1f1f51761059618f72c4ad782cc8350576852d166c50cafe4a60c69e7188f44f

Analysis

max time kernel
233s
max time network
233s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
15/07/2025, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
907cff1b76b2e2e44fa6bb41e6b0502733592fee7c18bb9873b9ae2b88bf941c.msi
Size 1.5MB
Sample250715-2twfeazzcx
SHA256 907cff1b76b2e2e44fa6bb41e6b0502733592fee7c18bb9873b9ae2b88bf941c
MD5 4ad791d3aef14562e74d7e756fccd828
SHA1 39a006a7c7cb7be765ef6a508d28e1f244707f12
SHA512 b5f59797e5d21007df17d987200a38ef917250af5cc0be880ac2fcb41911a743d60b2973c200c9252bb23a60e78f14beaf55f68205845a1db63a8a64f2360f08
SSDEEP 49152:YKotURB9xb0mexyBer3rU/eOhPD2ZaWoVYQ:YrURtBWL4/eOsZaWoVP
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6056	powershell.exe
3108	powershell.exe
4880	powershell.exe
2412	powershell.exe
2604	powershell.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	4468	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\Installer\e5775ad.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF80063B1A7301A51B.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{CBE3BB92-1E80-46F5-BBE7-E41F2C8F209F}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB6E98066E214E334.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7714.tmp	msiexec.exe
File created	C:\Windows\Installer\e5775af.msi	msiexec.exe
File created	C:\Windows\Installer\e5775ad.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF399876BF2134FCDB.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF44A71E3AA5ABF8D3.TMP	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
3964	LPrKz6y2fG.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4468	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b77a3d11c3faaf5c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000b77a3d110000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900b77a3d11000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1db77a3d11000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000b77a3d1100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4664	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133970936719052191"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
6136	reg.exe
3804	reg.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
6064	msiexec.exe
6064	msiexec.exe
3108	powershell.exe
3108	powershell.exe
4880	powershell.exe
4880	powershell.exe
2412	powershell.exe
2412	powershell.exe
2604	powershell.exe
2604	powershell.exe
6056	powershell.exe
6056	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2104	chrome.exe
2104	chrome.exe
2412	powershell.exe
2104	chrome.exe
2104	chrome.exe
3436	chrome.exe
3436	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4468	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4468	msiexec.exe
Token: SeSecurityPrivilege	6064	msiexec.exe
Token: SeCreateTokenPrivilege	4468	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4468	msiexec.exe
Token: SeLockMemoryPrivilege	4468	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4468	msiexec.exe
Token: SeMachineAccountPrivilege	4468	msiexec.exe
Token: SeTcbPrivilege	4468	msiexec.exe
Token: SeSecurityPrivilege	4468	msiexec.exe
Token: SeTakeOwnershipPrivilege	4468	msiexec.exe
Token: SeLoadDriverPrivilege	4468	msiexec.exe
Token: SeSystemProfilePrivilege	4468	msiexec.exe
Token: SeSystemtimePrivilege	4468	msiexec.exe
Token: SeProfSingleProcessPrivilege	4468	msiexec.exe
Token: SeIncBasePriorityPrivilege	4468	msiexec.exe
Token: SeCreatePagefilePrivilege	4468	msiexec.exe
Token: SeCreatePermanentPrivilege	4468	msiexec.exe
Token: SeBackupPrivilege	4468	msiexec.exe
Token: SeRestorePrivilege	4468	msiexec.exe
Token: SeShutdownPrivilege	4468	msiexec.exe
Token: SeDebugPrivilege	4468	msiexec.exe
Token: SeAuditPrivilege	4468	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4468	msiexec.exe
Token: SeChangeNotifyPrivilege	4468	msiexec.exe
Token: SeRemoteShutdownPrivilege	4468	msiexec.exe
Token: SeUndockPrivilege	4468	msiexec.exe
Token: SeSyncAgentPrivilege	4468	msiexec.exe
Token: SeEnableDelegationPrivilege	4468	msiexec.exe
Token: SeManageVolumePrivilege	4468	msiexec.exe
Token: SeImpersonatePrivilege	4468	msiexec.exe
Token: SeCreateGlobalPrivilege	4468	msiexec.exe
Token: SeBackupPrivilege	1428	vssvc.exe
Token: SeRestorePrivilege	1428	vssvc.exe
Token: SeAuditPrivilege	1428	vssvc.exe
Token: SeBackupPrivilege	6064	msiexec.exe
Token: SeRestorePrivilege	6064	msiexec.exe
Token: SeRestorePrivilege	6064	msiexec.exe
Token: SeTakeOwnershipPrivilege	6064	msiexec.exe
Token: SeRestorePrivilege	6064	msiexec.exe
Token: SeTakeOwnershipPrivilege	6064	msiexec.exe
Token: SeRestorePrivilege	6064	msiexec.exe
Token: SeTakeOwnershipPrivilege	6064	msiexec.exe
Token: SeRestorePrivilege	6064	msiexec.exe
Token: SeTakeOwnershipPrivilege	6064	msiexec.exe
Token: SeRestorePrivilege	6064	msiexec.exe
Token: SeTakeOwnershipPrivilege	6064	msiexec.exe
Token: SeRestorePrivilege	6064	msiexec.exe
Token: SeTakeOwnershipPrivilege	6064	msiexec.exe
Token: SeRestorePrivilege	6064	msiexec.exe
Token: SeTakeOwnershipPrivilege	6064	msiexec.exe
Token: SeRestorePrivilege	6064	msiexec.exe
Token: SeTakeOwnershipPrivilege	6064	msiexec.exe
Token: SeRestorePrivilege	6064	msiexec.exe
Token: SeTakeOwnershipPrivilege	6064	msiexec.exe
Token: SeRestorePrivilege	6064	msiexec.exe
Token: SeTakeOwnershipPrivilege	6064	msiexec.exe
Token: SeRestorePrivilege	6064	msiexec.exe
Token: SeTakeOwnershipPrivilege	6064	msiexec.exe
Token: SeRestorePrivilege	6064	msiexec.exe
Token: SeTakeOwnershipPrivilege	6064	msiexec.exe
Token: SeRestorePrivilege	6064	msiexec.exe
Token: SeTakeOwnershipPrivilege	6064	msiexec.exe
Token: SeRestorePrivilege	6064	msiexec.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
4468	msiexec.exe
4468	msiexec.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6064 wrote to memory of 4236	6064	msiexec.exe	82
PID 6064 wrote to memory of 4236	6064	msiexec.exe	82
PID 6064 wrote to memory of 3108	6064	msiexec.exe	84
PID 6064 wrote to memory of 3108	6064	msiexec.exe	84
PID 3108 wrote to memory of 3884	3108	powershell.exe	86
PID 3108 wrote to memory of 3884	3108	powershell.exe	86
PID 6064 wrote to memory of 4880	6064	msiexec.exe	88
PID 6064 wrote to memory of 4880	6064	msiexec.exe	88
PID 3884 wrote to memory of 4664	3884	cmd.exe	90
PID 3884 wrote to memory of 4664	3884	cmd.exe	90
PID 4880 wrote to memory of 1640	4880	powershell.exe	91
PID 4880 wrote to memory of 1640	4880	powershell.exe	91
PID 1640 wrote to memory of 2412	1640	cmd.exe	93
PID 1640 wrote to memory of 2412	1640	cmd.exe	93
PID 3884 wrote to memory of 2604	3884	cmd.exe	94
PID 3884 wrote to memory of 2604	3884	cmd.exe	94
PID 3884 wrote to memory of 6056	3884	cmd.exe	95
PID 3884 wrote to memory of 6056	3884	cmd.exe	95
PID 3884 wrote to memory of 3964	3884	cmd.exe	97
PID 3884 wrote to memory of 3964	3884	cmd.exe	97
PID 2412 wrote to memory of 6136	2412	powershell.exe	99
PID 2412 wrote to memory of 6136	2412	powershell.exe	99
PID 2412 wrote to memory of 3804	2412	powershell.exe	100
PID 2412 wrote to memory of 3804	2412	powershell.exe	100
PID 2412 wrote to memory of 3076	2412	powershell.exe	101
PID 2412 wrote to memory of 3076	2412	powershell.exe	101
PID 2412 wrote to memory of 3304	2412	powershell.exe	103
PID 2412 wrote to memory of 3304	2412	powershell.exe	103
PID 2412 wrote to memory of 5184	2412	powershell.exe	105
PID 2412 wrote to memory of 5184	2412	powershell.exe	105
PID 2412 wrote to memory of 660	2412	powershell.exe	107
PID 2412 wrote to memory of 660	2412	powershell.exe	107
PID 2412 wrote to memory of 2104	2412	powershell.exe	109
PID 2412 wrote to memory of 2104	2412	powershell.exe	109
PID 2104 wrote to memory of 4496	2104	chrome.exe	110
PID 2104 wrote to memory of 4496	2104	chrome.exe	110
PID 2104 wrote to memory of 2640	2104	chrome.exe	112
PID 2104 wrote to memory of 2640	2104	chrome.exe	112
PID 2104 wrote to memory of 2640	2104	chrome.exe	112
PID 2104 wrote to memory of 2640	2104	chrome.exe	112
PID 2104 wrote to memory of 2640	2104	chrome.exe	112
PID 2104 wrote to memory of 2640	2104	chrome.exe	112
PID 2104 wrote to memory of 2640	2104	chrome.exe	112
PID 2104 wrote to memory of 2640	2104	chrome.exe	112
PID 2104 wrote to memory of 2640	2104	chrome.exe	112
PID 2104 wrote to memory of 2640	2104	chrome.exe	112
PID 2104 wrote to memory of 2640	2104	chrome.exe	112
PID 2104 wrote to memory of 2640	2104	chrome.exe	112
PID 2104 wrote to memory of 2640	2104	chrome.exe	112
PID 2104 wrote to memory of 2640	2104	chrome.exe	112
PID 2104 wrote to memory of 2640	2104	chrome.exe	112
PID 2104 wrote to memory of 2640	2104	chrome.exe	112
PID 2104 wrote to memory of 2640	2104	chrome.exe	112
PID 2104 wrote to memory of 2640	2104	chrome.exe	112
PID 2104 wrote to memory of 2640	2104	chrome.exe	112
PID 2104 wrote to memory of 2640	2104	chrome.exe	112
PID 2104 wrote to memory of 2640	2104	chrome.exe	112
PID 2104 wrote to memory of 2640	2104	chrome.exe	112
PID 2104 wrote to memory of 2640	2104	chrome.exe	112
PID 2104 wrote to memory of 2640	2104	chrome.exe	112
PID 2104 wrote to memory of 2640	2104	chrome.exe	112
PID 2104 wrote to memory of 2640	2104	chrome.exe	112
PID 2104 wrote to memory of 2640	2104	chrome.exe	112
PID 2104 wrote to memory of 2640	2104	chrome.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\907cff1b76b2e2e44fa6bb41e6b0502733592fee7c18bb9873b9ae2b88bf941c.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4468

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6064
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -Command "Start-Process -FilePath "C:\Users\Admin\AppData\Local\._50068de2f1f9\\setup.cmd" -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\._50068de2f1f9\setup.cmd" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3884
  - - C:\Windows\system32\timeout.exe
      timeout /t 10 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4664
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Expand-Archive -Path 'C:\Users\Admin\AppData\Local\._50068de2f1f9\kmkuQJXow2F6RJy.zip' -DestinationPath 'C:\\Users\\Public\\Documents/Zc7jKCHpaL' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2604
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& 'C:\Users\Admin\AppData\Local\Temp\start_process.ps1'; Remove-Item 'C:\Users\Admin\AppData\Local\Temp\start_process.ps1'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6056
  - - C:\Users\Public\Documents\Zc7jKCHpaL\LPrKz6y2fG.exe
      "LPrKz6y2fG.exe"
      4⤵
      Executes dropped EXE
      PID:3964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -Command "Start-Process -FilePath "C:\Users\Admin\AppData\Local\._50068de2f1f9\\register.cmd" -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\._50068de2f1f9\register.cmd" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1640
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\._50068de2f1f9\atalhos.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2412
    - - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add HKCU\Software\Google\Chrome\NativeMessagingHosts\com.yourcompany.monitoringapp /ve /d C:\\Users\\Public\\Documents\Zc7jKCHpaL\com.yourcompany.monitoringapp.json /f
        5⤵
        Modifies registry key
        
        PID:6136
    - - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add HKCU\Software\Microsoft\Edge\NativeMessagingHosts\com.yourcompany.monitoringapp /ve /d C:\\Users\\Public\\Documents\Zc7jKCHpaL\com.yourcompany.monitoringapp.json /f
        5⤵
        Modifies registry key
        
        PID:3804
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\remove_shortcut.cmd" "
        5⤵
        
        PID:3076
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\remove_shortcut.cmd" "
        5⤵
        
        PID:3304
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\remove_shortcut.cmd" "
        5⤵
        
        PID:5184
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\remove_shortcut.cmd" "
        5⤵
        
        PID:660
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension="C:\Users\Public\Documents\LPrKz6y2fG\3a5OxUe6" --disable-extensions-except="C:\Users\Public\Documents\LPrKz6y2fG\3a5OxUe6" -no-first-run
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2104
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe776ddcf8,0x7ffe776ddd04,0x7ffe776ddd10
        6⤵
        
        PID:4496
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1936,i,9814342893912683429,4417572932291018047,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=1932 /prefetch:2
        6⤵
        
        PID:2640
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1428,i,9814342893912683429,4417572932291018047,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2248 /prefetch:11
        6⤵
        
        PID:432
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2320,i,9814342893912683429,4417572932291018047,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2336 /prefetch:13
        6⤵
        
        PID:2340
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3216,i,9814342893912683429,4417572932291018047,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3288 /prefetch:1
        6⤵
        
        PID:3924
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3224,i,9814342893912683429,4417572932291018047,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3312 /prefetch:1
        6⤵
        
        PID:5604
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4496,i,9814342893912683429,4417572932291018047,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4508 /prefetch:9
        6⤵
        
        PID:4756
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4648,i,9814342893912683429,4417572932291018047,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4684 /prefetch:1
        6⤵
        
        PID:4752
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5324,i,9814342893912683429,4417572932291018047,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5340 /prefetch:14
        6⤵
        
        PID:2324
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5692,i,9814342893912683429,4417572932291018047,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5736 /prefetch:1
        6⤵
        
        PID:5688
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3356,i,9814342893912683429,4417572932291018047,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5880 /prefetch:14
        6⤵
        
        PID:3132
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3300,i,9814342893912683429,4417572932291018047,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3412 /prefetch:14
        6⤵
        
        PID:4312
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3436,i,9814342893912683429,4417572932291018047,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5716 /prefetch:14
        6⤵
        
        PID:4584
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=5492,i,9814342893912683429,4417572932291018047,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4816 /prefetch:10
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3436
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5496,i,9814342893912683429,4417572932291018047,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4536 /prefetch:9
        6⤵
        
        PID:5064
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4532,i,9814342893912683429,4417572932291018047,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5352 /prefetch:14
        6⤵
        
        PID:3036
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\remove_shortcut.cmd" "
        5⤵
        
        PID:860
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\remove_shortcut.cmd" "
        5⤵
        
        PID:956
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\remove_shortcut.cmd" "
        5⤵
        
        PID:4300
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\remove_shortcut.cmd" "
        5⤵
        
        PID:2248

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1428

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:3436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:808

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5775ae.rbs

Path C:\Config.Msi\e5775ae.rbs
Size 8KB
SHA256 08f172cb07ad37587efff95884a0eaaf9fc9deda08e532f50540dbdeea4fccc7
MD5 01ecb6b857f679cf59c3b31bb8497502
SHA1 3f3b422e3c42246f8ca585ca9a03f209bc9cb9a2
SHA512 ddfa31811eda6e5e6c4bfbbc416e33c2def3ddfebb4772ca199b81baa3f08442e763738a5d37048446db84ff665b4ed7460d734a9e3eebbd24b8f4b63ead3ef9
SSDEEP 96:Dm03J0zkAnk72J+2SDrB2s9CoOp1qUhfmSNCsTl+LqUhfmSNC6jx+vEoTl+Ng5mR:aOJ0Q6M9Cz19LQIm9LQCoDqo35poL9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Google Chrome.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
Size 2KB
SHA256 54b3ecbda0bda91591b1eb15740c8ef2a2445c1f4eeb06b8c54a230ba5476a26
MD5 1ff96637c49240967b5e51f33a1e9271
SHA1 c8e428e7906071f7c16167c8bd0d019a0b738028
SHA512 14785f4a763e1c0461c183bfa03353ed894c3b1ac72fb8080da8707a3932cfc638ca069aab4d8cd5e21c9b4cb5730e0dbabccff88258daea281ad19be55f77c8
MD5 SHA1 SHA512

Submit Download

atalhos.ps1

Path C:\Users\Admin\AppData\Local\._50068de2f1f9\atalhos.ps1
Size 8KB
SHA256 9c5a145aba635371ca2db2c092e3a267290dbf5a476550dc30bbea9f6c4ad775
MD5 6241261f15d386c8695a99b835c81cdc
SHA1 872fd4f91ac000805766023e7d08e56f42d9fb1a
SHA512 aebd575e09bdd39f4c4afc6d36ba052e450e0477c8626462c61a5379b8f0a0fc54b9027d92a9f51a1810f43ff3286ec5a82e8e1cf388367f87c3caa16a24389c
SSDEEP 192:Sqb7HOVcxA1bHKm8ZDJ02SynvwaXs+EihjQhr3Qhah2:114PrkO2
MD5 SHA1 SHA512 SSDEEP

Submit Download

kmkuQJXow2F6RJy.zip

Path C:\Users\Admin\AppData\Local\._50068de2f1f9\kmkuQJXow2F6RJy.zip
Size 1.5MB
SHA256 d77a9fc826b75f32f2dcf853fb2657273de45f967eac55ce3897237e643fba04
MD5 dea7d9eaf316d89428b68bafebfd4265
SHA1 8af9bed3b8db74af06d7cb6e41ec1b9b03bd40a2
SHA512 6af5f91d60037930fc273e00207094d62ffa72f98f6c8ba76e2414fbfb9e323c260f567ab0762299d0d6573195b164514c9fed98eb4ecb913b1c769f18dd3c25
SSDEEP 49152:/j1o6L5Y+LW3ueyyXrarCuCmwn/v0Z3ULe7dq:hTL5YV3D2euCmw0Z3Uuq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\._50068de2f1f9\register.cmd
Size 109B
SHA256 376d912bc209b2d13acd8ba1b2b37fa7854154577bdeb52c5bbd2c7373654268
MD5 9988e4e4cf65c6656926b9b9f67bc0cc
SHA1 9bd11533b8edb5b103cca15516c6e35d6addf94b
SHA512 b3cdd83f5e6fcae3f4d315b1856beae28c595b8b002d29409d9d47aa779c43fec2f5463e607908d0e2e81c976211ef56ff4348cc4caf1bd1d0ce25d910f01f33
MD5 SHA1 SHA512

Submit Download

setup.cmd

Path C:\Users\Admin\AppData\Local\._50068de2f1f9\setup.cmd
Size 715B
SHA256 a9c2782d8985cdece2f634a620da5c2fdf92ddfa20bb4fb83ea1d44c6cc80d4a
MD5 782dc9850a305d99babb1a248c61fb79
SHA1 75c23ff5cae9a12f6d2bf4a5a4fd486619115e53
SHA512 0fe878724cbdffe5310909e391ca42d87adadf624805c4ca562e2d580a48e05c09a51b6ca7ae8c724eab115e71564269fb0f2349ea95190cbbdb8068fbceab35
MD5 SHA1 SHA512

Submit Download

4d53059b-2c37-4654-b2ea-5d113bf1c4b4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4d53059b-2c37-4654-b2ea-5d113bf1c4b4.tmp
Size 83KB
SHA256 7309384c1d11932f74b403f2c90190c18e744e4cef7b62a6aba359c6d68e28e1
MD5 961e6bc65d8abf59d28f412946c836b0
SHA1 8907ce5c8096213ed3776cd4fcd502c3d8281dfb
SHA512 ea3ba9c5cff37dfce6c462fddb08d0a4169ac0dee81781e52d7e68f258fdc917eba8b7f9d403570f46fa2211e68a6acea946ad439e0895742d9f23f94de2e0f7
SSDEEP 1536:4FfXj8V43bjn6ldz5eU1vkHzZYiVNoV8cWKNR+K7i9U39SK17W5HvTwMB:eXjM4rTmN5eWvStRNoV8cWK7XF+TwMB
MD5 SHA1 SHA512 SSDEEP

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 fa7916b09a44d24d543ebb6e42cf69d837d6f25f92095d277a14f7bbac320609
MD5 23bcf1474d5dfe90e032e2c7e944c2ba
SHA1 baeff8c22ff235b308f45b056bb9dd262bdd11b8
SHA512 c6a54f039ed5a9e2b3aeb4e08fa2995b132d1656e33370f0e4cd9beff425c5ee06318e982704338529d6d20edf536c1da0c6f5fd3a81cfc8ab617f244a44e0fe
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b9f234c8ca8a705d0aaebc2ea5b2d474cccc172439a08fba439f9180c948ea73
MD5 d0e77e80cd5ff2ec7620b5d4f2517a5d
SHA1 a4cda646f58d24c3b01e0461e3df58562153580e
SHA512 c72f1850a4128ed3e746be55a559861477dd1c88c9c58f2b119bb365bad733017ae956124e39e103f738e9db7f12d414e15ba1e3fcace4374a819d47cce7e26a
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 89a98f41a98f7060ef6ef5b07097a7ce0e104c37d63c4849bded80487d70f09d
MD5 56786e9d2291456846d1cd875c59e171
SHA1 d37f5371f208e4af823f346fe23cca0368823406
SHA512 2934f90dd4ae664f8c4593632094f3a58a1135cc933215998010b86c302e251f7837fc40e2b60a693e40621b0b6e1bf16e61f146bbd17abd3adafd521f9b57a7
SSDEEP 192:nHYlnX62FT4I9VUZ8PRpI3HS+WNKgCDubQ+2UeEKGpQyIsnA/g4:nHYlnX62FL9VdXIXcKtDubd2NQZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 fb8c913510eef47c50666a2659a1e57bb101402f50d5c9011cbd2507b989d3ce
MD5 962ad9489e6f1425c9962c2f96925b4b
SHA1 382601eeacc939508aef3e726e8c67e7443957f0
SHA512 dba88b0460d6c78cc013ebec734bdf0fa8e37ab6db17525860febcd53a5ceb9385f124c3158dcc1a5253d86f03464882a064cdfca84158dc37ce026dd136175d
SSDEEP 192:nHYlnX62FT4I93UZ8PRp68O3HS+WNS6oqTgCDuvQ+2UeEvGpQyIsnA/g2:nHYlnX62FL93dX0XcS6xTtDuvd20QZ2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 f887d8123f3240c51a793671005fe2185f09f8bad5ffd189f406941828bb51d1
MD5 76d88c7d6a1af3b5c40f21f08c75e7a8
SHA1 f2fd69d779012e457c1787ff021808b47083870d
SHA512 b8f38499ba467663a7e6e62d8499a2d5c1b4305608cfeb77c33fe12084865bfb0b8ffc03ef868c8aef68e332bea83df6038193d89e280a05d337cf754fbf5472
SSDEEP 192:nHYlnX62FT4I9VUZ8PRp68O3HS+WNS6oqTgCDuDQ+2UeEKGpQyIsnA/g4:nHYlnX62FL9VdX0XcS6xTtDuDd2NQZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 ed983d763686db542691877e7ae35cd44f2ae8122e471bc0f179b5a839a0bf3f
MD5 eb3783005e4d07b37165ac568c66a3b1
SHA1 8699debb30745e2b0497e98dff34094160ac874c
SHA512 c651c1acf567b8ad861999caf7b18e1e0a59b48a21766429025648836d8b6301b90e1f3c8f9d920ff14d8a8e6c97751a2bfedc6bf9858d5c8ef7152161b06d51
SSDEEP 384:+K2P6hlHf7pLuLcei2bXoVPkXqKf/pUZNCgVLH2Hf1KLrU85z3cnp:+zKRf7pLuL7vDoVPkXqKf/pUZNCgVLHu
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 5977f6100c13ab1819f348aab0d8f6f00497b5536df1e6bbd2076b65b9001d3d
MD5 aeee1b26317b0369694d5ae0115f69b0
SHA1 8fbe305bbc12461702d48772758fcf49496dbe28
SHA512 d98e8b32203ea2cc05610fb81e34c08dbe2ea75f290db20d20c543d63e879e80fe9110b49a781792ad4fda19175d02be29e08689b4b905f370bcd23f3f6de8d8
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe585cc1.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585cc1.TMP
Size 72B
SHA256 b98d3db72868fd31a4fbea3c6a3661e022aaae08fa07de35f2c27cf1b1062ea8
MD5 0cfa184af40e02353dd3f0ae4dfd0fba
SHA1 052bf8d92302ab0dbb3f546ad9996c52b24d2c3e
SHA512 f1bed2637da98dc426c0531e35f292fe7829720f2f4a045c5f9091d651276d94120546bc040f6da9d907733f51ddf6fea878df300160cf34ec49b922549b4b65
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nmmhkkegccagdldgiimedpiccmgmieda\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nmmhkkegccagdldgiimedpiccmgmieda\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 170KB
SHA256 8fdb936b7891fadcf597d2eafcfe121c55e914293f06ea0cc53a14138e2f91e0
MD5 e84cab950174b3717888ed652ec29124
SHA1 e7d4d403b4cf928f5136067f3d6a025ed75826bd
SHA512 8323b4bec39463b60fcb03e956e6482ba481957d045e539ef5a3067ddfec1be427de7acb0ec21aa912c624e2e5bd5149644800d0a50da85556f21325a921f479
SSDEEP 3072:rNXl8ZYIlUFLWZkJ30Mpb6o6EkSSDHKB/8XjM4rTmN5eWvStRNoV8cWK7XF+TwMa:mHMLuSb6ekxDqBAJrTnGfzF+TwMa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 170KB
SHA256 1882566e136b4563c3ce112d6a9cc7ae9197bb766eeb8281c40cb86e7f28d789
MD5 5468f0df2b11c439f3ec323ffcd5f188
SHA1 d69eb1a93e6981ba0ccca12f53ef769915a978a4
SHA512 af79022dde039c37815238a226bf3c0fbc1985385a05a9a558de01a7e8049bc9700aaa9143c288c043da5094751b1cf9cbedc99fa4cf0f3a9a66d888dee1b565
SSDEEP 3072:WNXl8ZYIlUFLWZkJ30Mpb6o6EkSSDHKB/8XjM4rTmN5eWvStRNoV8cWK7XF+TwMa:JHMLuSb6ekxDqBAJrTnGfzF+TwMa
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
MD5 88dc70c361a22feac57b031dd9c1f02f
SHA1 a9b4732260c2a323750022a73480f229ce25d46d
SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b773b908dd43812f5bd5d96f81a9a78d2fb1de1ba471323bf9588f2ac677bb46
MD5 008e38e258131b18627594b762fa30d7
SHA1 9feffd946f52d114fbaa1c758e13bfb9c115cee2
SHA512 f0188d3be625a16364826115bad4aaac159ec534cf6c085406a0a72fe4f2b139648d39b45dba2e2bf246344349d9d28aa8bfbe4b2f0ba0e9c50c2429208f32e1
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 46e488628e5348c9c4dfcdeed5a91747eae3b3aa49ae1b94d37173b6609efa0e
MD5 50a8221b93fbd2628ac460dd408a9fc1
SHA1 7e99fe16a9b14079b6f0316c37cc473e1f83a7e6
SHA512 27dda53e7edcc1a12c61234e850fe73bf3923f5c3c19826b67f2faf9e0a14ba6658001a9d6a56a7036409feb9238dd452406e88e318919127b4a06c64dba86f0
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1b6e24e1d7ae400dcdabebc263a85243d02ec01ab848768defdb3af6b790c1f3
MD5 7932fbcd92027dfff5611896f9355757
SHA1 ed7c38ef6708e13f64be2196dc51acb780619fe2
SHA512 d5d3587550e61d4aa7a29a085502232224b958af7ed6c878c1f179e5faeab5245703698dd475bc518a5e498edf2174b7e76d04bb85ae098666580291781eee6f
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_xfsrjlr4.4x1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xfsrjlr4.4x1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

remove_shortcut.cmd

Path C:\Users\Admin\AppData\Local\Temp\remove_shortcut.cmd
Size 68B
SHA256 3e79251982703b6377d91e5be36729f091f39d67d66c348770e4578a18a70216
MD5 633ba60948f602d43aa8b62d670e45db
SHA1 6d8cef307ec9ef673833927750672919b35391eb
SHA512 c1332adc8cf624fea5ac697f28719e34c31b0457effb5029201799b11d67b6bbe477da9dd0d4106860210072b784d871ea8f954c98ffc4a7eea67465ad53c7e6
MD5 SHA1 SHA512

Submit Download

remove_shortcut.cmd

Path C:\Users\Admin\AppData\Local\Temp\remove_shortcut.cmd
Size 97B
SHA256 84ed177b2fb5744ab627093506d149b30993102546970fc67736c72be1a54b1f
MD5 861626869054b3f482d751059a441f59
SHA1 7115d373b1be65639bfcbe44311104f3a11b0c86
SHA512 6522cc914a8b93e3b263b15f473c25f89fae34c861124670e5e4f355c0cc29ca1351d681ed0e147cc2c053ed3e2f58fa41535ed5a66d60abcbbcd7edfa7ca0d9
MD5 SHA1 SHA512

Submit Download

remove_shortcut.cmd

Path C:\Users\Admin\AppData\Local\Temp\remove_shortcut.cmd
Size 116B
SHA256 f8484f73199e083cdc998f82ec32ab665ab033e2482af2bd43c184a91d289e59
MD5 2214053e5e67c027622688ab6054e1ac
SHA1 e9d120cb63044ae37a5f1f15be29523ecfd40f2e
SHA512 111a28a638c183ad49871816a5c03a6c2051d9793a26b413341c34e46dcb7c0ff9cabc5f625513ea24cdc7f66575fff14ee5ecbb3f100623080db007749056ab
MD5 SHA1 SHA512

Submit Download

remove_shortcut.cmd

Path C:\Users\Admin\AppData\Local\Temp\remove_shortcut.cmd
Size 69B
SHA256 668ddaffaffe886724cb9ae090492731d05aec1886ace9087e4b1d417d4cf6e1
MD5 6280f916c47c2d45d4230292b82b05f9
SHA1 68a223e92fc6b2b271311452fe5cc07e94c978a8
SHA512 5554e19ad51f5fb6fa99e41a3a7bf759dfdf9e2e9e11dde141720dae44bf6e6d51a6ece7648939516c2bf3e66ae167ef57d7762657979d4282899b35dbb41c70
MD5 SHA1 SHA512

Submit Download

remove_shortcut.cmd

Path C:\Users\Admin\AppData\Local\Temp\remove_shortcut.cmd
Size 136B
SHA256 ef472fcc84eb1c49dcd08ad3c7ce6b26fcaa38afe0bca5d0a251bc0aa7029dec
MD5 ecc34e74037b3f6981cbb37ddb24f84b
SHA1 6c147ec91a44e876c561c4211ce56a70e9ee1b2f
SHA512 4df15dd13c864a7047b6734678c448392b4783191230c02685b1f1e3025cd12453dd6a7367a48bf9faf46b8946dbb1a878c412f04cc57d977882476c89d1fe13
MD5 SHA1 SHA512

Submit Download

remove_shortcut.cmd

Path C:\Users\Admin\AppData\Local\Temp\remove_shortcut.cmd
Size 68B
SHA256 13b48a333fd59adf200e5c32e96c1986c5fac655e4a4118a850b6b3c5399da58
MD5 55150c66ae882236ccbb68df895a9c2a
SHA1 9ce7550b405810fe4c9b0756931257731d700b22
SHA512 f5daa2fb3242a2ac0fc0d81d8d8a22a9b0bc40a5d5588812d1cfe16a9dbbdf0dd530cd11bbc97296ff8476fbbfa3c4dad903a18a859ca8ec0d4fc09540c2033a
MD5 SHA1 SHA512

Submit Download

remove_shortcut.cmd

Path C:\Users\Admin\AppData\Local\Temp\remove_shortcut.cmd
Size 117B
SHA256 c39f5fdb2525cc77617b8e21fa3ec88ae19b695855a38b32ac17fe942c2c6e0a
MD5 f240dc211fd692eaff659efc7f299030
SHA1 2234893704bee26e4d4b7fc1a7bdf5ef34536ffb
SHA512 1059d5e77a2f58b0a640c50af1b8bf9d67845196ba9fbdcbd30c4dde1d0a28c61bf00c6452d46e50c8e7f1d89fbd1d544a34292d9b96329883dddb9d02488dce
MD5 SHA1 SHA512

Submit Download

remove_shortcut.cmd

Path C:\Users\Admin\AppData\Local\Temp\remove_shortcut.cmd
Size 98B
SHA256 39386c6a130c2e67a1cd022002d6e3ede46fd800ad93be23d95e721787e0aa4a
MD5 76be7806b08ef76363b071953ff64de0
SHA1 0c68234d238e9cb78e8a236b266d9f104f1f08a3
SHA512 999c2e7c1f49d2056e6590ae603074f748df1cc9f29a7a18b0a8e952c2a86adb12743a74678d5b7e97d3259e759436cf39e08232522f78dd4d7b2bf23988a3db
MD5 SHA1 SHA512

Submit Download

start_process.ps1

Path C:\Users\Admin\AppData\Local\Temp\start_process.ps1
Size 149B
SHA256 df0ac975e4ac91c169b5042a1a413479e62991e3a9979b5e8ccf4cc7d7d9a1f2
MD5 efcd67bd90a7cc11512353c2666b026c
SHA1 a89a3bda4d56283338fcb13500cf99aa4f3f8cd0
SHA512 a85ed4279d687545d2faf9a616b9bdbb72ab0378c21fee79034c776ef16fbea9a3bdee313889534d54d89b01c9167bb296cbb0ccac5020bd44d1613f60f1e23f
MD5 SHA1 SHA512

Submit Download

bg_d94f45fa.js

Path C:\Users\Public\Documents\LPrKz6y2fG\3a5OxUe6\bg_d94f45fa.js
Size 81KB
SHA256 ff87a97363631d70abaf085b300fb2396e05cd6cff7f7dda2c45a6b5c8d3115b
MD5 9d82f2a51de178853e9b52df85892cd2
SHA1 63fbdc8707ba14d6ec90d19eb607f32442854bb0
SHA512 bcee120e786fc97ffc2d5c24c5dc5e8bfb99b9a22bcbd203b06d8a7abd22d92e7ac3eb93de262ae9977298d234344e52e4aff67ad3c5594b1fe2d0d8272ffaa8
SSDEEP 768:duMlFmEwJD66zjfXJx9whGLKyKUkpQZ8mLQquoHiSqh5FMCkTXX/ddoORTnPllGM:duKmfmr4OYhX/FRTn+Xlc37Pk5c
MD5 SHA1 SHA512 SSDEEP

Submit Download

config.json

Path C:\Users\Public\Documents\LPrKz6y2fG\3a5OxUe6\config.json
Size 842B
SHA256 4a661b0ea3bc357e9e399a78d211e36c5a1786ac70bfd7a241125eead89831be
MD5 475a3a899aec903d9219d4f2bac84daf
SHA1 e3604fc95d70e22b095a61f3bf9f04bd5903ebd5
SHA512 47c84f52bc99152318086d104030d8cbf42ab9d68c54b6bbfc9198416ce92d75a521f25af15914647158995eae820f8e8419292a5c8dba498c75d90d70c3d643
MD5 SHA1 SHA512

Submit Download

ct_cb4f5a58.js

Path C:\Users\Public\Documents\LPrKz6y2fG\3a5OxUe6\ct_cb4f5a58.js
Size 614B
SHA256 64f15372e14aaa63e01459ac31be67b4c309444e6f92ef910c87ac66cc0004d0
MD5 f096f0df9d50c543999623bcd090fb97
SHA1 7dbd5c580414fc8c23ed4becdd6b76e94bbe9cf4
SHA512 a5208982576d0cd53fe9ae5bd03fd2e2be0412c451e639856fcaa3ddc0f2a88131e5c0c488b33b91cc14af7370fd9f09b29c78ee6e320a66dd75a830bb4f8497
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Public\Documents\LPrKz6y2fG\3a5OxUe6\manifest.json
Size 1KB
SHA256 8a558b728b8e17d6ae8f67c9586894a2da8124b60dd646a8f8049e10621cc785
MD5 083263084eb6066c93a720f49372bfab
SHA1 e3fb9f1c56b75539faff10fa43a61443d1c4f3b3
SHA512 04446cba484999c529dd10f115cb779eaf485850ebdf1785b0d7cfc291faf871827d1b15257dff1f90adb6509a7c70b4556aca8b459617019c7b494e14636ed7
MD5 SHA1 SHA512

Submit Download

LPrKz6y2fG.exe

Path C:\Users\Public\Documents\Zc7jKCHpaL\LPrKz6y2fG.exe
Size 2.7MB
SHA256 da6b97b245c65193eb231de0314508759a69db35a8f76afc66b4757702a231d0
MD5 6550ea36af6d367e39b948835738f76d
SHA1 006fab2aad27c01f702d60b0210a3dde420fe6e5
SHA512 e13c61292dd7fe724a5f330b7c49f873a070d9234d8b347beb11724c90661e83dbaae4e1a33c9ff7a4864d9407dd97ce4af751aae6c1ee12eaf6eece4a8ec330
SSDEEP 24576:bcbLcNaeaEntLCwviZt0PFaN50tmzb2nMdU8wG1Bjl3mqvkujjmlJWF:bcb+aeUSiZtoFS5r2QZi
MD5 SHA1 SHA512 SSDEEP

Submit Download

LPrKz6y2fG.zip

Path C:\Users\Public\Documents\Zc7jKCHpaL\LPrKz6y2fG.zip
Size 375KB
SHA256 451073f0462ea4d092d48d5e6504bb30a4f1a73d627418263f6846d05b3b8b70
MD5 18b9a611b987b31f8f46d69c0c9022de
SHA1 56dd8b64f96fd7f50f6ebc2d30c54ea8004e12cb
SHA512 769b9cc54cc75b22f3248a8b7910556b4e299970b38b3f1f19fc14b9e1cc3327ab3bc8913cba5328e72f18b2b547c62986c195cf8082316633a98213229b203b
SSDEEP 6144:ZdALoF6sUglCoBPqvLw32lZ1BP8nn8vLfMsHD7woNsxsTZPYQTmYQ8e76PYC5bOf:r4oflzPgS2l524LfMsHD7Gsd/qYJe7tP
MD5 SHA1 SHA512 SSDEEP

Submit Download

e5775ad.msi

Path C:\Windows\Installer\e5775ad.msi
Size 1.5MB
SHA256 907cff1b76b2e2e44fa6bb41e6b0502733592fee7c18bb9873b9ae2b88bf941c
MD5 4ad791d3aef14562e74d7e756fccd828
SHA1 39a006a7c7cb7be765ef6a508d28e1f244707f12
SHA512 b5f59797e5d21007df17d987200a38ef917250af5cc0be880ac2fcb41911a743d60b2973c200c9252bb23a60e78f14beaf55f68205845a1db63a8a64f2360f08
SSDEEP 49152:YKotURB9xb0mexyBer3rU/eOhPD2ZaWoVYQ:YrURtBWL4/eOsZaWoVP
MD5 SHA1 SHA512 SSDEEP

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 f58159eeef5df26701f2097c9ca0fed2ae3008ada513cff6b3439a47c9011f95
MD5 28feca09f442884510519eaa03b95ee7
SHA1 b1afda61bcd0bf1cbe76ba1923a2c81a285efdfe
SHA512 47192b429c49e853b150b7412c38284802a62edfac51e0e6d5edcfe2e7764401be745f1b63a0a9065a7fed83148edb4cc05dcbb9b55b34e36e73da4ce7db347b
SSDEEP 24576:tZ1mSptVdoO/vvTLh2KOBEHaPqlfwIegGmJN3Z0KjRaYUWOiohLnL7QN2:H
MD5 SHA1 SHA512 SSDEEP

Submit Download

{0c429683-5ed5-486b-bcef-fd1783720c12}_OnDiskSnapshotProp

Path \??\Volume{113d7ab7-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{0c429683-5ed5-486b-bcef-fd1783720c12}_OnDiskSnapshotProp
Size 6KB
SHA256 1cbc14bf499354f9f7ac01b84a7461d9f90ce66d9ccf9aec45ad2800f2d316e9
MD5 97db2325790b9d878a6c6618291c988a
SHA1 94cb48ec323eaedcfe8cb647b5296692b899b78e
SHA512 86bdcb93b415b3d0f87bb46d50d75b363d6b8abf64afb94f51fca4ec87cd21b47765c4c2c24fec9850b191215970031dc5a87e04887d1eb631e876e40404fb6e
SSDEEP 96:F+AznMMFDD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:AAz1b++ZVmN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2604-74-0x0000020A686B0000-0x0000020A686BA000-memory.dmp

Download

memory/2604-73-0x0000020A688E0000-0x0000020A688F2000-memory.dmp

Download

memory/3108-23-0x0000019C327A0000-0x0000019C327C2000-memory.dmp

Download