bruteratel | ec3ca0877e599ae9c40cbcec51a9a4718114e33d9e2d9d8c72f5f24d7cebdcbf

Analysis

max time kernel
144s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
20-02-2025 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

calma.msi
Size

4.6MB
MD5

27708977fc83f3b70177d6cf68900eba
SHA1

f679bb77e2876b17da2276017df6cf252aa5bd22
SHA256

ec3ca0877e599ae9c40cbcec51a9a4718114e33d9e2d9d8c72f5f24d7cebdcbf
SHA512

831ccd1e4fdda16ff7cd16096e3291b9fa986f814e56aec9d8d0c6a36ae402002940a9d9aa7c1c5c8cf1b8e65c2d9ee529956f9cae3832e513a37bff3839c8ac
SSDEEP

98304:HYVK/AKIN29ryVzg+Vho+5d67amiFP/0hnJRZuq2sDSq5Fwfp:G29W5jmih/0xXLFm

Score

10^/10

bruteratel latrodectus backdoor discovery loader persistence privilege_escalation

Malware Config

Extracted

Family

latrodectus

Version

1.4

https://tynifinilam.com/test/

https://horetimodual.com/test/

aes.hex

Signatures

Brute Ratel C4
A customized command and control framework for red teaming and adversary simulation.
backdoor bruteratel
Bruteratel family
bruteratel

Detect BruteRatel badger 1 IoCs

resource	yara_rule
behavioral2/memory/2188-76-0x0000022A22F60000-0x0000022A22F9E000-memory.dmp	family_bruteratel

Detects Latrodectus 3 IoCs

Detects Latrodectus v1.4.

resource	yara_rule
behavioral2/memory/2188-114-0x00007FF46C170000-0x00007FF46C185000-memory.dmp	family_latrodectus_1_4
behavioral2/memory/3468-119-0x0000000002B20000-0x0000000002B35000-memory.dmp	family_latrodectus_1_4
behavioral2/memory/3468-120-0x0000000002B20000-0x0000000002B35000-memory.dmp	family_latrodectus_1_4

Latrodectus family
latrodectus
Latrodectus loader
Latrodectus is a loader written in C++.
loader latrodectus

Blocklisted process makes network request 5 IoCs

flow	pid	Process
2	3120	msiexec.exe
4	3120	msiexec.exe
6	3120	msiexec.exe
32	1364	MsiExec.exe
34	1364	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSID0FC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID216.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID2C3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID2E3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID5C3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5A26EB9D-6594-4101-AA03-DC6D3AABD44F}	msiexec.exe
File created	C:\Windows\Installer\e57d021.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57d021.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID68F.tmp	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
2188	NVIDIA Notification.exe

Loads dropped DLL 6 IoCs

pid	Process
1364	MsiExec.exe
1364	MsiExec.exe
1364	MsiExec.exe
1364	MsiExec.exe
1364	MsiExec.exe
2188	NVIDIA Notification.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3120	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000074e11e240694ce490000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000074e11e240000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090074e11e24000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d74e11e24000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000074e11e2400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3632	msiexec.exe
3632	msiexec.exe
2188	NVIDIA Notification.exe
2188	NVIDIA Notification.exe
2188	NVIDIA Notification.exe
2188	NVIDIA Notification.exe
2188	NVIDIA Notification.exe
2188	NVIDIA Notification.exe
2188	NVIDIA Notification.exe
2188	NVIDIA Notification.exe

Suspicious use of AdjustPrivilegeToken 63 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3120	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3120	msiexec.exe
Token: SeSecurityPrivilege	3632	msiexec.exe
Token: SeCreateTokenPrivilege	3120	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3120	msiexec.exe
Token: SeLockMemoryPrivilege	3120	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3120	msiexec.exe
Token: SeMachineAccountPrivilege	3120	msiexec.exe
Token: SeTcbPrivilege	3120	msiexec.exe
Token: SeSecurityPrivilege	3120	msiexec.exe
Token: SeTakeOwnershipPrivilege	3120	msiexec.exe
Token: SeLoadDriverPrivilege	3120	msiexec.exe
Token: SeSystemProfilePrivilege	3120	msiexec.exe
Token: SeSystemtimePrivilege	3120	msiexec.exe
Token: SeProfSingleProcessPrivilege	3120	msiexec.exe
Token: SeIncBasePriorityPrivilege	3120	msiexec.exe
Token: SeCreatePagefilePrivilege	3120	msiexec.exe
Token: SeCreatePermanentPrivilege	3120	msiexec.exe
Token: SeBackupPrivilege	3120	msiexec.exe
Token: SeRestorePrivilege	3120	msiexec.exe
Token: SeShutdownPrivilege	3120	msiexec.exe
Token: SeDebugPrivilege	3120	msiexec.exe
Token: SeAuditPrivilege	3120	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3120	msiexec.exe
Token: SeChangeNotifyPrivilege	3120	msiexec.exe
Token: SeRemoteShutdownPrivilege	3120	msiexec.exe
Token: SeUndockPrivilege	3120	msiexec.exe
Token: SeSyncAgentPrivilege	3120	msiexec.exe
Token: SeEnableDelegationPrivilege	3120	msiexec.exe
Token: SeManageVolumePrivilege	3120	msiexec.exe
Token: SeImpersonatePrivilege	3120	msiexec.exe
Token: SeCreateGlobalPrivilege	3120	msiexec.exe
Token: SeBackupPrivilege	2104	vssvc.exe
Token: SeRestorePrivilege	2104	vssvc.exe
Token: SeAuditPrivilege	2104	vssvc.exe
Token: SeBackupPrivilege	3632	msiexec.exe
Token: SeRestorePrivilege	3632	msiexec.exe
Token: SeRestorePrivilege	3632	msiexec.exe
Token: SeTakeOwnershipPrivilege	3632	msiexec.exe
Token: SeRestorePrivilege	3632	msiexec.exe
Token: SeTakeOwnershipPrivilege	3632	msiexec.exe
Token: SeRestorePrivilege	3632	msiexec.exe
Token: SeTakeOwnershipPrivilege	3632	msiexec.exe
Token: SeRestorePrivilege	3632	msiexec.exe
Token: SeTakeOwnershipPrivilege	3632	msiexec.exe
Token: SeRestorePrivilege	3632	msiexec.exe
Token: SeTakeOwnershipPrivilege	3632	msiexec.exe
Token: SeRestorePrivilege	3632	msiexec.exe
Token: SeTakeOwnershipPrivilege	3632	msiexec.exe
Token: SeRestorePrivilege	3632	msiexec.exe
Token: SeTakeOwnershipPrivilege	3632	msiexec.exe
Token: SeRestorePrivilege	3632	msiexec.exe
Token: SeTakeOwnershipPrivilege	3632	msiexec.exe
Token: SeRestorePrivilege	3632	msiexec.exe
Token: SeTakeOwnershipPrivilege	3632	msiexec.exe
Token: SeBackupPrivilege	2272	srtasks.exe
Token: SeRestorePrivilege	2272	srtasks.exe
Token: SeSecurityPrivilege	2272	srtasks.exe
Token: SeTakeOwnershipPrivilege	2272	srtasks.exe
Token: SeBackupPrivilege	2272	srtasks.exe
Token: SeRestorePrivilege	2272	srtasks.exe
Token: SeSecurityPrivilege	2272	srtasks.exe
Token: SeTakeOwnershipPrivilege	2272	srtasks.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3120	msiexec.exe
3120	msiexec.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3468	Explorer.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 2272	3632	msiexec.exe	94
PID 3632 wrote to memory of 2272	3632	msiexec.exe	94
PID 3632 wrote to memory of 1364	3632	msiexec.exe	96
PID 3632 wrote to memory of 1364	3632	msiexec.exe	96
PID 3632 wrote to memory of 1364	3632	msiexec.exe	96
PID 3632 wrote to memory of 2188	3632	msiexec.exe	97
PID 3632 wrote to memory of 2188	3632	msiexec.exe	97
PID 2188 wrote to memory of 3468	2188	NVIDIA Notification.exe	56

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
PID:3468
- C:\Windows\system32\msiexec.exe
  msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\calma.msi
  2⤵
  - Blocklisted process makes network request
  - Enumerates connected drives
  - Event Triggered Execution: Installer Packages
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3120

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2272
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4EF8B0B98B306149E74373A103C2EFE9
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1364
- C:\Users\Admin\AppData\Roaming\nvidia\NVIDIA Notification.exe
  "C:\Users\Admin\AppData\Roaming\nvidia\NVIDIA Notification.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2188

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57d024.rbs

Filesize
2KB

MD5
4e7b2fa963f2649ce5056a588c78a406

SHA1
94735bbc107796d49f04f0cd503d66f1aaa4117c

SHA256
6545dd7dd6ad23f4ff12dea9ca56b79cd20a91cfdd2f3d675e503c39fd6820c7

SHA512
4e655856ed3ead92ee4f27db3533968b7e41cbb9bfc3b2e0a3ab93e58cf6189bd3798bcab202710fd4421c342ad614ce58c803d98e6ecd948ea66591c8c1d704

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_FD01465368E204AAEA741CF2D9C1BB6D

Filesize
1KB

MD5
2448a7a546dd3b47eb8e7452e78020e5

SHA1
1b919a8a76bedf23b8f99fd60afef6556e1a34ef

SHA256
4ae10bde30cf8761c5559719556e34b47f3f2315a681b9c21723c5cebebecf66

SHA512
cac35235cbadc10ca1166cd362e64355b95f77c0552e31bf6915b07c4908c6a715ebda23b7fc7168093cc74cfbccbc62a82c8f3be6d37a2a3a6d12b14a233547

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Filesize
1KB

MD5
5b135ca33a24494246272c8aabd2ea11

SHA1
f1b9f1817c5df9565991da201ca68a4b433ca023

SHA256
48caa23e7677b2e96ca11c1f7e3234c535b94e73040eae698337c4400022c28d

SHA512
5377d1960c655ad9bfdbcbd4134f9bc46127e9c77b66417288bc324c515f5c3e79e431cb11d062f999b29e517263dde5d75c4ea2a1177de70123959faa8ed795

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_FD01465368E204AAEA741CF2D9C1BB6D

Filesize
536B

MD5
4309d71f67a5c094472eb2d3f1ad5c6d

SHA1
d6dc226c27d15321e8a693a4ab295ac072f178fb

SHA256
aa699868ad7d7bfe7ef7661becb7a443cc4284e16f6422405e75f908b665a80b

SHA512
c6d346761f2210d5b733d2e3a2471a8b5a33e14ebbf3a9c8c1259523ea40ea646386703bab6da6d553a41f3acd85ba2cd8623f0b08910049965bbec424060484

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Filesize
536B

MD5
aded92a00bd5521bed3bd1ebc4b88796

SHA1
015aeb733e6f535f4d8bc903b18925edb55cf60c

SHA256
29605d84f5dbb9f191459ac65af3525c52580481885e98c1c4bdbb8c2848ee55

SHA512
3b5bfe295790e68c81262fca2f7d6d8c189ae4e261374aaa45a88a2045b3e8d1e3932876abdbacba2186528df1e97a00674fad3616e2c233cba4bf140e772401

Download Submit
C:\Users\Admin\AppData\Roaming\nvidia\NVIDIA Notification.exe

Filesize
3.2MB

MD5
07459a0b5f524ad62b5b5401133d4d55

SHA1
bcaec0c106f7f97c09618870e0d4868a156c93ec

SHA256
6c94c9d7e231523e06b41275ab208e42cdd39278f341123b066b05a0a6830e4d

SHA512
5133970b743eaa730e97baf9c4f52c05af469b880cd158900e62447daab45445112b41cc31c330fb90ee1e274d85e444ab86cfffc3e4fea7380d4217c446e9b5

Download Submit
C:\Users\Admin\AppData\Roaming\nvidia\libcef.dll

Filesize
3.2MB

MD5
c6bb7631c35b6a8fc21077ca49aa8559

SHA1
240d2d8e8da0bba108ee831bcc7a17a92d190db2

SHA256
6b3854e74a1ec9a70f14d124c9ae8456129c0b5968f3781b95e430940c64fad4

SHA512
1cc5f67413727ea12b0ff0c26ef822fe689b15c674ee4bb03789b949879cfd0f84ad76bd8b93db53ef35160c751344134fc36d8bb3995be658ca7c268bdada72

Download Submit
C:\Windows\Installer\MSID0FC.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSID2E3.tmp

Filesize
355KB

MD5
cac65e61b287555ea0e2a7f1aa0645cc

SHA1
0c93bdbfddd7e00ec30c81dbff8f3a1bfaf62519

SHA256
57c0d90010d3a476770c8085d2641cbf234b0ca47ec687ca4aabbf4db92df737

SHA512
e80076eb7e632e40f8dcb013b854a5825e7a19dd451505aa121a47a110032a1c571cd6d9e3e5aeacdb8f5897cb17ece4e65846b5d9080605e81176fe0811456a

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
3156e63ebf08a086ce6f2c374a06a40b

SHA1
d273c57f643f2f8b41ad0af3d2dc7f9220475622

SHA256
b14c0b55bf1fb38e77f620a9e24e39c70a10a7e20bfaf35ffde9b45621360224

SHA512
e4fb54dbfb48e68b5a5f032b6eae8b92f0456bd3fb10715a655c0ed6055ea383627414c6093a1cc09351bf95a83ca0c9df071b27df5b0ecbf7f95a90866e8fc9

Download Submit
\??\Volume{241ee174-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{0aeec951-28a6-4a3a-91de-184556c0d6b5}_OnDiskSnapshotProp

Filesize
6KB

MD5
44bf1a208699787f3872ad500fe52da5

SHA1
9b31f72972fda1c818e68a882e6add82a26bcca0

SHA256
587df0013b7f135bc740b1e092d1ece1a8aa3066f9c0491a6795ddeb51bb96af

SHA512
9331be44021aa242b5ca737d296ab6a7735682060d1845f848a822c583fef565b76ef9a5321bb3693308fa3a79f44eb827e8148dbcf4638f53d66b0dba50f41e

Download Submit
memory/2188-95-0x0000022A23850000-0x0000022A2389B000-memory.dmp

Filesize
300KB

Download
memory/2188-75-0x00007FFC0C560000-0x00007FFC0C578000-memory.dmp

Filesize
96KB

Download
memory/2188-78-0x0000022A22FF0000-0x0000022A2303B000-memory.dmp

Filesize
300KB

Download
memory/2188-79-0x0000022A23090000-0x0000022A230DB000-memory.dmp

Filesize
300KB

Download
memory/2188-80-0x0000022A230E0000-0x0000022A2312C000-memory.dmp

Filesize
304KB

Download
memory/2188-89-0x0000022A23180000-0x0000022A231CB000-memory.dmp

Filesize
300KB

Download
memory/2188-90-0x00000003A6450000-0x00000003A649B000-memory.dmp

Filesize
300KB

Download
memory/2188-91-0x0000022A23220000-0x0000022A2326B000-memory.dmp

Filesize
300KB

Download
memory/2188-92-0x0000022A23600000-0x0000022A2364B000-memory.dmp

Filesize
300KB

Download
memory/2188-93-0x0000022A236A0000-0x0000022A236EB000-memory.dmp

Filesize
300KB

Download
memory/2188-94-0x0000022A23750000-0x0000022A2379B000-memory.dmp

Filesize
300KB

Download
memory/2188-76-0x0000022A22F60000-0x0000022A22F9E000-memory.dmp

Filesize
248KB

Download
memory/2188-96-0x0000022A23910000-0x0000022A2395B000-memory.dmp

Filesize
300KB

Download
memory/2188-97-0x0000022A239C0000-0x0000022A23A0B000-memory.dmp

Filesize
300KB

Download
memory/2188-101-0x0000022A23BC0000-0x0000022A23C0B000-memory.dmp

Filesize
300KB

Download
memory/2188-102-0x0000022A23C70000-0x0000022A23CBB000-memory.dmp

Filesize
300KB

Download
memory/2188-106-0x0000022A23D20000-0x0000022A23D6B000-memory.dmp

Filesize
300KB

Download
memory/2188-77-0x00000003A6450000-0x00000003A649B000-memory.dmp

Filesize
300KB

Download
memory/2188-73-0x00000003A6450000-0x00000003A649B000-memory.dmp

Filesize
300KB

Download
memory/2188-112-0x0000022A23FD0000-0x0000022A2401B000-memory.dmp

Filesize
300KB

Download
memory/2188-113-0x00007FF46C190000-0x00007FF46C191000-memory.dmp

Filesize
4KB

Download
memory/2188-114-0x00007FF46C170000-0x00007FF46C185000-memory.dmp

Filesize
84KB

Download
memory/2188-118-0x00007FF46C130000-0x00007FF46C131000-memory.dmp

Filesize
4KB

Download
memory/2188-133-0x0000022A22EE0000-0x0000022A22F2B000-memory.dmp

Filesize
300KB

Download
memory/2188-117-0x00007FF46C140000-0x00007FF46C141000-memory.dmp

Filesize
4KB

Download
memory/2188-116-0x00007FF46C150000-0x00007FF46C151000-memory.dmp

Filesize
4KB

Download
memory/2188-115-0x00007FF46C160000-0x00007FF46C161000-memory.dmp

Filesize
4KB

Download
memory/2188-132-0x0000022A22E30000-0x0000022A22E7B000-memory.dmp

Filesize
300KB

Download
memory/2188-123-0x0000022A22C20000-0x0000022A22C6B000-memory.dmp

Filesize
300KB

Download
memory/2188-124-0x0000022A230E0000-0x0000022A2312C000-memory.dmp

Filesize
304KB

Download
memory/2188-129-0x0000022A22CD0000-0x0000022A22D1B000-memory.dmp

Filesize
300KB

Download
memory/2188-130-0x0000022A22D80000-0x0000022A22DCB000-memory.dmp

Filesize
300KB

Download
memory/3468-120-0x0000000002B20000-0x0000000002B35000-memory.dmp

Filesize
84KB

Download
memory/3468-119-0x0000000002B20000-0x0000000002B35000-memory.dmp

Filesize
84KB

Download