3bab6ad7eb3f01a719fa9d8f110e924c95c234c2ea3be2df45642d28b13dfebd

Analysis

max time kernel
298s
max time network
154s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
10/11/2026, 01:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sokrt.msi
Size 7.2MB
Sample261110-b7twmaxxc1
SHA256 3bab6ad7eb3f01a719fa9d8f110e924c95c234c2ea3be2df45642d28b13dfebd
MD5 df83535c124e705be925c23709f25747
SHA1 0ad71052ed71490aff3a7254783ea75a9045cfce
SHA512 32774ad44465f369330690731090390485cb831b5bf234305083bbfb910dcc8f3adc78bce60f260ad35d2026da3bf1fe3d4d14d2fd2b84989d52bfe667e209a4
SSDEEP 196608:rppScTHZJSpPlC4mAWAtQeEdp3ZV9ii0s2qHbaz:rpMcT7SpQgftQPdVki01E+z
TLSH
T1E4763380D1972EAEDB9403368708DDA646207D392FF06A7B8561B2416FFE7177CB06B4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2545564138-786060179-1728272436-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
3472	MSBuild.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
2504	wscript.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
3472	MSBuild.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e58991e.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7D1E582C-34AB-4A3F-81C3-B5CAF5C7D634}	msiexec.exe
File created	C:\Windows\Installer\e589920.msi	msiexec.exe
File created	C:\Windows\Installer\e58991e.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9AD4.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4700	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000061aa9e1339fe41d80000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000ffffffff00000000270101000088380161aa9e130000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d083020000000000c050dc000000ffffffff000000000700010000e8410161aa9e13000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4de0000000000000005000000ffffffff000000000700010000486a6f61aa9e1300000000000090d4de000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4e30000000000000005000000ffffffff00000000070001000048ea7161aa9e1300000000000090d4e300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4724	msiexec.exe
4724	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4700	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4700	msiexec.exe
Token: SeSecurityPrivilege	4724	msiexec.exe
Token: SeCreateTokenPrivilege	4700	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4700	msiexec.exe
Token: SeLockMemoryPrivilege	4700	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4700	msiexec.exe
Token: SeMachineAccountPrivilege	4700	msiexec.exe
Token: SeTcbPrivilege	4700	msiexec.exe
Token: SeSecurityPrivilege	4700	msiexec.exe
Token: SeTakeOwnershipPrivilege	4700	msiexec.exe
Token: SeLoadDriverPrivilege	4700	msiexec.exe
Token: SeSystemProfilePrivilege	4700	msiexec.exe
Token: SeSystemtimePrivilege	4700	msiexec.exe
Token: SeProfSingleProcessPrivilege	4700	msiexec.exe
Token: SeIncBasePriorityPrivilege	4700	msiexec.exe
Token: SeCreatePagefilePrivilege	4700	msiexec.exe
Token: SeCreatePermanentPrivilege	4700	msiexec.exe
Token: SeBackupPrivilege	4700	msiexec.exe
Token: SeRestorePrivilege	4700	msiexec.exe
Token: SeShutdownPrivilege	4700	msiexec.exe
Token: SeDebugPrivilege	4700	msiexec.exe
Token: SeAuditPrivilege	4700	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4700	msiexec.exe
Token: SeChangeNotifyPrivilege	4700	msiexec.exe
Token: SeRemoteShutdownPrivilege	4700	msiexec.exe
Token: SeUndockPrivilege	4700	msiexec.exe
Token: SeSyncAgentPrivilege	4700	msiexec.exe
Token: SeEnableDelegationPrivilege	4700	msiexec.exe
Token: SeManageVolumePrivilege	4700	msiexec.exe
Token: SeImpersonatePrivilege	4700	msiexec.exe
Token: SeCreateGlobalPrivilege	4700	msiexec.exe
Token: SeBackupPrivilege	4488	vssvc.exe
Token: SeRestorePrivilege	4488	vssvc.exe
Token: SeAuditPrivilege	4488	vssvc.exe
Token: SeBackupPrivilege	4724	msiexec.exe
Token: SeRestorePrivilege	4724	msiexec.exe
Token: SeRestorePrivilege	4724	msiexec.exe
Token: SeTakeOwnershipPrivilege	4724	msiexec.exe
Token: SeRestorePrivilege	4724	msiexec.exe
Token: SeTakeOwnershipPrivilege	4724	msiexec.exe
Token: SeRestorePrivilege	4724	msiexec.exe
Token: SeTakeOwnershipPrivilege	4724	msiexec.exe
Token: SeRestorePrivilege	4724	msiexec.exe
Token: SeTakeOwnershipPrivilege	4724	msiexec.exe
Token: SeRestorePrivilege	4724	msiexec.exe
Token: SeTakeOwnershipPrivilege	4724	msiexec.exe
Token: SeRestorePrivilege	4724	msiexec.exe
Token: SeTakeOwnershipPrivilege	4724	msiexec.exe
Token: SeRestorePrivilege	4724	msiexec.exe
Token: SeTakeOwnershipPrivilege	4724	msiexec.exe
Token: SeRestorePrivilege	4724	msiexec.exe
Token: SeTakeOwnershipPrivilege	4724	msiexec.exe
Token: SeRestorePrivilege	4724	msiexec.exe
Token: SeTakeOwnershipPrivilege	4724	msiexec.exe
Token: SeRestorePrivilege	4724	msiexec.exe
Token: SeTakeOwnershipPrivilege	4724	msiexec.exe
Token: SeRestorePrivilege	4724	msiexec.exe
Token: SeTakeOwnershipPrivilege	4724	msiexec.exe
Token: SeRestorePrivilege	4724	msiexec.exe
Token: SeTakeOwnershipPrivilege	4724	msiexec.exe
Token: SeRestorePrivilege	4724	msiexec.exe
Token: SeTakeOwnershipPrivilege	4724	msiexec.exe
Token: SeRestorePrivilege	4724	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4700	msiexec.exe
4700	msiexec.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 1200	4724	msiexec.exe	97
PID 4724 wrote to memory of 2504	4724	msiexec.exe	99
PID 2504 wrote to memory of 3472	2504	wscript.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\sokrt.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4700

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1200
- C:\Windows\system32\wscript.exe
  "C:\Windows\system32\wscript.exe" //B //NoLogo "C:\Users\Admin\AppData\Local\JMicron\Storage Manager\TelemetryExporter.wsf"
  2⤵
  - Checks computer location settings
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Users\Admin\AppData\Local\JMicron\Storage Manager\MSBuild.exe
    "C:\Users\Admin\AppData\Local\JMicron\Storage Manager\MSBuild.exe" "C:\Users\Admin\AppData\Local\JMicron\Storage Manager\TelemetryExporter.csproj" /nologo /v:q /nodereuse:false
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:3472

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4488

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe
1⤵
PID:2984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Debugger Evasion

T1622

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Debugger Evasion

T1622

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58991f.rbs

Path C:\Config.Msi\e58991f.rbs
Size 12KB
SHA256 2ec9ac41c573c1bd2589b8e4c00aac6a37050756089475a5c8d4436512d083ad
MD5 44633293c7e9292c99a48ceef8ac034f
SHA1 88cf5379a41cf7343449d5a71590ae6c70e33d79
SHA512 f6a73c01cbcced88cb3363e88938e30080c70eaeee574fa35ea4a61386de85826db913aee6b8e5de7b0b03679fc09781e0c9d1a8958ca6ab89416e74390c95a6
SSDEEP 192:STntWGuoSdEqeJI/wdAI9dAn9SLAz8MQ9vUgQkBpvT2n2+2A2B2C62v21:SLpXdRdS8MQA
TLSH
T185525506F790C091D408223786B3570CFBB2E7EADB50775F4B9AD1284F02B5ADAD189E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.gitattributes

Path C:\Users\Admin\AppData\Local\JMicron\Storage Manager\.gitattributes
Size 52B
SHA256 c0e4f20c88314e4c0ea6f41e977747e07e21a2322e15c81725628b53a14ce77a
MD5 f6cef101900768b28ff9a6332b8afbc9
SHA1 d0125c1e525d7dce793928406258505b4d0f4844
SHA512 3e81c1bfd34e22cb71f5b1a73cbc129876b367f162556a773f97f45953556a67f606068f51a628e41762c4f0a8b1c6fdd8179f486e628ef039ac49c002a705ca
TLSH
T1ED900201B5455755A45020C0D422B5450164179F3262D078095AA980B0901A86D291E5
MD5 SHA1 SHA512 TLSH

Submit Download

.gitignore

Path C:\Users\Admin\AppData\Local\JMicron\Storage Manager\.gitignore
Size 66B
SHA256 da94df32f9751d635aaaf89c41868815af3d7df3b03e2be9d471db6be3e271cd
MD5 d6e586ea4294851b2b1b5fc443b54c33
SHA1 b384a6c9ec65b063a930348bc5eee60f918e6711
SHA512 bdfabe593d5193c5d46f2e9a35eb2f3110c8cced9e2f5ea08f9fd8487f2c79e018595df2dd15259a927ffd880977c30df2f84b7a3e8e5c4dcee5aceefe2eb3be
TLSH
T138A0220080B023202C8A00C3F2322008E30820BC208BA0B3AE82E332BA08A003300028
MD5 SHA1 SHA512 TLSH

Submit Download

AssemblyInfo.cs

Path C:\Users\Admin\AppData\Local\JMicron\Storage Manager\AssemblyInfo.cs
Size 463B
SHA256 ac9291e755d30e1193d1bbb3480d82c4c540e8c302acbc3fc3185651371db7ef
MD5 92083412f533ac27572af64bc1f5ddba
SHA1 9bd50b9960a7b428f1a5a231c606a3eb69bc92d9
SHA512 c7cebeecb4c93e60a0ba0a92e2ca6e4c452613d1b2f96f26b403af3539a68d2fc98aacaecd965272cd3d3a2a3fd17a041c262d13188532ace58ec7b329138290
TLSH
T1D9F0276C9209635CEF0020E3BDA3B0C8435F733002E94D0161EC3D13F8167B06064225
MD5 SHA1 SHA512 TLSH

Submit Download

Build.targets

Path C:\Users\Admin\AppData\Local\JMicron\Storage Manager\Build.targets
Size 4KB
SHA256 30f7dfde8a9fb5f2d62a8649058e197642f0d4a3d930dbeb19cfe18dfc1e6e5d
MD5 c44b041497040066db5b40408656084b
SHA1 7bd2502a69957e1ee96b66a3e1c7d88a98881b40
SHA512 a53020c48bcfcc2f530e1e2cb280cde91f4b9dc320638ae4be9336d84d5db8284ee46e21eeb9b37c44ccfeeba4ead9b13552a229425d8eb0a9e3cecf0b61fe05
SSDEEP 96:8sHaZl9rnyLS3kxEt330Mf66Oyuae2+nessziVypP4BrWmQIARh:laNeHsp5WrWmfah
TLSH
T1C581F222B7F1A09913C5FB867350CA423A36EDB106A178B0E6B6ED19C1534A46FAF01D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CHANGELOG.md

Path C:\Users\Admin\AppData\Local\JMicron\Storage Manager\CHANGELOG.md
Size 735B
SHA256 7a4882d50bc66837599d0271bc6b58d5985f7e3fba8f367e61a42c73c0c23b15
MD5 1af6dded1c98e9032a6c4b1f3bb1e656
SHA1 6aa6c12b936b45e7d3ebfb7ffafcdff335dd9a2c
SHA512 b149c704089a63757228cd8afad7e2a19ddc8823517e6e340a652aa8ada7943258eb5168689fa42f435f077e4193960606164e3b963cfc097dd27440034fd612
TLSH
T190015E9613B7C02039BB80A67C1273E55908E59386864D9DF5182599C3E65B1CEED31D
MD5 SHA1 SHA512 TLSH

Submit Download

CONTRIBUTORS

Path C:\Users\Admin\AppData\Local\JMicron\Storage Manager\CONTRIBUTORS
Size 50B
SHA256 97996a4b7918629ea064dbc4291dd03fda8e39d2ce55184f12381780d8751ccc
MD5 f77f0356fb47e6bea221b2d6069b86c7
SHA1 c18f2dc778f2f398787bd5b7916b2a2c388aee48
SHA512 9f44ad11506f67c50be01f96b919a57ecbf38969737de7cb94ec2fe29205bb9af6468895143a817f54e5ba0e4df13bc9bdf967c01132f99b8b0045d68f26372e
TLSH
T1A890023554561720888801446345245D704058D6057107F335C71585944F8412734028
MD5 SHA1 SHA512 TLSH

Submit Download

Defaults.props

Path C:\Users\Admin\AppData\Local\JMicron\Storage Manager\Defaults.props
Size 2KB
SHA256 81f53e2e58da5d425c47b2da1ef7448187079b99be57a2b208a26542c359cc7d
MD5 6b8a994250c172c96ebad7ce60af5f8c
SHA1 c24498dccdd1dcc6cebb217bc1dbf331ebffd909
SHA512 36b1dcbe06da199138d54ecd741caa0f25e067f99ab1f0beea7ffe94bba59592f59c31b01fec892149a678dd1cde9c627b890e95e4c8b61b31b5d7f48144d35e
TLSH
T10F5173B826D46B3A596303FE20B9B520DA7F65B3225524CC39CD880E7B220782E77661
MD5 SHA1 SHA512 TLSH

Submit Download

Directory.Build.props

Path C:\Users\Admin\AppData\Local\JMicron\Storage Manager\Directory.Build.props
Size 274B
SHA256 e2d57d93edf616586052c3d8e02357e0ead041f3a159a450660983ee56902a72
MD5 9499a6acb612504b0df83847192f831d
SHA1 47114dd428304bd615b371ac2c7bd08d0448e863
SHA512 e80ae61cb9279823c1c37efa09009350ad516e2961447d5897b7a7a698aa2e7f376d1e97b34af0e7a0130f2e0c5f19b152ab37607ca1a2784a9d39f864869e91
TLSH
T111D05E16AFC17A355EF0A02846366A68EB9BA26208710834B6CEC84F879680D5933B31
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\JMicron\Storage Manager\LICENSE
Size 1KB
SHA256 1191e8c19c5bd6342333e1fd19303c99e7b91d81bc32b0ba035d3aa90cf14165
MD5 c9c0ae27a02033ea3d1db8b79d6de316
SHA1 31e0279314bb7d0800c2d8eea978c0b355b61664
SHA512 c152ead4094f2ef203405500f0e0667a752cc2568d60373058bd61c1a964fc647bab761ff8087b7eb25c6166b4c0e3623fdea9e20dbb7ca378c03bbdf3bde007
TLSH
T12711B61E72590373288227A015A8ECC5F22BB04B7FAB1980302DF2051326458C5FFC64
MD5 SHA1 SHA512 TLSH

Submit Download

MSBuild.exe

Path C:\Users\Admin\AppData\Local\JMicron\Storage Manager\MSBuild.exe
Size 249KB
SHA256 9db50ddab4741de2d1cc38a3848deb1f398f76bed50cec6e48259420c588e0fb
MD5 cf5fd85adaa17b174e9a28f84881d449
SHA1 ff52bacfa66532d03dd6ef59b9b356253ed2a6e4
SHA512 88244592239881fa90a69d76b2b17b8742afe2e8b89f688fc0ab7995e3328cf55628eeae86fe84fe50c64f7c8734a73fcff42b87d680b7546409f5eeca01a2c5
SSDEEP 3072:+DEKKwBWmSEoRooC7GvORoQYiY35e8w2XpFU4rwOe+ZbZEFf02RFivFuv4GuhK:oHK2W0u1tvORstRXfM102bicw4
TLSH
T1B2445A01A7EC4615F6FF1A78B8B015158B76F867E866E35E388C61AC1F73740EA60363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

README.md

Path C:\Users\Admin\AppData\Local\JMicron\Storage Manager\README.md
Size 587B
SHA256 4a9cfe0874f1bc749095f559f9c1aa01add004f94410f725b11907b1f51a65bb
MD5 f9057827748d796a128f6afd505b78a3
SHA1 3e56f5adbc00596e5cb499cee35b0fe75d2556ba
SHA512 c33b7f2f76c67e1fd24bf290a7b740b8eb167e9a97809cc93f7a819d9f45c1117710718d1531527d9ccf16ad5615db2c7bef6b2d0e0a456ea516fbcda90a14a4
TLSH
T177F0AC7BD3AA93B23D332826207093D2C34885376D918A10364906B9316BE51B5BE38D
MD5 SHA1 SHA512 TLSH

Submit Download

Resources.resx

Path C:\Users\Admin\AppData\Local\JMicron\Storage Manager\Resources.resx
Size 16.6MB
SHA256 5f29a04a92503a5fe18a402a6769a191cc561cabc8735f32262b4ac3fe8d1043
MD5 0e608f05aa14873177497556164f7c7a
SHA1 a5bf08acba0620444701e9540f3a27b51b83cffd
SHA512 be1b0f4a953568c4cddaf83bd6c97ad37b2b0c8f658ecdd10ba666599dde4fb9ed4e39415cdc92297f487e5c1434ce5382cbb5182569beac77bdbe126559fd2f
SSDEEP 24576:dVFs6sX1pCbQMtqv6DB6EWZ4IUrx4gwMJpMeHwFAJr0ClqjyVvzo1vjCuYGg+k+T:w
TLSH
T18B07F97CA49197E99A8F84CDCE28BF584AD69D094781EC8FF3F86187452127DAF4C183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TelemetryExporter.csproj

Path C:\Users\Admin\AppData\Local\JMicron\Storage Manager\TelemetryExporter.csproj
Size 3KB
SHA256 5334b9d6d40033deb2b860fbd5c12bbee76b2ad6ec1bcf96766c88bb58bf3516
MD5 e88ed20c01fec8f4761a31d71ec0548e
SHA1 114be9d30b3291ccff2b7a11b15ec30fac6e30bc
SHA512 3a16d756f292f4d41bf9474511bee053def48c7fd43b898e50d76e734a52d5351c8a91c489d956d3ce39ce250420f06fc8fb45b3ac39f8a2293c5e372ad07d59
TLSH
T144712031A2C469B443F2243391B3AA54EB3656E722B444B8F61EE75F1FB3A542163363
MD5 SHA1 SHA512 TLSH

Submit Download

TelemetryExporter.csproj.user

Path C:\Users\Admin\AppData\Local\JMicron\Storage Manager\TelemetryExporter.csproj.user
Size 2KB
SHA256 a0dc61960927e94063b2906f2d4ecd2b4bd70240789c4be74029731cd70afc8e
MD5 40abec3779b170581aa5b477eff2f4a4
SHA1 5362197155a639e024a2789546e1352f98f5a3d3
SHA512 939149348aaf1a4d0d27ae5664c97ce19407eb1b2509433980c94f71b5eff67e555f854f344184056af6e0bdeec131f0d18bc14162eccf7c0f31918cb20687c1
TLSH
T10C51DF55D8F1EB7548BE3796F032AB59AAF743A303D52BF4348C890F9B21CAC0957261
MD5 SHA1 SHA512 TLSH

Submit Download

TelemetryExporter.wsf

Path C:\Users\Admin\AppData\Local\JMicron\Storage Manager\TelemetryExporter.wsf
Size 1014B
SHA256 678b8bf043e6e3fda14ed8fee2c236ca0e74b8a485a1de325d89a64343a0d33c
MD5 e467db25abce244da6726b8bed2c1dbf
SHA1 8bf3addc4ec4461a35fecb029f9ef86df72cf659
SHA512 2dd24afcec5437a76ada93658a7fc3282732e8c09acf1f1778cca9ab97a28c7dec5aae786e88ab2289f52291e13151310eb16944829042cd327c24e0a4473cb1
TLSH
T175110246AC2ED0BDD046F299E17BDE4C95F191A13420E1E2049CCE9DB72AE38CAF4179
MD5 SHA1 SHA512 TLSH

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\JMicron\Storage Manager\app.config
Size 694B
SHA256 095480b4a2970f13aac8b6646c0988243ca32b1039e2d15d794215c22ff12384
MD5 126182d3ba400690615b4f3d8c05a578
SHA1 5ebe907aac7d31946e7c5af8a3546e10ffa3282b
SHA512 99ec5d5862c58841b304e1c08ab98658f31f9ee350b914bdaa37bd207396bdba0fa99b00fab8cb647c25686605700716f926b6cdf88228876e2ddf5de38841d7
TLSH
T17D01A2266AC5AD57DF321D2BA5228A28DA7CE2DB3091184CF0F952570E335C505232D6
MD5 SHA1 SHA512 TLSH

Submit Download

build.cmd

Path C:\Users\Admin\AppData\Local\JMicron\Storage Manager\build.cmd
Size 536B
SHA256 96df26f0a5d8b4424f933ba1f578d9ca2ff1aae57aacea397f458952ba3be3d2
MD5 5f4c3f7eafe160efe6a19ccd4d3d2316
SHA1 69f77a5954e2c84018ff57954215497151015e8e
SHA512 28e741942708e6f6414619bad34ea8b15a63ed96fe886a7beb802494d713defae7c5a983dcde38d9881ea52bacdb87a948e3cde3dbefcbee9a0d6179269d6d92
TLSH
T12EF04C46602A246865BB5BA472F2E50077CAC3E70F54F3ECE080DD26608E14A64D91D8
MD5 SHA1 SHA512 TLSH

Submit Download

config_dbb9a.tmp

Path C:\Users\Admin\AppData\Local\JMicron\Storage Manager\config_dbb9a.tmp
Size 201B
SHA256 8704f45897e489705fe0aa499b03684e01e5d6a59d1fc0dfc537f6e19ce9a424
MD5 b19c123cb119bf636f42da36ec1e0cb7
SHA1 7b567324af50d7d3682fc249a2ebb687adcfbe80
SHA512 6b9ba80af4f1bb866be156a7312dd406d6cef5c6d45190dc74326c36ae0be68700e95060e1c048fd87a91e4bf27f286677fd6f0527bc41a25680885d71ad33e6
TLSH
T1B7D022B809D19A1EE60DAF5A06CED822001720466386A88AA3068A3E204A1AC0C52D26
MD5 SHA1 SHA512 TLSH

Submit Download

filelist

Path C:\Users\Admin\AppData\Local\JMicron\Storage Manager\filelist
Size 365B
SHA256 00cfd19d4fa91da551064ef983043ce83c1260190d5e92d7f1de635afd8d2149
MD5 b4b4d928ef677d65560115fa0650a795
SHA1 1c22e72fb35b54a6810db036ebbc92dc29713ab1
SHA512 496c0b33984b017e8ca2f66ced09e32daf75ff76dab55e65639c41fda75e2892a3f35cf86a95a75712366e40883a331f38957208b1190245fc92422f9fa0e9a3
TLSH
T192E02073F71DE1FAAC41145FD67341007AD98FE584622314265153FB012F81B32FA551
MD5 SHA1 SHA512 TLSH

Submit Download

global.json

Path C:\Users\Admin\AppData\Local\JMicron\Storage Manager\global.json
Size 86B
SHA256 e01fb8a1a325a3f6138a1a5d267157bbaeb4edac3f1935a23dcfa31f04161fce
MD5 3c34e84a718d5f2a1f710ba636a3af88
SHA1 b27f7d84ff99503ce71d9de160a181854cf00781
SHA512 38903b4e1787242b2241da351159077f088f72cc90a6a204d09447fa8de89697ddfa84189b2119f68afdfe1406779ad0d0e0b2ea8025f538a1d3b81ae29d0890
TLSH
T12AA01205C0244D2350F00B30C1204940EF01936F1930000031A20D8C87601B50044B44
MD5 SHA1 SHA512 TLSH

Submit Download

packages.config

Path C:\Users\Admin\AppData\Local\JMicron\Storage Manager\packages.config
Size 219B
SHA256 7100c4e1a304408bf1abab8a39974041db93bd15b4f125b1f3512256488e8386
MD5 7ed35881559bd12330a128ddd6405ffe
SHA1 494ada92f71e98ecd85c53dd87f5105328757c8a
SHA512 2ba298c3b400478b0cc80b33568946b000a58385cf41f58a802e4ac63cc68b9cebfb46480247ed91c49e84c84fe8f3be645062a3992f3558e967f3044232767b
TLSH
T13DD0A7082269653646201F99B7E949056BBC712AB51109CCBC6116A983364554207311
MD5 SHA1 SHA512 TLSH

Submit Download

settings_2cf.cache

Path C:\Users\Admin\AppData\Local\JMicron\Storage Manager\settings_2cf.cache
Size 182B
SHA256 468d0eaddde88700a6a526fe19cf68e1ade8773b0eedbbc2545fc77ada6fc9f7
MD5 3a1010af89be9ff84da37736350b2ba2
SHA1 60a809c934d747352e0cc80ff5d92ecb91924913
SHA512 62057bb366bb8afc85ece07d2ecf5004d7dd90e977a3a86666d825f129896ab879bd9c9342c199d3853b3c141eb871f767889463777061583dc7b389b6b8a40e
TLSH
T18BC0C081305C5CF48BFCB16FB49770784C564C2FD4051371A08E8458730208E22D03C4
MD5 SHA1 SHA512 TLSH

Submit Download

settings_955.tmp

Path C:\Users\Admin\AppData\Local\JMicron\Storage Manager\settings_955.tmp
Size 151B
SHA256 16bcd28c4dcc72705d12d9997e934b386899f3cb4e9bec1cb7a5d2b171ccdeaa
MD5 131fc72eea3d8458c3199b57ed2680f8
SHA1 776cca09f9d59fb86d905dc365eb4b108f6aa10c
SHA512 e45e1e21300db32881bc381cf2a34036c938704276393bb4e576038f8322b7836a0f597a70021673dd83dd0ba78e194434cbf78379bcb72f8eb5eff99edc9418
TLSH
T149C0809105B44F65555442890D91CB56EA51505D452539D5912E3F55143540346C1515
MD5 SHA1 SHA512 TLSH

Submit Download

TelemetryExporter.lnk

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\TelemetryExporter\TelemetryExporter.lnk
Size 976B
SHA256 c7e33fc8c2ab620f2260590c0b460dc46221d853bb37daa4c6eb53ec69aa636f
MD5 ddae90e876f514013c74160b5af40eb9
SHA1 651d2ef1b427ae50bfa42ecd27c85da222107f20
SHA512 a0f3d6679748844ef70c79840241b374dfceb8e5f5fd7266a6b487aca6318c03687e087935386b2be0e974716592ff25aacdae7e1a325efd6aa64e336fbead12
TLSH
T14711121091DC0704CA2019776C78D6086675B8556A0252899D9691BA28E2940FD17707
MD5 SHA1 SHA512 TLSH

Submit Download

TelemetryExporter.sln

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\TelemetryExporter\TelemetryExporter.sln
Size 1003B
SHA256 c5382404d74a34fd73787dd7181266a8a4dee12e03ca9944f72d41019e2f172a
MD5 7dcd4b08375ff8927dc65c402dc7daa5
SHA1 8e7cd83b4704a3cb028c65009c799137dc7ff219
SHA512 f61ea9bc99bf070c4d5e8fae439e5469c4ab7285429caa1f5feaa3648448b87b145f780acfb8c4fba42fbcfbbe8346c601148de829eba4cfef329dea948d3e20
TLSH
T1231130AB644C0C98FD8527EA95F32CCA353F8290C16D993C119A109C5E2F940927789F
MD5 SHA1 SHA512 TLSH

Submit Download

e589920.msi

Path C:\Windows\Installer\e589920.msi
Size 7.2MB
SHA256 3bab6ad7eb3f01a719fa9d8f110e924c95c234c2ea3be2df45642d28b13dfebd
MD5 df83535c124e705be925c23709f25747
SHA1 0ad71052ed71490aff3a7254783ea75a9045cfce
SHA512 32774ad44465f369330690731090390485cb831b5bf234305083bbfb910dcc8f3adc78bce60f260ad35d2026da3bf1fe3d4d14d2fd2b84989d52bfe667e209a4
SSDEEP 196608:rppScTHZJSpPlC4mAWAtQeEdp3ZV9ii0s2qHbaz:rpMcT7SpQgftQPdVki01E+z
TLSH
T1E4763380D1972EAEDB9403368708DDA646207D392FF06A7B8561B2416FFE7177CB06B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.0MB
SHA256 810d5be9a4d496c87223389b242d5f394945aa1b3dd90ce3bb3201f81e980706
MD5 cb94c342a842cf09e1f7feaf5b990fd1
SHA1 abe097c6578ef4536b364227641ebe70bf50fe12
SHA512 bb20ebfebf23fafa75f26495be563adb113495f61457b54ba34c4485a3620abd44347e93115d93a0936d559e6c22130db1a5291a696a09b3c03002d9b866f468
SSDEEP 24576:wEpmg3MPdoO/vvTLzX1efpWb987h4tqjJF4tjD5n8QqDZmr14wW2QJxOzS:Yc
TLSH
T10947F46436F92110F7F39E3CA8F06A274A397D5B9C15DE8D45411B8E0821BB1E872F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{177ce15f-c3d8-47c0-96ae-2db32ee386ac}_OnDiskSnapshotProp

Path \??\Volume{139eaa61-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{177ce15f-c3d8-47c0-96ae-2db32ee386ac}_OnDiskSnapshotProp
Size 6KB
SHA256 d14da55b184c388cfc4315f3333734a469fa5891c11452d48ae6ee7c9365e074
MD5 aab3d1776036309c5e4a4dc820785faf
SHA1 3a0235ecf5f30c79596ca2102c15d2479bd668a2
SHA512 563338fb503bfc7b47aa42285015963846c3501725dd58de40911f675c06b28be110250f83af3e0ca49bcdd35801ab07a9bacc5e6b3de30749259079d11b2203
SSDEEP 96:FU0z7lQmOvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:+kQbb++ZVm
TLSH
T17DD199085AF54311E2B3AB3229F54557A877B811EF33CB8E0198638E2631A14F875F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3472-46-0x00000000050D0000-0x000000000522A000-memory.dmp

Download

memory/3472-59-0x0000000005BB0000-0x000000000610E000-memory.dmp

Download

memory/3472-53-0x0000000002A10000-0x0000000002A4C000-memory.dmp

Download

memory/3472-44-0x0000000000580000-0x00000000005C0000-memory.dmp

Download

memory/3472-47-0x0000000004FA0000-0x0000000004FD0000-memory.dmp

Download

memory/3472-45-0x0000000002A90000-0x0000000002AAA000-memory.dmp

Download

memory/3472-405-0x000000000A450000-0x000000000A53C000-memory.dmp

Download