Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    299s
  • max time network
    293s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/12/2024, 21:36

General

  • Target

    installr.msi

  • Size

    1.9MB

  • MD5

    2ce1e206f7ff74d4ab03a5d217e3d49e

  • SHA1

    b6eac4a0ced4a85d3011b2d4c66a4959aa01b22c

  • SHA256

    648453397f085125c6cb42dc6ff68562f04f5b928ca7ae4550f83bcb86926b26

  • SHA512

    6295edb37122511d46a1f0e3f0861e4226e94ceb68c43d2490cf6d895d8703929d5c05aa7e3a04e67b32b6844071bfa82e2ada8d272e27f73b9f313009b5876b

  • SSDEEP

    49152:PpRh/UaTJseaFPs1yGW7BM8M35QVPtVh:PpMMJseaFQDi9Ma1V

Malware Config

Extracted

Family

metastealer

C2

kiyaqoimsiieeyqa.xyz

ssqsmisuowqcwsqo.xyz

ykqmwgsuummieaug.xyz

ewukeskgqswqesiw.xyz

cscqcsgewmwwaaui.xyz

cyoksykiamiscyia.xyz

okgomokemoucqeso.xyz

ikwacuakiqeimwua.xyz

aawcsqqaywckiwmi.xyz

aiqasksgmyeqocei.xyz

qgumcuisgaeyuqqe.xyz

eiesoycamyqqgcea.xyz

ywceswakicsqomqw.xyz

auaieuewouawygku.xyz

cmiascusccywowcs.xyz

uiqkkomkaceqacec.xyz

quqeciymqmkqccqw.xyz

ssqsauuuyyigouou.xyz

aogaakukuugqswcy.xyz

ucgwcwsuqsuwewgc.xyz

Attributes
  • dga_seed

    21845

  • domain_length

    16

  • num_dga_domains

    10000

  • port

    443

Signatures

  • Meta Stealer

    Meta Stealer steals passwords stored in browsers, written in C++.

  • MetaStealer payload 1 IoCs
  • Metastealer family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Modifies file permissions 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in Windows directory 9 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\installr.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1944
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:664
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2328
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 544CDAB3F653CF71B4C9BB262B28E90B
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1920
      • C:\Windows\SysWOW64\ICACLS.EXE
        "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-c68e3aed-f2cc-4aad-9854-ec6c92d411b8\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
        3⤵
        • Modifies file permissions
        • System Location Discovery: System Language Discovery
        PID:3408
      • C:\Windows\SysWOW64\EXPAND.EXE
        "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:544
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c start msedge https://www.med.unc.edu/webguide/wp-content/uploads/sites/419/2019/07/AdobePDF.pdf
        3⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1728
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.med.unc.edu/webguide/wp-content/uploads/sites/419/2019/07/AdobePDF.pdf
          4⤵
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:4972
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd9d1546f8,0x7ffd9d154708,0x7ffd9d154718
            5⤵
              PID:1652
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,12347747947199218136,14497104954253813708,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
              5⤵
                PID:2424
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,12347747947199218136,14497104954253813708,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:4740
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,12347747947199218136,14497104954253813708,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
                5⤵
                  PID:2460
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12347747947199218136,14497104954253813708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2244 /prefetch:1
                  5⤵
                    PID:1472
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12347747947199218136,14497104954253813708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
                    5⤵
                      PID:1612
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12347747947199218136,14497104954253813708,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
                      5⤵
                        PID:1356
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2180,12347747947199218136,14497104954253813708,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=5164 /prefetch:6
                        5⤵
                          PID:5156
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12347747947199218136,14497104954253813708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
                          5⤵
                            PID:5244
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12347747947199218136,14497104954253813708,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
                            5⤵
                              PID:5252
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,12347747947199218136,14497104954253813708,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5876 /prefetch:8
                              5⤵
                                PID:5364
                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,12347747947199218136,14497104954253813708,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5876 /prefetch:8
                                5⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5620
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12347747947199218136,14497104954253813708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
                                5⤵
                                  PID:5628
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12347747947199218136,14497104954253813708,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
                                  5⤵
                                    PID:5640
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,12347747947199218136,14497104954253813708,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5428 /prefetch:2
                                    5⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:5108
                              • C:\Users\Admin\AppData\Local\Temp\MW-c68e3aed-f2cc-4aad-9854-ec6c92d411b8\files\installr.exe
                                "C:\Users\Admin\AppData\Local\Temp\MW-c68e3aed-f2cc-4aad-9854-ec6c92d411b8\files\installr.exe" /VERYSILENT /VERYSILENT
                                3⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2968
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\Windows\systemtask.exe"
                                  4⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5312
                                • C:\Windows\SysWOW64\systeminfo.exe
                                  systeminfo
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  • Gathers system information
                                  PID:3052
                          • C:\Windows\system32\vssvc.exe
                            C:\Windows\system32\vssvc.exe
                            1⤵
                            • Checks SCSI registry key(s)
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1740
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:4620
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:4532

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                Filesize

                                152B

                                MD5

                                34d2c4f40f47672ecdf6f66fea242f4a

                                SHA1

                                4bcad62542aeb44cae38a907d8b5a8604115ada2

                                SHA256

                                b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

                                SHA512

                                50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                Filesize

                                152B

                                MD5

                                8749e21d9d0a17dac32d5aa2027f7a75

                                SHA1

                                a5d555f8b035c7938a4a864e89218c0402ab7cde

                                SHA256

                                915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

                                SHA512

                                c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                eaaa2d855e96958afc4ebbcc59333c24

                                SHA1

                                bfe2158384af486a88224f9e1b7b316cce21bdf5

                                SHA256

                                8937a2475fabf2f357308d675c7d995165ea18d6e2ab7337dce8871803555454

                                SHA512

                                7206d8858eaa8b0b6aa9338d5095ced29e9f6e4d992d01f6b7dec92809b0cb8b43bd5a2d9e4d73916df162dfe529fd57b90a538c491003c2e767aaf06c3bd40f

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                5KB

                                MD5

                                457c819f4d95a47971dc728fed8eeb70

                                SHA1

                                ef9240ddaa0273719bbdd1095c72e67f0507e307

                                SHA256

                                3874fca9bfd7dcacfadd9813e1724f6e23a05c516aa041d596184d0e7245ea7f

                                SHA512

                                b279f1b1bb25d845577e8f7fc9380218fdc307dcd142f9dcd47c81fca5e12954a030f01ec673a1103c05386c66fa34537ab5168b01a7a6bdeff6c1d66e70a44f

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                Filesize

                                16B

                                MD5

                                6752a1d65b201c13b62ea44016eb221f

                                SHA1

                                58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                SHA256

                                0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                SHA512

                                9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                Filesize

                                10KB

                                MD5

                                9d9e2357a78528c27110289ec22fc54e

                                SHA1

                                0999fe25c80ef2e7c2bb13245f670d59b04616c2

                                SHA256

                                08b257499132188c25b7dc2c17ad15c1ebe193f703903a383f8a16cd9eab8681

                                SHA512

                                8af276eabe584de94a8b62166265db04de5af766a958367afd2f912f9090738b8c9902cdec2da1470fc73ad2b92a3263be9251348bd9402ae697f122d1b90702

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                Filesize

                                10KB

                                MD5

                                e3c4655283675bb10d83cb89f76deedb

                                SHA1

                                4bea452b8971c1383b2cbf586c5e3c4ab5d87fdb

                                SHA256

                                246b4c136d7239932bf7cf40ff7143b001873cc1353e83dd30409bc0f27cdd80

                                SHA512

                                86c72caa7b964989bf99caca468174972e71ba8cb067d65820b46e1158c8e8d7f240aa52c8cdd0b9d7b4ae9879df12b628b4057255ee8a68aeea4a5f04f86f67

                              • C:\Users\Admin\AppData\Local\Temp\MW-c68e3aed-f2cc-4aad-9854-ec6c92d411b8\files.cab

                                Filesize

                                1.6MB

                                MD5

                                1d82b57b7db01fcbe2901cabc2a06dff

                                SHA1

                                da23c499bbf3e5091477dccdd5dc88e20a1d01e0

                                SHA256

                                ae0862dd3a53765c4c8321655b61a8d0b47738a3ef43f9b7a4b8d7cd555baa0c

                                SHA512

                                866c117c98359261fe190fe30071947dc71729f03d06e765fb42bb672c1fa1b761a10c1598a598ed900fa1bf9f7ce53020d440add378fa3876b2c56766674266

                              • C:\Users\Admin\AppData\Local\Temp\MW-c68e3aed-f2cc-4aad-9854-ec6c92d411b8\msiwrapper.ini

                                Filesize

                                1KB

                                MD5

                                08da7ae6bc681f601328a059886c1b76

                                SHA1

                                93e613b45c3a781661accf99f9dce5b69dfe2fea

                                SHA256

                                f0bc7f4b6a766a32131cb964bfdb4893fead678b2cf6087a09fa011003feb6b6

                                SHA512

                                a8ca0de5d4b3b3a6ff921249d4625402c8f25fb55870c1223835b85698d3f680760f1d7765821cdf637ec10d61cb8822b84b7537cf228a2360ecd0a4885d3af3

                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zmvvsjay.nax.ps1

                                Filesize

                                60B

                                MD5

                                d17fe0a3f47be24a6453e9ef58c94641

                                SHA1

                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                SHA256

                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                SHA512

                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                              • C:\Windows\Installer\MSIE639.tmp

                                Filesize

                                208KB

                                MD5

                                0c8921bbcc37c6efd34faf44cf3b0cb5

                                SHA1

                                dcfa71246157edcd09eecaf9d4c5e360b24b3e49

                                SHA256

                                fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

                                SHA512

                                ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108

                              • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

                                Filesize

                                24.1MB

                                MD5

                                439c1d711288043ce60b2c93de54c45c

                                SHA1

                                612b245db40da013fc97fd55db105f25f6b8825d

                                SHA256

                                eea256f26210c4918311b3c1f0bfed8e1fa5e012c17a0f82eca6335066d067e8

                                SHA512

                                ebd37d2449834c7686fcfb42a390ff86ee1236b67ddbf3a959a3d72472d69abfdee4286f1f56192fa5323e8207d6e2fee514110734f74dbb2e092ac744eab789

                              • \??\Volume{77a2731a-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3810a127-f688-4dc9-a6ea-4b31bdfde288}_OnDiskSnapshotProp

                                Filesize

                                6KB

                                MD5

                                108827c509db9d34b042cdba784b7496

                                SHA1

                                b1741d23efb4d17bd2c4c9283dd7db3a82bf602b

                                SHA256

                                7f3ec2f766d1ffae619d3c8012201878827a7821334e3881fcf0c42eed3c3223

                                SHA512

                                8cb7d1cc22fe3f9bba0a1edcd523b029a9bdc862ceaee6625e44e68038aec42cd488b9b4dbfa162eee15ceff881f1b9f07465f03f8456a5cfec58ae0de3c6d75

                              • memory/2968-173-0x0000000010000000-0x0000000010731000-memory.dmp

                                Filesize

                                7.2MB

                              • memory/5312-181-0x00000000062C0000-0x0000000006326000-memory.dmp

                                Filesize

                                408KB

                              • memory/5312-207-0x0000000007AF0000-0x0000000007B93000-memory.dmp

                                Filesize

                                652KB

                              • memory/5312-180-0x0000000006250000-0x00000000062B6000-memory.dmp

                                Filesize

                                408KB

                              • memory/5312-178-0x0000000005BB0000-0x00000000061D8000-memory.dmp

                                Filesize

                                6.2MB

                              • memory/5312-177-0x0000000002FD0000-0x0000000003006000-memory.dmp

                                Filesize

                                216KB

                              • memory/5312-191-0x0000000006430000-0x0000000006784000-memory.dmp

                                Filesize

                                3.3MB

                              • memory/5312-192-0x00000000068F0000-0x000000000690E000-memory.dmp

                                Filesize

                                120KB

                              • memory/5312-193-0x0000000006930000-0x000000000697C000-memory.dmp

                                Filesize

                                304KB

                              • memory/5312-195-0x0000000007880000-0x00000000078B2000-memory.dmp

                                Filesize

                                200KB

                              • memory/5312-196-0x000000006EDD0000-0x000000006EE1C000-memory.dmp

                                Filesize

                                304KB

                              • memory/5312-206-0x0000000007AC0000-0x0000000007ADE000-memory.dmp

                                Filesize

                                120KB

                              • memory/5312-179-0x0000000005A70000-0x0000000005A92000-memory.dmp

                                Filesize

                                136KB

                              • memory/5312-208-0x0000000008270000-0x00000000088EA000-memory.dmp

                                Filesize

                                6.5MB

                              • memory/5312-209-0x0000000007C20000-0x0000000007C3A000-memory.dmp

                                Filesize

                                104KB

                              • memory/5312-210-0x0000000007C90000-0x0000000007C9A000-memory.dmp

                                Filesize

                                40KB

                              • memory/5312-211-0x0000000007EB0000-0x0000000007F46000-memory.dmp

                                Filesize

                                600KB

                              • memory/5312-212-0x0000000007E20000-0x0000000007E31000-memory.dmp

                                Filesize

                                68KB

                              • memory/5312-213-0x0000000007E60000-0x0000000007E6E000-memory.dmp

                                Filesize

                                56KB

                              • memory/5312-214-0x0000000007E70000-0x0000000007E84000-memory.dmp

                                Filesize

                                80KB

                              • memory/5312-215-0x0000000007F50000-0x0000000007F6A000-memory.dmp

                                Filesize

                                104KB

                              • memory/5312-216-0x0000000007EA0000-0x0000000007EA8000-memory.dmp

                                Filesize

                                32KB