Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/12/2024, 02:15

General

  • Target

    2a6978db146ea87b8da5cb48b821c8219ac05d6d3f33cbff8571f5ff4141d198.msi

  • Size

    1.8MB

  • MD5

    a08ac9d031b2c05b4ad646e76867f2c2

  • SHA1

    49e8cd403932e528db6ab8fea229dac7dc2064af

  • SHA256

    2a6978db146ea87b8da5cb48b821c8219ac05d6d3f33cbff8571f5ff4141d198

  • SHA512

    3acdb495d5ecf2579d54e7fe30d4e3686f3aab65b6fbf3b39c9e73bead09bd9de422dc91baba45f235baef6c326b5d1c8a58d1e68b2c9ba62a1497f3378ee922

  • SSDEEP

    24576:Kt9cpVDhmldE4LOTVE+2gDcVYBII/g7M3z:9pRhmkthkQIbM

Malware Config

Extracted

Family

metastealer

C2

kiyaqoimsiieeyqa.xyz

ssqsmisuowqcwsqo.xyz

ykqmwgsuummieaug.xyz

ewukeskgqswqesiw.xyz

cscqcsgewmwwaaui.xyz

cyoksykiamiscyia.xyz

okgomokemoucqeso.xyz

ikwacuakiqeimwua.xyz

aawcsqqaywckiwmi.xyz

aiqasksgmyeqocei.xyz

qgumcuisgaeyuqqe.xyz

eiesoycamyqqgcea.xyz

ywceswakicsqomqw.xyz

auaieuewouawygku.xyz

cmiascusccywowcs.xyz

uiqkkomkaceqacec.xyz

quqeciymqmkqccqw.xyz

ssqsauuuyyigouou.xyz

aogaakukuugqswcy.xyz

ucgwcwsuqsuwewgc.xyz

Attributes
  • dga_seed

    21845

  • domain_length

    16

  • num_dga_domains

    10000

  • port

    443

Signatures

  • Meta Stealer

    Meta Stealer steals passwords stored in browsers, written in C++.

  • MetaStealer payload 1 IoCs
  • Metastealer family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Modifies file permissions 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in Windows directory 9 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\2a6978db146ea87b8da5cb48b821c8219ac05d6d3f33cbff8571f5ff4141d198.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2176
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1204
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3916
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 0C182CF624CCEBE6C1909478892268DC
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3952
      • C:\Windows\SysWOW64\ICACLS.EXE
        "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-ba6bb1db-b69f-40de-b60d-de8e592ebd49\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
        3⤵
        • Modifies file permissions
        • System Location Discovery: System Language Discovery
        PID:2060
      • C:\Windows\SysWOW64\EXPAND.EXE
        "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:5104
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c start msedge https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf
        3⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4876
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf
          4⤵
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:3560
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffaf15846f8,0x7ffaf1584708,0x7ffaf1584718
            5⤵
              PID:3900
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,3058715973966090912,10026454697555247801,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
              5⤵
                PID:380
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,3058715973966090912,10026454697555247801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:4224
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,3058715973966090912,10026454697555247801,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
                5⤵
                  PID:4016
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3058715973966090912,10026454697555247801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
                  5⤵
                    PID:928
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3058715973966090912,10026454697555247801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
                    5⤵
                      PID:232
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,3058715973966090912,10026454697555247801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
                      5⤵
                        PID:4600
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,3058715973966090912,10026454697555247801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
                        5⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1516
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3058715973966090912,10026454697555247801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
                        5⤵
                          PID:2368
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3058715973966090912,10026454697555247801,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
                          5⤵
                            PID:2060
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3058715973966090912,10026454697555247801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
                            5⤵
                              PID:5200
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,3058715973966090912,10026454697555247801,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
                              5⤵
                                PID:5208
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,3058715973966090912,10026454697555247801,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2396 /prefetch:2
                                5⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4164
                          • C:\Users\Admin\AppData\Local\Temp\MW-ba6bb1db-b69f-40de-b60d-de8e592ebd49\files\setup.exe
                            "C:\Users\Admin\AppData\Local\Temp\MW-ba6bb1db-b69f-40de-b60d-de8e592ebd49\files\setup.exe" /VERYSILENT /VERYSILENT
                            3⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1636
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\Windows\systemtask.exe"
                              4⤵
                              • Command and Scripting Interpreter: PowerShell
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:6136
                            • C:\Windows\SysWOW64\systeminfo.exe
                              systeminfo
                              4⤵
                              • System Location Discovery: System Language Discovery
                              • Gathers system information
                              PID:696
                      • C:\Windows\system32\vssvc.exe
                        C:\Windows\system32\vssvc.exe
                        1⤵
                        • Checks SCSI registry key(s)
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3840
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:2916
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:228

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            443a627d539ca4eab732bad0cbe7332b

                            SHA1

                            86b18b906a1acd2a22f4b2c78ac3564c394a9569

                            SHA256

                            1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

                            SHA512

                            923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            99afa4934d1e3c56bbce114b356e8a99

                            SHA1

                            3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

                            SHA256

                            08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

                            SHA512

                            76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                            Filesize

                            184B

                            MD5

                            0144f813407aa0fe300436850b359a93

                            SHA1

                            335b4016acb582f6110429d8742e639a007f61dc

                            SHA256

                            50d8020d11f3876e18a3fd05209f5962ed94f352efe00e30aa2e7ebc20424d9b

                            SHA512

                            de88771cc91785f7ae776a4e4bbdc2573d9ba209304577eff120521dcc806fdbf86bc33d66cef4c8ed8252e47a3abb65bb9813efe18085be74dce6fa4e7268bc

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            dfa384df7d3888888fa325652550b5da

                            SHA1

                            870b3c9374d8de981dc1d23bbe0f7e7df2314a52

                            SHA256

                            59d85f365370321a4fda163a76dc3ab2d3145cb3b19bc89585dcdc38d5b7deae

                            SHA512

                            e2a5d45f48516ce296da68a8640d6ed6a60ecfdece0f14fbf5649d2d0d0851f36396e2c0d966c469aaeeca9ad30014944f93b57b087e906989414e2cf464d2e0

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            ebdb75355355f6ce6280ebf1f7377ae8

                            SHA1

                            09b8391cf0f0edc10e6c43ec5011bfe13ba7e1f2

                            SHA256

                            0cc51a38d55860045a68536e73c438e24849fb1f8b7e0d32a773b6686e87d8f5

                            SHA512

                            42d81ac0b4c5183cb28b04a03528944cae27605da6c86219abbab10df0720c764ac2642a62734ccb99c42f59287291f316140310b79b641be7ae57bfb12aeafd

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                            Filesize

                            16B

                            MD5

                            46295cac801e5d4857d09837238a6394

                            SHA1

                            44e0fa1b517dbf802b18faf0785eeea6ac51594b

                            SHA256

                            0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                            SHA512

                            8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                            Filesize

                            16B

                            MD5

                            206702161f94c5cd39fadd03f4014d98

                            SHA1

                            bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                            SHA256

                            1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                            SHA512

                            0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                            Filesize

                            10KB

                            MD5

                            b9fc0f5d89879109537b4c5a1619ad10

                            SHA1

                            8efe2553396a206d89dd05850ce75d5a75d5c50f

                            SHA256

                            3350ad9283768bb24aa3723e375724b31d46393eb71c0ab1c39b3c10dab8f8b4

                            SHA512

                            84a47198e105c1e18597c0c79eb2fc86a74d1eb63ca1a72563b6a3f6ecc0dd1e55b4152b915150c63f77377a182b6e6bd3c0a6066319e7980fd303f03ac5c52f

                          • C:\Users\Admin\AppData\Local\Temp\MW-ba6bb1db-b69f-40de-b60d-de8e592ebd49\files.cab

                            Filesize

                            1.5MB

                            MD5

                            6ea1c4d2c75ee362820e814110f3dc90

                            SHA1

                            6f73fda661df49c64f6d8d2b66bef5a2f1939775

                            SHA256

                            8d1a7eafd0eb76d2aa0b522c6a98240489692fd1ca82565ad85d65be64b05d94

                            SHA512

                            5335ac317d7aeb93f509f073442e65a5be2bf0aed5fd88839d69a6b72360560ed227975fac062ab8d2476074417288dfd53eddfb3b12667ae0a8677e73f7a495

                          • C:\Users\Admin\AppData\Local\Temp\MW-ba6bb1db-b69f-40de-b60d-de8e592ebd49\msiwrapper.ini

                            Filesize

                            380B

                            MD5

                            f0064a2f7c934e338afdd6198154cb7b

                            SHA1

                            6ee0b6071f5ef6dfbb3ddd3f6203e5ce10822301

                            SHA256

                            86e19ca05e55783c3939861d7fb416a281e545e28bb68522e1c641f371c3bcb8

                            SHA512

                            3e5e454221d51f511c34aae0d19a724e4461b10f04a39e4a47a21eeb212e99627aab2475e8ab6761b9a21f5c7c1d939dd47ca4b7c495a859f3750a2c112dfafe

                          • C:\Users\Admin\AppData\Local\Temp\MW-ba6bb1db-b69f-40de-b60d-de8e592ebd49\msiwrapper.ini

                            Filesize

                            1KB

                            MD5

                            28b114bf37d3576b6b936dcf2ade54b1

                            SHA1

                            1484adaca79131c67aff26462aa1a14dff110562

                            SHA256

                            1581e35650c2146905c00ed9cf3c37e37d0586e5b4cf29618773023e8def3162

                            SHA512

                            4904fb46825780497d155d19bcb68540be0386ba15a68d2e072bf7abb12d1fb8705972319a601b615ffeb20f22864c89a12bf96309cb1e8b291a8ef6c17d0a0c

                          • C:\Users\Admin\AppData\Local\Temp\MW-ba6bb1db-b69f-40de-b60d-de8e592ebd49\msiwrapper.ini

                            Filesize

                            1KB

                            MD5

                            c90021aac4032d4878b1c01ff42ec1df

                            SHA1

                            00e6e34e9af7c03f75a60c7cde256271f3381699

                            SHA256

                            6d8e5ae0c82b3890a6be4c3c6daa649e339a95a0a6cb3e58208753d42cab7046

                            SHA512

                            ef04634e600bd9dfb582b21ebd91e4b88e0a28bd6d569daf5aa1749ed1d0488556f14eae564bb038751c8d2105e188f8607a350f29a2c2f5c91e839acbe670a3

                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_km31ik4z.ci0.ps1

                            Filesize

                            60B

                            MD5

                            d17fe0a3f47be24a6453e9ef58c94641

                            SHA1

                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                            SHA256

                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                            SHA512

                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                          • C:\Windows\Installer\MSIF08A.tmp

                            Filesize

                            208KB

                            MD5

                            0c8921bbcc37c6efd34faf44cf3b0cb5

                            SHA1

                            dcfa71246157edcd09eecaf9d4c5e360b24b3e49

                            SHA256

                            fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

                            SHA512

                            ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108

                          • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

                            Filesize

                            24.1MB

                            MD5

                            d26abfd262764730a95f38d061d0b099

                            SHA1

                            41ad7104604c1eca031c31745b8d850bd6c0bdca

                            SHA256

                            4311261a5f0bd9093c48e67bb0cd5328506ddb425a5a0a910338f0f54a43fb81

                            SHA512

                            f9745ae8feeea7bfba4680b5b2596e642fca7bb42ed6ec226747aed3f046ed57b51d60d3422cc44fb0b977b66a8e35a72798e16ab38c14a5e2ffce75e5770ed9

                          • \??\Volume{612d9cf5-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{200af845-b04b-414d-b00b-761f806c4abf}_OnDiskSnapshotProp

                            Filesize

                            6KB

                            MD5

                            0b2672266872065210684ea41e9dc338

                            SHA1

                            f959cef023eabd7c299c17f524bcf54af77736e6

                            SHA256

                            976481944e5b4571d47dd05b0e920846a447918d0c5d81e5ab26ce3fb8da6310

                            SHA512

                            23d5f0dd54b1d0634e085164fc8cbc0d236efa183145e095298c955d43becd190be9f57620f9000de5d26a9f7649edf7ef779d8520f0957971841a2d88f8da36

                          • memory/1636-175-0x0000000010000000-0x0000000010731000-memory.dmp

                            Filesize

                            7.2MB

                          • memory/6136-183-0x00000000059C0000-0x00000000059E2000-memory.dmp

                            Filesize

                            136KB

                          • memory/6136-211-0x0000000008200000-0x000000000887A000-memory.dmp

                            Filesize

                            6.5MB

                          • memory/6136-185-0x0000000006210000-0x0000000006276000-memory.dmp

                            Filesize

                            408KB

                          • memory/6136-181-0x0000000005A40000-0x0000000006068000-memory.dmp

                            Filesize

                            6.2MB

                          • memory/6136-195-0x0000000006280000-0x00000000065D4000-memory.dmp

                            Filesize

                            3.3MB

                          • memory/6136-196-0x0000000006860000-0x000000000687E000-memory.dmp

                            Filesize

                            120KB

                          • memory/6136-197-0x00000000068A0000-0x00000000068EC000-memory.dmp

                            Filesize

                            304KB

                          • memory/6136-198-0x0000000007830000-0x0000000007862000-memory.dmp

                            Filesize

                            200KB

                          • memory/6136-199-0x000000006E2C0000-0x000000006E30C000-memory.dmp

                            Filesize

                            304KB

                          • memory/6136-209-0x0000000006E60000-0x0000000006E7E000-memory.dmp

                            Filesize

                            120KB

                          • memory/6136-210-0x0000000007A80000-0x0000000007B23000-memory.dmp

                            Filesize

                            652KB

                          • memory/6136-184-0x00000000061A0000-0x0000000006206000-memory.dmp

                            Filesize

                            408KB

                          • memory/6136-212-0x0000000007BB0000-0x0000000007BCA000-memory.dmp

                            Filesize

                            104KB

                          • memory/6136-213-0x0000000007C10000-0x0000000007C1A000-memory.dmp

                            Filesize

                            40KB

                          • memory/6136-214-0x0000000007E40000-0x0000000007ED6000-memory.dmp

                            Filesize

                            600KB

                          • memory/6136-215-0x0000000007DB0000-0x0000000007DC1000-memory.dmp

                            Filesize

                            68KB

                          • memory/6136-216-0x0000000007DE0000-0x0000000007DEE000-memory.dmp

                            Filesize

                            56KB

                          • memory/6136-217-0x0000000007DF0000-0x0000000007E04000-memory.dmp

                            Filesize

                            80KB

                          • memory/6136-218-0x0000000007F00000-0x0000000007F1A000-memory.dmp

                            Filesize

                            104KB

                          • memory/6136-219-0x0000000007E30000-0x0000000007E38000-memory.dmp

                            Filesize

                            32KB

                          • memory/6136-180-0x00000000052B0000-0x00000000052E6000-memory.dmp

                            Filesize

                            216KB