Overview

overview

9

Static

static

1

2026-07-20...ca.exe

windows10-2004-x64

9

2026-07-20...ca.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    166s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/07/2026, 02:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-20_fadd6b5e6d700d2bb6c2f669d6f8b6c6_amadey_cobalt-strike_hellokitty_hijackloader_icedid_luca.exe
  • Size 27.5MB
  • Sample260720-ctckvse13x
  • SHA256 ecfac04621be8038a9ff069da8cf2b480780912d52cafb15816706448675678c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies Windows Firewall 2 TTPs 1 IoCs
    defense_evasion
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 23 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 49 IoCs
  • Modifies registry class 27 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_fadd6b5e6d700d2bb6c2f669d6f8b6c6_amadey_cobalt-strike_hellokitty_hijackloader_icedid_luca.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-20_fadd6b5e6d700d2bb6c2f669d6f8b6c6_amadey_cobalt-strike_hellokitty_hijackloader_icedid_luca.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1400
    • C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\TiaConnect-Setup.msi"
      2⤵
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:4560
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2456
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 5BFDA4CD733634F8C74C718BA0207646 C
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1624
      • C:\Users\Admin\AppData\Local\Temp\{84FBF7E3-C337-4340-963C-DF5DA639A424}\NetCoreCheck.exe
        "C:\Users\Admin\AppData\Local\Temp\{84FBF7E3-C337-4340-963C-DF5DA639A424}\NetCoreCheck.exe" -n Microsoft.WindowsDesktop.App -v 4.8.0 -r Major
        3⤵
        • Executes dropped EXE
        PID:1236
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:2540
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 42800D3D0292F49D4254268AA2B05A93
        2⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4620
        • C:\Users\Admin\AppData\Local\Temp\{C790AA7C-1BF2-41C0-866A-96425D32674D}\NetCoreCheck.exe
          "C:\Users\Admin\AppData\Local\Temp\{C790AA7C-1BF2-41C0-866A-96425D32674D}\NetCoreCheck.exe" -n Microsoft.WindowsDesktop.App -v 4.8.0 -r Major
          3⤵
          • Executes dropped EXE
          PID:1788
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 426951E58C05409E10489A5AD43C376F E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4108
      • C:\Program Files\FeelAutomCorp\TiaConnect\TiaPortalApi.App.exe
        "C:\Program Files\FeelAutomCorp\TiaConnect\TiaPortalApi.App.exe" --setup --classroom-ip "" --classroom-port "" --classroom-token ""
        2⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of WriteProcessMemory
        PID:3404
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" -NoProfile -Command "Add-MpPreference -ControlledFolderAccessAllowedApplications 'C:\Program Files\FeelAutomCorp\TiaConnect\TiaPortalApi.App.exe'"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:3140
        • C:\Windows\SYSTEM32\netsh.exe
          "netsh" http add urlacl url=http://+:9100/ user="NT AUTHORITY\SYSTEM"
          3⤵
          • Event Triggered Execution: Netsh Helper DLL
          PID:5364
        • C:\Windows\SYSTEM32\netsh.exe
          "netsh" advfirewall firewall add rule name="T-IA Connect Classroom (TCP-In 9100)" dir=in action=allow protocol=tcp localport=9100
          3⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:1840
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding EBEC48D22BE17B33F650C37311BC246E C
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4236
        • C:\Program Files\FeelAutomCorp\TiaConnect\TiaPortalApi.App.exe
          "C:\Program Files\FeelAutomCorp\TiaConnect\TiaPortalApi.App.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          • Modifies Control Panel
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          PID:3512
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:4652
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:1200

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            1
            T1059

            PowerShell

            1
            T1059.001

            Persistence

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            2
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Netsh Helper DLL

            1
            T1546.007

            Privilege Escalation

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            2
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Netsh Helper DLL

            1
            T1546.007

            Defense Evasion

            Impair Defenses

            1
            T1562

            Disable or Modify System Firewall

            1
            T1562.004

            Credential Access

            Discovery

            Peripheral Device Discovery

            2
            T1120

            Query Registry

            3
            T1012

            System Information Discovery

            4
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            Lateral Movement

            Collection

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e5a6871.rbs
            • Path C:\Config.Msi\e5a6871.rbs
            • Size 149KB
            • SHA256 0be83e0290d7e26a08fec8f4fad6d22281dbee21d716584982cf2c7f8998ef8d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cd619c38-87b7-4170-afc7-4f9e956f34a2.bin
            • Path C:\Program Files\FeelAutomCorp\TiaConnect\App_Data\blob_storage.dat\cd619c38-87b7-4170-afc7-4f9e956f34a2.bin
            • Size 33KB
            • SHA256 f54c0fa753c52263f90a753996555612bc05574f354bf195ee7a0263dae2cc2f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FontAwesome.WPF.dll
            • Path C:\Program Files\FeelAutomCorp\TiaConnect\FontAwesome.WPF.dll
            • Size 204KB
            • SHA256 63d50dbe094bbce5d7bf8af08c0d919cfa5e057ca05ae7b27704a8477c8b348f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.AspNet.SignalR.Core.dll
            • Path C:\Program Files\FeelAutomCorp\TiaConnect\Microsoft.AspNet.SignalR.Core.dll
            • Size 338KB
            • SHA256 2672829713f57630f2fc4da57926456dda7832f0e0f474f06462d2340b4dc4e3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Extensions.Localization.Abstractions.dll
            • Path C:\Program Files\FeelAutomCorp\TiaConnect\Microsoft.Extensions.Localization.Abstractions.dll
            • Size 21KB
            • SHA256 40bf1b4e022e06706c6dd17a0b6d53c7aa8ec0f0bb80f3840da2a70a21434f0f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Extensions.Logging.Abstractions.dll
            • Path C:\Program Files\FeelAutomCorp\TiaConnect\Microsoft.Extensions.Logging.Abstractions.dll
            • Size 67KB
            • SHA256 c071f7bb1dac06185232727d8b43412537d856a7ee23b8d128f45d5774b70270
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Owin.dll
            • Path C:\Program Files\FeelAutomCorp\TiaConnect\Microsoft.Owin.dll
            • Size 119KB
            • SHA256 42ed395c54526dad6aa275ca2a65f6de6e94bc8cec8548cfb9891ba430ff1974
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Web.WebView2.Core.dll
            • Path C:\Program Files\FeelAutomCorp\TiaConnect\Microsoft.Web.WebView2.Core.dll
            • Size 634KB
            • SHA256 7c2e9c1e2089705b55e82a3d2cd2f57c4d72774e5c9ed5eef33d6616fa8184b4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Web.WebView2.Wpf.dll
            • Path C:\Program Files\FeelAutomCorp\TiaConnect\Microsoft.Web.WebView2.Wpf.dll
            • Size 80KB
            • SHA256 4e19b4642dbad7a1fae43f6b435f9b8a25d1fa9d782e4933ef7c3a34b5d7e2c9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ModernWpf.dll
            • Path C:\Program Files\FeelAutomCorp\TiaConnect\ModernWpf.dll
            • Size 902KB
            • SHA256 dd9f01178911a942cbab963d311c675c298d288a0079b5a9bb47fc86f1a74ac3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Newtonsoft.Json.dll
            • Path C:\Program Files\FeelAutomCorp\TiaConnect\Newtonsoft.Json.dll
            • Size 685KB
            • SHA256 b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Serilog.Extensions.Logging.dll
            • Path C:\Program Files\FeelAutomCorp\TiaConnect\Serilog.Extensions.Logging.dll
            • Size 28KB
            • SHA256 f53e641e4f68b69419f312eba761bac8a657f6b9ba8c8d1d2aff5fad09232aad
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Serilog.Filters.Expressions.dll
            • Path C:\Program Files\FeelAutomCorp\TiaConnect\Serilog.Filters.Expressions.dll
            • Size 75KB
            • SHA256 541763db7c4ab3ac5f8a18d87f8c400e0286f7db3f4abd208e025724df2d1c18
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Serilog.Sinks.Console.dll
            • Path C:\Program Files\FeelAutomCorp\TiaConnect\Serilog.Sinks.Console.dll
            • Size 40KB
            • SHA256 2bc8600466c7a4199dd1b96d9edc31eab91909b475f3fd419305df95062a25b6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Serilog.Sinks.File.dll
            • Path C:\Program Files\FeelAutomCorp\TiaConnect\Serilog.Sinks.File.dll
            • Size 38KB
            • SHA256 f57dc69a0fcc22b908bc6f6c9c180d634013749ebdb25b07a85c83776bd75625
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Serilog.dll
            • Path C:\Program Files\FeelAutomCorp\TiaConnect\Serilog.dll
            • Size 161KB
            • SHA256 dce550ab904db02c329e32b34d304556e4f32f7a3accb07f2e885961424d84a5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SoftLicence.SDK.dll
            • Path C:\Program Files\FeelAutomCorp\TiaConnect\SoftLicence.SDK.dll
            • Size 35KB
            • SHA256 da64ebd19d132b36bfca51d4b99d6ffbef9754ea500e6d5b59ae2a5a8c810be5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Superpower.dll
            • Path C:\Program Files\FeelAutomCorp\TiaConnect\Superpower.dll
            • Size 74KB
            • SHA256 a59bc0abb77b294bacc81ebe7d212cbb5b621d525c9368da66835acda49090fe
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Diagnostics.DiagnosticSource.dll
            • Path C:\Program Files\FeelAutomCorp\TiaConnect\System.Diagnostics.DiagnosticSource.dll
            • Size 195KB
            • SHA256 9c4f0069f18d0ffc71056562318d1caec0b60820188426d7005a39612853993c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Runtime.CompilerServices.Unsafe.dll
            • Path C:\Program Files\FeelAutomCorp\TiaConnect\System.Runtime.CompilerServices.Unsafe.dll
            • Size 17KB
            • SHA256 37768488e8ef45729bc7d9a2677633c6450042975bb96516e186da6cb9cd0dcf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            TiaConnect.Native.dll
            • Path C:\Program Files\FeelAutomCorp\TiaConnect\TiaConnect.Native.dll
            • Size 200KB
            • SHA256 6277ddc11ab602a2b754192f6e105428da43277f18fc8c95121558abf2f5179b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            TiaPortalApi.App.exe
            • Path C:\Program Files\FeelAutomCorp\TiaConnect\TiaPortalApi.App.exe
            • Size 2.9MB
            • SHA256 cab658c2ded5a92df283c71344a9592ddeae59755479848fe3570c6da7b721c7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            TiaPortalApi.App.exe.config
            • Path C:\Program Files\FeelAutomCorp\TiaConnect\TiaPortalApi.App.exe.config
            • Size 4KB
            • SHA256 5c061be9faada6e4482c4c693371f692100b25f24500d01dad96546e96ca74dd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            TiaPortalApi.Core.dll
            • Path C:\Program Files\FeelAutomCorp\TiaConnect\TiaPortalApi.Core.dll
            • Size 7.1MB
            • SHA256 9a0373d1153273ece251cc272d6dfe5f8f155758ec7da0125af8951df70f4e8c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Unity.Abstractions.dll
            • Path C:\Program Files\FeelAutomCorp\TiaConnect\Unity.Abstractions.dll
            • Size 63KB
            • SHA256 56c2cbf48d67078d04a3bdd824685015d6f24ebc6ad2e1f0a7528eaead33b6a4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Unity.Container.dll
            • Path C:\Program Files\FeelAutomCorp\TiaConnect\Unity.Container.dll
            • Size 142KB
            • SHA256 fc3b006fd249542d2001f8e6c9e0f1ab813dcbd6facb54b0645d0a85c77c7a5c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            appsettings.json
            • Path C:\Program Files\FeelAutomCorp\TiaConnect\appsettings.json
            • Size 1KB
            • SHA256 2ba466784f61b9a00e30df96845457bd50805df3e5e338afcbb90cb49ead0eaf
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            setup-report.json
            • Path C:\ProgramData\FeelAutomCorp\TiaConnect\setup-report.json
            • Size 298B
            • SHA256 7b90450577fd445c5dcddd599d67489bebd684aaaa0a36478c95c03da7ff8da1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            api.log
            • Path C:\Users\Admin\AppData\Local\FeelAutomCorp\T-IA-Connect\logs\api.log
            • Size 180B
            • SHA256 8a91abc1c0a43045982d884873822c958fa2fceaa0171a52264fc0b4bd2636d3
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            api.log
            • Path C:\Users\Admin\AppData\Local\FeelAutomCorp\T-IA-Connect\logs\api.log
            • Size 2KB
            • SHA256 908baa1710afb5ac3106058f1b741655c3ffd76cc32b86d38a7ec47d5f4bd2cd
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            api.log
            • Path C:\Users\Admin\AppData\Local\FeelAutomCorp\T-IA-Connect\logs\api.log
            • Size 4KB
            • SHA256 3bdbeb31df0f284beabe7eab3243f79c1e75b0bc7450f7fc621419a73f2492d1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSI1446.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\MSI1446.tmp
            • Size 179KB
            • SHA256 a3ed7ff3e2a7281672708d9a56579ec5f3d6a341920524c390aa1f4db0a54b7b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSIAE16.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\MSIAE16.tmp
            • Size 341KB
            • SHA256 f3f449f427e49d1f9321b834e6b37582628afe81a7072d20616365325a3e9950
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSIC886.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\MSIC886.tmp
            • Size 218KB
            • SHA256 29433e5927dd3ff7ceb351aa6e5ad5ac31b9309136703425bfae09b68a29db7b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            TiaConnect-Setup.msi
            • Path C:\Users\Admin\AppData\Local\Temp\TiaConnect-Setup.msi
            • Size 27.5MB
            • SHA256 1670d044aa46c11cc7c733c12142362755e02e4507ad9782ff9e14626b8a4382
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            NetCoreCheck.exe
            • Path C:\Users\Admin\AppData\Local\Temp\{84FBF7E3-C337-4340-963C-DF5DA639A424}\NetCoreCheck.exe
            • Size 142KB
            • SHA256 8d8f90ca3adc53d7862e82c72522674d4fee14d2b08566d378e46371d5db7f2a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Test240765296.runtimeconfig.json
            • Path C:\Users\Admin\AppData\Local\Temp\{84FBF7E3-C337-4340-963C-DF5DA639A424}\Test240765296.runtimeconfig.json
            • Size 127B
            • SHA256 ad5da54c5b11ac03367eccd54fe8ee58cf6ac4e12536770683d17dc13609885d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            MSI7021.tmp
            • Path C:\Windows\Installer\MSI7021.tmp
            • Size 394KB
            • SHA256 50bbf22db97433456a4307211b99641740f20a6421bcee32216fa888feaa7b2c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            metadata-2
            • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
            • Size 26.1MB
            • SHA256 02e29e4dfd88902e43d46b694d703d2392716cf87acb8302ce565755806f8fe0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            {59e16969-6894-42c8-92dd-e17b17fc5b39}_OnDiskSnapshotProp
            • Path \??\Volume{c4eee659-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{59e16969-6894-42c8-92dd-e17b17fc5b39}_OnDiskSnapshotProp
            • Size 6KB
            • SHA256 df968a6df7a6ca02013cac9a7e55911525f02b3dbfc0e06f833493a8a8c608e3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/1400-7-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
            Download

            memory/1400-23-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
            Download

            memory/1400-1-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
            Download

            memory/1400-2-0x0000000000F20000-0x0000000002AAE000-memory.dmp
            Download

            memory/1400-0-0x00007FFDFB5AF000-0x00007FFDFB5B0000-memory.dmp
            Download

            memory/1400-4-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
            Download

            memory/1400-5-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
            Download

            memory/1400-6-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
            Download

            memory/1400-795-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
            Download

            memory/1400-8-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
            Download

            memory/3140-760-0x000002AF6BA10000-0x000002AF6BA32000-memory.dmp
            Download

            memory/3140-765-0x000002AF6BA90000-0x000002AF6BA9A000-memory.dmp
            Download

            memory/3140-763-0x000002AF6BA70000-0x000002AF6BA8E000-memory.dmp
            Download

            memory/3140-764-0x000002AF6BBD0000-0x000002AF6BC82000-memory.dmp
            Download

            memory/3404-768-0x00000201EC980000-0x00000201ECA30000-memory.dmp
            Download

            memory/3404-748-0x00000201E9B60000-0x00000201E9E52000-memory.dmp
            Download

            memory/3404-750-0x00000201ECCB0000-0x00000201ED3D6000-memory.dmp
            Download

            memory/3404-754-0x00000201EBAF0000-0x00000201EBB1E000-memory.dmp
            Download

            memory/3404-757-0x00000201EC480000-0x00000201EC4CA000-memory.dmp
            Download

            memory/3404-752-0x00000201EBAA0000-0x00000201EBAC2000-memory.dmp
            Download

            memory/3512-816-0x00000295A6D50000-0x00000295A6D58000-memory.dmp
            Download

            memory/3512-832-0x00000295C10E0000-0x00000295C10FA000-memory.dmp
            Download

            memory/3512-834-0x00000295C1420000-0x00000295C1508000-memory.dmp
            Download

            memory/3512-835-0x00000295C1380000-0x00000295C13A6000-memory.dmp
            Download

            memory/3512-836-0x00000295A6DC0000-0x00000295A6DC8000-memory.dmp
            Download

            memory/3512-837-0x00000295C1100000-0x00000295C110A000-memory.dmp
            Download

            memory/3512-830-0x00000295C1290000-0x00000295C12C4000-memory.dmp
            Download

            memory/3512-840-0x00000295C27A0000-0x00000295C27F8000-memory.dmp
            Download

            memory/3512-842-0x00000295C1400000-0x00000295C1408000-memory.dmp
            Download

            memory/3512-828-0x00000295C0EB0000-0x00000295C0ECA000-memory.dmp
            Download

            memory/3512-826-0x00000295A6DA0000-0x00000295A6DB0000-memory.dmp
            Download

            memory/3512-851-0x00000295C1410000-0x00000295C1420000-memory.dmp
            Download

            memory/3512-852-0x00000295C2760000-0x00000295C277A000-memory.dmp
            Download

            memory/3512-853-0x00000295C1600000-0x00000295C1608000-memory.dmp
            Download

            memory/3512-822-0x00000295C1240000-0x00000295C1290000-memory.dmp
            Download

            memory/3512-859-0x00000295C2780000-0x00000295C2798000-memory.dmp
            Download

            memory/3512-818-0x00000295A6D60000-0x00000295A6D70000-memory.dmp
            Download

            memory/3512-861-0x00000295C2850000-0x00000295C288A000-memory.dmp
            Download

            memory/3512-862-0x00000295C2950000-0x00000295C2A0A000-memory.dmp
            Download

            memory/3512-812-0x00000295A6D20000-0x00000295A6D2E000-memory.dmp
            Download

            memory/3512-864-0x00000295C2A10000-0x00000295C2AB2000-memory.dmp
            Download

            memory/3512-867-0x00000295C6060000-0x00000295C609E000-memory.dmp
            Download

            memory/3512-868-0x00000295C2900000-0x00000295C290E000-memory.dmp
            Download

            memory/3512-810-0x00000295C0E50000-0x00000295C0E7A000-memory.dmp
            Download

            memory/3512-881-0x00000295C6B00000-0x00000295C6B08000-memory.dmp
            Download

            memory/3512-814-0x00000295A6D80000-0x00000295A6D94000-memory.dmp
            Download

            memory/3512-886-0x00000295C7740000-0x00000295C77B6000-memory.dmp
            Download

            memory/3512-808-0x00000295A6D30000-0x00000295A6D46000-memory.dmp
            Download