Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/12/2024, 02:56

General

  • Target

    b6c37e3d6c1e61c71f42e005774cae3f722a3273a91d6e29d27e9f76ab4ab934.msi

  • Size

    1.8MB

  • MD5

    0d4245b805741f0d90e4a964971b0527

  • SHA1

    0828f6cbe30fc369eb62d9e992162870767489f5

  • SHA256

    b6c37e3d6c1e61c71f42e005774cae3f722a3273a91d6e29d27e9f76ab4ab934

  • SHA512

    be3c036f37be183201c4fadc3c1111b8ea0c2acf9d6f2eb1ce4e1dc4ffe4664ed91504e8fd83346257f10352f84cb701fb39057eb948fff038be3e3328e68371

  • SSDEEP

    24576:at9cpVDh1i+OG6gviWd2ZXY3kJh8b1sd7ptsn5t:tpRh1agVYtAkJSbCpyT

Malware Config

Extracted

Family

metastealer

C2

kiyaqoimsiieeyqa.xyz

ssqsmisuowqcwsqo.xyz

ykqmwgsuummieaug.xyz

ewukeskgqswqesiw.xyz

cscqcsgewmwwaaui.xyz

cyoksykiamiscyia.xyz

okgomokemoucqeso.xyz

ikwacuakiqeimwua.xyz

aawcsqqaywckiwmi.xyz

aiqasksgmyeqocei.xyz

qgumcuisgaeyuqqe.xyz

eiesoycamyqqgcea.xyz

ywceswakicsqomqw.xyz

auaieuewouawygku.xyz

cmiascusccywowcs.xyz

uiqkkomkaceqacec.xyz

quqeciymqmkqccqw.xyz

ssqsauuuyyigouou.xyz

aogaakukuugqswcy.xyz

ucgwcwsuqsuwewgc.xyz

Attributes
  • dga_seed

    21845

  • domain_length

    16

  • num_dga_domains

    10000

  • port

    443

Signatures

  • Meta Stealer

    Meta Stealer steals passwords stored in browsers, written in C++.

  • MetaStealer payload 1 IoCs
  • Metastealer family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Modifies file permissions 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in Windows directory 9 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\b6c37e3d6c1e61c71f42e005774cae3f722a3273a91d6e29d27e9f76ab4ab934.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4484
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3660
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5008
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 11D8DF62F9ED94317026712312F2F706
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5084
      • C:\Windows\SysWOW64\ICACLS.EXE
        "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-80d4ac50-f49f-4e64-bc25-75caaf940ba8\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
        3⤵
        • Modifies file permissions
        • System Location Discovery: System Language Discovery
        PID:3896
      • C:\Windows\SysWOW64\EXPAND.EXE
        "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:4572
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c start msedge https://www.med.unc.edu/webguide/wp-content/uploads/sites/419/2019/07/AdobePDF.pdf
        3⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2892
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.med.unc.edu/webguide/wp-content/uploads/sites/419/2019/07/AdobePDF.pdf
          4⤵
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:5056
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xbc,0x128,0x7ffeccfe46f8,0x7ffeccfe4708,0x7ffeccfe4718
            5⤵
              PID:4452
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,17042624219096252716,8921661157544906029,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
              5⤵
                PID:4760
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1876,17042624219096252716,8921661157544906029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:3364
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1876,17042624219096252716,8921661157544906029,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
                5⤵
                  PID:3356
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,17042624219096252716,8921661157544906029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
                  5⤵
                    PID:2724
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,17042624219096252716,8921661157544906029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
                    5⤵
                      PID:3472
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,17042624219096252716,8921661157544906029,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
                      5⤵
                        PID:4928
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=1876,17042624219096252716,8921661157544906029,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=5068 /prefetch:6
                        5⤵
                          PID:3440
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,17042624219096252716,8921661157544906029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
                          5⤵
                            PID:2832
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,17042624219096252716,8921661157544906029,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
                            5⤵
                              PID:3140
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1876,17042624219096252716,8921661157544906029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:8
                              5⤵
                                PID:5256
                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1876,17042624219096252716,8921661157544906029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:8
                                5⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5400
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,17042624219096252716,8921661157544906029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
                                5⤵
                                  PID:5572
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,17042624219096252716,8921661157544906029,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
                                  5⤵
                                    PID:5580
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,17042624219096252716,8921661157544906029,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3176 /prefetch:2
                                    5⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:1352
                              • C:\Users\Admin\AppData\Local\Temp\MW-80d4ac50-f49f-4e64-bc25-75caaf940ba8\files\setup.exe
                                "C:\Users\Admin\AppData\Local\Temp\MW-80d4ac50-f49f-4e64-bc25-75caaf940ba8\files\setup.exe" /VERYSILENT /VERYSILENT
                                3⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4372
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\Windows\systemtask.exe"
                                  4⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5784
                                • C:\Windows\SysWOW64\systeminfo.exe
                                  systeminfo
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  • Gathers system information
                                  PID:6044
                          • C:\Windows\system32\vssvc.exe
                            C:\Windows\system32\vssvc.exe
                            1⤵
                            • Checks SCSI registry key(s)
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1820
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:3632
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:4308

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                Filesize

                                152B

                                MD5

                                c2d9eeb3fdd75834f0ac3f9767de8d6f

                                SHA1

                                4d16a7e82190f8490a00008bd53d85fb92e379b0

                                SHA256

                                1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

                                SHA512

                                d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                Filesize

                                152B

                                MD5

                                e55832d7cd7e868a2c087c4c73678018

                                SHA1

                                ed7a2f6d6437e907218ffba9128802eaf414a0eb

                                SHA256

                                a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

                                SHA512

                                897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                5KB

                                MD5

                                421030ee0d46971f76ffcb77ddf51fc3

                                SHA1

                                8bf82acab299d2278984c7df62d891d2d83de0dc

                                SHA256

                                4a53290d00519474dcf3d71035f2d7588b4621bd7f38022c5473035816a5a4df

                                SHA512

                                8f2edc92a13e504aceb8bf40f4c269b1c3bfaf6e44f2c512903445b589e878bbc509a871f55d7a5f5b77a8fd2dbd965f6fbeea1d37b4479fade39f755d01b5fd

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                708e161da1b9ec1b0c32e1f1cef5e55b

                                SHA1

                                0dd4cced01969adf27dd133b7c9e442cb9738c8c

                                SHA256

                                51a9eaffad835a97530cf06efa87731645f64bdc46baf34121b06676bbe6465d

                                SHA512

                                628ab4d9017ac2716b37ec46c026f8a4e29dc6a3abd1d2a6a3413402d94201907be76ecc6417cd7a35cde63262b8000e531c66b78bd75e2a918cef7128338826

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                Filesize

                                16B

                                MD5

                                6752a1d65b201c13b62ea44016eb221f

                                SHA1

                                58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                SHA256

                                0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                SHA512

                                9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                Filesize

                                10KB

                                MD5

                                babcce138af56cf0e87c40e6a084aeb9

                                SHA1

                                d443d73178bb47020b5d20c201aebf37141e75bc

                                SHA256

                                b8519c5c04f544e7787b4814669c566a5b708d38b960c6f2484c833f9f9109aa

                                SHA512

                                7a317010bfd1364ff3ccf60565a71865b4f389f943c6b0ab545592fe659bc478c9e1067d216f8702bee8cdfe09bf45f6a6fb7cf66d97bd7dacb386fcbc3ec037

                              • C:\Users\Admin\AppData\Local\Temp\MW-80d4ac50-f49f-4e64-bc25-75caaf940ba8\files.cab

                                Filesize

                                1.5MB

                                MD5

                                0eb1dab24d3da5ed8b7c5ea63f6ba5a5

                                SHA1

                                13384e702c3dd018d5e553676639167f6f351174

                                SHA256

                                d88f05a410a655e23d498bdfa307084f5d3771e29a51417aa5ce42044ef4fb56

                                SHA512

                                6c07aa50cc944ac3be3a74c0bb3aa57b57df3e15ba3bf2a74eb4a5d7d4e3a2d4b055b0c5dec51e174c164b75465824037d1230b9e4375f54c18da568e3f94680

                              • C:\Users\Admin\AppData\Local\Temp\MW-80d4ac50-f49f-4e64-bc25-75caaf940ba8\msiwrapper.ini

                                Filesize

                                1KB

                                MD5

                                e72bd3d432b65c6be148f77127c8c588

                                SHA1

                                1fd490c151eb3fded04ccb0ab7678f638a97d1ac

                                SHA256

                                7314674e9ea51aa642cdb9b13ec693a13ae46c533fdd20d982d5c0babdd5eec5

                                SHA512

                                0a9e389a017140ec3639b4e1e50bdafdfb38212f733f3c37974654118beb1b7f0c3c5a27058301ac0c402af30a1c70f4eff34e32377a1c5c60ae5852360e8ed7

                              • C:\Users\Admin\AppData\Local\Temp\MW-80d4ac50-f49f-4e64-bc25-75caaf940ba8\msiwrapper.ini

                                Filesize

                                1KB

                                MD5

                                4eb1201fefd3f02cdceda6761b58b14f

                                SHA1

                                8c45f9308e4abbe0a589a51731c870a186ce7030

                                SHA256

                                6402cee1cf87e534d3b0db116721fd99413f0239d22e2a928544a0d39410d147

                                SHA512

                                f08960eb7fd685050368cbcc0aadc758fa4bde0aec3a92b2d5e9247dc20b9d60cc2fee1086ad0c8d80bfb5296de2547d1112996efa475c4bfcc49549a1bb3689

                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jevg3i1o.ndp.ps1

                                Filesize

                                60B

                                MD5

                                d17fe0a3f47be24a6453e9ef58c94641

                                SHA1

                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                SHA256

                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                SHA512

                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                              • C:\Windows\Installer\MSICA45.tmp

                                Filesize

                                208KB

                                MD5

                                0c8921bbcc37c6efd34faf44cf3b0cb5

                                SHA1

                                dcfa71246157edcd09eecaf9d4c5e360b24b3e49

                                SHA256

                                fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

                                SHA512

                                ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108

                              • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

                                Filesize

                                24.1MB

                                MD5

                                c67976b5d14371248a4ebc0bd5fbda9b

                                SHA1

                                8a5acab556af8e6b9229f51ec8d932a180f1e85c

                                SHA256

                                2d31aa0a804f4a44d2aebb78b53a0cc5e10e4a1d6899893a3778f20a4a1dd0c2

                                SHA512

                                6ec554a47d23b498c07343c8f109ca981993569e110a4958cc078812bf7eae58ea249c67a9a1d67634e5bd9957f2c385d2919be0b33f6f5a1305fe83f7a138e9

                              • \??\Volume{625ed6c4-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{d0e49134-62f4-464d-b93b-6ab237820f0d}_OnDiskSnapshotProp

                                Filesize

                                6KB

                                MD5

                                0b30f5f0301806c8a5da99ce8267b775

                                SHA1

                                5d3c52ceb61493b576ffde80a2ecdbc4e35736f0

                                SHA256

                                d99bb454873a36d9b552ce3c73214acc55179fecb34963329275ca023a197fe4

                                SHA512

                                5883fcd321d83e2e5944ce0f18579f6f141fd8007993395b4e0404c013d403605be4394746a184f0808559b8b18d09316bede2df5d3ebfb22a4401892e177c6c

                              • memory/4372-157-0x0000000010000000-0x0000000010731000-memory.dmp

                                Filesize

                                7.2MB

                              • memory/5784-199-0x000000006EB50000-0x000000006EB9C000-memory.dmp

                                Filesize

                                304KB

                              • memory/5784-210-0x0000000007350000-0x00000000073F3000-memory.dmp

                                Filesize

                                652KB

                              • memory/5784-166-0x0000000005A70000-0x0000000005AD6000-memory.dmp

                                Filesize

                                408KB

                              • memory/5784-163-0x0000000005440000-0x0000000005A68000-memory.dmp

                                Filesize

                                6.2MB

                              • memory/5784-169-0x0000000005AE0000-0x0000000005B46000-memory.dmp

                                Filesize

                                408KB

                              • memory/5784-177-0x0000000005C50000-0x0000000005FA4000-memory.dmp

                                Filesize

                                3.3MB

                              • memory/5784-188-0x0000000006170000-0x00000000061BC000-memory.dmp

                                Filesize

                                304KB

                              • memory/5784-187-0x0000000006130000-0x000000000614E000-memory.dmp

                                Filesize

                                120KB

                              • memory/5784-162-0x0000000002830000-0x0000000002866000-memory.dmp

                                Filesize

                                216KB

                              • memory/5784-209-0x0000000006760000-0x000000000677E000-memory.dmp

                                Filesize

                                120KB

                              • memory/5784-198-0x0000000006720000-0x0000000006752000-memory.dmp

                                Filesize

                                200KB

                              • memory/5784-165-0x00000000051A0000-0x00000000051C2000-memory.dmp

                                Filesize

                                136KB

                              • memory/5784-212-0x0000000007470000-0x000000000748A000-memory.dmp

                                Filesize

                                104KB

                              • memory/5784-211-0x0000000007AC0000-0x000000000813A000-memory.dmp

                                Filesize

                                6.5MB

                              • memory/5784-213-0x00000000074D0000-0x00000000074DA000-memory.dmp

                                Filesize

                                40KB

                              • memory/5784-214-0x0000000007700000-0x0000000007796000-memory.dmp

                                Filesize

                                600KB

                              • memory/5784-215-0x0000000007670000-0x0000000007681000-memory.dmp

                                Filesize

                                68KB

                              • memory/5784-216-0x00000000076A0000-0x00000000076AE000-memory.dmp

                                Filesize

                                56KB

                              • memory/5784-217-0x00000000076B0000-0x00000000076C4000-memory.dmp

                                Filesize

                                80KB

                              • memory/5784-218-0x00000000077C0000-0x00000000077DA000-memory.dmp

                                Filesize

                                104KB

                              • memory/5784-219-0x00000000076F0000-0x00000000076F8000-memory.dmp

                                Filesize

                                32KB