Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/12/2024, 02:35

General

  • Target

    6d2705d1bd666792331b29b0ae1895a1ef2072d0dc1e55ef105212da9024fc47.msi

  • Size

    1.9MB

  • MD5

    74a757de4790c76a4d83d640901e5249

  • SHA1

    d27c7ace0079aaf1fd39abbc0e161aa84aa399a9

  • SHA256

    6d2705d1bd666792331b29b0ae1895a1ef2072d0dc1e55ef105212da9024fc47

  • SHA512

    db06f8f0082fb45c97e35b3d959e513dc9defc8ed2ef15f4a937dee92c2a762ef0802dfcadb6a8741964e517eb0190bf40adca08c64bc0f9a976cbca57a2ede4

  • SSDEEP

    24576:Qt9cpVDh7lt0nSRDxmR+UJ2jUvshD3rcxCEiPzRqe:PpRh7FDxzUSDFr7EKz9

Malware Config

Extracted

Family

metastealer

C2

kiyaqoimsiieeyqa.xyz

ssqsmisuowqcwsqo.xyz

ykqmwgsuummieaug.xyz

ewukeskgqswqesiw.xyz

cscqcsgewmwwaaui.xyz

cyoksykiamiscyia.xyz

okgomokemoucqeso.xyz

ikwacuakiqeimwua.xyz

aawcsqqaywckiwmi.xyz

aiqasksgmyeqocei.xyz

qgumcuisgaeyuqqe.xyz

eiesoycamyqqgcea.xyz

ywceswakicsqomqw.xyz

auaieuewouawygku.xyz

cmiascusccywowcs.xyz

uiqkkomkaceqacec.xyz

quqeciymqmkqccqw.xyz

ssqsauuuyyigouou.xyz

aogaakukuugqswcy.xyz

ucgwcwsuqsuwewgc.xyz

Attributes
  • dga_seed

    21845

  • domain_length

    16

  • num_dga_domains

    10000

  • port

    443

Signatures

  • Meta Stealer

    Meta Stealer steals passwords stored in browsers, written in C++.

  • MetaStealer payload 1 IoCs
  • Metastealer family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Modifies file permissions 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in Windows directory 9 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\6d2705d1bd666792331b29b0ae1895a1ef2072d0dc1e55ef105212da9024fc47.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4668
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1120
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3516
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 72358ADA01729BB1991828311BF7E993
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:956
      • C:\Windows\SysWOW64\ICACLS.EXE
        "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-05f435ab-827d-4ce0-b7cb-9a636582d6dc\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
        3⤵
        • Modifies file permissions
        • System Location Discovery: System Language Discovery
        PID:4356
      • C:\Windows\SysWOW64\EXPAND.EXE
        "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:3540
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c start msedge https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf
        3⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1308
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf
          4⤵
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2624
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffeb25246f8,0x7ffeb2524708,0x7ffeb2524718
            5⤵
              PID:4412
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,9665162275215371902,10928726399005810485,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
              5⤵
                PID:868
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,9665162275215371902,10928726399005810485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:5048
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,9665162275215371902,10928726399005810485,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
                5⤵
                  PID:4432
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9665162275215371902,10928726399005810485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
                  5⤵
                    PID:1700
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9665162275215371902,10928726399005810485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
                    5⤵
                      PID:3712
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9665162275215371902,10928726399005810485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
                      5⤵
                        PID:3708
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9665162275215371902,10928726399005810485,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
                        5⤵
                          PID:3920
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,9665162275215371902,10928726399005810485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
                          5⤵
                            PID:1932
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,9665162275215371902,10928726399005810485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
                            5⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5240
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9665162275215371902,10928726399005810485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
                            5⤵
                              PID:5384
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9665162275215371902,10928726399005810485,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
                              5⤵
                                PID:5392
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,9665162275215371902,10928726399005810485,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4840 /prefetch:2
                                5⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:6064
                          • C:\Users\Admin\AppData\Local\Temp\MW-05f435ab-827d-4ce0-b7cb-9a636582d6dc\files\setup.exe
                            "C:\Users\Admin\AppData\Local\Temp\MW-05f435ab-827d-4ce0-b7cb-9a636582d6dc\files\setup.exe" /VERYSILENT /VERYSILENT
                            3⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1908
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\Windows\systemtask.exe"
                              4⤵
                              • Command and Scripting Interpreter: PowerShell
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3708
                            • C:\Windows\SysWOW64\systeminfo.exe
                              systeminfo
                              4⤵
                              • System Location Discovery: System Language Discovery
                              • Gathers system information
                              PID:5636
                      • C:\Windows\system32\vssvc.exe
                        C:\Windows\system32\vssvc.exe
                        1⤵
                        • Checks SCSI registry key(s)
                        • Suspicious use of AdjustPrivilegeToken
                        PID:232
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:4348
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:3920

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            c2d9eeb3fdd75834f0ac3f9767de8d6f

                            SHA1

                            4d16a7e82190f8490a00008bd53d85fb92e379b0

                            SHA256

                            1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

                            SHA512

                            d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            e55832d7cd7e868a2c087c4c73678018

                            SHA1

                            ed7a2f6d6437e907218ffba9128802eaf414a0eb

                            SHA256

                            a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

                            SHA512

                            897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                            Filesize

                            184B

                            MD5

                            0144f813407aa0fe300436850b359a93

                            SHA1

                            335b4016acb582f6110429d8742e639a007f61dc

                            SHA256

                            50d8020d11f3876e18a3fd05209f5962ed94f352efe00e30aa2e7ebc20424d9b

                            SHA512

                            de88771cc91785f7ae776a4e4bbdc2573d9ba209304577eff120521dcc806fdbf86bc33d66cef4c8ed8252e47a3abb65bb9813efe18085be74dce6fa4e7268bc

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            e1e278dec08cc83be24ed38ff1a1a2e2

                            SHA1

                            2d4135ef2cf7373d48f8315358151061269ff2c4

                            SHA256

                            3767f56b6630c45e3b43e4dc47d219f771fcd50bd8da2592407f916194073395

                            SHA512

                            005e973e739c154a2f6f8f4af3a100e00a3bcc81d2ca9a1ad23b510faa63cb4ba843c0ac5f181264a81453c2344e4871734c5e6aad31cfa0a2855d575e2ba3a2

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            5c675c6175bde1ad21aff0acdf25acf2

                            SHA1

                            6d3280fae1f63ce904faa66efec3a8f0d9a61b99

                            SHA256

                            f6804cb1b241af284872013ff7eb94ae13d0fe60914d46cb2fb1e494a009f713

                            SHA512

                            5aff1cff9283e772dcb95736e1881480d31eaa93190edc9beeca7d22132bac098996ef8f73b388af5fd87a4e9a85d3b877fb3bfc32c4a773bdc976b9d6912fdc

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                            Filesize

                            16B

                            MD5

                            6752a1d65b201c13b62ea44016eb221f

                            SHA1

                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                            SHA256

                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                            SHA512

                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                            Filesize

                            10KB

                            MD5

                            8535a6b7e2eddfe7f2f2282683f1f284

                            SHA1

                            fce738d12f0bdd58a223ea260c31e64c5813f9e8

                            SHA256

                            959a99ef9bdc5f6147df8789abc5bbe0e427cc7112debbfc67a924764fe1f4b7

                            SHA512

                            bf6972dfe78b69abebc0ae30911ff337cac72db00a6c628fe42c39e3e6e1bc8a720bdbb4bb14a86d75875a85ba98e9a751f8a55d87461d86ddf926f10c99e9bf

                          • C:\Users\Admin\AppData\Local\Temp\MW-05f435ab-827d-4ce0-b7cb-9a636582d6dc\files.cab

                            Filesize

                            1.6MB

                            MD5

                            d0ecbe8399a46101b4e9d90b891deeb8

                            SHA1

                            1bcd3c5af8ab80e427402c92665e39a993a85b9a

                            SHA256

                            639f888682c0526229cabecac2da894fddf3a90e899f20d48aad28563b2cd3fb

                            SHA512

                            6986e33f3b3be73803a32d481f0987c3906bfadfe38a6fddf2b0df626f74bf9618e964aec9d091ad38f4253b0c5d2a242c8f4840c81e27464f537fc13730619f

                          • C:\Users\Admin\AppData\Local\Temp\MW-05f435ab-827d-4ce0-b7cb-9a636582d6dc\msiwrapper.ini

                            Filesize

                            1KB

                            MD5

                            d3e714fc37880123354a947039a9eaea

                            SHA1

                            02bd4c0e9e13d58c970000c3c11bbf4e3523ab15

                            SHA256

                            3b03bb013ed63097e0a52e1f8aa0044bfab230fe6b323a7efe5a47999b574582

                            SHA512

                            c87bdf4bd5bcb6fe1b9203ee91ea39a1ff5564c16bf047c41574889212432456dc6cd314be0e12cdd0724fdcc54923f4833c3c604f07467943c7573c089f76f3

                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hlbuimss.31r.ps1

                            Filesize

                            60B

                            MD5

                            d17fe0a3f47be24a6453e9ef58c94641

                            SHA1

                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                            SHA256

                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                            SHA512

                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                          • C:\Windows\Installer\MSIC0DF.tmp

                            Filesize

                            208KB

                            MD5

                            0c8921bbcc37c6efd34faf44cf3b0cb5

                            SHA1

                            dcfa71246157edcd09eecaf9d4c5e360b24b3e49

                            SHA256

                            fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

                            SHA512

                            ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108

                          • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

                            Filesize

                            24.1MB

                            MD5

                            e7ede6311f102b7c62b55a7c226f87cf

                            SHA1

                            c159d1f25516619fbb4f27f95619dacbda1c244e

                            SHA256

                            523022204f8a1a83dea28de882d1fd7225174476c91eb35c72f5b30816e0fcc1

                            SHA512

                            4d04cfd1fbeddf2d946aa2c7307e549478c3f7e95281d19f70cfeb02d6344f39d2460515ba4acbfb4ee3ed3506384abc083e9dfde48ee3e0d04f60d86e49b33e

                          • \??\Volume{625ed6c4-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{c530b967-7a77-4205-aed0-5140cac214e1}_OnDiskSnapshotProp

                            Filesize

                            6KB

                            MD5

                            49a1e6f092148be49a22d3609c8859e1

                            SHA1

                            0cc8a460ecf2094d83224441448e07ca93091988

                            SHA256

                            3b4c0deed711e7f50d97ec785f0cd9b8966e47aa2e62fdc22e11ca457adc09b2

                            SHA512

                            83cede494c7c36db45f3b81b10e4941135a6ca0747e47f7c97663138c3dee4060d090cc06f969e56e4c7c28b7e8b9da380219b3cf643f1a9b4e24d8d0f9a114c

                          • memory/1908-184-0x0000000010000000-0x0000000010731000-memory.dmp

                            Filesize

                            7.2MB

                          • memory/3708-217-0x0000000006DB0000-0x0000000006DCE000-memory.dmp

                            Filesize

                            120KB

                          • memory/3708-219-0x0000000007560000-0x0000000007BDA000-memory.dmp

                            Filesize

                            6.5MB

                          • memory/3708-192-0x0000000005500000-0x0000000005566000-memory.dmp

                            Filesize

                            408KB

                          • memory/3708-191-0x0000000004C40000-0x0000000004C62000-memory.dmp

                            Filesize

                            136KB

                          • memory/3708-203-0x0000000005750000-0x0000000005AA4000-memory.dmp

                            Filesize

                            3.3MB

                          • memory/3708-204-0x0000000005BF0000-0x0000000005C0E000-memory.dmp

                            Filesize

                            120KB

                          • memory/3708-205-0x0000000005CA0000-0x0000000005CEC000-memory.dmp

                            Filesize

                            304KB

                          • memory/3708-207-0x000000006E820000-0x000000006E86C000-memory.dmp

                            Filesize

                            304KB

                          • memory/3708-206-0x0000000006B70000-0x0000000006BA2000-memory.dmp

                            Filesize

                            200KB

                          • memory/3708-189-0x0000000004D20000-0x0000000005348000-memory.dmp

                            Filesize

                            6.2MB

                          • memory/3708-218-0x0000000006DE0000-0x0000000006E83000-memory.dmp

                            Filesize

                            652KB

                          • memory/3708-193-0x00000000055E0000-0x0000000005646000-memory.dmp

                            Filesize

                            408KB

                          • memory/3708-220-0x0000000006F20000-0x0000000006F3A000-memory.dmp

                            Filesize

                            104KB

                          • memory/3708-188-0x0000000004660000-0x0000000004696000-memory.dmp

                            Filesize

                            216KB

                          • memory/3708-226-0x0000000006F80000-0x0000000006F8A000-memory.dmp

                            Filesize

                            40KB

                          • memory/3708-227-0x00000000071B0000-0x0000000007246000-memory.dmp

                            Filesize

                            600KB

                          • memory/3708-228-0x0000000007120000-0x0000000007131000-memory.dmp

                            Filesize

                            68KB

                          • memory/3708-229-0x0000000007160000-0x000000000716E000-memory.dmp

                            Filesize

                            56KB

                          • memory/3708-230-0x0000000007170000-0x0000000007184000-memory.dmp

                            Filesize

                            80KB

                          • memory/3708-231-0x0000000007250000-0x000000000726A000-memory.dmp

                            Filesize

                            104KB

                          • memory/3708-232-0x00000000071A0000-0x00000000071A8000-memory.dmp

                            Filesize

                            32KB