09f8ca807d58a47cf3d5c9c3790

Download Submit
C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms.ENC
Filesize
16B

MD5
d012e5555ae6936cbe76b0edf9b0da69

SHA1
0a80fe68cdd19432d8f4ccae4b505613064f1966

SHA256
7a35c4144ba71bf57b0fe01b116314ff31f3765cd6667c3d48def6fe1c4af861

SHA512
920b93ad09eddab8b03be79bc8813abce6beaa0cbb37ff0a8d85c92c8940ce003bb03d967eaa84d22b01e00aabfab26e16c2d41fb2c56bd60bf08171cb130de6

Download Submit
memory/1432-58-0x00007FF9872D0000-0x00007FF987D91000-memory.dmp

Filesize
10.8MB

Download
memory/1432-908-0x000000001BF20000-0x000000001BF56000-memory.dmp

Filesize
216KB

Download
memory/1432-879-0x00000000014B0000-0x00000000014BE000-memory.dmp

Filesize
56KB

Download
memory/1432-1-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/1432-0-0x00007FF9872D3000-0x00007FF9872D5000-memory.dmp

Filesize
8KB

Download
memory/1432-268-0x0000000001490000-0x000000000149C000-memory.dmp

Filesize
48KB

Download
memory/1432-267-0x000000001D390000-0x000000001D864000-memory.dmp

Filesize
4.8MB

Download
memory/1432-1481-0x000000001BF70000-0x000000001BF7A000-memory.dmp

Filesize
40KB

Download
memory/1432-65-0x00000000013C0000-0x00000000013CC000-memory.dmp

Filesize
48KB

Download
memory/1432-60-0x00007FF9872D0000-0x00007FF987D91000-memory.dmp

Filesize
10.8MB

Download
memory/1432-59-0x00007FF9872D3000-0x00007FF9872D5000-memory.dmp

Filesize
8KB

Download
memory/4620-2-0x00000170DD9E0000-0x00000170DDA02000-memory.dmp

Filesize
136KB

Download
memory/4620-19-0x00007FF9872D0000-0x00007FF987D91000-memory.dmp

Filesize
10.8MB

Download
memory/4620-16-0x00007FF9872D0000-0x00007FF987D91000-memory.dmp

Filesize
10.8MB

Download
memory/4620-15-0x00007FF9872D0000-0x00007FF987D91000-memory.dmp

Filesize
10.8MB

Download
memory/4620-14-0x00007FF9872D0000-0x00007FF987D91000-memory.dmp

Filesize
10.8MB

Download
memory/4620-13-0x00007FF9872D0000-0x00007FF987D91000-memory.dmp

Filesize
10.8MB

Download
memory/4620-12-0x00007FF9872D0000-0x00007FF987D91000-memory.dmp

Filesize
10.8MB

Download
memory/4748-283-0x00007FF99F830000-0x00007FF99F848000-memory.dmp

Filesize
96KB

Download
memory/4748-277-0x00007FF99F850000-0x00007FF99F884000-memory.dmp

Filesize
208KB

Download
memory/4748-276-0x00007FF6D9820000-0x00007FF6D9918000-memory.dmp

Filesize
992KB

Download
memory/4748-278-0x00007FF97D9D0000-0x00007FF97DC84000-memory.dmp

Filesize
2.7MB

Download
memory/4748-288-0x00007FF9987F0000-0x00007FF998801000-memory.dmp

Filesize
68KB

Download
memory/4748-287-0x00007FF998880000-0x00007FF99889D000-memory.dmp

Filesize
116KB

Download
memory/4748-286-0x00007FF9988A0000-0x00007FF9988B7000-memory.dmp

Filesize
92KB

Download
memory/4748-285-0x00007FF99EBD0000-0x00007FF99EBE1000-memory.dmp

Filesize
68KB

Download
memory/4748-284-0x00007FF99F810000-0x00007FF99F827000-memory.dmp

Filesize
92KB

Download
memory/4748-293-0x00007FF97D9D0000-0x00007FF97DC84000-memory.dmp

Filesize
2.7MB

Download
memory/4748-292-0x00007FF99F850000-0x00007FF99F884000-memory.dmp

Filesize
208KB

Download
memory/4748-291-0x00007FF6D9820000-0x00007FF6D9918000-memory.dmp

Filesize
992KB

Download
memory/4748-294-0x00007FF9795B0000-0x00007FF97A65B000-memory.dmp

Filesize
16.7MB

Download