Overview

overview

8

Static

static

1

disk-drill-win.exe

windows10-2004-x64

8

Resubmissions

13-08-2024 07:31

240813-jcszva1cjg 8

13-08-2024 06:35

240813-hctqpsyenh 8

Analysis

  • max time kernel
    300s
  • max time network
    304s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    13-08-2024 07:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    disk-drill-win.exe

  • Size

    27.0MB

  • MD5

    db78eda8cb52e64d403890ad2201f007

  • SHA1

    174c837386ce92144bb6c8d722e4809426b2519a

  • SHA256

    97e296f77f96ea55d1e0f962f0fe980170a4e8d11464a7ca45b2976aa8ee16ee

  • SHA512

    94691338ff0b788b16eed3eb2973b2534b5c7774ceba3aba11a2f73ee4d9e754c8039d47ed3b45ab55ea3e3a6f7138c5a70a40f516397167a97a36c2773c09ad

  • SSDEEP

    786432:Ep3+DT+fEKOIYSwpcPa39JWJ2GsaZ/mCoq31/:l+MKrYSwqPa3HW7saZ/mPYJ

Score
8/10
bootkitdiscoverypersistence

Malware Config

Signatures

  • Blocklisted process makes network request 5 IoCs
  • Drops file in Drivers directory 3 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 47 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 63 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 51 IoCs
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 50 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 7 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 23 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 11 IoCs
    evasionspywaretrojan
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 31 IoCs
  • Suspicious use of SendNotifyMessage 28 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\disk-drill-win.exe
    "C:\Users\Admin\AppData\Local\Temp\disk-drill-win.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4956
    • C:\Windows\Temp\{22F579E6-D05A-4EA6-B3DA-60A333BF0B03}\.cr\disk-drill-win.exe
      "C:\Windows\Temp\{22F579E6-D05A-4EA6-B3DA-60A333BF0B03}\.cr\disk-drill-win.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\disk-drill-win.exe" -burn.filehandle.attached=656 -burn.filehandle.self=684
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1544
      • C:\Windows\Temp\{C3232769-63B0-46A9-9596-87F8E501F3F5}\.be\DiskDrillSetup.5.5.900.0.exe
        "C:\Windows\Temp\{C3232769-63B0-46A9-9596-87F8E501F3F5}\.be\DiskDrillSetup.5.5.900.0.exe" -q -burn.elevated BurnPipe.{62D85DE8-2A2D-41E6-B518-96FF8A99E700} {96EA1668-3FF8-4719-89BE-82406E6ADA49} 1544
        3⤵
        • Adds Run key to start application
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2460
        • C:\ProgramData\Package Cache\046F00C519900FCBF2E6E955FC155B11156A733B\vc_redist.14.38.33135.x64.exe
          "C:\ProgramData\Package Cache\046F00C519900FCBF2E6E955FC155B11156A733B\vc_redist.14.38.33135.x64.exe" /norestart /q /chainingpackage ADMINDEPLOYMENT /pipe NetFxSection.{86B1EC84-3BB2-4A67-9A84-A8CF7E8C4ABD}
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4576
          • C:\Windows\Temp\{2CBF2B03-6903-4C48-9D3D-FA3C8175ACD7}\.cr\vc_redist.14.38.33135.x64.exe
            "C:\Windows\Temp\{2CBF2B03-6903-4C48-9D3D-FA3C8175ACD7}\.cr\vc_redist.14.38.33135.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\046F00C519900FCBF2E6E955FC155B11156A733B\vc_redist.14.38.33135.x64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548 /norestart /q /chainingpackage ADMINDEPLOYMENT /pipe NetFxSection.{86B1EC84-3BB2-4A67-9A84-A8CF7E8C4ABD}
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2560
            • C:\Windows\Temp\{52A5C403-EB42-46E7-A79A-A722C0ACECD5}\.be\VC_redist.x64.exe
              "C:\Windows\Temp\{52A5C403-EB42-46E7-A79A-A722C0ACECD5}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{1BBB5E48-6815-45C7-8B6B-0DF0231B042A} {59B83A00-2967-4818-B30D-E9A7D7C15E39} 2560
              6⤵
              • Adds Run key to start application
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1620
              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={c649ede4-f16a-4486-a117-dcc2f2a35165} -burn.filehandle.self=1060 -burn.embedded BurnPipe.{60F814BD-80B0-48EA-94CA-20DBF5A28187} {FBCCD525-FEB7-4AAA-8220-979AD20A9D69} 1620
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3044
                • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={c649ede4-f16a-4486-a117-dcc2f2a35165} -burn.filehandle.self=1060 -burn.embedded BurnPipe.{60F814BD-80B0-48EA-94CA-20DBF5A28187} {FBCCD525-FEB7-4AAA-8220-979AD20A9D69} 1620
                  8⤵
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:5116
                  • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                    "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{0632E45A-9394-494B-AE5C-96AA585F5C43} {C8AD6664-9E6B-449D-8B7D-431CBDF10E64} 5116
                    9⤵
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    PID:4304
        • C:\ProgramData\Package Cache\20B1CAB9BCD5CAD52C5407D60E8556437242C730\DokanSetup.1.5.1.1000.exe
          "C:\ProgramData\Package Cache\20B1CAB9BCD5CAD52C5407D60E8556437242C730\DokanSetup.1.5.1.1000.exe" /norestart /quiet /install -burn.filehandle.self=984 -burn.embedded BurnPipe.{1D75BF74-AFC6-4661-A5D3-37055A1FD306} {17353CFE-1467-455A-92B9-5E6BA7367AE6} 2460
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1664
          • C:\Windows\Temp\{8AEA24D9-651B-4F5C-8E6A-F246D4FC0B33}\.cr\DokanSetup.1.5.1.1000.exe
            "C:\Windows\Temp\{8AEA24D9-651B-4F5C-8E6A-F246D4FC0B33}\.cr\DokanSetup.1.5.1.1000.exe" -burn.clean.room="C:\ProgramData\Package Cache\20B1CAB9BCD5CAD52C5407D60E8556437242C730\DokanSetup.1.5.1.1000.exe" -burn.filehandle.attached=692 -burn.filehandle.self=532 /norestart /quiet /install -burn.filehandle.self=984 -burn.embedded BurnPipe.{1D75BF74-AFC6-4661-A5D3-37055A1FD306} {17353CFE-1467-455A-92B9-5E6BA7367AE6} 2460
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5024
            • C:\Windows\Temp\{D369D167-9211-454D-955B-18FD798398E9}\.be\DokanSetup.exe
              "C:\Windows\Temp\{D369D167-9211-454D-955B-18FD798398E9}\.be\DokanSetup.exe" -q -burn.elevated BurnPipe.{CF7454A5-EEC9-46B4-95EE-BD5F451ACBD2} {86E5581A-95A1-440A-BBC7-9E8B16E7BB48} 5024
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:4768
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:3436
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3416
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2608
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding C8DB95D99252EC072019C4FAC16A2011
      2⤵
      • Loads dropped DLL
      PID:3068
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 71721481D279F5C0F55D65A67A084393 E Global\MSI0000
      2⤵
      • Drops file in Drivers directory
      • Drops file in System32 directory
      • Loads dropped DLL
      • Modifies data under HKEY_USERS
      PID:2552
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 8ECBF8ADB727B236082CA463B4D329E6 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2800
      • C:\Program Files\Dokan\Dokan Library-1.5.1\dokanctl.exe
        "C:\Program Files\Dokan\Dokan Library-1.5.1\dokanctl.exe" /i n
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3424
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 1FE77A5FA40EF14E2F74C412AF566BCD
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:5064
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI3CF9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240729406 88 msiGaCustomAction!msiGaCustomAction.CustomActions.gaCheckInstallPathCustomAction
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        PID:4440
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI3E71.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240729734 92 msiGaCustomAction!msiGaCustomAction.CustomActions.gaCheckInstallConditionCustomAction
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        PID:1164
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI4818.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240732171 114 msiGaCustomAction!msiGaCustomAction.CustomActions.gaSuccessCustomAction
        3⤵
        • Blocklisted process makes network request
        • Checks computer location settings
        • Drops file in Windows directory
        • Loads dropped DLL
        • Checks processor information in registry
        PID:1928
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 3359AC14D840771D64E40E15F0ACCD23 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1120
      • C:\Windows\System32\taskkill.exe
        "C:\Windows\\System32\taskkill.exe" /F /IM DD.exe
        3⤵
        • Kills process with taskkill
        PID:1792
    • C:\Program Files\CleverFiles\Disk Drill\cfbackd.w32.exe
      "C:\Program Files\CleverFiles\Disk Drill\cfbackd.w32.exe" -i
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2344
  • C:\Program Files\CleverFiles\Disk Drill\DD.exe
    "C:\Program Files\CleverFiles\Disk Drill\DD.exe"
    1⤵
    • Checks BIOS information in registry
    • Enumerates connected drives
    • Writes to the Master Boot Record (MBR)
    • Checks computer location settings
    • Drops file in Program Files directory
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Modifies system certificate store
    • NTFS ADS
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4316
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.cleverfiles.com/disk-drill-windows-pro.html?utm_nooverride=1&dd=1
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:164
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffeccc646f8,0x7ffeccc64708,0x7ffeccc64718
        3⤵
          PID:3140
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,13837764333017053706,4485213233645634703,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
          3⤵
            PID:1456
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,13837764333017053706,4485213233645634703,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:5056
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,13837764333017053706,4485213233645634703,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
            3⤵
              PID:1568
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13837764333017053706,4485213233645634703,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
              3⤵
                PID:1388
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13837764333017053706,4485213233645634703,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
                3⤵
                  PID:4532
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,13837764333017053706,4485213233645634703,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5604 /prefetch:8
                  3⤵
                    PID:1948
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,13837764333017053706,4485213233645634703,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5604 /prefetch:8
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2268
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13837764333017053706,4485213233645634703,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
                    3⤵
                      PID:1264
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13837764333017053706,4485213233645634703,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
                      3⤵
                        PID:3068
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13837764333017053706,4485213233645634703,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
                        3⤵
                          PID:2980
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13837764333017053706,4485213233645634703,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:1
                          3⤵
                            PID:4768
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13837764333017053706,4485213233645634703,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
                            3⤵
                              PID:4216
                        • C:\Program Files\CleverFiles\Disk Drill\cfbackd.w32.exe
                          "C:\Program Files\CleverFiles\Disk Drill\cfbackd.w32.exe"
                          1⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:4556
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:3352
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:3100

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Config.Msi\e58f925.rbs
                              Filesize

                              19KB

                              MD5

                              ff2822026040e4ac21d2414443bcce6d

                              SHA1

                              5bd2fad1f60e0f07eca97d107825eb1c13ecc8e6

                              SHA256

                              16062fc38ffc33d8f79176e0d223ef1783d5978a60e5b2f0fac63064e554402e

                              SHA512

                              a01e823a4909a11aabfd15281768710f3674e03ff072d9a1c593c38b7122e1eb5c0f8a7cb7e64dfb4ef0254a64c7eeb7193b14eeaf54497359a1380fd44bb621

                              Download Submit

                            • C:\Config.Msi\e58f931.rbs
                              Filesize

                              19KB

                              MD5

                              419ecec627de1621ab24d9666fb42e8d

                              SHA1

                              53c38caafde8e46d9dd059b7d60e73bb3cde3c8f

                              SHA256

                              2966a558019fc39160f2fac05c5e133f8bea9e2a9865afbb203fbace5e13054c

                              SHA512

                              9780dc9b38d418cc0a84ad9959bd46310841ca677d1d8e3b7087b21f6b5d0c0fca309e0bf49ba52b1a1adb14ded8dfe7ddc953e56b58a79970dea3f431f060c2

                              Download Submit

                            • C:\Config.Msi\e58f938.rbs
                              Filesize

                              21KB

                              MD5

                              2df9b0c7dd597d48713d91bc26330114

                              SHA1

                              8d27f03c1354d33b279896ccc770b32d855289c2

                              SHA256

                              6f0ec8660059505c2f102f6e1c7c56fbfa6d62d07b993ee925f68555972ee03c

                              SHA512

                              dc6af1869d21b9cf936f9c926994f297f554b2f50ca19c89afb5a0d2455109b945d39c203e5ee7ffc39f3750fdfa98a97342d89c62c2cb51a4681623bd4f17f5

                              Download Submit

                            • C:\Config.Msi\e58f947.rbs
                              Filesize

                              21KB

                              MD5

                              c7c7f5c8689d566b9413f7e9628f3a71

                              SHA1

                              72d6d82f1cdaabc6c635766537ef45fe723434f1

                              SHA256

                              0d1aa03f7f8c4cbe063cec782e89fbf600954e9935a291a68bdbe74416742e71

                              SHA512

                              0ef44270da3a6cbb2a2c97a55e581dbe12c1afdce498f5255e78d26317347c3943fa0d4de9294b8e34b262a2a4ecb81678ec3587deb3680cc8f0fc0b8584af8a

                              Download Submit

                            • C:\Config.Msi\e58f94c.rbs
                              Filesize

                              713KB

                              MD5

                              7cffa2e3ea8544a1e7b7e61afdf55f9a

                              SHA1

                              e6d008c2c45e71bf6fe42ccf77b008fd2f98e899

                              SHA256

                              a4064f087c6797c5d4945f9f7b3e7ae6557671c7a241809796d718cf675d910a

                              SHA512

                              5a210d8955586763dd5b5e4075a7b76dbfb1849bb0efe1103a849452787a7039f2e525db9ba190986165738e9340abc6ce05618e336db680f3e0e07cc98753c8

                              Download Submit

                            • C:\Config.Msi\e58f94f.rbs
                              Filesize

                              28KB

                              MD5

                              692f290221909cf452840c1e044e22c9

                              SHA1

                              eae6013c12bcaef571eb6bd95904c96a8ae116d8

                              SHA256

                              7796c0d42601f673db53b1b8e3e442c7ce1ae94592d6efb5d4a1e52a40900aa1

                              SHA512

                              081be8ab5cbe55aeefbba2992e8c6866470a197c145265adee32520c19a1d44293b34a04c70ad9528f36d39cf64aeac18c1b9c2c1e8992e01dcf3d1236579070

                              Download Submit

                            • C:\Program Files\CleverFiles\Disk Drill\DD.exe
                              Filesize

                              388KB

                              MD5

                              a8df446d2c364532abb3a99ff593941d

                              SHA1

                              99482ba7d46169c1e388c9511764349a31e43a8e

                              SHA256

                              f71184a0833a16f5e8eb0203fae916fee2392b58b217bd52119cfb792f2e1f04

                              SHA512

                              d2207758dc7c194a0ca760773e6de1e06150b83c659e048cb595164ee0cb00376f25e7c39fe857b96186225a773490085f9c64b8306c766f1216c2e025c82b78

                              Download Submit

                            • C:\Program Files\Dokan\Dokan Library-1.5.1\dokanctl.exe
                              Filesize

                              141KB

                              MD5

                              2725dba3e6aacf3a49c9c9d493a4efec

                              SHA1

                              99b17c0aef3d01238b90caeb3738f1f279ab17a5

                              SHA256

                              03e34f788305431d0540c0fddac2d9a66dcaf2cb7e267ffbe7678334ff3995ff

                              SHA512

                              1bc76002e53d788d6bd8558ffb880863dcef28f8f03fda7e8ac6bf0eb46bb754e06b042cc56fd8549552320960a29e005b42f21c5acfb16e2de8e1ae05a48337

                              Download Submit

                            • C:\Program Files\Dokan\Dokan Library-1.5.1\driver\dokan.inf
                              Filesize

                              1KB

                              MD5

                              5eeb5aa1f9e34a6f91fa5c431a072dcc

                              SHA1

                              cc3268d2ff2e998d845b01e1fdb4188a749a4b9d

                              SHA256

                              7f03ffd6cfa3a50539c9c5c6fe6e8b207183942df0e25bed513ee5dd39f975c5

                              SHA512

                              b8a3e8fa80308a336be372ece7ea6ba4089a844ca7e2edf99e2601a6c69724442dc160f5df0bb6783f388ac46defd1763e33fd3acc6a70ed72749395b5f81f8a

                              Download Submit

                            • C:\Program Files\Dokan\Dokan Library-1.5.1\driver\dokan1.cat
                              Filesize

                              10KB

                              MD5

                              a0eb9366a5d6042030c6aec99292f406

                              SHA1

                              c9c23e1918e5abd45f0bafde646f163969ba20f8

                              SHA256

                              90839856dddc01bf2af21340a83641dc40d2d68b8c01c3dd29eb261827a0ac7a

                              SHA512

                              dbb636588d03010d027f15a8c1ad8e7641bbfc3f7ba2794ac6e4353f93f0da12a0bc039abdac664840d034bcdd15489d59768d829736d2b1eb725757370e590c

                              Download Submit

                            • C:\Program Files\Dokan\Dokan Library-1.5.1\driver\dokan1.sys
                              Filesize

                              377KB

                              MD5

                              98d68d07ed2759612018ef269f713dc8

                              SHA1

                              830ae5d65a2782a874d2373f883de113867a3609

                              SHA256

                              7a055d96a85ca1926e0f89da0bffe47e31beb0c75f756b38bdf935e5f972ded4

                              SHA512

                              7c6cf6126b6625fda1f76add72db7864fde9d675d3a424dee91d558b618ebd65588e2ec6ba7fedc140555450a9fe8717ae27baa4d934adef0408fc3bb3447932

                              Download Submit

                            • C:\Program Files\Dokan\Dokan Library-1.5.1\x86\dokan1.dll
                              Filesize

                              394KB

                              MD5

                              a60f678d0fd4524adc0eb934a1739365

                              SHA1

                              5dd45ab3c14a1998fec3a10fc998ab1c86f63485

                              SHA256

                              d3ebcc2003be13a8fe9d9b35da2a08d59521beb19591cbecf808a8b68af419a1

                              SHA512

                              e701a51dfb203e1483f13d75788e8d7182fc8f3c8e5807c60b492baf8dcb46c02fea90b33f56b3018737a06b8e03eaee46b8b0d3abf6c9b3facae93d6fc588bb

                              Download Submit

                            • C:\ProgramData\Package Cache\{bf17c798-887e-4516-8036-35d6e0649a36}\state.rsm
                              Filesize

                              874B

                              MD5

                              c71531f94d4ae216f42c422668976ec5

                              SHA1

                              66cb93178d4adda899c9c4ac7c6fd67b79159163

                              SHA256

                              ee356c60065ca500d3e2d8f6387718a3f7cc064f0a971e81a2c84bd9f04cf3a4

                              SHA512

                              a851cda83108e05724d988ca9bea1ff917c340413e4cb89d01726c8cd1aa4636cf60551b87c3256a3e5e1e83dbb58d92e648d61100fd2734447da2ff0b94e3d7

                              Download Submit

                            • C:\ProgramData\Package Cache\{c649ede4-f16a-4486-a117-dcc2f2a35165}\state.rsm
                              Filesize

                              1KB

                              MD5

                              60dacc85e0efd9963e1d7621d84c1e4a

                              SHA1

                              45e5727d97dccf637491d5ddf48e0eb90b93f979

                              SHA256

                              e4861eb65823511e6e18cd4228dc79f9a2d0cb472c13242d048e7e15826a9444

                              SHA512

                              795cff6ccef94690f7d7209f1e2b32f6a87ec49e90802863eadb30c549d5d0cab48815a077c97d8e2dfc7e9fa8541fea51f8caa107e3f8c53a84e724a86d136c

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rundll32.exe.log
                              Filesize

                              1KB

                              MD5

                              7eb236f10d5013e533c3322c975581ac

                              SHA1

                              34817692913f5648a0fc316065b5b8f6d961818d

                              SHA256

                              08d02396e382b80765486f922c06d8840ca63a5251eee8f870499b045e52424d

                              SHA512

                              6af25144233fee34d438250d8ae70d93ccab079e9f06b69c2cb8bec1a7a282fb48efe70fada5005b0b24433150a3bf62abdb89bd1a41ec95559a66aad2bd9d2f

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                              Filesize

                              152B

                              MD5

                              38f59a47b777f2fc52088e96ffb2baaf

                              SHA1

                              267224482588b41a96d813f6d9e9d924867062db

                              SHA256

                              13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

                              SHA512

                              4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8ae6304c-0443-4892-a168-3b0734d79140.tmp
                              Filesize

                              7KB

                              MD5

                              4f56ec9325bff9fb9f46affdf3847d32

                              SHA1

                              01205765bde9e87aad0a85cbd227df1bb69d71b1

                              SHA256

                              6c2281ec2404b9ef25837610d5ef27df2eb31c40e989ea0081955eff57f0e28f

                              SHA512

                              35bdde6343a3012ef91f84c00da3b7f8c7c3a7444b190a781bbefb06a424b57d37425a71e391687bb15c669b765897aed6762f4522d17e2537157d42183bb7d2

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                              Filesize

                              360B

                              MD5

                              f541eb0644d969318625dd3a87777633

                              SHA1

                              fe11683b284ade8177e7434ccfad96c624379214

                              SHA256

                              52a59a3cf2f5e6e743fb8b233f5536374e0826d3e328061c0b355d4af6ed7350

                              SHA512

                              49e5c3100970259461f9d66a84d7d8e56af44e877b1f737a692ff5d81b0ce2f800e41022bd126c0a9eaf200b43d200de818bafefd62e1f87bf9faad0273707fb

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                              Filesize

                              6KB

                              MD5

                              7622c46c95aa217019b889a643149d65

                              SHA1

                              cc9ea498feb829c1b5e7b16f0ce04742800c7bcb

                              SHA256

                              5dd0fcae4720ef5a57dd3569ebc9751afa343863d4138e33cf18ee3a59d422e7

                              SHA512

                              fa2b998bb18b0778ff97b3c412840d04d1666145756d297a6343838e4e9e3cccb9f595bbfea34e88c13c6342607a0bbb9da44d55ff3ba8ef1aafd8a9658b1494

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                              Filesize

                              7KB

                              MD5

                              bf522568a8108772cfab81025b76641d

                              SHA1

                              31d426ea2d2c8647940352cdea8170788fedec67

                              SHA256

                              254b5949ec0e68f95ab4d3a66b3d6aa9bd2376d418db4db7b833a5d2fa0ff375

                              SHA512

                              fc0c3deae236028fbafad971c0d8338668f9d87a61347a1f3c3a37d0bc5608c8583b6b8887b315b47ecbf301461369aaf0ae92179a960b81dfd14b3460ae1e9a

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                              Filesize

                              16B

                              MD5

                              6752a1d65b201c13b62ea44016eb221f

                              SHA1

                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                              SHA256

                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                              SHA512

                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                              Filesize

                              11KB

                              MD5

                              1148b1903ec82689ef59026d2689e082

                              SHA1

                              87be3ca0572e09d86b38c01c97a0640eca25a7c5

                              SHA256

                              3061665450ef71499d16fef66cb69a291f00b73c525776da64217264fbef475f

                              SHA512

                              2a26cd688e55668ebab28bb8a0d2ad3933992084eb912f06fdc26cdc51a635d8e6052628182a73bd3c7d941e4c85bb31f9ba7a8a66615b57e3886cb0b4ff2dd6

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\DDInstall.cpccLog.txt
                              Filesize

                              313B

                              MD5

                              86425aa96e3771cd881b7dfa42e96761

                              SHA1

                              18ec0e90f5240c31c540bdced380e1134c2832e7

                              SHA256

                              62af20bfcff41d6500777adc738420ead5225203069bf2c085a82ca7fc8be8fe

                              SHA512

                              d1ae86a9f0167d13afd248cef957d26b7ca8db88044522f4d0b394c5cb2ccd143ee85c66bfe51bd2aaa0a005f2a1b52c159ecd321422c90f1c73e608982d321d

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\Disk_Drill_5.5.900.0_20240813073217_002_DD.Setup.x64.msi.log
                              Filesize

                              1KB

                              MD5

                              a1b948c200d89c9b65abe9ced5951331

                              SHA1

                              c7874d0cb1fc895edde45a52f5f2d63eb954d044

                              SHA256

                              5b268e428c97045c69981c787435198330d075bdf2117d203523bfad59a2a976

                              SHA512

                              6191796c275b1d381c48d78ee5c31c50c0fdadfe085d790b035a360c2ac5063f7ef8d9035b7098b578b371b38dddb699d8789b0826806f1717215fd49ed56deb

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\Dokan_Library_1.5.1.1000_Bundle_20240813073351_000_Dokan_x64.msi.log
                              Filesize

                              1KB

                              MD5

                              61a4a63cfa7d959c86c9e2a3ce693cf0

                              SHA1

                              49010384bd4a064865b1a3eec257fa49964fb9f0

                              SHA256

                              d0b0a4f534594b51bc3eab02215042c14c8e117730b77036b2ee3b12aba86b6c

                              SHA512

                              d44cd54cb5d6caa072cb8f00521e0ef194a345eb407eca22913bdc0e0ba3515a3f29302be493e3fdeb310da834497b054086714735c2a0fae8d800ce77d7ddc9

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240813073345_000_vcRuntimeMinimum_x64.log
                              Filesize

                              2KB

                              MD5

                              b7e7e406ffa0b86ea0aaacc273756df3

                              SHA1

                              e4bbaf2edf53481054a9af6f44e76a2043c26497

                              SHA256

                              e605434c2ba277231b76fa0215e13d4f985860314150f54ca6baa1d1dd5e11f6

                              SHA512

                              87691d222353bba5d8f2df5f82c33c557a4c70988a2d029c39694972de4d99a4bc1c8ffcb1247010772677b12f3025c78998cb8062eacbec9284072aa6eb847c

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240813073345_001_vcRuntimeAdditional_x64.log
                              Filesize

                              2KB

                              MD5

                              4f4b51dfb271b32d54fe1684e4081ae9

                              SHA1

                              5c9f1b8a8a4a5aaa11daa563650d8345cd25f205

                              SHA256

                              561665c29d2838afa28440f7ac045556658985dac6c2d8bc8c2169b4f5e511fe

                              SHA512

                              abfdf72fae5fa95c0ccdbb782a1ca5d39b4157802d576365ed785724b7e6767126c60d3f095f436b89139e2b3235232d0db54f535a5df616fcc7a48e3991afb0

                              Download Submit

                            • C:\Windows\Installer\MSI1103.tmp
                              Filesize

                              149KB

                              MD5

                              418322f7be2b68e88a93a048ac75a757

                              SHA1

                              09739792ff1c30f73dacafbe503630615922b561

                              SHA256

                              ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b

                              SHA512

                              253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef

                              Download Submit

                            • C:\Windows\Installer\MSI1346.tmp
                              Filesize

                              690KB

                              MD5

                              8deb7d2f91c7392925718b3ba0aade22

                              SHA1

                              fc8e9b10c83e16eb0af1b6f10128f5c37b389682

                              SHA256

                              cb42fac1aebb6e1ac4907a38035b218b5f992d1bcd4dece11b1664a588e876e4

                              SHA512

                              37f2c132b632c8e5a336bdc773d953c7f39872b1bae2ba34fbaf7794a477fd0dcb9ff60a3ddb447fe76abd98e557bd5ee544876584adea152b0841b3e313054c

                              Download Submit

                            • C:\Windows\Installer\MSI1470.tmp
                              Filesize

                              113KB

                              MD5

                              fa0d3eb4ff2a36049eb0373e645fc16a

                              SHA1

                              e757a6f96303313778670e6f6fbdfd237743e7b1

                              SHA256

                              ee2f295eacd7d54799e2f6df191ff1da3bac490a865bb9654bd1ecbf9f2bb4d3

                              SHA512

                              be7508c9ca9f17ac0d2f9c656fa5eada18f345781d8ed210c23dc038394f7564b3821f4528139ae3db5067a4b2dcda1ed8d00150993f1904098c439da19dfc9f

                              Download Submit

                            • C:\Windows\Installer\MSI3CF9.tmp
                              Filesize

                              615KB

                              MD5

                              a95da1b0805973f5becc95995e713a68

                              SHA1

                              2572032a0aaa9615cf20949c957ea5aeffd2c654

                              SHA256

                              ecb80749bf597194f61699401e6805a45c4cb6cbdf50f8b4ad5e13890f82a900

                              SHA512

                              95bf9485bfe43c0f387fc5741f08adbae027310b291ff8fe2343e9f5ac2c33ace365ede408f6b134f81876b35451006232f5e26638109a0b791caaa0564ab2df

                              Download Submit

                            • C:\Windows\Installer\MSI3CF9.tmp-\msiGaCustomAction.dll
                              Filesize

                              28KB

                              MD5

                              f6fabea50d0e85ec3e0cb93794ac55d6

                              SHA1

                              a985999df06adc4580811380db813e2e4697ec0c

                              SHA256

                              26e377ee21ed4b09f1aaf241081e29c09d2e47bc0512fb7c755653b5fba5e11c

                              SHA512

                              be9e31350d10f6f7f60434d06a350bf659a8a301659b303b6b323e145069bc774efd6fd3dec41fa8234099f9efe32b98d455adeb97ef223c6e4ac2b3f7f178ee

                              Download Submit

                            • C:\Windows\Installer\MSI3E71.tmp-\CustomAction.config
                              Filesize

                              1KB

                              MD5

                              01c01d040563a55e0fd31cc8daa5f155

                              SHA1

                              3c1c229703198f9772d7721357f1b90281917842

                              SHA256

                              33d947c04a10e3aff3dca3b779393fa56ce5f02251c8cbae5076a125fdea081f

                              SHA512

                              9c3f0cc17868479575090e1949e31a688b8c1cdfa56ac4a08cbe661466bb40ecfc94ea512dc4b64d5ff14a563f96f1e71c03b6eeacc42992455bd4f1c91f17d5

                              Download Submit

                            • C:\Windows\Installer\MSI3E71.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                              Filesize

                              179KB

                              MD5

                              1a5caea6734fdd07caa514c3f3fb75da

                              SHA1

                              f070ac0d91bd337d7952abd1ddf19a737b94510c

                              SHA256

                              cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

                              SHA512

                              a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

                              Download Submit

                            • C:\Windows\Installer\MSI4028.tmp
                              Filesize

                              211KB

                              MD5

                              a3ae5d86ecf38db9427359ea37a5f646

                              SHA1

                              eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

                              SHA256

                              c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

                              SHA512

                              96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

                              Download Submit

                            • C:\Windows\Installer\MSI4818.tmp-\libSoftMeter.dll
                              Filesize

                              931KB

                              MD5

                              79f8f96d861c87c949cc904020a2092b

                              SHA1

                              75eb3505e6bef949a0778c178ec87b417482a259

                              SHA256

                              735006e0e39a3d38f42be4ee96434a239d2ba827ce7bc3e95d74c7cc8ce800da

                              SHA512

                              f73f44da61ed29e0805afcbb8b652dd1fbbc6fad60452708697b12af22ed287fce640f3451015cf0dee14a852a9209c5093a6a892bc4264a427d9baddda1c03a

                              Download Submit

                            • C:\Windows\System32\dokan1.dll
                              Filesize

                              507KB

                              MD5

                              3556298d25afd095b48279264d9911da

                              SHA1

                              a1182374dd98b0ec3c9edfa3597f2142a25fed2b

                              SHA256

                              e5a4d9f08f0faf571abfe0a361f5e5ad9fd80315c835f7a8ddb5d6a8f81e5b57

                              SHA512

                              ab2b66b366ba6c56e075e652ac8a8a30e8310488d65db7812ba9676e4c500ba21c9c0e00730998693874d33924d4e2a591ec54aa2da394578d2c6e5262b49f5c

                              Download Submit

                            • C:\Windows\Temp\{22F579E6-D05A-4EA6-B3DA-60A333BF0B03}\.cr\disk-drill-win.exe
                              Filesize

                              888KB

                              MD5

                              ddc2103d7db9f4b5ba331ed09293a336

                              SHA1

                              73bd031762f1168a4d7fed65bbc1663ca6cceb3c

                              SHA256

                              386a38dd828a617f60d11719ad5eaa3fa21a21b46f3871f5b4553e9f6e67aced

                              SHA512

                              2e77b5c6d7562bd23d1372903da819c5a905f791228dc89317159e9ed2c32e7dc40bb2067de6de3b43a887d3799b58fd44505d81fae3b6348e64bedeab2effb3

                              Download Submit

                            • C:\Windows\Temp\{2CBF2B03-6903-4C48-9D3D-FA3C8175ACD7}\.cr\vc_redist.14.38.33135.x64.exe
                              Filesize

                              635KB

                              MD5

                              b73be38096eddc4d427fbbfdd8cf15bd

                              SHA1

                              534f605fd43cc7089e448e5fa1b1a2d56de14779

                              SHA256

                              ab1164dcaf6c7d7d4905881f332a7b6f854be46e36b860c44d9eedc96ab6607a

                              SHA512

                              5af779926d344bc7c4140725f90cddad5eb778f5ca4856d5a31a6084424964d205638815eab4454e0ea34ea56fafca19fadd1eb2779dc6b7f277e4e4ce4b1603

                              Download Submit

                            • C:\Windows\Temp\{52A5C403-EB42-46E7-A79A-A722C0ACECD5}\.ba\logo.png
                              Filesize

                              1KB

                              MD5

                              d6bd210f227442b3362493d046cea233

                              SHA1

                              ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

                              SHA256

                              335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

                              SHA512

                              464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

                              Download Submit

                            • C:\Windows\Temp\{52A5C403-EB42-46E7-A79A-A722C0ACECD5}\.ba\wixstdba.dll
                              Filesize

                              191KB

                              MD5

                              eab9caf4277829abdf6223ec1efa0edd

                              SHA1

                              74862ecf349a9bedd32699f2a7a4e00b4727543d

                              SHA256

                              a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

                              SHA512

                              45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

                              Download Submit

                            • C:\Windows\Temp\{52A5C403-EB42-46E7-A79A-A722C0ACECD5}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
                              Filesize

                              5.4MB

                              MD5

                              d0cbbe859fbb7c25dd5158e0f45d3682

                              SHA1

                              9c2f0b8379976fda1b46aa8c4a4a27b6f824b659

                              SHA256

                              97aef328363e120e786841903bb51a17547aa84f64d5d3525940ec5a69b9a627

                              SHA512

                              7ad84ae54668c07033ad100bc101fd0bf0b0783a1dd1f018d241097e167328b8e87cc15e4c0b45859e1946d41ef7528f46ca3c44deccd8859f11274d9e4189b6

                              Download Submit

                            • C:\Windows\Temp\{52A5C403-EB42-46E7-A79A-A722C0ACECD5}\cab5046A8AB272BF37297BB7928664C9503
                              Filesize

                              955KB

                              MD5

                              3d14b0e254ea96fef419e6da38eb25e4

                              SHA1

                              93341ef98a0e2ae2cccc7e467af23bcc477d9a5c

                              SHA256

                              8717dc81d0345d8b81aa85e776fd3e0e6010dba974bf0f5660071e6d680c4526

                              SHA512

                              64a656648c16aa78ed74196e327126f6a9eb5d89052cdcd8f83eb655842e41c4f42be7f61541371f36ce322d208d1d707f485e99a79aa799fad7fd2c51553811

                              Download Submit

                            • C:\Windows\Temp\{52A5C403-EB42-46E7-A79A-A722C0ACECD5}\vcRuntimeAdditional_x64
                              Filesize

                              188KB

                              MD5

                              d5a907e3b279f26804af0c56b0c65d52

                              SHA1

                              63bf7f0afd12ef21781dc14dd3b14c59d9e66518

                              SHA256

                              401ffa2ef4f070e211ef3f6e4f8a2a7af2bc9ea0119bbacad040669ab6221bba

                              SHA512

                              8d23fed4d26f0e2d1e40d5993ab2f588be1e7873cbcbe2064351ca8ef705bf74535225e9d0c2adf93fabfd45691077c7abb3991a013c8b4b234b9751c991f327

                              Download Submit

                            • C:\Windows\Temp\{52A5C403-EB42-46E7-A79A-A722C0ACECD5}\vcRuntimeMinimum_x64
                              Filesize

                              188KB

                              MD5

                              e312d6be7dee2b8f3737e0a1bc92e3aa

                              SHA1

                              72487572a3f8b8eff93489997c8a5041ea7a6867

                              SHA256

                              d48c8e848a219bceb638b2505132756cb908703fe75dee78bdf475435420dc49

                              SHA512

                              b39a0c18aa242887e3f9ae3d49bc9d6765ce15097718964cccd86b824d13481cbd53175105db29d17e3a08f74fe4d20dfb3f9989eca5276c3f5fbb255b80f8ae

                              Download Submit

                            • C:\Windows\Temp\{8AEA24D9-651B-4F5C-8E6A-F246D4FC0B33}\.cr\DokanSetup.1.5.1.1000.exe
                              Filesize

                              700KB

                              MD5

                              a506dc305fea77b94923f210e5389968

                              SHA1

                              5857367e32178fff8b501b16a025ecf02ed05d24

                              SHA256

                              203b6c8e2d88200e290ffb83791e1953acbdd2aee21fa841c4c67081583a0d4c

                              SHA512

                              c7c01c018c9fa07f2e0ae5dce31a3b22004ddbca5d794c193790f0685b8f511f95f8df6b3da6d0f8bfc392460f24faf84de450f968e0cb215fb6db813c03daf2

                              Download Submit

                            • C:\Windows\Temp\{C3232769-63B0-46A9-9596-87F8E501F3F5}\.ba\logo.png
                              Filesize

                              80KB

                              MD5

                              bc348d03ed3d614eeb776df9c17dd0c9

                              SHA1

                              0d0628742f480a07e08f251d7ffa6d2c671b6811

                              SHA256

                              bcc352480c5bb9be1021442b5f1c948a33504d75b9c76f899eb3244e0b40c786

                              SHA512

                              12b12b6ccece3de9e76562ca83e078cf502e0de34747abe84f70665bd2727f4cdd62d04a1811095440c5f52fcc2b4a07f3c45b2fd3bf7d1933b596a09b5cf311

                              Download Submit

                            • C:\Windows\Temp\{C3232769-63B0-46A9-9596-87F8E501F3F5}\.ba\wixstdba.dll
                              Filesize

                              184KB

                              MD5

                              fe7e0bd53f52e6630473c31299a49fdd

                              SHA1

                              f706f45768bfb95f4c96dfa0be36df57aa863898

                              SHA256

                              2bea14d70943a42d344e09b7c9de5562fa7e109946e1c615dd584da30d06cc80

                              SHA512

                              feed48286b1e182996a3664f0facdf42aae3692d3d938ea004350c85764db7a0bea996dfddf7a77149c0d4b8b776fb544e8b1ce5e9944086a5b1ed6a8a239a3c

                              Download Submit

                            • C:\Windows\Temp\{C3232769-63B0-46A9-9596-87F8E501F3F5}\DD.Setup.x64.msi
                              Filesize

                              26.8MB

                              MD5

                              b0a9539ec71a5de35bc4e97332550498

                              SHA1

                              403a5f29a4e1cbf5a2c410586ff53324cc622ca2

                              SHA256

                              dc01ad88f8c85fd7436f6942fbec660fa8d9bbf5a5b69e979874cfa8b93303fa

                              SHA512

                              da1c87c13547af669718ef4dc69154b9f81ff0d5ada84d2a0eb36d34dc77f357bce75e533695eaf28c362e8c8649b382860269989feca761a72a38e2a5050480

                              Download Submit

                            • C:\Windows\Temp\{C3232769-63B0-46A9-9596-87F8E501F3F5}\DokanSetup.exe
                              Filesize

                              17.6MB

                              MD5

                              5494822f54196466a02bfbd78b91e827

                              SHA1

                              20b1cab9bcd5cad52c5407d60e8556437242c730

                              SHA256

                              48e7b21310d28bbef6961ba01d52ace8a08a937a8c9cf4f60f4fa17885eeb518

                              SHA512

                              bf4d243f805087d8dbe5a36e5ebcf00bb7d0456d6304ea89ae4b1cb0aece790c04f5941424a91d988604472c910e02e7fc494b5718ed091ec4e92c710c2f125d

                              Download Submit

                            • C:\Windows\Temp\{C3232769-63B0-46A9-9596-87F8E501F3F5}\vcredist_2019_x64.exe
                              Filesize

                              24.2MB

                              MD5

                              a8a68bcc74b5022467f12587baf1ef93

                              SHA1

                              046f00c519900fcbf2e6e955fc155b11156a733b

                              SHA256

                              1ad7988c17663cc742b01bef1a6df2ed1741173009579ad50a94434e54f56073

                              SHA512

                              70a05bde549e5a973397cd77fe0c6380807cae768aa98454830f321a0de64bd0da30f31615ae6b4d9f0d244483a571e46024cf51b20fe813a6304a74bd8c0cc2

                              Download Submit

                            • C:\Windows\Temp\{D369D167-9211-454D-955B-18FD798398E9}\.ba\logo.png
                              Filesize

                              4KB

                              MD5

                              0d1ae52cb83dc37298bd0872d1e08374

                              SHA1

                              d6223fe2e4834b0e10d946879a2cb645c11e6db5

                              SHA256

                              4e716f8dc1fdf9a803ea2441e2a6a185f7bbccd25dcb4a389742f056f9b4e74e

                              SHA512

                              0e2a7938cab23eeb430a677f5061b40eb2b68d5691b9cdf4ac697caab52142a79f40ccd5e52d8b1eb73a3eff3495de92161e6cced5b4478f2240eb2c10add484

                              Download Submit

                            • C:\Windows\Temp\{D369D167-9211-454D-955B-18FD798398E9}\Dokan_x64.msi
                              Filesize

                              11.9MB

                              MD5

                              910c2771cc11e19efecc8b79437df6f0

                              SHA1

                              65cf740580e4c202579aedd2ec520a9f85e68e05

                              SHA256

                              c7ab35e0d80d0f81a03e44cbeb7220625248d00de8c8019fc6a87ffe223db49f

                              SHA512

                              492f4560c1505ada9d5c79ad0c098159af473de7567048e7dc48559328c9970641cd5e2eb8f749ce04918a9a0bb1a0bd943915abd686ea8824191c0747fafe1f

                              Download Submit

                            • \??\PIPE\wkssvc
                              MD5

                              d41d8cd98f00b204e9800998ecf8427e

                              SHA1

                              da39a3ee5e6b4b0d3255bfef95601890afd80709

                              SHA256

                              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                              SHA512

                              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                              Download Submit

                            • memory/3044-316-0x0000000000070000-0x00000000000E7000-memory.dmp

                              Filesize

                              476KB

                              Download

                            • memory/4304-278-0x0000000000070000-0x00000000000E7000-memory.dmp

                              Filesize

                              476KB

                              Download

                            • memory/4440-589-0x0000022A52D40000-0x0000022A52D6E000-memory.dmp

                              Filesize

                              184KB

                              Download

                            • memory/4440-593-0x0000022A3A8B0000-0x0000022A3A8BC000-memory.dmp

                              Filesize

                              48KB

                              Download

                            • memory/5116-315-0x0000000000070000-0x00000000000E7000-memory.dmp

                              Filesize

                              476KB

                              Download