9acec82250082db98a156292e9aebc2ba22ae177f8003fe29d7e59b220e14ebc

Analysis

max time kernel
237s
max time network
307s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
28/03/2025, 13:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SuperViewer Installer/Volume/bin/p16/nicurl64.msi
Size

1.1MB
MD5

34f3d3c76b5e1768c1e33354d12b86cd
SHA1

cfa71a635fc18eba072b4eba4066d6074ca7f354
SHA256

fb745d3bd330f229f03693368db3dac75ce6262865a6997ac1c0a6b9ae75e151
SHA512

a1dcb2e8b6897ab8a04998dfe4e498a36967e41a028431eefde610d1f64c3aa824b1039aaaf020133b2041778b9cb0462ba897d828c3b9b7009a328ec3be861d
SSDEEP

24576:pFitUXZo/3G1Xu+TQNxshTK+63S3ZgTqGgeSZUf/:pFitmFfC2PJg6Uf

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\National Instruments\Shared\nicurl\curlimpl.dll	msiexec.exe
File created	C:\Program Files\National Instruments\Shared\nicurl\ca-bundle.crt	msiexec.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF87AB2E61DABAD8C2.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF86A1DAD3B7B545D4.TMP	msiexec.exe
File created	C:\Windows\Installer\e582bc0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2F4F.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF612D0DA81E7E4636.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2D75.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E32.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF90C89CCF16A1E3EC.TMP	msiexec.exe
File created	C:\Windows\Installer\e582bbe.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e582bbe.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2C3B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2D76.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E43.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0B70FBA3-C887-4B13-976E-DBA47D7F7E08}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E53.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E93.tmp	msiexec.exe

Loads dropped DLL 11 IoCs

pid	Process
3124	MsiExec.exe
3124	MsiExec.exe
3124	MsiExec.exe
3124	MsiExec.exe
4496	MsiExec.exe
4496	MsiExec.exe
4496	MsiExec.exe
4496	MsiExec.exe
4496	MsiExec.exe
4496	MsiExec.exe
4496	MsiExec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000006ff5154e0b80d71f0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800006ff5154e0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809006ff5154e000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d6ff5154e000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000006ff5154e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3ABF07B0788C31B479E6BD4AD7F7E780\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\SuperViewer Installer\\Volume\\bin\\p16\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3ABF07B0788C31B479E6BD4AD7F7E780	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3ABF07B0788C31B479E6BD4AD7F7E780\Version = "318816256"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3ABF07B0788C31B479E6BD4AD7F7E780\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3ABF07B0788C31B479E6BD4AD7F7E780\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3ABF07B0788C31B479E6BD4AD7F7E780\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3ABF07B0788C31B479E6BD4AD7F7E780\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SuperViewer Installer\\Volume\\bin\\p16\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3ABF07B0788C31B479E6BD4AD7F7E780\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3ABF07B0788C31B479E6BD4AD7F7E780\ProductName = "NI Curl 19.0.0 (64-bit)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3ABF07B0788C31B479E6BD4AD7F7E780\Language = "9"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3ABF07B0788C31B479E6BD4AD7F7E780\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3ABF07B0788C31B479E6BD4AD7F7E780\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B7C6F978A08F422408EE2A7D6D2A8ABB\3ABF07B0788C31B479E6BD4AD7F7E780	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3ABF07B0788C31B479E6BD4AD7F7E780\SourceList\PackageName = "nicurl64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3ABF07B0788C31B479E6BD4AD7F7E780	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3ABF07B0788C31B479E6BD4AD7F7E780\NIMUFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3ABF07B0788C31B479E6BD4AD7F7E780\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3ABF07B0788C31B479E6BD4AD7F7E780\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B7C6F978A08F422408EE2A7D6D2A8ABB	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3ABF07B0788C31B479E6BD4AD7F7E780\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3ABF07B0788C31B479E6BD4AD7F7E780\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3ABF07B0788C31B479E6BD4AD7F7E780\nicurl64.NI.CURL64.2019	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3ABF07B0788C31B479E6BD4AD7F7E780\PackageCode = "BF9E796FA24D4804891EE6103FDAD128"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3ABF07B0788C31B479E6BD4AD7F7E780\SourceList\Media\1 = ";"	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4860	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4860	msiexec.exe
Token: SeSecurityPrivilege	3960	msiexec.exe
Token: SeCreateTokenPrivilege	4860	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4860	msiexec.exe
Token: SeLockMemoryPrivilege	4860	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4860	msiexec.exe
Token: SeMachineAccountPrivilege	4860	msiexec.exe
Token: SeTcbPrivilege	4860	msiexec.exe
Token: SeSecurityPrivilege	4860	msiexec.exe
Token: SeTakeOwnershipPrivilege	4860	msiexec.exe
Token: SeLoadDriverPrivilege	4860	msiexec.exe
Token: SeSystemProfilePrivilege	4860	msiexec.exe
Token: SeSystemtimePrivilege	4860	msiexec.exe
Token: SeProfSingleProcessPrivilege	4860	msiexec.exe
Token: SeIncBasePriorityPrivilege	4860	msiexec.exe
Token: SeCreatePagefilePrivilege	4860	msiexec.exe
Token: SeCreatePermanentPrivilege	4860	msiexec.exe
Token: SeBackupPrivilege	4860	msiexec.exe
Token: SeRestorePrivilege	4860	msiexec.exe
Token: SeShutdownPrivilege	4860	msiexec.exe
Token: SeDebugPrivilege	4860	msiexec.exe
Token: SeAuditPrivilege	4860	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4860	msiexec.exe
Token: SeChangeNotifyPrivilege	4860	msiexec.exe
Token: SeRemoteShutdownPrivilege	4860	msiexec.exe
Token: SeUndockPrivilege	4860	msiexec.exe
Token: SeSyncAgentPrivilege	4860	msiexec.exe
Token: SeEnableDelegationPrivilege	4860	msiexec.exe
Token: SeManageVolumePrivilege	4860	msiexec.exe
Token: SeImpersonatePrivilege	4860	msiexec.exe
Token: SeCreateGlobalPrivilege	4860	msiexec.exe
Token: SeCreateTokenPrivilege	4860	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4860	msiexec.exe
Token: SeLockMemoryPrivilege	4860	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4860	msiexec.exe
Token: SeMachineAccountPrivilege	4860	msiexec.exe
Token: SeTcbPrivilege	4860	msiexec.exe
Token: SeSecurityPrivilege	4860	msiexec.exe
Token: SeTakeOwnershipPrivilege	4860	msiexec.exe
Token: SeLoadDriverPrivilege	4860	msiexec.exe
Token: SeSystemProfilePrivilege	4860	msiexec.exe
Token: SeSystemtimePrivilege	4860	msiexec.exe
Token: SeProfSingleProcessPrivilege	4860	msiexec.exe
Token: SeIncBasePriorityPrivilege	4860	msiexec.exe
Token: SeCreatePagefilePrivilege	4860	msiexec.exe
Token: SeCreatePermanentPrivilege	4860	msiexec.exe
Token: SeBackupPrivilege	4860	msiexec.exe
Token: SeRestorePrivilege	4860	msiexec.exe
Token: SeShutdownPrivilege	4860	msiexec.exe
Token: SeDebugPrivilege	4860	msiexec.exe
Token: SeAuditPrivilege	4860	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4860	msiexec.exe
Token: SeChangeNotifyPrivilege	4860	msiexec.exe
Token: SeRemoteShutdownPrivilege	4860	msiexec.exe
Token: SeUndockPrivilege	4860	msiexec.exe
Token: SeSyncAgentPrivilege	4860	msiexec.exe
Token: SeEnableDelegationPrivilege	4860	msiexec.exe
Token: SeManageVolumePrivilege	4860	msiexec.exe
Token: SeImpersonatePrivilege	4860	msiexec.exe
Token: SeCreateGlobalPrivilege	4860	msiexec.exe
Token: SeCreateTokenPrivilege	4860	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4860	msiexec.exe
Token: SeLockMemoryPrivilege	4860	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4860	msiexec.exe
4860	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3960 wrote to memory of 3124	3960	msiexec.exe	82
PID 3960 wrote to memory of 3124	3960	msiexec.exe	82
PID 3960 wrote to memory of 3124	3960	msiexec.exe	82
PID 3960 wrote to memory of 2016	3960	msiexec.exe	86
PID 3960 wrote to memory of 2016	3960	msiexec.exe	86
PID 3960 wrote to memory of 4496	3960	msiexec.exe	88
PID 3960 wrote to memory of 4496	3960	msiexec.exe	88
PID 3960 wrote to memory of 4496	3960	msiexec.exe	88

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\SuperViewer Installer\Volume\bin\p16\nicurl64.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4860

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F4CC3E0DACD9DB19461B3757A6DBA890 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3124
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2016
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D8E8A3E20235503579EA281D156C3D92
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4496

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e582bbf.rbs

Filesize
9KB

MD5
1c494c329a4c67d5181607a41161acf4

SHA1
67eb50036ee7ba8cda3720fcb1e094322d7ac2e2

SHA256
a3a0cf223c8c6277840fe3872a900ea6731155d956cb950bb7cd782d87d7477d

SHA512
f86b38aca6cb977f79cf97077efc1762d1076a2b74d615c74713616321171aebe0efc55f84c46b57b3b983e8b6914bf082418f649f448274235444cd0b6fe2e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI902A.tmp

Filesize
639KB

MD5
c6417930af8969f9f2cb431acd76ec89

SHA1
d2f2dc9b44f5f79348f7f36091b26a5465ad4f2b

SHA256
1b89704532113150fc7a8a06b5367ee26937c346635a860e93662e1fbb5cd79b

SHA512
f30d7a5b51f5d866ccabf3e15a45d3b4013e28a9bdaaf2176e8b121fbd4ab41a8e67c059b2ece8db5bc7a0ce043e76bbc4e3f6400fb9cd2886e1ffcd9e65d79b

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.6MB

MD5
6e14fee13fd384c8c42f15110b8d77a1

SHA1
3362b2748b5c1422e94c2fb99496153eb096f82f

SHA256
6581c181c30ac46556dd020a9909a520fe262391c8b854dbf214a8a60ccd7b5f

SHA512
571d43ed39b7bf75158369afcb211cfff4b746d2897effbb7a625c6cc74c15f0bc6888b1a26b7d74ea091fe2402c55c013aa63b118b4aeff229d507ef4bf62d3

Download Submit
\??\Volume{4e15f56f-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{dc9b5c7c-c262-4a4c-a2a7-aa73916d02bd}_OnDiskSnapshotProp

Filesize
6KB

MD5
bbf4fc995286ff607adb988ccd457ce2

SHA1
8d58171ec8605a688575b6f96f4c3d264fa6f813

SHA256
5cbdba8941451d6fdd2c6ebd25b52125da255571a525c84eaf3e3a5844e952c3

SHA512
576dc9b232611fd04a0e2f7b55f67192f977e0d894d6ec2c2637d41b6f14db708cfb8ad85a182c9cc1e92bbf2256f85d621e81fab36f61b454526693071dccbf

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads