Overview

overview

8

Static

static

3

Zoom_Installer.msi

windows10-2004-x64

8

Zoom_Installer.msi

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    137s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    25/09/2026, 17:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Zoom_Installer.msi
  • Size 6.8MB
  • Sample260925-vrm8pas15l
  • SHA256 32cf96cbb407092ef2dc807d37ba538f31fb98a401a89158713ef534d65a3493
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Executes dropped EXE 3 IoCs
  • Enumerates connected drives 3 TTPs 52 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Power Settings 1 TTPs 14 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 39 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 63 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies registry key 1 TTPs 13 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 46 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Zoom_Installer.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2336
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4556
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:1072
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:2800
    • C:\Program Files\WSafeService\WSafeService.exe
      "C:\Program Files\WSafeService\WSafeService.exe" --service
      1⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3288
      • C:\Program Files\WSafeService\WSafeService.exe
        "C:\Program Files\WSafeService\WSafeService.exe" --server
        2⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4304
        • C:\Windows\system32\cmd.exe
          "cmd" /c "taskkill /F /IM RuntimeBroker_WinSafeService.exe"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2376
          • C:\Windows\system32\taskkill.exe
            taskkill /F /IM RuntimeBroker_WinSafeService.exe
            4⤵
            • Kills process with taskkill
            PID:3920
        • C:\Program Files\WSafeService\WSafeService.exe
          "C:\Program Files\WSafeService\WSafeService.exe" --cm
          3⤵
          • Executes dropped EXE
          PID:5108
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" -NoProfile -NonInteractive -Command "$ErrorActionPreference = 'Continue' # Power buttons: lid, power, sleep -> do nothing (0) powercfg.exe /setacvalueindex SCHEME_CURRENT SUB_BUTTONS LIDACTION 0 2>$null powercfg.exe /setdcvalueindex SCHEME_CURRENT SUB_BUTTONS LIDACTION 0 2>$null powercfg.exe /setacvalueindex SCHEME_CURRENT SUB_BUTTONS PBUTTONACTION 0 2>$null powercfg.exe /setdcvalueindex SCHEME_CURRENT SUB_BUTTONS PBUTTONACTION 0 2>$null powercfg.exe /setacvalueindex SCHEME_CURRENT SUB_BUTTONS SBUTTONACTION 0 2>$null powercfg.exe /setdcvalueindex SCHEME_CURRENT SUB_BUTTONS SBUTTONACTION 0 2>$null # Standby and hibernate timeouts: never (0) powercfg.exe /setacvalueindex SCHEME_CURRENT SUB_SLEEP STANDBY 0 2>$null powercfg.exe /setdcvalueindex SCHEME_CURRENT SUB_SLEEP STANDBY 0 2>$null powercfg.exe /setacvalueindex SCHEME_CURRENT SUB_SLEEP HIBERNATE 0 2>$null powercfg.exe /setdcvalueindex SCHEME_CURRENT SUB_SLEEP HIBERNATE 0 2>$null # Away mode: enable (1) — silenced; not all hardware supports this subkey powercfg.exe /setacvalueindex SCHEME_CURRENT SUB_SLEEP AWAYMODE 1 2>$null powercfg.exe /setdcvalueindex SCHEME_CURRENT SUB_SLEEP AWAYMODE 1 2>$null # Disable hibernate file and apply scheme powercfg.exe -h off 2>$null powercfg.exe /setactive SCHEME_CURRENT 2>$null # Policies: shutdown without logon off, lock screen off, lock workstation off reg.exe add \"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\" /v ShutdownWithoutLogon /t REG_DWORD /d 0 /f 2>&1 | Out-Null reg.exe add \"HKLM\SOFTWARE\Policies\Microsoft\Windows\Personalization\" /v NoLockScreen /t REG_DWORD /d 1 /f 2>&1 | Out-Null reg.exe add \"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\" /v DisableLockWorkstation /t REG_DWORD /d 1 /f 2>&1 | Out-Null reg.exe add \"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FlyoutMenuSettings\" /v ShowLockOption /t REG_DWORD /d 0 /f 2>&1 | Out-Null reg.exe add \"HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer\" /v ShowSleepOption /t REG_DWORD /d 0 /f 2>&1 | Out-Null reg.exe add \"HKLM\SOFTWARE\Microsoft\PolicyManager\default\Start\HideSleep\" /v value /t REG_DWORD /d 1 /f 2>&1 | Out-Null # Fast shutdown timeouts (1 ms) reg.exe add \"HKLM\SYSTEM\CurrentControlSet\Control\" /v WaitToKillAppTimeout /t REG_SZ /d 1 /f 2>&1 | Out-Null reg.exe add \"HKLM\SYSTEM\CurrentControlSet\Control\" /v HungAppTimeout /t REG_SZ /d 1 /f 2>&1 | Out-Null reg.exe add \"HKCU\Control Panel\Desktop\" /v WaitToKillAppTimeout /t REG_SZ /d 1 /f 2>&1 | Out-Null reg.exe add \"HKCU\Control Panel\Desktop\" /v HungAppTimeout /t REG_SZ /d 1 /f 2>&1 | Out-Null reg.exe add \"HKCU\Control Panel\Desktop\" /v AutoEndTasks /t REG_SZ /d 1 /f 2>&1 | Out-Null reg.exe add \"HKEY_USERS\.DEFAULT\Control Panel\Desktop\" /v WaitToKillAppTimeout /t REG_SZ /d 1 /f 2>&1 | Out-Null reg.exe add \"HKEY_USERS\.DEFAULT\Control Panel\Desktop\" /v HungAppTimeout /t REG_SZ /d 1 /f 2>&1 | Out-Null reg.exe add \"HKEY_USERS\.DEFAULT\Control Panel\Desktop\" /v AutoEndTasks /t REG_SZ /d 1 /f 2>&1 | Out-Null # Expose hidden power settings attributes reg.exe add \"HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\4f9623ff-915f-4617-bb3d-773b6748ee57\5a50326f-ece7-4ee3-98c5-77786dd618c2\" /v Attributes /t REG_DWORD /d 1 /f 2>&1 | Out-Null reg.exe add \"HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\4f9623ff-915f-4617-bb3d-773b6748ee57\96996bc0-ad50-47ec-923b-6f41874b5f70\" /v Attributes /t REG_DWORD /d 1 /f 2>&1 | Out-Null reg.exe add \"HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\238c9fa8-0aad-41ed-83f4-97be242c8f20\29f6c1db-86da-48c5-9fdb-f2b67b1f44da\" /v Attributes /t REG_DWORD /d 1 /f 2>&1 | Out-Null # Disable connected standby reg.exe add \"HKLM\SYSTEM\CurrentControlSet\Control\Power\" /v CsEnabled /t REG_DWORD /d 0 /f 2>&1 | Out-Null reg.exe add \"HKLM\SYSTEM\CurrentControlSet\Control\Power\" /v PlatformAoAcOverride /t REG_DWORD /d 0 /f 2>&1 | Out-Null # Restart Explorer shell without opening a File Explorer window if (Get-Process explorer -ErrorAction SilentlyContinue) { Stop-Process -Name explorer -Force -ErrorAction SilentlyContinue Start-Sleep -Milliseconds 1000 Start-Process \"$env:windir\explorer.exe\" -ArgumentList \"/factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding\" } Write-Output \"Keep PC Awake: all settings applied.\""
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Enumerates connected drives
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3896
          • C:\Windows\system32\powercfg.exe
            "C:\Windows\system32\powercfg.exe" /setacvalueindex SCHEME_CURRENT SUB_BUTTONS LIDACTION 0
            4⤵
            • Power Settings
            PID:3804
          • C:\Windows\system32\powercfg.exe
            "C:\Windows\system32\powercfg.exe" /setdcvalueindex SCHEME_CURRENT SUB_BUTTONS LIDACTION 0
            4⤵
            • Power Settings
            PID:2164
          • C:\Windows\system32\powercfg.exe
            "C:\Windows\system32\powercfg.exe" /setacvalueindex SCHEME_CURRENT SUB_BUTTONS PBUTTONACTION 0
            4⤵
            • Power Settings
            PID:3724
          • C:\Windows\system32\powercfg.exe
            "C:\Windows\system32\powercfg.exe" /setdcvalueindex SCHEME_CURRENT SUB_BUTTONS PBUTTONACTION 0
            4⤵
            • Power Settings
            PID:1940
          • C:\Windows\system32\powercfg.exe
            "C:\Windows\system32\powercfg.exe" /setacvalueindex SCHEME_CURRENT SUB_BUTTONS SBUTTONACTION 0
            4⤵
            • Power Settings
            PID:1652
          • C:\Windows\system32\powercfg.exe
            "C:\Windows\system32\powercfg.exe" /setdcvalueindex SCHEME_CURRENT SUB_BUTTONS SBUTTONACTION 0
            4⤵
            • Power Settings
            PID:2736
          • C:\Windows\system32\powercfg.exe
            "C:\Windows\system32\powercfg.exe" /setacvalueindex SCHEME_CURRENT SUB_SLEEP STANDBY 0
            4⤵
            • Power Settings
            PID:3816
          • C:\Windows\system32\powercfg.exe
            "C:\Windows\system32\powercfg.exe" /setdcvalueindex SCHEME_CURRENT SUB_SLEEP STANDBY 0
            4⤵
            • Power Settings
            PID:824
          • C:\Windows\system32\powercfg.exe
            "C:\Windows\system32\powercfg.exe" /setacvalueindex SCHEME_CURRENT SUB_SLEEP HIBERNATE 0
            4⤵
            • Power Settings
            PID:928
          • C:\Windows\system32\powercfg.exe
            "C:\Windows\system32\powercfg.exe" /setdcvalueindex SCHEME_CURRENT SUB_SLEEP HIBERNATE 0
            4⤵
            • Power Settings
            PID:4752
          • C:\Windows\system32\powercfg.exe
            "C:\Windows\system32\powercfg.exe" /setacvalueindex SCHEME_CURRENT SUB_SLEEP AWAYMODE 1
            4⤵
            • Power Settings
            PID:948
          • C:\Windows\system32\powercfg.exe
            "C:\Windows\system32\powercfg.exe" /setdcvalueindex SCHEME_CURRENT SUB_SLEEP AWAYMODE 1
            4⤵
            • Power Settings
            PID:3080
          • C:\Windows\system32\powercfg.exe
            "C:\Windows\system32\powercfg.exe" -h off
            4⤵
            • Power Settings
            PID:1952
          • C:\Windows\system32\powercfg.exe
            "C:\Windows\system32\powercfg.exe" /setactive SCHEME_CURRENT
            4⤵
            • Power Settings
            PID:5060
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ShutdownWithoutLogon /t REG_DWORD /d 0 /f
            4⤵
            • Modifies registry key
            PID:1004
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\Personalization /v NoLockScreen /t REG_DWORD /d 1 /f
            4⤵
            • Modifies registry key
            PID:2236
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
            4⤵
            • Modifies registry key
            PID:2008
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FlyoutMenuSettings /v ShowLockOption /t REG_DWORD /d 0 /f
            4⤵
            • Modifies registry key
            PID:4040
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer /v ShowSleepOption /t REG_DWORD /d 0 /f
            4⤵
            • Modifies registry key
            PID:1036
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Microsoft\PolicyManager\default\Start\HideSleep /v value /t REG_DWORD /d 1 /f
            4⤵
            • Modifies registry key
            PID:3268
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SYSTEM\CurrentControlSet\Control /v WaitToKillAppTimeout /t REG_SZ /d 1 /f
            4⤵
            • Modifies registry key
            PID:3636
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SYSTEM\CurrentControlSet\Control /v HungAppTimeout /t REG_SZ /d 1 /f
            4⤵
            • Modifies registry key
            PID:2744
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKCU\Control Panel\Desktop" /v WaitToKillAppTimeout /t REG_SZ /d 1 /f
            4⤵
            • Modifies data under HKEY_USERS
            PID:1564
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKCU\Control Panel\Desktop" /v HungAppTimeout /t REG_SZ /d 1 /f
            4⤵
            • Modifies data under HKEY_USERS
            PID:3024
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKCU\Control Panel\Desktop" /v AutoEndTasks /t REG_SZ /d 1 /f
            4⤵
            • Modifies data under HKEY_USERS
            PID:2644
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKEY_USERS\.DEFAULT\Control Panel\Desktop" /v WaitToKillAppTimeout /t REG_SZ /d 1 /f
            4⤵
            • Modifies data under HKEY_USERS
            PID:1400
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKEY_USERS\.DEFAULT\Control Panel\Desktop" /v HungAppTimeout /t REG_SZ /d 1 /f
            4⤵
            • Modifies data under HKEY_USERS
            PID:4652
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKEY_USERS\.DEFAULT\Control Panel\Desktop" /v AutoEndTasks /t REG_SZ /d 1 /f
            4⤵
            • Modifies data under HKEY_USERS
            PID:2068
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\4f9623ff-915f-4617-bb3d-773b6748ee57\5a50326f-ece7-4ee3-98c5-77786dd618c2 /v Attributes /t REG_DWORD /d 1 /f
            4⤵
            • Modifies registry key
            PID:3560
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\4f9623ff-915f-4617-bb3d-773b6748ee57\96996bc0-ad50-47ec-923b-6f41874b5f70 /v Attributes /t REG_DWORD /d 1 /f
            4⤵
            • Modifies registry key
            PID:452
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\238c9fa8-0aad-41ed-83f4-97be242c8f20\29f6c1db-86da-48c5-9fdb-f2b67b1f44da /v Attributes /t REG_DWORD /d 1 /f
            4⤵
            • Modifies registry key
            PID:3736
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SYSTEM\CurrentControlSet\Control\Power /v CsEnabled /t REG_DWORD /d 0 /f
            4⤵
            • Modifies registry key
            PID:2932
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SYSTEM\CurrentControlSet\Control\Power /v PlatformAoAcOverride /t REG_DWORD /d 0 /f
            4⤵
            • Modifies registry key
            PID:2732
          • C:\Windows\explorer.exe
            "C:\Windows\explorer.exe" /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
            4⤵
            • Drops file in System32 directory
            • Checks processor information in registry
            • Modifies data under HKEY_USERS
            PID:3256
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2428
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:176
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2056

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e58e03a.rbs
          • Path C:\Config.Msi\e58e03a.rbs
          • Size 7KB
          • SHA256 f5b7329c4f3f5913b2635350db2b60d4e196c818ba218bdbbbcf732add960f4a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WSafeService.exe
          • Path C:\Program Files\WSafeService\WSafeService.exe
          • Size 23.1MB
          • SHA256 41cad2f4d7d7e82834f0b0f9aab91f72021f77057bc081e0c23ac3de039ce4f9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AppCache134348300949767436.txt.~tmp
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134348300949767436.txt.~tmp
          • Size 84KB
          • SHA256 06d89be5be35d76ac7d9f6171c8f322673acd1dd6f686d5f282a1ca72f9eb77c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CortanaUnifiedTileModelCache.dat
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
          • Size 21KB
          • SHA256 5d41361efc5d597b11c10570290b15bb1cd5151bcef58f1191bced3070c6b1e6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WinBaseConsole2.5108_ThreadId(1)_1790356481800819100
          • Path C:\Users\Admin\AppData\Roaming\WinBaseConsole\config\WinBaseConsole2.5108_ThreadId(1)_1790356481800819100
          • Size 186B
          • SHA256 53e12e7cbb81bc013e3833358cd4de6b1be2cb437ce25db69c451c8c66d8b764
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          WinBaseConsole2.5108_ThreadId(1)_1790356481801437700
          • Path C:\Users\Admin\AppData\Roaming\WinBaseConsole\config\WinBaseConsole2.5108_ThreadId(1)_1790356481801437700
          • Size 240B
          • SHA256 eac9d88108479b50446fbd063eef2585d915d3a6ab6cca00fe72eec1a2a88a4b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          e58e039.msi
          • Path C:\Windows\Installer\e58e039.msi
          • Size 6.8MB
          • SHA256 32cf96cbb407092ef2dc807d37ba538f31fb98a401a89158713ef534d65a3493
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          __PSScriptPolicyTest_pu2uhmmq.rro.ps1
          • Path C:\Windows\Temp\__PSScriptPolicyTest_pu2uhmmq.rro.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 24.1MB
          • SHA256 2c1f73ae8873d5ca868f82e5bb55da7111b0fd12a7a8f45a590a2982763a6b08
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          {7eac6d4a-289c-414c-b67d-d0d4cd4e1d73}_OnDiskSnapshotProp
          • Path \??\Volume{9f840213-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{7eac6d4a-289c-414c-b67d-d0d4cd4e1d73}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 2d5bb70497bfeaf3e30c99d6cf849f062db6ec900f5001d78b67b33ccd677aba
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/2056-182-0x0000019688B00000-0x0000019688C00000-memory.dmp
          Download

          memory/2056-183-0x0000019688B00000-0x0000019688C00000-memory.dmp
          Download

          memory/2056-187-0x0000019689AB0000-0x0000019689AD0000-memory.dmp
          Download

          memory/2056-196-0x0000019689A70000-0x0000019689A90000-memory.dmp
          Download

          memory/2056-218-0x0000019689E80000-0x0000019689EA0000-memory.dmp
          Download

          memory/2056-380-0x0000018E86DB0000-0x0000018E886DF000-memory.dmp
          Download

          memory/2428-181-0x0000000002CE0000-0x0000000002CE1000-memory.dmp
          Download

          memory/3896-162-0x000001CFCAC70000-0x000001CFCAC92000-memory.dmp
          Download