9acec82250082db98a156292e9aebc2ba22ae177f8003fe29d7e59b220e14ebc

Analysis

max time kernel
225s
max time network
294s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
28/03/2025, 13:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SuperViewer Installer/Volume/bin/p5/NI_De00/dep_framework.msi
Size

1.1MB
MD5

55d5c4ab6bb3723fbb450971aefebc2f
SHA1

4d21101af885150e2a10d461a832339c65326c87
SHA256

a83222da56d1a314a6cbf3a606518ede0f262d4f02556be8f35ead7d9a946f8c
SHA512

5bf7ccd73066d59958accae4235bfd5e97036be1bb4bdaa44de49090f23171013ec71a3085602c9dfa1078b9b5faf523ea7b4609df3bc040f81ec1b515ce5412
SSDEEP

24576:NFAtbRo/3Gf5IhM+TQNxshTK+63S3ZgTqGgeSZUf/:NFAtbX5cC2PJg6Uf

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\National Instruments\Shared\DeploymentFramework\nidp_target_end.dll	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\DeploymentFramework\nidp_host_end.dll	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\_Legal Information\NI LabVIEW 2019 Deployment Framework 19.00.49152 {2D235EC4-446F-4CD5-8516-6BC1AC99F2F2}\notice.txt	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\MDF\Manifests\NI LabVIEW 2019 Deployment Framework {2D235EC4-446F-4CD5-8516-6BC1AC99F2F2}.xml	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\WinMIF\ni-deployment-framework-x86_19.0.0.49152-0+f0_wind {2D235EC4-446F-4CD5-8516-6BC1AC99F2F2}.control	msiexec.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e584997.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4B0F.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF064BAFD6BDEF0EA9.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{2D235EC4-446F-4CD5-8516-6BC1AC99F2F2}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAC77B2D67E7518E5.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4D18.tmp	msiexec.exe
File created	C:\Windows\Installer\e584997.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI49E5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4BBD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4C2D.tmp	msiexec.exe
File created	C:\Windows\Installer\e584999.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF436B134EDD855F0B.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF56C30CD08B31B909.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4BDD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4B3F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4BFD.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Loads dropped DLL 11 IoCs

pid	Process
2272	MsiExec.exe
2272	MsiExec.exe
2272	MsiExec.exe
2272	MsiExec.exe
4872	MsiExec.exe
4872	MsiExec.exe
4872	MsiExec.exe
4872	MsiExec.exe
4872	MsiExec.exe
4872	MsiExec.exe
4872	MsiExec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000003c9263343ee389390000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800003c9263340000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809003c926334000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d3c926334000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000003c92633400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 25 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4E249838C37BE294183AAAE192F10DCD	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4CE532D2F6445DC45861B61CCA992F2F\SourceList\PackageName = "dep_framework.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4CE532D2F6445DC45861B61CCA992F2F\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4CE532D2F6445DC45861B61CCA992F2F\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4CE532D2F6445DC45861B61CCA992F2F	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4CE532D2F6445DC45861B61CCA992F2F\Language = "9"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4CE532D2F6445DC45861B61CCA992F2F\Version = "318816256"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4CE532D2F6445DC45861B61CCA992F2F\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4CE532D2F6445DC45861B61CCA992F2F\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4CE532D2F6445DC45861B61CCA992F2F\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4CE532D2F6445DC45861B61CCA992F2F\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4CE532D2F6445DC45861B61CCA992F2F\lvrt_DEP.LVRT.DEP.2019	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4CE532D2F6445DC45861B61CCA992F2F\NIMUFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4CE532D2F6445DC45861B61CCA992F2F\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4CE532D2F6445DC45861B61CCA992F2F\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SuperViewer Installer\\Volume\\bin\\p5\\NI_De00\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4CE532D2F6445DC45861B61CCA992F2F\SourceList\Media\2 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4CE532D2F6445DC45861B61CCA992F2F	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4CE532D2F6445DC45861B61CCA992F2F\ProductName = "NI LabVIEW 2019 Deployment Framework"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4CE532D2F6445DC45861B61CCA992F2F\PackageCode = "B51A9416D78D19D4BB2F33D50D7A8E0F"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4CE532D2F6445DC45861B61CCA992F2F\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4E249838C37BE294183AAAE192F10DCD\4CE532D2F6445DC45861B61CCA992F2F	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4CE532D2F6445DC45861B61CCA992F2F\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4CE532D2F6445DC45861B61CCA992F2F\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4CE532D2F6445DC45861B61CCA992F2F\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\SuperViewer Installer\\Volume\\bin\\p5\\NI_De00\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4CE532D2F6445DC45861B61CCA992F2F\Assignment = "1"	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3528	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3528	msiexec.exe
Token: SeSecurityPrivilege	4808	msiexec.exe
Token: SeCreateTokenPrivilege	3528	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3528	msiexec.exe
Token: SeLockMemoryPrivilege	3528	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3528	msiexec.exe
Token: SeMachineAccountPrivilege	3528	msiexec.exe
Token: SeTcbPrivilege	3528	msiexec.exe
Token: SeSecurityPrivilege	3528	msiexec.exe
Token: SeTakeOwnershipPrivilege	3528	msiexec.exe
Token: SeLoadDriverPrivilege	3528	msiexec.exe
Token: SeSystemProfilePrivilege	3528	msiexec.exe
Token: SeSystemtimePrivilege	3528	msiexec.exe
Token: SeProfSingleProcessPrivilege	3528	msiexec.exe
Token: SeIncBasePriorityPrivilege	3528	msiexec.exe
Token: SeCreatePagefilePrivilege	3528	msiexec.exe
Token: SeCreatePermanentPrivilege	3528	msiexec.exe
Token: SeBackupPrivilege	3528	msiexec.exe
Token: SeRestorePrivilege	3528	msiexec.exe
Token: SeShutdownPrivilege	3528	msiexec.exe
Token: SeDebugPrivilege	3528	msiexec.exe
Token: SeAuditPrivilege	3528	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3528	msiexec.exe
Token: SeChangeNotifyPrivilege	3528	msiexec.exe
Token: SeRemoteShutdownPrivilege	3528	msiexec.exe
Token: SeUndockPrivilege	3528	msiexec.exe
Token: SeSyncAgentPrivilege	3528	msiexec.exe
Token: SeEnableDelegationPrivilege	3528	msiexec.exe
Token: SeManageVolumePrivilege	3528	msiexec.exe
Token: SeImpersonatePrivilege	3528	msiexec.exe
Token: SeCreateGlobalPrivilege	3528	msiexec.exe
Token: SeCreateTokenPrivilege	3528	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3528	msiexec.exe
Token: SeLockMemoryPrivilege	3528	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3528	msiexec.exe
Token: SeMachineAccountPrivilege	3528	msiexec.exe
Token: SeTcbPrivilege	3528	msiexec.exe
Token: SeSecurityPrivilege	3528	msiexec.exe
Token: SeTakeOwnershipPrivilege	3528	msiexec.exe
Token: SeLoadDriverPrivilege	3528	msiexec.exe
Token: SeSystemProfilePrivilege	3528	msiexec.exe
Token: SeSystemtimePrivilege	3528	msiexec.exe
Token: SeProfSingleProcessPrivilege	3528	msiexec.exe
Token: SeIncBasePriorityPrivilege	3528	msiexec.exe
Token: SeCreatePagefilePrivilege	3528	msiexec.exe
Token: SeCreatePermanentPrivilege	3528	msiexec.exe
Token: SeBackupPrivilege	3528	msiexec.exe
Token: SeRestorePrivilege	3528	msiexec.exe
Token: SeShutdownPrivilege	3528	msiexec.exe
Token: SeDebugPrivilege	3528	msiexec.exe
Token: SeAuditPrivilege	3528	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3528	msiexec.exe
Token: SeChangeNotifyPrivilege	3528	msiexec.exe
Token: SeRemoteShutdownPrivilege	3528	msiexec.exe
Token: SeUndockPrivilege	3528	msiexec.exe
Token: SeSyncAgentPrivilege	3528	msiexec.exe
Token: SeEnableDelegationPrivilege	3528	msiexec.exe
Token: SeManageVolumePrivilege	3528	msiexec.exe
Token: SeImpersonatePrivilege	3528	msiexec.exe
Token: SeCreateGlobalPrivilege	3528	msiexec.exe
Token: SeCreateTokenPrivilege	3528	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3528	msiexec.exe
Token: SeLockMemoryPrivilege	3528	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3528	msiexec.exe
3528	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 2272	4808	msiexec.exe	84
PID 4808 wrote to memory of 2272	4808	msiexec.exe	84
PID 4808 wrote to memory of 2272	4808	msiexec.exe	84
PID 4808 wrote to memory of 2464	4808	msiexec.exe	88
PID 4808 wrote to memory of 2464	4808	msiexec.exe	88
PID 4808 wrote to memory of 4872	4808	msiexec.exe	90
PID 4808 wrote to memory of 4872	4808	msiexec.exe	90
PID 4808 wrote to memory of 4872	4808	msiexec.exe	90

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\SuperViewer Installer\Volume\bin\p5\NI_De00\dep_framework.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3528

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C993D2F9BD8FA08A8D80368BFB9AA9B3 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2272
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2464
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 87861B09A239FD4F9D09E93C2209D2BD
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4872

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e584998.rbs

Filesize
13KB

MD5
d85fb7d4eb69cdc890de09edad1c4ff8

SHA1
f09b555383801ffff8f6f8d311b1c8511c91fbf7

SHA256
7c497e526f105005cb70d344b317078e3a00cd3c2bf5e6abe4be33c93ffa7f97

SHA512
1ebc5d64d69b6abb9a736e027eacfd1b920bd33d2350dd0c954d7783cdfe422850b8f67aacaa931e310b597e48f46297114a42e96dc60ed60595d737aa5e0483

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9AC9.tmp

Filesize
639KB

MD5
c6417930af8969f9f2cb431acd76ec89

SHA1
d2f2dc9b44f5f79348f7f36091b26a5465ad4f2b

SHA256
1b89704532113150fc7a8a06b5367ee26937c346635a860e93662e1fbb5cd79b

SHA512
f30d7a5b51f5d866ccabf3e15a45d3b4013e28a9bdaaf2176e8b121fbd4ab41a8e67c059b2ece8db5bc7a0ce043e76bbc4e3f6400fb9cd2886e1ffcd9e65d79b

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.6MB

MD5
09d536e2e279078e9f40c54cd857444f

SHA1
8a72d96d690328f9982f67c57f28839434882684

SHA256
9eba8017b8aed7a20cef86041a71f940600ee075f455f964029f81d74ae0dbd0

SHA512
ab0a3600f9f5f58a650089b80dd34ef786189ad415841573ce5e1b3cda44a624c985ffadc21a7234a87d2e6979784f853941473385aa252e38e38d64104fb2f2

Download Submit
\??\Volume{3463923c-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{d4eb06e3-6227-411c-860b-3d42f59b5de0}_OnDiskSnapshotProp

Filesize
6KB

MD5
c255c624e4fc3e50acf4cd95a086a45c

SHA1
19187a226af72373ed0c31d7ef237d58ae700821

SHA256
611468937355fd461eb9f257706877c54ab7304a1cb6b8aad2954310491fc0e2

SHA512
4c6b26d1c07272ff95ab0558224e4b6afe6df24a1b5f129474e06a18f73f680db94f631cfb569f9e77a1481407b542c5d80e18ba82e2b9e4ebaeff04be7e8607

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads