Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/12/2024, 02:32

General

  • Target

    60f172403738997a3e49ba5b7b247854bc45b42db5895c47d43b0b0ed86588c1.msi

  • Size

    1.9MB

  • MD5

    dc1dacc4a53407aebffc38ef512f52e7

  • SHA1

    737e0c4312552da152f009bdce0f9048e368fee1

  • SHA256

    60f172403738997a3e49ba5b7b247854bc45b42db5895c47d43b0b0ed86588c1

  • SHA512

    9685d5c2a48d334814599fc0f8f05dcc9af441a30d09f034030f01158648a2ffd25febfad1e4237457b1de8adb9765f005c3549624dd588f73cc738a2ed62cba

  • SSDEEP

    24576:vt9cpVDhol4Cw4o72KP8MgRhG52dt3JJCyrdEnlBj:4pRho2XN2Q8xhGQP6QdE

Malware Config

Extracted

Family

metastealer

C2

kiyaqoimsiieeyqa.xyz

ssqsmisuowqcwsqo.xyz

ykqmwgsuummieaug.xyz

ewukeskgqswqesiw.xyz

cscqcsgewmwwaaui.xyz

cyoksykiamiscyia.xyz

okgomokemoucqeso.xyz

ikwacuakiqeimwua.xyz

aawcsqqaywckiwmi.xyz

aiqasksgmyeqocei.xyz

qgumcuisgaeyuqqe.xyz

eiesoycamyqqgcea.xyz

ywceswakicsqomqw.xyz

auaieuewouawygku.xyz

cmiascusccywowcs.xyz

uiqkkomkaceqacec.xyz

quqeciymqmkqccqw.xyz

ssqsauuuyyigouou.xyz

aogaakukuugqswcy.xyz

ucgwcwsuqsuwewgc.xyz

Attributes
  • dga_seed

    21845

  • domain_length

    16

  • num_dga_domains

    10000

  • port

    443

Signatures

  • Meta Stealer

    Meta Stealer steals passwords stored in browsers, written in C++.

  • MetaStealer payload 1 IoCs
  • Metastealer family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Modifies file permissions 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in Windows directory 9 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\60f172403738997a3e49ba5b7b247854bc45b42db5895c47d43b0b0ed86588c1.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3996
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5008
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1492
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 9D80E3B3DF23CAF42C71103AC641098C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3728
      • C:\Windows\SysWOW64\ICACLS.EXE
        "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-5669a1f8-8b25-4f9b-8458-6044553abd4a\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
        3⤵
        • Modifies file permissions
        • System Location Discovery: System Language Discovery
        PID:2924
      • C:\Windows\SysWOW64\EXPAND.EXE
        "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:3904
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c start msedge https://www.med.unc.edu/webguide/wp-content/uploads/sites/419/2019/07/AdobePDF.pdf
        3⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1276
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.med.unc.edu/webguide/wp-content/uploads/sites/419/2019/07/AdobePDF.pdf
          4⤵
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2752
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcebf946f8,0x7ffcebf94708,0x7ffcebf94718
            5⤵
              PID:3452
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,17857928929568599128,3669000991538893712,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1976 /prefetch:2
              5⤵
                PID:2948
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1964,17857928929568599128,3669000991538893712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:5084
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1964,17857928929568599128,3669000991538893712,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
                5⤵
                  PID:940
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,17857928929568599128,3669000991538893712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
                  5⤵
                    PID:1316
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,17857928929568599128,3669000991538893712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
                    5⤵
                      PID:2360
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,17857928929568599128,3669000991538893712,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
                      5⤵
                        PID:1080
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=1964,17857928929568599128,3669000991538893712,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=5072 /prefetch:6
                        5⤵
                          PID:1352
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,17857928929568599128,3669000991538893712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 /prefetch:8
                          5⤵
                            PID:1148
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,17857928929568599128,3669000991538893712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 /prefetch:8
                            5⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1472
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,17857928929568599128,3669000991538893712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
                            5⤵
                              PID:3736
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,17857928929568599128,3669000991538893712,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
                              5⤵
                                PID:4124
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,17857928929568599128,3669000991538893712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
                                5⤵
                                  PID:5336
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,17857928929568599128,3669000991538893712,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
                                  5⤵
                                    PID:5344
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,17857928929568599128,3669000991538893712,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4048 /prefetch:2
                                    5⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:3000
                              • C:\Users\Admin\AppData\Local\Temp\MW-5669a1f8-8b25-4f9b-8458-6044553abd4a\files\install86.exe
                                "C:\Users\Admin\AppData\Local\Temp\MW-5669a1f8-8b25-4f9b-8458-6044553abd4a\files\install86.exe" /VERYSILENT /VERYSILENT
                                3⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2868
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\Windows\systemtask.exe"
                                  4⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1148
                                • C:\Windows\SysWOW64\systeminfo.exe
                                  systeminfo
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  • Gathers system information
                                  PID:5624
                          • C:\Windows\system32\vssvc.exe
                            C:\Windows\system32\vssvc.exe
                            1⤵
                            • Checks SCSI registry key(s)
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4840
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:3172
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:3956

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                Filesize

                                152B

                                MD5

                                f426165d1e5f7df1b7a3758c306cd4ae

                                SHA1

                                59ef728fbbb5c4197600f61daec48556fec651c1

                                SHA256

                                b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

                                SHA512

                                8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                Filesize

                                152B

                                MD5

                                6960857d16aadfa79d36df8ebbf0e423

                                SHA1

                                e1db43bd478274366621a8c6497e270d46c6ed4f

                                SHA256

                                f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

                                SHA512

                                6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                5KB

                                MD5

                                306e5694be381544bd2df05155c37078

                                SHA1

                                22d16d97551e9853aa79520b1a28b97c7c5bba8c

                                SHA256

                                5abbc3cecd936ddd9bd0973f20db472abd35e2f311019d439ba67ad0cbe87cc2

                                SHA512

                                6f90580e9df2139f6597310e79d935c9b37f3bd0cf5663ff0f52f584b626a0c6afa92abad4a3b15751e24ae69a52a7da759ae8b0d6a178e953d1174d09141bb0

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                a5fda08b82816af1a922a4076d173658

                                SHA1

                                f7b5cfe170012ff7ba401f9b7936c63d3b2257f8

                                SHA256

                                040768fe22314af5944c9d69fa038910a3a50f658b967bd27ce5ac7d653ea856

                                SHA512

                                85ab2de5e73b20350dcf3b305e56c5a7c230cb54ac3fe61a3474999b685b61b9563ad8ce1d7589a3e72e9bfd234751c4dd955d571d083fd6c6e054da2f067e6e

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                Filesize

                                16B

                                MD5

                                6752a1d65b201c13b62ea44016eb221f

                                SHA1

                                58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                SHA256

                                0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                SHA512

                                9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                Filesize

                                10KB

                                MD5

                                4d54b253c54bef50417a01cf344a4944

                                SHA1

                                cba89bc58c764eb394a1be92bf5268461042fa75

                                SHA256

                                30507e6934c17ba84c9f1ddc6af3731aaa68c1409c119c1ba0da8d579c379df2

                                SHA512

                                549803df85fc102b278926295d5a5d4d5db130e01de438a96ea585252dc3e90ce29460f0916e00294796fc1ff45e8cc6ea7958473c24c435f8d8328a7963fafa

                              • C:\Users\Admin\AppData\Local\Temp\MW-5669a1f8-8b25-4f9b-8458-6044553abd4a\files.cab

                                Filesize

                                1.6MB

                                MD5

                                32ae8557d0880ecf9d0120578c3d4262

                                SHA1

                                06b7e7c8ffdbbbda50982135c5966b248d882535

                                SHA256

                                6f8cc33cb74cf753413e56b40aca479b6aa5a88edc02c8aa26a2b902f448f862

                                SHA512

                                181ebfa32f8906a9b7032b0417262b13240310e40edd76f6b45ddeb6bf3c02a083105256d0aa7b028c9c32d87b92c1add298b5e01aa38d756f2cdd386e41fa39

                              • C:\Users\Admin\AppData\Local\Temp\MW-5669a1f8-8b25-4f9b-8458-6044553abd4a\msiwrapper.ini

                                Filesize

                                1KB

                                MD5

                                f3e9183f1e950390dc3e11fc6153c514

                                SHA1

                                ae4ea1b45874a22064f4354b0e6cf1e07410b319

                                SHA256

                                808a964d2fa4ee2ddf24a3960f032ae69f5c283231a764fe0816d5635e5852f5

                                SHA512

                                7dc6dd6a9a21b00488ae6fc191ae8ac2d63255f1515956785ca9f2f1792d843ca63dab68478fa197e79e3978501af3cc0573e5cb607f97391680be5c92455354

                              • C:\Users\Admin\AppData\Local\Temp\MW-5669a1f8-8b25-4f9b-8458-6044553abd4a\msiwrapper.ini

                                Filesize

                                1KB

                                MD5

                                0958a25522970ea71c36de5e6e4b8181

                                SHA1

                                2b21e3842b0840f5c60a39298217b6030cde8c63

                                SHA256

                                0ecae21348cad6abbc34605dc262869d0d81878331e18d2399d0eb73f0f4e044

                                SHA512

                                24b176268c2cb170562f84c18838c426e0fe72207ebda7b38e120206901e0c68ffe098b0ef894112829fa6c0dd1dad6c4fcf3998a87424ff9225df5d3b541e65

                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b4bwb0vu.nfr.ps1

                                Filesize

                                60B

                                MD5

                                d17fe0a3f47be24a6453e9ef58c94641

                                SHA1

                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                SHA256

                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                SHA512

                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                              • C:\Windows\Installer\MSIE1A5.tmp

                                Filesize

                                208KB

                                MD5

                                0c8921bbcc37c6efd34faf44cf3b0cb5

                                SHA1

                                dcfa71246157edcd09eecaf9d4c5e360b24b3e49

                                SHA256

                                fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

                                SHA512

                                ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108

                              • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

                                Filesize

                                24.1MB

                                MD5

                                653a976401c0e4842d4b2a0826b77f8c

                                SHA1

                                7905117c49b6f1f163053a9e2c2104f79c91995c

                                SHA256

                                b5499e476e99ff1dc485d35a01410817389674fc85aa610c6c44c07c70c96c81

                                SHA512

                                562ae95c274547f5865d2efb225b72196e451bdbf3d52f22e32ef23834ea798bb17badac979213ff57f2670167c93966df9f5a802e67bb88c95b5542e28a75cf

                              • \??\Volume{62c5c1e3-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{a2c3de5f-527f-4045-9f64-b4e812512b51}_OnDiskSnapshotProp

                                Filesize

                                6KB

                                MD5

                                29391c6639e6b68efff755a790736992

                                SHA1

                                fc33cf690d93bcd228d9424e3ff552fedcaa25fd

                                SHA256

                                1ea55ef01f5171c7d5d1adefdddef21e7a0a0c23b7febda743cf85bc4e91691d

                                SHA512

                                331a6cfda4b1981dd213a34b4eed335926d77cd51397fd88f2261025980328e59f3efde28045437c48c9128850e0f664aa2e819a9bc032729fcf2e204ae63bb0

                              • memory/1148-184-0x00000000060B0000-0x0000000006116000-memory.dmp

                                Filesize

                                408KB

                              • memory/1148-210-0x00000000078C0000-0x0000000007963000-memory.dmp

                                Filesize

                                652KB

                              • memory/1148-182-0x0000000005720000-0x0000000005742000-memory.dmp

                                Filesize

                                136KB

                              • memory/1148-183-0x0000000005840000-0x00000000058A6000-memory.dmp

                                Filesize

                                408KB

                              • memory/1148-180-0x0000000002DA0000-0x0000000002DD6000-memory.dmp

                                Filesize

                                216KB

                              • memory/1148-219-0x0000000007C80000-0x0000000007C88000-memory.dmp

                                Filesize

                                32KB

                              • memory/1148-195-0x0000000006220000-0x0000000006574000-memory.dmp

                                Filesize

                                3.3MB

                              • memory/1148-196-0x00000000066C0000-0x00000000066DE000-memory.dmp

                                Filesize

                                120KB

                              • memory/1148-197-0x0000000006700000-0x000000000674C000-memory.dmp

                                Filesize

                                304KB

                              • memory/1148-199-0x000000006EC50000-0x000000006EC9C000-memory.dmp

                                Filesize

                                304KB

                              • memory/1148-198-0x0000000006CA0000-0x0000000006CD2000-memory.dmp

                                Filesize

                                200KB

                              • memory/1148-181-0x00000000058D0000-0x0000000005EF8000-memory.dmp

                                Filesize

                                6.2MB

                              • memory/1148-209-0x0000000006CE0000-0x0000000006CFE000-memory.dmp

                                Filesize

                                120KB

                              • memory/1148-211-0x0000000008040000-0x00000000086BA000-memory.dmp

                                Filesize

                                6.5MB

                              • memory/1148-212-0x0000000007A00000-0x0000000007A1A000-memory.dmp

                                Filesize

                                104KB

                              • memory/1148-213-0x0000000007A60000-0x0000000007A6A000-memory.dmp

                                Filesize

                                40KB

                              • memory/1148-214-0x0000000007C90000-0x0000000007D26000-memory.dmp

                                Filesize

                                600KB

                              • memory/1148-215-0x0000000007C00000-0x0000000007C11000-memory.dmp

                                Filesize

                                68KB

                              • memory/1148-216-0x0000000007C30000-0x0000000007C3E000-memory.dmp

                                Filesize

                                56KB

                              • memory/1148-217-0x0000000007C40000-0x0000000007C54000-memory.dmp

                                Filesize

                                80KB

                              • memory/1148-218-0x0000000007D50000-0x0000000007D6A000-memory.dmp

                                Filesize

                                104KB

                              • memory/2868-175-0x0000000010000000-0x0000000010731000-memory.dmp

                                Filesize

                                7.2MB