9acec82250082db98a156292e9aebc2ba22ae177f8003fe29d7e59b220e14ebc

Analysis

max time kernel
238s
max time network
284s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
28/03/2025, 13:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SuperViewer Installer/Volume/bin/p16/nicurl.msi
Size

1.1MB
MD5

064917d761d31bac6725c5225e864da6
SHA1

f0831767c8d4ad641a671098558e2f078ef0779d
SHA256

7cea8ed04cb65fa7898b32a9211a667e11460c83769d6d05d3bf84634a558529
SHA512

bc6fa003936f3a910012d5f450f7a57498b902c4bdc036aac5213cd382cb539fad6679c8b5e1cedb904e819d679fafd398cf5ac3b9fe1dde192352b551b43024
SSDEEP

24576:zFzxtmKo/3GfI+TQNxshTK+63S3ZgTqGgeSZUf/:zF9tm4pC2PJg6Uf

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Merge Modules\nicurl.msm	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\nicurl\ca-bundle.crt	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Merge Modules\nicurl64.msm	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\_Legal Information\NI Curl 2019 19.00.49152 {B29007A1-E053-46E4-8A51-6803638AF06D}\notice.txt	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\MDF\Manifests\NI Curl 2019 {B29007A1-E053-46E4-8A51-6803638AF06D}.xml	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\WinMIF\ni-curl_19.0.0.49152-0+f0_windows_all {B29007A1-E053-46E4-8A51-6803638AF06D}.control	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\nicurl\curlimpl.dll	msiexec.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI879A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAE51D38CF5C42071.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBC9965304FA97ED2.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8A30.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8866.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8952.tmp	msiexec.exe
File created	C:\Windows\Installer\e58873e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8ABE.tmp	msiexec.exe
File created	C:\Windows\Installer\e58873c.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8877.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8964.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD191F0A99B55C2E3.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC30D3D4249229739.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e58873c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8953.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B29007A1-E053-46E4-8A51-6803638AF06D}	msiexec.exe

Loads dropped DLL 11 IoCs

pid	Process
5540	MsiExec.exe
5540	MsiExec.exe
5540	MsiExec.exe
5540	MsiExec.exe
2740	MsiExec.exe
2740	MsiExec.exe
2740	MsiExec.exe
2740	MsiExec.exe
2740	MsiExec.exe
2740	MsiExec.exe
2740	MsiExec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000016c72ef864aebe750000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000016c72ef80000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090016c72ef8000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d16c72ef8000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000016c72ef800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 25 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A70092B350E4E64A815863036A80FD6\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A70092B350E4E64A815863036A80FD6\PackageCode = "6AAD30FBE430FA644B37F9AD5F416E45"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A70092B350E4E64A815863036A80FD6\Language = "9"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\339BDD8FD5A68154EA1A2F1514E19DA8	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A70092B350E4E64A815863036A80FD6\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A70092B350E4E64A815863036A80FD6\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SuperViewer Installer\\Volume\\bin\\p16\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A70092B350E4E64A815863036A80FD6\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1A70092B350E4E64A815863036A80FD6	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A70092B350E4E64A815863036A80FD6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A70092B350E4E64A815863036A80FD6\ProductName = "NI Curl 2019"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A70092B350E4E64A815863036A80FD6\Version = "318816256"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A70092B350E4E64A815863036A80FD6\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\339BDD8FD5A68154EA1A2F1514E19DA8\1A70092B350E4E64A815863036A80FD6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A70092B350E4E64A815863036A80FD6\SourceList\PackageName = "nicurl.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A70092B350E4E64A815863036A80FD6\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A70092B350E4E64A815863036A80FD6\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A70092B350E4E64A815863036A80FD6\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A70092B350E4E64A815863036A80FD6\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A70092B350E4E64A815863036A80FD6\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A70092B350E4E64A815863036A80FD6\SourceList\Media\2 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A70092B350E4E64A815863036A80FD6\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A70092B350E4E64A815863036A80FD6\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\SuperViewer Installer\\Volume\\bin\\p16\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1A70092B350E4E64A815863036A80FD6\nicurl.NI.CURL.2019	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1A70092B350E4E64A815863036A80FD6\NIMUFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1A70092B350E4E64A815863036A80FD6\AdvertiseFlags = "388"	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3084	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3084	msiexec.exe
Token: SeSecurityPrivilege	3236	msiexec.exe
Token: SeCreateTokenPrivilege	3084	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3084	msiexec.exe
Token: SeLockMemoryPrivilege	3084	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3084	msiexec.exe
Token: SeMachineAccountPrivilege	3084	msiexec.exe
Token: SeTcbPrivilege	3084	msiexec.exe
Token: SeSecurityPrivilege	3084	msiexec.exe
Token: SeTakeOwnershipPrivilege	3084	msiexec.exe
Token: SeLoadDriverPrivilege	3084	msiexec.exe
Token: SeSystemProfilePrivilege	3084	msiexec.exe
Token: SeSystemtimePrivilege	3084	msiexec.exe
Token: SeProfSingleProcessPrivilege	3084	msiexec.exe
Token: SeIncBasePriorityPrivilege	3084	msiexec.exe
Token: SeCreatePagefilePrivilege	3084	msiexec.exe
Token: SeCreatePermanentPrivilege	3084	msiexec.exe
Token: SeBackupPrivilege	3084	msiexec.exe
Token: SeRestorePrivilege	3084	msiexec.exe
Token: SeShutdownPrivilege	3084	msiexec.exe
Token: SeDebugPrivilege	3084	msiexec.exe
Token: SeAuditPrivilege	3084	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3084	msiexec.exe
Token: SeChangeNotifyPrivilege	3084	msiexec.exe
Token: SeRemoteShutdownPrivilege	3084	msiexec.exe
Token: SeUndockPrivilege	3084	msiexec.exe
Token: SeSyncAgentPrivilege	3084	msiexec.exe
Token: SeEnableDelegationPrivilege	3084	msiexec.exe
Token: SeManageVolumePrivilege	3084	msiexec.exe
Token: SeImpersonatePrivilege	3084	msiexec.exe
Token: SeCreateGlobalPrivilege	3084	msiexec.exe
Token: SeCreateTokenPrivilege	3084	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3084	msiexec.exe
Token: SeLockMemoryPrivilege	3084	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3084	msiexec.exe
Token: SeMachineAccountPrivilege	3084	msiexec.exe
Token: SeTcbPrivilege	3084	msiexec.exe
Token: SeSecurityPrivilege	3084	msiexec.exe
Token: SeTakeOwnershipPrivilege	3084	msiexec.exe
Token: SeLoadDriverPrivilege	3084	msiexec.exe
Token: SeSystemProfilePrivilege	3084	msiexec.exe
Token: SeSystemtimePrivilege	3084	msiexec.exe
Token: SeProfSingleProcessPrivilege	3084	msiexec.exe
Token: SeIncBasePriorityPrivilege	3084	msiexec.exe
Token: SeCreatePagefilePrivilege	3084	msiexec.exe
Token: SeCreatePermanentPrivilege	3084	msiexec.exe
Token: SeBackupPrivilege	3084	msiexec.exe
Token: SeRestorePrivilege	3084	msiexec.exe
Token: SeShutdownPrivilege	3084	msiexec.exe
Token: SeDebugPrivilege	3084	msiexec.exe
Token: SeAuditPrivilege	3084	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3084	msiexec.exe
Token: SeChangeNotifyPrivilege	3084	msiexec.exe
Token: SeRemoteShutdownPrivilege	3084	msiexec.exe
Token: SeUndockPrivilege	3084	msiexec.exe
Token: SeSyncAgentPrivilege	3084	msiexec.exe
Token: SeEnableDelegationPrivilege	3084	msiexec.exe
Token: SeManageVolumePrivilege	3084	msiexec.exe
Token: SeImpersonatePrivilege	3084	msiexec.exe
Token: SeCreateGlobalPrivilege	3084	msiexec.exe
Token: SeCreateTokenPrivilege	3084	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3084	msiexec.exe
Token: SeLockMemoryPrivilege	3084	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3084	msiexec.exe
3084	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 5540	3236	msiexec.exe	84
PID 3236 wrote to memory of 5540	3236	msiexec.exe	84
PID 3236 wrote to memory of 5540	3236	msiexec.exe	84
PID 3236 wrote to memory of 3304	3236	msiexec.exe	88
PID 3236 wrote to memory of 3304	3236	msiexec.exe	88
PID 3236 wrote to memory of 2740	3236	msiexec.exe	90
PID 3236 wrote to memory of 2740	3236	msiexec.exe	90
PID 3236 wrote to memory of 2740	3236	msiexec.exe	90

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\SuperViewer Installer\Volume\bin\p16\nicurl.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3084

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5C2418C69519F0BE896502DC3C59AEBB C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5540
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3304
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A5C951ED966B4DD6C52C99A3179875CA
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2740

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e58873d.rbs

Filesize
14KB

MD5
496aca7793f29a139203b1b5d976fc0f

SHA1
99f881b2cf2bdf33a91fde2a7bff91277cc09b11

SHA256
35839c646bdf5d5ea83977efa3675be055fd6fc70eee404a2a9465ca7a8c02d7

SHA512
6691bb05077934b6f005c66378a40dfc7e91053024ddb64d40aa569d8b2c3c9c0d1580ac96ce6c5d2c1cc60c18b6fe762457d21205ac54ffc0990392d4ee70ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSICCB6.tmp

Filesize
639KB

MD5
c6417930af8969f9f2cb431acd76ec89

SHA1
d2f2dc9b44f5f79348f7f36091b26a5465ad4f2b

SHA256
1b89704532113150fc7a8a06b5367ee26937c346635a860e93662e1fbb5cd79b

SHA512
f30d7a5b51f5d866ccabf3e15a45d3b4013e28a9bdaaf2176e8b121fbd4ab41a8e67c059b2ece8db5bc7a0ce043e76bbc4e3f6400fb9cd2886e1ffcd9e65d79b

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.6MB

MD5
aeb1c41859642460d315d307bc31944d

SHA1
3fc284689cbcb4c3bcbf630779f4662b7055d846

SHA256
74f2f69c4672d0ff4506d6abda7f9471b644c5b5756b18cb75e3f799e690c68a

SHA512
a87021355e14f6c736fdbf80c65737a59ff6788acdafbf0f6c288c293d0427da7e95d32a640cda64cae9dccccebfc70c97c31ac886cecfc32c6869980fea2f64

Download Submit
\??\Volume{f82ec716-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{b5218742-8c52-4c19-8858-0c4219268e87}_OnDiskSnapshotProp

Filesize
6KB

MD5
c060ba261eb0357a0cddf429a0503071

SHA1
cf7aafaf01949a1b17b7484afc00f0e3557ba86c

SHA256
a0c7f895580a714eebf925a245edcc92947635f6c3cb60a2f4b5eb72cd7a8da4

SHA512
0af5e743cdafaa7ecafaa3cbdbaf09742650b52fc675c5ef0a78c5348cd394fca210241a0400d52563382ec0a930e567e546406459f8c3dbb6a09eb0f7e90f53

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads