Overview

overview

8

Static

static

3

Zoom_Installer.msi

windows10-2004-x64

8

Zoom_Installer.msi

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    97s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/09/2026, 17:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Zoom_Installer.msi
  • Size 6.8MB
  • Sample260925-vrm8pas15l
  • SHA256 32cf96cbb407092ef2dc807d37ba538f31fb98a401a89158713ef534d65a3493
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Executes dropped EXE 3 IoCs
  • Enumerates connected drives 3 TTPs 52 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Power Settings 1 TTPs 14 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 44 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 38 IoCs
  • Modifies registry key 1 TTPs 13 IoCs
  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 41 IoCs
  • Suspicious use of SendNotifyMessage 28 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Zoom_Installer.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:4844
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2324
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:5684
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:4224
    • C:\Program Files\WSafeService\WSafeService.exe
      "C:\Program Files\WSafeService\WSafeService.exe" --service
      1⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4164
      • C:\Program Files\WSafeService\WSafeService.exe
        "C:\Program Files\WSafeService\WSafeService.exe" --server
        2⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2340
        • C:\Windows\system32\cmd.exe
          "cmd" /c "taskkill /F /IM RuntimeBroker_WinSafeService.exe"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:816
          • C:\Windows\System32\taskkill.exe
            taskkill /F /IM RuntimeBroker_WinSafeService.exe
            4⤵
            • Kills process with taskkill
            PID:2044
        • C:\Program Files\WSafeService\WSafeService.exe
          "C:\Program Files\WSafeService\WSafeService.exe" --cm
          3⤵
          • Executes dropped EXE
          PID:1320
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" -NoProfile -NonInteractive -Command "$ErrorActionPreference = 'Continue' # Power buttons: lid, power, sleep -> do nothing (0) powercfg.exe /setacvalueindex SCHEME_CURRENT SUB_BUTTONS LIDACTION 0 2>$null powercfg.exe /setdcvalueindex SCHEME_CURRENT SUB_BUTTONS LIDACTION 0 2>$null powercfg.exe /setacvalueindex SCHEME_CURRENT SUB_BUTTONS PBUTTONACTION 0 2>$null powercfg.exe /setdcvalueindex SCHEME_CURRENT SUB_BUTTONS PBUTTONACTION 0 2>$null powercfg.exe /setacvalueindex SCHEME_CURRENT SUB_BUTTONS SBUTTONACTION 0 2>$null powercfg.exe /setdcvalueindex SCHEME_CURRENT SUB_BUTTONS SBUTTONACTION 0 2>$null # Standby and hibernate timeouts: never (0) powercfg.exe /setacvalueindex SCHEME_CURRENT SUB_SLEEP STANDBY 0 2>$null powercfg.exe /setdcvalueindex SCHEME_CURRENT SUB_SLEEP STANDBY 0 2>$null powercfg.exe /setacvalueindex SCHEME_CURRENT SUB_SLEEP HIBERNATE 0 2>$null powercfg.exe /setdcvalueindex SCHEME_CURRENT SUB_SLEEP HIBERNATE 0 2>$null # Away mode: enable (1) — silenced; not all hardware supports this subkey powercfg.exe /setacvalueindex SCHEME_CURRENT SUB_SLEEP AWAYMODE 1 2>$null powercfg.exe /setdcvalueindex SCHEME_CURRENT SUB_SLEEP AWAYMODE 1 2>$null # Disable hibernate file and apply scheme powercfg.exe -h off 2>$null powercfg.exe /setactive SCHEME_CURRENT 2>$null # Policies: shutdown without logon off, lock screen off, lock workstation off reg.exe add \"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\" /v ShutdownWithoutLogon /t REG_DWORD /d 0 /f 2>&1 | Out-Null reg.exe add \"HKLM\SOFTWARE\Policies\Microsoft\Windows\Personalization\" /v NoLockScreen /t REG_DWORD /d 1 /f 2>&1 | Out-Null reg.exe add \"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\" /v DisableLockWorkstation /t REG_DWORD /d 1 /f 2>&1 | Out-Null reg.exe add \"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FlyoutMenuSettings\" /v ShowLockOption /t REG_DWORD /d 0 /f 2>&1 | Out-Null reg.exe add \"HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer\" /v ShowSleepOption /t REG_DWORD /d 0 /f 2>&1 | Out-Null reg.exe add \"HKLM\SOFTWARE\Microsoft\PolicyManager\default\Start\HideSleep\" /v value /t REG_DWORD /d 1 /f 2>&1 | Out-Null # Fast shutdown timeouts (1 ms) reg.exe add \"HKLM\SYSTEM\CurrentControlSet\Control\" /v WaitToKillAppTimeout /t REG_SZ /d 1 /f 2>&1 | Out-Null reg.exe add \"HKLM\SYSTEM\CurrentControlSet\Control\" /v HungAppTimeout /t REG_SZ /d 1 /f 2>&1 | Out-Null reg.exe add \"HKCU\Control Panel\Desktop\" /v WaitToKillAppTimeout /t REG_SZ /d 1 /f 2>&1 | Out-Null reg.exe add \"HKCU\Control Panel\Desktop\" /v HungAppTimeout /t REG_SZ /d 1 /f 2>&1 | Out-Null reg.exe add \"HKCU\Control Panel\Desktop\" /v AutoEndTasks /t REG_SZ /d 1 /f 2>&1 | Out-Null reg.exe add \"HKEY_USERS\.DEFAULT\Control Panel\Desktop\" /v WaitToKillAppTimeout /t REG_SZ /d 1 /f 2>&1 | Out-Null reg.exe add \"HKEY_USERS\.DEFAULT\Control Panel\Desktop\" /v HungAppTimeout /t REG_SZ /d 1 /f 2>&1 | Out-Null reg.exe add \"HKEY_USERS\.DEFAULT\Control Panel\Desktop\" /v AutoEndTasks /t REG_SZ /d 1 /f 2>&1 | Out-Null # Expose hidden power settings attributes reg.exe add \"HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\4f9623ff-915f-4617-bb3d-773b6748ee57\5a50326f-ece7-4ee3-98c5-77786dd618c2\" /v Attributes /t REG_DWORD /d 1 /f 2>&1 | Out-Null reg.exe add \"HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\4f9623ff-915f-4617-bb3d-773b6748ee57\96996bc0-ad50-47ec-923b-6f41874b5f70\" /v Attributes /t REG_DWORD /d 1 /f 2>&1 | Out-Null reg.exe add \"HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\238c9fa8-0aad-41ed-83f4-97be242c8f20\29f6c1db-86da-48c5-9fdb-f2b67b1f44da\" /v Attributes /t REG_DWORD /d 1 /f 2>&1 | Out-Null # Disable connected standby reg.exe add \"HKLM\SYSTEM\CurrentControlSet\Control\Power\" /v CsEnabled /t REG_DWORD /d 0 /f 2>&1 | Out-Null reg.exe add \"HKLM\SYSTEM\CurrentControlSet\Control\Power\" /v PlatformAoAcOverride /t REG_DWORD /d 0 /f 2>&1 | Out-Null # Restart Explorer shell without opening a File Explorer window if (Get-Process explorer -ErrorAction SilentlyContinue) { Stop-Process -Name explorer -Force -ErrorAction SilentlyContinue Start-Sleep -Milliseconds 1000 Start-Process \"$env:windir\explorer.exe\" -ArgumentList \"/factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding\" } Write-Output \"Keep PC Awake: all settings applied.\""
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Enumerates connected drives
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1512
          • C:\Windows\system32\powercfg.exe
            "C:\Windows\system32\powercfg.exe" /setacvalueindex SCHEME_CURRENT SUB_BUTTONS LIDACTION 0
            4⤵
            • Power Settings
            PID:1916
          • C:\Windows\system32\powercfg.exe
            "C:\Windows\system32\powercfg.exe" /setdcvalueindex SCHEME_CURRENT SUB_BUTTONS LIDACTION 0
            4⤵
            • Power Settings
            PID:6048
          • C:\Windows\system32\powercfg.exe
            "C:\Windows\system32\powercfg.exe" /setacvalueindex SCHEME_CURRENT SUB_BUTTONS PBUTTONACTION 0
            4⤵
            • Power Settings
            PID:2648
          • C:\Windows\system32\powercfg.exe
            "C:\Windows\system32\powercfg.exe" /setdcvalueindex SCHEME_CURRENT SUB_BUTTONS PBUTTONACTION 0
            4⤵
            • Power Settings
            PID:2316
          • C:\Windows\system32\powercfg.exe
            "C:\Windows\system32\powercfg.exe" /setacvalueindex SCHEME_CURRENT SUB_BUTTONS SBUTTONACTION 0
            4⤵
            • Power Settings
            PID:3632
          • C:\Windows\system32\powercfg.exe
            "C:\Windows\system32\powercfg.exe" /setdcvalueindex SCHEME_CURRENT SUB_BUTTONS SBUTTONACTION 0
            4⤵
            • Power Settings
            PID:5080
          • C:\Windows\system32\powercfg.exe
            "C:\Windows\system32\powercfg.exe" /setacvalueindex SCHEME_CURRENT SUB_SLEEP STANDBY 0
            4⤵
            • Power Settings
            PID:5336
          • C:\Windows\system32\powercfg.exe
            "C:\Windows\system32\powercfg.exe" /setdcvalueindex SCHEME_CURRENT SUB_SLEEP STANDBY 0
            4⤵
            • Power Settings
            PID:5732
          • C:\Windows\system32\powercfg.exe
            "C:\Windows\system32\powercfg.exe" /setacvalueindex SCHEME_CURRENT SUB_SLEEP HIBERNATE 0
            4⤵
            • Power Settings
            PID:3640
          • C:\Windows\system32\powercfg.exe
            "C:\Windows\system32\powercfg.exe" /setdcvalueindex SCHEME_CURRENT SUB_SLEEP HIBERNATE 0
            4⤵
            • Power Settings
            PID:564
          • C:\Windows\system32\powercfg.exe
            "C:\Windows\system32\powercfg.exe" /setacvalueindex SCHEME_CURRENT SUB_SLEEP AWAYMODE 1
            4⤵
            • Power Settings
            PID:1588
          • C:\Windows\system32\powercfg.exe
            "C:\Windows\system32\powercfg.exe" /setdcvalueindex SCHEME_CURRENT SUB_SLEEP AWAYMODE 1
            4⤵
            • Power Settings
            PID:2844
          • C:\Windows\system32\powercfg.exe
            "C:\Windows\system32\powercfg.exe" -h off
            4⤵
            • Power Settings
            PID:1344
          • C:\Windows\system32\powercfg.exe
            "C:\Windows\system32\powercfg.exe" /setactive SCHEME_CURRENT
            4⤵
            • Power Settings
            PID:2964
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ShutdownWithoutLogon /t REG_DWORD /d 0 /f
            4⤵
            • Modifies registry key
            PID:2492
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\Personalization /v NoLockScreen /t REG_DWORD /d 1 /f
            4⤵
            • Modifies registry key
            PID:3580
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
            4⤵
            • Modifies registry key
            PID:5520
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FlyoutMenuSettings /v ShowLockOption /t REG_DWORD /d 0 /f
            4⤵
            • Modifies registry key
            PID:4144
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer /v ShowSleepOption /t REG_DWORD /d 0 /f
            4⤵
            • Modifies registry key
            PID:5060
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Microsoft\PolicyManager\default\Start\HideSleep /v value /t REG_DWORD /d 1 /f
            4⤵
            • Modifies registry key
            PID:2236
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SYSTEM\CurrentControlSet\Control /v WaitToKillAppTimeout /t REG_SZ /d 1 /f
            4⤵
            • Modifies registry key
            PID:3776
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SYSTEM\CurrentControlSet\Control /v HungAppTimeout /t REG_SZ /d 1 /f
            4⤵
            • Modifies registry key
            PID:5164
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKCU\Control Panel\Desktop" /v WaitToKillAppTimeout /t REG_SZ /d 1 /f
            4⤵
            • Modifies data under HKEY_USERS
            PID:5728
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKCU\Control Panel\Desktop" /v HungAppTimeout /t REG_SZ /d 1 /f
            4⤵
            • Modifies data under HKEY_USERS
            PID:4920
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKCU\Control Panel\Desktop" /v AutoEndTasks /t REG_SZ /d 1 /f
            4⤵
            • Modifies data under HKEY_USERS
            PID:476
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKEY_USERS\.DEFAULT\Control Panel\Desktop" /v WaitToKillAppTimeout /t REG_SZ /d 1 /f
            4⤵
            • Modifies data under HKEY_USERS
            PID:4384
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKEY_USERS\.DEFAULT\Control Panel\Desktop" /v HungAppTimeout /t REG_SZ /d 1 /f
            4⤵
            • Modifies data under HKEY_USERS
            PID:4688
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKEY_USERS\.DEFAULT\Control Panel\Desktop" /v AutoEndTasks /t REG_SZ /d 1 /f
            4⤵
            • Modifies data under HKEY_USERS
            PID:4848
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\4f9623ff-915f-4617-bb3d-773b6748ee57\5a50326f-ece7-4ee3-98c5-77786dd618c2 /v Attributes /t REG_DWORD /d 1 /f
            4⤵
            • Modifies registry key
            PID:4520
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\4f9623ff-915f-4617-bb3d-773b6748ee57\96996bc0-ad50-47ec-923b-6f41874b5f70 /v Attributes /t REG_DWORD /d 1 /f
            4⤵
            • Modifies registry key
            PID:1492
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\238c9fa8-0aad-41ed-83f4-97be242c8f20\29f6c1db-86da-48c5-9fdb-f2b67b1f44da /v Attributes /t REG_DWORD /d 1 /f
            4⤵
            • Modifies registry key
            PID:540
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SYSTEM\CurrentControlSet\Control\Power /v CsEnabled /t REG_DWORD /d 0 /f
            4⤵
            • Modifies registry key
            PID:4132
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SYSTEM\CurrentControlSet\Control\Power /v PlatformAoAcOverride /t REG_DWORD /d 0 /f
            4⤵
            • Modifies registry key
            PID:3148
          • C:\Windows\explorer.exe
            "C:\Windows\explorer.exe" /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
            4⤵
            • Drops file in System32 directory
            • Checks processor information in registry
            • Modifies data under HKEY_USERS
            • Suspicious use of SetWindowsHookEx
            PID:4740
    • C:\Windows\system32\userinit.exe
      C:\Windows\system32\userinit.exe
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1696
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        2⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:4580
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4628
    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:5584
    • C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
      1⤵
        PID:5164

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e59b7be.rbs
            • Path C:\Config.Msi\e59b7be.rbs
            • Size 7KB
            • SHA256 33a1cb6fc6af8b1973bf96557eb444d451860ab77e1b3eabcec1c3f5678f59f2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WSafeService.exe
            • Path C:\Program Files\WSafeService\WSafeService.exe
            • Size 23.1MB
            • SHA256 41cad2f4d7d7e82834f0b0f9aab91f72021f77057bc081e0c23ac3de039ce4f9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            prep_Activatable Class_Hermes_perf.cache
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
            • Size 607B
            • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            WinBaseConsole2.1320_ThreadId(1)_1790356502384136000
            • Path C:\Users\Admin\AppData\Roaming\WinBaseConsole\config\WinBaseConsole2.1320_ThreadId(1)_1790356502384136000
            • Size 186B
            • SHA256 53e12e7cbb81bc013e3833358cd4de6b1be2cb437ce25db69c451c8c66d8b764
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            WinBaseConsole2.1320_ThreadId(1)_1790356502385036800
            • Path C:\Users\Admin\AppData\Roaming\WinBaseConsole\config\WinBaseConsole2.1320_ThreadId(1)_1790356502385036800
            • Size 240B
            • SHA256 dc3bb7556a322a627223f7ee89f3b4402b0ed0ea2ed3d345793876ad42b53589
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            e59b7bd.msi
            • Path C:\Windows\Installer\e59b7bd.msi
            • Size 6.8MB
            • SHA256 32cf96cbb407092ef2dc807d37ba538f31fb98a401a89158713ef534d65a3493
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            metadata-2
            • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
            • Size 26.1MB
            • SHA256 66ffff3a6c0de1c4ae34facd8c4692ec9b4abc20a1eeba90b01727ce213d82e5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            {cffcfbdf-a0cc-4b56-99b3-edaf98fbab3a}_OnDiskSnapshotProp
            • Path \??\Volume{e35bb194-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{cffcfbdf-a0cc-4b56-99b3-edaf98fbab3a}_OnDiskSnapshotProp
            • Size 6KB
            • SHA256 35c43daa01c91cdc38f7328580eae1bc3c4dbd1383ba2353b28bffcb9a8f1a70
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/1512-162-0x000001F9D8A80000-0x000001F9D8AA2000-memory.dmp
            Download

            memory/4628-359-0x000002284C000000-0x000002284C434000-memory.dmp
            Download

            memory/5584-186-0x00000232801E0000-0x00000232802E0000-memory.dmp
            Download

            memory/5584-232-0x00000232846C0000-0x00000232846E0000-memory.dmp
            Download

            memory/5584-218-0x0000023283C40000-0x0000023283C60000-memory.dmp
            Download

            memory/5584-202-0x00000232839E0000-0x0000023283A00000-memory.dmp
            Download

            memory/5584-204-0x0000023283E40000-0x0000023283F40000-memory.dmp
            Download