9acec82250082db98a156292e9aebc2ba22ae177f8003fe29d7e59b220e14ebc

Analysis

max time kernel
262s
max time network
295s
platform
windows11-21h2_x64
resource
win11-20250314-en
resource tags

arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system
submitted
28/03/2025, 13:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SuperViewer Installer/Volume/bin/p7/NITraceEngine64.msi
Size

1.1MB
MD5

256e488451e0a22b2570563c36459b89
SHA1

3d2f3a1b37cd6f3c9008060eae2784062055d3f2
SHA256

b2939b052ae15c65b489da856d680b8b883ce3c4f6cff4bd07bad4823e7129cc
SHA512

00d7dcc380f00b22594481962f5436c410db1be25c1834f65adef0c329e4f00047b3dbfd7c7e1213495bfba31d616bfecdc9112bacd8c4206e7ea1a070dd5c7e
SSDEEP

24576:NFltFHXo/3G1aY+TQNxshTK+63S3ZgTqGgeSZUf/:NFltxTuC2PJg6Uf

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\National Instruments\Shared\TraceEngine\ni_traceengine.dll	msiexec.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DFAE01C1901C87A69A.TMP	msiexec.exe
File created	C:\Windows\Installer\e582527.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI276C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI278D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e582529.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI277C.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{4858AE0F-D4FB-441E-9BB8-442115A9D282}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI28B8.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7340FC5B29FD0F53.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF87B1D0D132BBC407.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2594.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI270C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e582527.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI271D.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEF6C09770BA72F59.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI27BD.tmp	msiexec.exe

Loads dropped DLL 11 IoCs

pid	Process
5032	MsiExec.exe
5032	MsiExec.exe
5032	MsiExec.exe
5032	MsiExec.exe
2288	MsiExec.exe
2288	MsiExec.exe
2288	MsiExec.exe
2288	MsiExec.exe
2288	MsiExec.exe
2288	MsiExec.exe
2288	MsiExec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000059a4098a21d1e3e30000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000059a4098a0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090059a4098a000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d59a4098a000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000059a4098a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0EA8584BF4DE144B98B4412519A2D28\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\SuperViewer Installer\\Volume\\bin\\p7\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0EA8584BF4DE144B98B4412519A2D28\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8CED14F92CB7CB64BB68DB67AF42BAA3	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8CED14F92CB7CB64BB68DB67AF42BAA3\F0EA8584BF4DE144B98B4412519A2D28	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0EA8584BF4DE144B98B4412519A2D28\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0EA8584BF4DE144B98B4412519A2D28\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F0EA8584BF4DE144B98B4412519A2D28\NIMUFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0EA8584BF4DE144B98B4412519A2D28\PackageCode = "750B34420CE816A47BF2474E7A164EF5"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0EA8584BF4DE144B98B4412519A2D28\Language = "9"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0EA8584BF4DE144B98B4412519A2D28\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F0EA8584BF4DE144B98B4412519A2D28\TraceEngine64.LV.TRCENG64.2019	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0EA8584BF4DE144B98B4412519A2D28	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0EA8584BF4DE144B98B4412519A2D28\ProductName = "NI Trace Engine (64-bit)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0EA8584BF4DE144B98B4412519A2D28\Version = "318816256"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0EA8584BF4DE144B98B4412519A2D28\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SuperViewer Installer\\Volume\\bin\\p7\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0EA8584BF4DE144B98B4412519A2D28\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0EA8584BF4DE144B98B4412519A2D28\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F0EA8584BF4DE144B98B4412519A2D28	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0EA8584BF4DE144B98B4412519A2D28\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0EA8584BF4DE144B98B4412519A2D28\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0EA8584BF4DE144B98B4412519A2D28\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0EA8584BF4DE144B98B4412519A2D28\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0EA8584BF4DE144B98B4412519A2D28\SourceList\PackageName = "NITraceEngine64.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0EA8584BF4DE144B98B4412519A2D28\Clients = 3a0000000000	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4880	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4880	msiexec.exe
Token: SeSecurityPrivilege	4940	msiexec.exe
Token: SeCreateTokenPrivilege	4880	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4880	msiexec.exe
Token: SeLockMemoryPrivilege	4880	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4880	msiexec.exe
Token: SeMachineAccountPrivilege	4880	msiexec.exe
Token: SeTcbPrivilege	4880	msiexec.exe
Token: SeSecurityPrivilege	4880	msiexec.exe
Token: SeTakeOwnershipPrivilege	4880	msiexec.exe
Token: SeLoadDriverPrivilege	4880	msiexec.exe
Token: SeSystemProfilePrivilege	4880	msiexec.exe
Token: SeSystemtimePrivilege	4880	msiexec.exe
Token: SeProfSingleProcessPrivilege	4880	msiexec.exe
Token: SeIncBasePriorityPrivilege	4880	msiexec.exe
Token: SeCreatePagefilePrivilege	4880	msiexec.exe
Token: SeCreatePermanentPrivilege	4880	msiexec.exe
Token: SeBackupPrivilege	4880	msiexec.exe
Token: SeRestorePrivilege	4880	msiexec.exe
Token: SeShutdownPrivilege	4880	msiexec.exe
Token: SeDebugPrivilege	4880	msiexec.exe
Token: SeAuditPrivilege	4880	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4880	msiexec.exe
Token: SeChangeNotifyPrivilege	4880	msiexec.exe
Token: SeRemoteShutdownPrivilege	4880	msiexec.exe
Token: SeUndockPrivilege	4880	msiexec.exe
Token: SeSyncAgentPrivilege	4880	msiexec.exe
Token: SeEnableDelegationPrivilege	4880	msiexec.exe
Token: SeManageVolumePrivilege	4880	msiexec.exe
Token: SeImpersonatePrivilege	4880	msiexec.exe
Token: SeCreateGlobalPrivilege	4880	msiexec.exe
Token: SeCreateTokenPrivilege	4880	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4880	msiexec.exe
Token: SeLockMemoryPrivilege	4880	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4880	msiexec.exe
Token: SeMachineAccountPrivilege	4880	msiexec.exe
Token: SeTcbPrivilege	4880	msiexec.exe
Token: SeSecurityPrivilege	4880	msiexec.exe
Token: SeTakeOwnershipPrivilege	4880	msiexec.exe
Token: SeLoadDriverPrivilege	4880	msiexec.exe
Token: SeSystemProfilePrivilege	4880	msiexec.exe
Token: SeSystemtimePrivilege	4880	msiexec.exe
Token: SeProfSingleProcessPrivilege	4880	msiexec.exe
Token: SeIncBasePriorityPrivilege	4880	msiexec.exe
Token: SeCreatePagefilePrivilege	4880	msiexec.exe
Token: SeCreatePermanentPrivilege	4880	msiexec.exe
Token: SeBackupPrivilege	4880	msiexec.exe
Token: SeRestorePrivilege	4880	msiexec.exe
Token: SeShutdownPrivilege	4880	msiexec.exe
Token: SeDebugPrivilege	4880	msiexec.exe
Token: SeAuditPrivilege	4880	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4880	msiexec.exe
Token: SeChangeNotifyPrivilege	4880	msiexec.exe
Token: SeRemoteShutdownPrivilege	4880	msiexec.exe
Token: SeUndockPrivilege	4880	msiexec.exe
Token: SeSyncAgentPrivilege	4880	msiexec.exe
Token: SeEnableDelegationPrivilege	4880	msiexec.exe
Token: SeManageVolumePrivilege	4880	msiexec.exe
Token: SeImpersonatePrivilege	4880	msiexec.exe
Token: SeCreateGlobalPrivilege	4880	msiexec.exe
Token: SeCreateTokenPrivilege	4880	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4880	msiexec.exe
Token: SeLockMemoryPrivilege	4880	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4880	msiexec.exe
4880	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 5032	4940	msiexec.exe	86
PID 4940 wrote to memory of 5032	4940	msiexec.exe	86
PID 4940 wrote to memory of 5032	4940	msiexec.exe	86
PID 4940 wrote to memory of 4576	4940	msiexec.exe	90
PID 4940 wrote to memory of 4576	4940	msiexec.exe	90
PID 4940 wrote to memory of 2288	4940	msiexec.exe	92
PID 4940 wrote to memory of 2288	4940	msiexec.exe	92
PID 4940 wrote to memory of 2288	4940	msiexec.exe	92

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\SuperViewer Installer\Volume\bin\p7\NITraceEngine64.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4880

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 661C93FB6C87074D970B3D45E6A32099 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5032
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4576
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 43737AEF4075825C30415A7A7AE4457D
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2288

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e582528.rbs

Filesize
9KB

MD5
c4ad10786319b5af505a05f37fa2ede9

SHA1
0a7cf14cb92a092596314b18e18ea57ec17c2475

SHA256
ccb7881ac2af7dda66e80c13238c6d769e155571359f12e24b747b0603ed080b

SHA512
3185dd8ddc905a80af40d90c0d9a76d096f2cb726f33ddd59bc1ddc32983f824607e1727dc5cb2184d372862621963a8b233e721abe1fcdf4a034fc4569e9b24

Download Submit
C:\ProgramData\National Instruments\Trace Logs\traceengine.ini

Filesize
453B

MD5
3a6fda6210e0b4f5fd17a9d2948515bd

SHA1
9275e51c08940794667c1e0fc3608fad32768b5e

SHA256
f83976a41473986d6d6b1ddc8385fa698a300698690650d9c0eabab024c1be08

SHA512
32aa28944a0741ed597b493b6ef5c7bd2f095a678fc2839169e0466b9ff06f5e3b658c9b675a92cef6badd8d5c99281e9715e8635e70a0ece7be7caeb0f51954

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI7ACD.tmp

Filesize
639KB

MD5
c6417930af8969f9f2cb431acd76ec89

SHA1
d2f2dc9b44f5f79348f7f36091b26a5465ad4f2b

SHA256
1b89704532113150fc7a8a06b5367ee26937c346635a860e93662e1fbb5cd79b

SHA512
f30d7a5b51f5d866ccabf3e15a45d3b4013e28a9bdaaf2176e8b121fbd4ab41a8e67c059b2ece8db5bc7a0ce043e76bbc4e3f6400fb9cd2886e1ffcd9e65d79b

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.6MB

MD5
621ea6a3793dc6d42a4c070d5fc54d40

SHA1
f9f5d8ef3f6ebc3f401ba59029d76125e15f9a19

SHA256
b5b79ec74771f748ce1387940bc6f6f67635fa9a92b48cf255f17b4b1e5590ab

SHA512
9548dcdf92b847884456f92ac38e0bf26ca19472c748fb4e113f11c88f7b803d85007ce7231674400f1dadbb824a5f95a0f9a5d51d74156533ae7c548c2a75d8

Download Submit
\??\Volume{8a09a459-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{e8d8e932-4d47-4d51-afd7-1df782c73e1e}_OnDiskSnapshotProp

Filesize
6KB

MD5
8eebf870aaded2f88f03ba44d9314338

SHA1
57d97744a09debbc66fdaa1c9c1a98e8797eb41e

SHA256
fc5622f48801e9aff546aac76dd7d847ca295c521bde19511ebd5a55c4031313

SHA512
09c3c9091f3ddbf0a696be19c535635c30f7500b4361a842c5077fe30c789993133bb573c785299b00aa613e36acab26743133cc104d2c36ddc7ca93e10c4cb6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads