Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
21/07/2024, 18:19
Static task
static1
Behavioral task
behavioral1
Sample
NovaLauncher_11b0e9c62e0dfc7e3ce1251f38dad5ae.msi
Resource
win11-20240709-en
windows11-21h2-x64
General
-
Target
NovaLauncher_11b0e9c62e0dfc7e3ce1251f38dad5ae.msi
-
Size
7.1MB
-
MD5
11b0e9c62e0dfc7e3ce1251f38dad5ae
-
SHA1
fecde9f0459ab0fe90e6897aebf3c0c0a5bcb00f
-
SHA256
191f014b1168a7e1a6440467f72d810028aa42507a26b45e653413ed3531c3cb
-
SHA512
8d143b65207ffe58935450114d99d44cc2f0ee364377880f350beb565006f0ec0ed59a02e0b7e542779897c8caac640f97f909e9ed46525def02bd233236b645
-
SSDEEP
196608:oEWqqlBJKK09BYzW+ZUl4sK8bF/9NH5iPbPOt:o3Fls9BYzw4sK8bF/aTOt
Malware Config
Signatures
-
Blocklisted process makes network request 4 IoCs
flow pid Process 2 3492 msiexec.exe 3 3492 msiexec.exe 5 3492 msiexec.exe 6 3492 msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Project Nova\Nova Launcher\Nova.ico msiexec.exe File created C:\Program Files\Project Nova\Nova Launcher\NovaLauncher.Web.exe msiexec.exe -
Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\Installer\e57f136.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIF27E.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF71D0B7932774B5BD.TMP msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIF3D7.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\~DFF19418857DCC1C89.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{7DB911F8-3389-425C-88DE-4689E209F6E8} msiexec.exe File created C:\Windows\Installer\e57f138.msi msiexec.exe File opened for modification C:\Windows\Installer\e57f136.msi msiexec.exe File created C:\Windows\SystemTemp\~DF455DC92416AAF1AC.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF04ECB2D21FA4B918.TMP msiexec.exe -
Executes dropped EXE 2 IoCs
pid Process 3360 NovaLauncher.Web.exe 4272 NovaLauncher.Web.exe -
Loads dropped DLL 2 IoCs
pid Process 1168 MsiExec.exe 960 MsiExec.exe -
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Event Triggered Execution: Installer Packages 1 TTPs 1 IoCs
pid Process 3492 msiexec.exe -
Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000067b2cbe013c3218d0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000067b2cbe00000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090067b2cbe0000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d67b2cbe0000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000067b2cbe000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2087971895-212656400-463594913-1000_Classes\Local Settings\MuiCache MiniSearchHost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3648 msiexec.exe 3648 msiexec.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 3360 NovaLauncher.Web.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4272 NovaLauncher.Web.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3492 msiexec.exe Token: SeIncreaseQuotaPrivilege 3492 msiexec.exe Token: SeSecurityPrivilege 3648 msiexec.exe Token: SeCreateTokenPrivilege 3492 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3492 msiexec.exe Token: SeLockMemoryPrivilege 3492 msiexec.exe Token: SeIncreaseQuotaPrivilege 3492 msiexec.exe Token: SeMachineAccountPrivilege 3492 msiexec.exe Token: SeTcbPrivilege 3492 msiexec.exe Token: SeSecurityPrivilege 3492 msiexec.exe Token: SeTakeOwnershipPrivilege 3492 msiexec.exe Token: SeLoadDriverPrivilege 3492 msiexec.exe Token: SeSystemProfilePrivilege 3492 msiexec.exe Token: SeSystemtimePrivilege 3492 msiexec.exe Token: SeProfSingleProcessPrivilege 3492 msiexec.exe Token: SeIncBasePriorityPrivilege 3492 msiexec.exe Token: SeCreatePagefilePrivilege 3492 msiexec.exe Token: SeCreatePermanentPrivilege 3492 msiexec.exe Token: SeBackupPrivilege 3492 msiexec.exe Token: SeRestorePrivilege 3492 msiexec.exe Token: SeShutdownPrivilege 3492 msiexec.exe Token: SeDebugPrivilege 3492 msiexec.exe Token: SeAuditPrivilege 3492 msiexec.exe Token: SeSystemEnvironmentPrivilege 3492 msiexec.exe Token: SeChangeNotifyPrivilege 3492 msiexec.exe Token: SeRemoteShutdownPrivilege 3492 msiexec.exe Token: SeUndockPrivilege 3492 msiexec.exe Token: SeSyncAgentPrivilege 3492 msiexec.exe Token: SeEnableDelegationPrivilege 3492 msiexec.exe Token: SeManageVolumePrivilege 3492 msiexec.exe Token: SeImpersonatePrivilege 3492 msiexec.exe Token: SeCreateGlobalPrivilege 3492 msiexec.exe Token: SeCreateTokenPrivilege 3492 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3492 msiexec.exe Token: SeLockMemoryPrivilege 3492 msiexec.exe Token: SeIncreaseQuotaPrivilege 3492 msiexec.exe Token: SeMachineAccountPrivilege 3492 msiexec.exe Token: SeTcbPrivilege 3492 msiexec.exe Token: SeSecurityPrivilege 3492 msiexec.exe Token: SeTakeOwnershipPrivilege 3492 msiexec.exe Token: SeLoadDriverPrivilege 3492 msiexec.exe Token: SeSystemProfilePrivilege 3492 msiexec.exe Token: SeSystemtimePrivilege 3492 msiexec.exe Token: SeProfSingleProcessPrivilege 3492 msiexec.exe Token: SeIncBasePriorityPrivilege 3492 msiexec.exe Token: SeCreatePagefilePrivilege 3492 msiexec.exe Token: SeCreatePermanentPrivilege 3492 msiexec.exe Token: SeBackupPrivilege 3492 msiexec.exe Token: SeRestorePrivilege 3492 msiexec.exe Token: SeShutdownPrivilege 3492 msiexec.exe Token: SeDebugPrivilege 3492 msiexec.exe Token: SeAuditPrivilege 3492 msiexec.exe Token: SeSystemEnvironmentPrivilege 3492 msiexec.exe Token: SeChangeNotifyPrivilege 3492 msiexec.exe Token: SeRemoteShutdownPrivilege 3492 msiexec.exe Token: SeUndockPrivilege 3492 msiexec.exe Token: SeSyncAgentPrivilege 3492 msiexec.exe Token: SeEnableDelegationPrivilege 3492 msiexec.exe Token: SeManageVolumePrivilege 3492 msiexec.exe Token: SeImpersonatePrivilege 3492 msiexec.exe Token: SeCreateGlobalPrivilege 3492 msiexec.exe Token: SeCreateTokenPrivilege 3492 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3492 msiexec.exe Token: SeLockMemoryPrivilege 3492 msiexec.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3492 msiexec.exe 3492 msiexec.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe 4060 Taskmgr.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1748 osk.exe 1748 osk.exe 1748 osk.exe 1748 osk.exe 1748 osk.exe 720 MiniSearchHost.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3648 wrote to memory of 1168 3648 msiexec.exe 81 PID 3648 wrote to memory of 1168 3648 msiexec.exe 81 PID 3648 wrote to memory of 1168 3648 msiexec.exe 81 PID 3648 wrote to memory of 1520 3648 msiexec.exe 90 PID 3648 wrote to memory of 1520 3648 msiexec.exe 90 PID 3648 wrote to memory of 960 3648 msiexec.exe 92 PID 3648 wrote to memory of 960 3648 msiexec.exe 92 PID 3648 wrote to memory of 960 3648 msiexec.exe 92 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\NovaLauncher_11b0e9c62e0dfc7e3ce1251f38dad5ae.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3492
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C732DE00F72F16C251A5FA82B9D4B905 C2⤵
- Loads dropped DLL
PID:1168
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1520
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 01EE8B06172FA1BD3C9F462FB586BFC32⤵
- Loads dropped DLL
PID:960
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:3712
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:952
-
C:\Windows\system32\osk.exe"C:\Windows\system32\osk.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:1748
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:720
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004C0 0x00000000000004E01⤵PID:1700
-
C:\Windows\System32\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4060
-
C:\Program Files\Project Nova\Nova Launcher\NovaLauncher.Web.exe"C:\Program Files\Project Nova\Nova Launcher\NovaLauncher.Web.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3360
-
C:\Program Files\Project Nova\Nova Launcher\NovaLauncher.Web.exe"C:\Program Files\Project Nova\Nova Launcher\NovaLauncher.Web.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4272
Network
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
2Accessibility Features
1Installer Packages
1Privilege Escalation
Event Triggered Execution
2Accessibility Features
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD5afa610dfb5efc01e84ad13b2bfe34020
SHA1959d0adf0b607d3aad401c95d26c4d43fa6ccc1e
SHA256b7009aa034b70c90754eea012a0e36a56ecad23e519e4f89f51e06058d228e28
SHA5124168599a56d113db647b245314a2ca4ea9c3ecf07ce5f418816c22887b123c411d694d507e8b4ed67de251987494544f1102313da82b6597b289e6c36412cc48
-
Filesize
23.2MB
MD559bb0fd848be9f14836cebd201b58fb4
SHA121afc232f8e8140d44bd71ab512b9752cbb8787f
SHA2563666776536098176ef1c89afcefc74eca42c4c07f05503c0a781e1a6a7ce06ea
SHA51254dfa1e1e8ffd252bbc04aaccdf263d5ed480064c5514172acbd1362b4b6dc706df74aa94a547f8be98fc010a8e899cd46093172870a7a8c3abf26fdc668de4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\248DDD9FCF61002E219645695E3FFC98_8161B15032C07B64978FB2EBA40D052B
Filesize727B
MD53a06eca4086a985dc381f07d01384431
SHA10a609e27429a474129efbd04670883c54dcf9e1d
SHA256bb894a1c3a43da0c2c940293f0859eb0325803d8618456069c368390d317c436
SHA5120f3740396bd56e01edfa30794dbfb0545ce4810cae6151495bf318e735ba97b3291c4206f2644f7bb89875465a1270692c7241df704e2e15e257e081938fc7b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FE17BEC2A573BC9AE36869D0274FFA19_6DA81F04C5F9EAD2CD0268808FCE61E1
Filesize727B
MD57a3b8457313a521e0d44f91765a4e041
SHA14ea8ecb5e7b4c11f4c491caf6cee7ced5ec4c267
SHA2562b08ecf53bb8b6c430659926148f896102dc80b5f38b0ec5efe122199659651c
SHA5127349fd1b8c490d540a8bb25f40587f9874ff5d9b1f9bdb2ea69db9218ebdbdccea5e4d6645fbd1098d051b008b1ebfd12a619c3a4d6fb54940705ab14933e159
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\248DDD9FCF61002E219645695E3FFC98_8161B15032C07B64978FB2EBA40D052B
Filesize478B
MD50a471d4d772734547bc8dcd9b1c51446
SHA1519267a09d8b4a4697cedd6101ee7ff9967e9f35
SHA256fcf7602cfbb1167dffe37ac5d2aa3e1f81c382b96649f39c38c5c835aae4249e
SHA51266b3da5a8c02c8d5d17a81d401f956a23c10d8c154dbe3d6c9b88112d9072d16f7e820fb818e08d53683d28826363bcc9d3511838e80f307782b1d69f12dddd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FE17BEC2A573BC9AE36869D0274FFA19_6DA81F04C5F9EAD2CD0268808FCE61E1
Filesize478B
MD5dded6ac8b3c59a92fe5c0569b6ceef61
SHA104a1e55b799499b834a1bbc64b2064a1fc2ecf60
SHA256957e4baaf98358212a8dbe865d28593f6217346ef037e720668fa8813cc9b672
SHA5121816de85abde7cc9af833867c71c9ad4e9797a51a2b646f2255d4c178ad61cef00c75916fbe5ad6beaaa77c412ca6d94af88c172b106d3b642ff163507ea9495
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize10KB
MD55f7a48eb6f3614131075b16c51ce1f3b
SHA1974cf14d16f9b73df7a9a4682a7f3996421471ce
SHA256300af9817d180f7a8114e6e83c21e7d75c82eec63b59c3e2e3e72da9f7047c10
SHA512025c707f68e44a2d747a8678c3d2d718b5b1c5a6135ddbb7f12df6e40b399a8dc73d927b779214e66e5104bf7edd10fa729d8832c712c86868fea6faf3a3cf38
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize10KB
MD51338c0b23ef09d90485503f3754d6173
SHA1d042d03d04d312e14ce19c9f153d74a5291b0221
SHA256693f67bb605db323373461eb90b579da2f590150a3dab99072d2af90460a8da9
SHA51285b9a176e871d07137c303253991ac6460fdba4a182dcf17cdce97d252736641907f2b87950f982d579f6a9adf233080862686228cd9c69aedb67394f6b8eef9
-
Filesize
36B
MD57ae48f63228d7e282ab07fa066e72d02
SHA1de74eaa96890ceaad7218325a5f713ab04ed54d0
SHA256279a91a56471f46accc0c6e79c01bef24445a05709159508f48a9af98649400c
SHA512f8a5bb1fd3aa5dd66ce927a5a26628a2c3de7c9d5390c5c65275e1c84090c25b4e3f393899b415f26b066684db5e1db8f43052c5c597d91704d23292b7a1043f
-
Filesize
285KB
MD5b77a2a2768b9cc78a71bbffb9812b978
SHA1b70e27eb446fe1c3bc8ea03dabbee2739a782e04
SHA256f74c97b1a53541b059d3bfafe41a79005ce5065f8210d7de9f1b600dc4e28aa0
SHA512a8b16bc60f8559c78c64ca9e85cd7fd704bba1f55b362465b7accef1bb853d1c9616995a35f972256c57fbe877ce880398ba1fbceaa658604883aa12dcbc4f57
-
C:\Users\Admin\AppData\Roaming\Microsoft\Installer\{7DB911F8-3389-425C-88DE-4689E209F6E8}\_3712A3D946B4A1C3E58903.exe
Filesize4KB
MD53772bc572222ee4b4536e308d41b00a0
SHA1278ed102dc1ca22ab912f95a5be5c801ae475e10
SHA256a93caaaab2d4d9560a8acf5c9622f55ae31500bd1c173c658bb8f88c52b56834
SHA512f88b488a8312f2e2452ddacdbac8b0e509d182163506b282607c6869cd2545111c8d53b480443d1081e39dc742b38539fbb124a6e32cad15380f17f7b72fdca6
-
Filesize
2KB
MD5eb3b6f2ea8b83b9d9b61486ae9da3dd4
SHA138649efebe9671cde61e5b0547aff5025d3e89e5
SHA2561dff44ba83f27137124958f51234b01fb2a0d2a8cef8fb961dba496fbf35de53
SHA512572daa6350d2d4e96f0de5c1e2f4d83e4f46a0539f2cecc82accf41f6fb180cd00a2fdd016a1cef5516175f89bc1f762584275f7e4cc70954c2adcc33035f174
-
Filesize
7.1MB
MD511b0e9c62e0dfc7e3ce1251f38dad5ae
SHA1fecde9f0459ab0fe90e6897aebf3c0c0a5bcb00f
SHA256191f014b1168a7e1a6440467f72d810028aa42507a26b45e653413ed3531c3cb
SHA5128d143b65207ffe58935450114d99d44cc2f0ee364377880f350beb565006f0ec0ed59a02e0b7e542779897c8caac640f97f909e9ed46525def02bd233236b645
-
Filesize
12.8MB
MD55f2392df8fbc81bd66b972df866c63aa
SHA1324731358d5367cfbee6e44743f5aec7ce70803c
SHA256e3f8b8c3cc7a637332dc9b0cbb800fd8bcf80940fff508fd74164635c5d02adf
SHA512110fe8aa21e9dda1c9c7deb4771c042d26ac947ffd696217c37e3ae292e2a90eb7162edb3cc228e64a6e4f73a7602e6a741db74dcd92586a0fcf7975329bf48a
-
\??\Volume{e0cbb267-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{639b8edc-0b1c-4e31-9c50-1581e771530d}_OnDiskSnapshotProp
Filesize6KB
MD588b707ab2e34a1c2b54cd56869324c5a
SHA1ad878b799a0620e8766f0dcdd900222b32e99d41
SHA25605228e5cdae16eba6c00e090df79b4915b4911d0dde000b7ed2296fb4d3ce840
SHA512bff854fcaab05a23c6c3b8802281d10766a8f5ed738a352ab96fa1f72fcf4d04c8d946be21bd27701a53e661d0ec25a424f9adb4ee1d1159208783a14cc86c69