Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/12/2024, 11:09

General

  • Target

    setup.msi

  • Size

    1.8MB

  • MD5

    a08ac9d031b2c05b4ad646e76867f2c2

  • SHA1

    49e8cd403932e528db6ab8fea229dac7dc2064af

  • SHA256

    2a6978db146ea87b8da5cb48b821c8219ac05d6d3f33cbff8571f5ff4141d198

  • SHA512

    3acdb495d5ecf2579d54e7fe30d4e3686f3aab65b6fbf3b39c9e73bead09bd9de422dc91baba45f235baef6c326b5d1c8a58d1e68b2c9ba62a1497f3378ee922

  • SSDEEP

    24576:Kt9cpVDhmldE4LOTVE+2gDcVYBII/g7M3z:9pRhmkthkQIbM

Malware Config

Extracted

Family

metastealer

C2

kiyaqoimsiieeyqa.xyz

ssqsmisuowqcwsqo.xyz

ykqmwgsuummieaug.xyz

ewukeskgqswqesiw.xyz

cscqcsgewmwwaaui.xyz

cyoksykiamiscyia.xyz

okgomokemoucqeso.xyz

ikwacuakiqeimwua.xyz

aawcsqqaywckiwmi.xyz

aiqasksgmyeqocei.xyz

qgumcuisgaeyuqqe.xyz

eiesoycamyqqgcea.xyz

ywceswakicsqomqw.xyz

auaieuewouawygku.xyz

cmiascusccywowcs.xyz

uiqkkomkaceqacec.xyz

quqeciymqmkqccqw.xyz

ssqsauuuyyigouou.xyz

aogaakukuugqswcy.xyz

ucgwcwsuqsuwewgc.xyz

Attributes
  • dga_seed

    21845

  • domain_length

    16

  • num_dga_domains

    10000

  • port

    443

Signatures

  • Meta Stealer

    Meta Stealer steals passwords stored in browsers, written in C++.

  • MetaStealer payload 1 IoCs
  • Metastealer family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Modifies file permissions 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in Windows directory 9 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1092
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1744
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3308
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 8806B51D5ECD25FC6AB95A95C969DD4A
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2052
      • C:\Windows\SysWOW64\ICACLS.EXE
        "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-a76a0b58-df7e-4018-914a-283782fc34af\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
        3⤵
        • Modifies file permissions
        • System Location Discovery: System Language Discovery
        PID:1432
      • C:\Windows\SysWOW64\EXPAND.EXE
        "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:4760
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c start msedge https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf
        3⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4312
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf
          4⤵
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:904
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa47db46f8,0x7ffa47db4708,0x7ffa47db4718
            5⤵
              PID:3784
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,8993888741762776205,4130723399101992162,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
              5⤵
                PID:4024
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,8993888741762776205,4130723399101992162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:1640
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,8993888741762776205,4130723399101992162,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2472 /prefetch:8
                5⤵
                  PID:1276
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8993888741762776205,4130723399101992162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2936 /prefetch:1
                  5⤵
                    PID:4896
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8993888741762776205,4130723399101992162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2944 /prefetch:1
                    5⤵
                      PID:4604
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,8993888741762776205,4130723399101992162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
                      5⤵
                        PID:3972
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,8993888741762776205,4130723399101992162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
                        5⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:772
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8993888741762776205,4130723399101992162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
                        5⤵
                          PID:2080
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8993888741762776205,4130723399101992162,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
                          5⤵
                            PID:4420
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8993888741762776205,4130723399101992162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2468 /prefetch:1
                            5⤵
                              PID:5212
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8993888741762776205,4130723399101992162,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
                              5⤵
                                PID:5220
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,8993888741762776205,4130723399101992162,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3324 /prefetch:2
                                5⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4080
                          • C:\Users\Admin\AppData\Local\Temp\MW-a76a0b58-df7e-4018-914a-283782fc34af\files\setup.exe
                            "C:\Users\Admin\AppData\Local\Temp\MW-a76a0b58-df7e-4018-914a-283782fc34af\files\setup.exe" /VERYSILENT /VERYSILENT
                            3⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1876
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\Windows\systemtask.exe"
                              4⤵
                              • Command and Scripting Interpreter: PowerShell
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:6040
                            • C:\Windows\SysWOW64\systeminfo.exe
                              systeminfo
                              4⤵
                              • System Location Discovery: System Language Discovery
                              • Gathers system information
                              PID:5360
                      • C:\Windows\system32\vssvc.exe
                        C:\Windows\system32\vssvc.exe
                        1⤵
                        • Checks SCSI registry key(s)
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2640
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:3864
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:1472

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            a0486d6f8406d852dd805b66ff467692

                            SHA1

                            77ba1f63142e86b21c951b808f4bc5d8ed89b571

                            SHA256

                            c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

                            SHA512

                            065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            dc058ebc0f8181946a312f0be99ed79c

                            SHA1

                            0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

                            SHA256

                            378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

                            SHA512

                            36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                            Filesize

                            383B

                            MD5

                            e7d212f2f9e33121e50ef891d41b94fe

                            SHA1

                            cc54ef29755b06d6774f4352672f36d9182f645e

                            SHA256

                            3b2945f45459a484748affb27b9bab1963f56137c7382f3e82f634df73b6c81d

                            SHA512

                            fca5349ed4313a94022f911079d19091c737a3343976f5c7a8c62ef8d1f4dea6870a45436360d32d3ffecb0f8f02cb3d86ce216c0636ed57be7def6dbb57285e

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            e215386f3c61372aec25c52c0b094581

                            SHA1

                            53d67dd1f5cd2242b70911de1147c2e76df68eda

                            SHA256

                            802d41a35c3f455f09af339a9b49180b5c58093668dc5e3f570a028a4b77a706

                            SHA512

                            7732718e541054eea622a0b425a0bbd706feb534ca56d0be037ed0d1c018aa7d5a6a04cb52453dab1086bd54dc3f00c23676804de150ebc9390968e57ad326e2

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            7d0063a4dea91e288f9baceb628da762

                            SHA1

                            eca9fae585d2aaf872385aa5fc235dc01affd106

                            SHA256

                            ce5aac8f9fff901029e48862a59599c68d3202a96fc32d29902f26e2db874db9

                            SHA512

                            3c3b06da558f75206f68895b3e3c7673ac23e1c64b6d41a26d9e0fd0054dfa5729ce50af5953e6a3e16e93b4f3a404ef8c87d38a3958f358f1028352a4a76325

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                            Filesize

                            16B

                            MD5

                            6752a1d65b201c13b62ea44016eb221f

                            SHA1

                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                            SHA256

                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                            SHA512

                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                            Filesize

                            10KB

                            MD5

                            7879298444819015dbf84132d9f0cb14

                            SHA1

                            728d59ac79c72c81caf8658979477d9d9154daa2

                            SHA256

                            317a1369f8f599b02d80465f7416ef1b36f7061048dcb581111dead080adde5f

                            SHA512

                            1a04b21bfe0d72135d1cea6f9f9d628017d09ad17e461420035860e6a38c15d0a8f17f49fa8f0b32da09441325a809cdd2cbcf061cfa798abd4787f74639ad7a

                          • C:\Users\Admin\AppData\Local\Temp\MW-a76a0b58-df7e-4018-914a-283782fc34af\files.cab

                            Filesize

                            1.5MB

                            MD5

                            6ea1c4d2c75ee362820e814110f3dc90

                            SHA1

                            6f73fda661df49c64f6d8d2b66bef5a2f1939775

                            SHA256

                            8d1a7eafd0eb76d2aa0b522c6a98240489692fd1ca82565ad85d65be64b05d94

                            SHA512

                            5335ac317d7aeb93f509f073442e65a5be2bf0aed5fd88839d69a6b72360560ed227975fac062ab8d2476074417288dfd53eddfb3b12667ae0a8677e73f7a495

                          • C:\Users\Admin\AppData\Local\Temp\MW-a76a0b58-df7e-4018-914a-283782fc34af\msiwrapper.ini

                            Filesize

                            380B

                            MD5

                            46c0992cdb36bf6ed76dfc4b72ae6d87

                            SHA1

                            e5038fd6c925e6ff19710e7ee0ad43967a73c1ca

                            SHA256

                            16597e362540c7ae503b1875e98a39ff605e14357f16e1593ea45920a4a277d1

                            SHA512

                            04713f7a1633b5411aa0f3823d1395dd6c4bc5bd08ac871a3f30151ca28fbc85dfd8da7fab2bcbaa012a51b638de8bc7f71dca1adc4bb9c9c93c3c9eecd3f2bb

                          • C:\Users\Admin\AppData\Local\Temp\MW-a76a0b58-df7e-4018-914a-283782fc34af\msiwrapper.ini

                            Filesize

                            1KB

                            MD5

                            ce5c65b1ec806798222833649d275b5d

                            SHA1

                            b112baf3b0c061642a61964643d26cd8a686dfb9

                            SHA256

                            6bc185628a699ac68d2b8ece9c66e9dff8d5e630cc02fe500259d7cef6e641ad

                            SHA512

                            af6ee0e1810d85082675454cdc632343620752f91f856b3d9e92070cc9f43551b5afb53ec2e9b879357e614380fffbb4b667b467d1d1173db9194a34b7002faf

                          • C:\Users\Admin\AppData\Local\Temp\MW-a76a0b58-df7e-4018-914a-283782fc34af\msiwrapper.ini

                            Filesize

                            1KB

                            MD5

                            5a40279e5fff633167ea02338ee07b3b

                            SHA1

                            067cff548319b5248eee0e1015bf24b382d36689

                            SHA256

                            edc769286ea89fc4190d62adb1ae41004155fcab00956f879730492772226dff

                            SHA512

                            684c7a9bf209a2e90ae43f9f09472bc4e474825cc4b8b826acd060ef6927b13134dd41f7579ba023d15c8e8d268af1bb95cfa124caa9dad0525a8336e8acf82e

                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lfic14xp.g5z.ps1

                            Filesize

                            60B

                            MD5

                            d17fe0a3f47be24a6453e9ef58c94641

                            SHA1

                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                            SHA256

                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                            SHA512

                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                          • C:\Windows\Installer\MSIB391.tmp

                            Filesize

                            208KB

                            MD5

                            0c8921bbcc37c6efd34faf44cf3b0cb5

                            SHA1

                            dcfa71246157edcd09eecaf9d4c5e360b24b3e49

                            SHA256

                            fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

                            SHA512

                            ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108

                          • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

                            Filesize

                            24.1MB

                            MD5

                            add3fd883032a27e62fccf4f58e004b1

                            SHA1

                            ae5e641f5c1c4148b35fda7372944eb6f1017962

                            SHA256

                            ef33ed36915e67ede5d767b7ed28bfdcb98015699909a886e5744671ef721593

                            SHA512

                            c7bf0004f4a6dc60aa2ec0b49c9f53359ecf6283de9ac598fe7679030ca19950d5784d5f7e0cce82135e7d0ff5892b4a830ad8d8d6538f77af216c8aa19118db

                          • \??\Volume{1541411d-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{1489bfad-fe5a-4aca-8cb5-f5f5e2402e59}_OnDiskSnapshotProp

                            Filesize

                            6KB

                            MD5

                            d5918355bb41ef864c6d50b522bbbecc

                            SHA1

                            b7e43a8c075524197b4cc188615601df96fb15da

                            SHA256

                            a1dc21fec994a3c6eb8e10029090c5c695181644e46b342fe35b72e31cf45dbb

                            SHA512

                            358ac8b82cff5bcd9f740567dcc2f429bef0fb3937c77d44130ba48506a8e92786f581d9541a3fce93512445dca5acba74cf5f568d6dcc0290fe2406caa7d30e

                          • memory/1876-159-0x0000000010000000-0x0000000010731000-memory.dmp

                            Filesize

                            7.2MB

                          • memory/6040-167-0x00000000057C0000-0x0000000005826000-memory.dmp

                            Filesize

                            408KB

                          • memory/6040-195-0x0000000007180000-0x000000000719A000-memory.dmp

                            Filesize

                            104KB

                          • memory/6040-164-0x0000000005090000-0x00000000056B8000-memory.dmp

                            Filesize

                            6.2MB

                          • memory/6040-168-0x0000000005830000-0x0000000005896000-memory.dmp

                            Filesize

                            408KB

                          • memory/6040-178-0x00000000059A0000-0x0000000005CF4000-memory.dmp

                            Filesize

                            3.3MB

                          • memory/6040-180-0x0000000005EA0000-0x0000000005EEC000-memory.dmp

                            Filesize

                            304KB

                          • memory/6040-179-0x0000000005E50000-0x0000000005E6E000-memory.dmp

                            Filesize

                            120KB

                          • memory/6040-182-0x000000006EB80000-0x000000006EBCC000-memory.dmp

                            Filesize

                            304KB

                          • memory/6040-192-0x0000000006E30000-0x0000000006E4E000-memory.dmp

                            Filesize

                            120KB

                          • memory/6040-181-0x0000000006420000-0x0000000006452000-memory.dmp

                            Filesize

                            200KB

                          • memory/6040-193-0x0000000006E50000-0x0000000006EF3000-memory.dmp

                            Filesize

                            652KB

                          • memory/6040-166-0x0000000004EA0000-0x0000000004EC2000-memory.dmp

                            Filesize

                            136KB

                          • memory/6040-194-0x00000000077C0000-0x0000000007E3A000-memory.dmp

                            Filesize

                            6.5MB

                          • memory/6040-196-0x00000000071E0000-0x00000000071EA000-memory.dmp

                            Filesize

                            40KB

                          • memory/6040-197-0x0000000007410000-0x00000000074A6000-memory.dmp

                            Filesize

                            600KB

                          • memory/6040-198-0x0000000007380000-0x0000000007391000-memory.dmp

                            Filesize

                            68KB

                          • memory/6040-199-0x00000000073B0000-0x00000000073BE000-memory.dmp

                            Filesize

                            56KB

                          • memory/6040-200-0x00000000073C0000-0x00000000073D4000-memory.dmp

                            Filesize

                            80KB

                          • memory/6040-201-0x00000000074D0000-0x00000000074EA000-memory.dmp

                            Filesize

                            104KB

                          • memory/6040-202-0x0000000007400000-0x0000000007408000-memory.dmp

                            Filesize

                            32KB

                          • memory/6040-163-0x00000000048B0000-0x00000000048E6000-memory.dmp

                            Filesize

                            216KB