Analysis
-
max time kernel
96s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
14-02-2023 14:55
Static task
static1
Behavioral task
behavioral1
Sample
putty-64bit-0.78-installer.msi
Resource
win10v2004-20221111-en
windows10-2004-x64
General
-
Target
putty-64bit-0.78-installer.msi
-
Size
3.5MB
-
MD5
108b432c4dc0a66b657d985e180bec71
-
SHA1
262812d43303b7ddc7c04a1c243172ebe6579f00
-
SHA256
e64775374097f1b1c8fd4173f7d5be4305b88cec26a56d003113aff2837ae08e
-
SHA512
5ddb97078b417f22c54dce768564dec58fd92a9c190f7a6cac9c7979a0f136dd439da1d59dd3c088e709433f5c4f79c033abd4b6ca8989d38620c20f4623386e
-
SSDEEP
98304:Ujhyh9EoxGHgBRn8Tg4IDrwRW8FMDMb34+NHC6:UjhyJPR8Tg4IDrwdFMD048
Malware Config
Signatures
-
Blocklisted process makes network request 4 IoCs
Processes:
msiexec.exeflow pid Process 9 4988 msiexec.exe 11 4988 msiexec.exe 13 4988 msiexec.exe 15 4988 msiexec.exe -
Loads dropped DLL 2 IoCs
Processes:
MsiExec.exepid Process 4364 MsiExec.exe 4364 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc Process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe -
Drops file in Program Files directory 10 IoCs
Processes:
msiexec.exedescription ioc Process File created C:\Program Files\PuTTY\putty.chm msiexec.exe File created C:\Program Files\PuTTY\LICENCE msiexec.exe File created C:\Program Files\PuTTY\README.txt msiexec.exe File created C:\Program Files\PuTTY\website.url msiexec.exe File created C:\Program Files\PuTTY\puttygen.exe msiexec.exe File created C:\Program Files\PuTTY\pageant.exe msiexec.exe File created C:\Program Files\PuTTY\plink.exe msiexec.exe File created C:\Program Files\PuTTY\pscp.exe msiexec.exe File created C:\Program Files\PuTTY\psftp.exe msiexec.exe File created C:\Program Files\PuTTY\putty.exe msiexec.exe -
Drops file in Windows directory 8 IoCs
Processes:
msiexec.exedescription ioc Process File created C:\Windows\Installer\e574333.msi msiexec.exe File opened for modification C:\Windows\Installer\e574333.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{4EEF2644-700F-46F8-9655-915145248986} msiexec.exe File opened for modification C:\Windows\Installer\MSI4517.tmp msiexec.exe File created C:\Windows\Installer\e574335.msi msiexec.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
vssvc.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000005cb6ed2f2c7878f0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000005cb6ed20000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff00000000070001000068090005cb6ed2000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000005cb6ed200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000005cb6ed200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Modifies registry class 15 IoCs
Processes:
msiexec.exeMsiExec.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\PPK_Assoc_ProgId\shell\edit\command msiexec.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\PPK_Assoc_ProgId\shell msiexec.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\PPK_Assoc_ProgId\shell\edit msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\PPK_Assoc_ProgId\shell\edit\ = "Edit with PuTTYgen" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\.ppk msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\.ppk\ = "PPK_Assoc_ProgId" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\PPK_Assoc_ProgId\ = "PuTTY Private Key File" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\PPK_Assoc_ProgId\shell\open\command msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\PPK_Assoc_ProgId\shell\open\command\ = "\"C:\\Program Files\\PuTTY\\pageant.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\PPK_Assoc_ProgId\shell\edit\command\ = "\"C:\\Program Files\\PuTTY\\puttygen.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings MsiExec.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\PPK_Assoc_ProgId msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\PPK_Assoc_ProgId\shell\open\ = "Load into Pageant" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\.ppk\Content Type = "application/x-putty-private-key" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\PPK_Assoc_ProgId\shell\open msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msiexec.exepid Process 4332 msiexec.exe 4332 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exedescription pid Process Token: SeShutdownPrivilege 4988 msiexec.exe Token: SeIncreaseQuotaPrivilege 4988 msiexec.exe Token: SeSecurityPrivilege 4332 msiexec.exe Token: SeCreateTokenPrivilege 4988 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4988 msiexec.exe Token: SeLockMemoryPrivilege 4988 msiexec.exe Token: SeIncreaseQuotaPrivilege 4988 msiexec.exe Token: SeMachineAccountPrivilege 4988 msiexec.exe Token: SeTcbPrivilege 4988 msiexec.exe Token: SeSecurityPrivilege 4988 msiexec.exe Token: SeTakeOwnershipPrivilege 4988 msiexec.exe Token: SeLoadDriverPrivilege 4988 msiexec.exe Token: SeSystemProfilePrivilege 4988 msiexec.exe Token: SeSystemtimePrivilege 4988 msiexec.exe Token: SeProfSingleProcessPrivilege 4988 msiexec.exe Token: SeIncBasePriorityPrivilege 4988 msiexec.exe Token: SeCreatePagefilePrivilege 4988 msiexec.exe Token: SeCreatePermanentPrivilege 4988 msiexec.exe Token: SeBackupPrivilege 4988 msiexec.exe Token: SeRestorePrivilege 4988 msiexec.exe Token: SeShutdownPrivilege 4988 msiexec.exe Token: SeDebugPrivilege 4988 msiexec.exe Token: SeAuditPrivilege 4988 msiexec.exe Token: SeSystemEnvironmentPrivilege 4988 msiexec.exe Token: SeChangeNotifyPrivilege 4988 msiexec.exe Token: SeRemoteShutdownPrivilege 4988 msiexec.exe Token: SeUndockPrivilege 4988 msiexec.exe Token: SeSyncAgentPrivilege 4988 msiexec.exe Token: SeEnableDelegationPrivilege 4988 msiexec.exe Token: SeManageVolumePrivilege 4988 msiexec.exe Token: SeImpersonatePrivilege 4988 msiexec.exe Token: SeCreateGlobalPrivilege 4988 msiexec.exe Token: SeCreateTokenPrivilege 4988 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4988 msiexec.exe Token: SeLockMemoryPrivilege 4988 msiexec.exe Token: SeIncreaseQuotaPrivilege 4988 msiexec.exe Token: SeMachineAccountPrivilege 4988 msiexec.exe Token: SeTcbPrivilege 4988 msiexec.exe Token: SeSecurityPrivilege 4988 msiexec.exe Token: SeTakeOwnershipPrivilege 4988 msiexec.exe Token: SeLoadDriverPrivilege 4988 msiexec.exe Token: SeSystemProfilePrivilege 4988 msiexec.exe Token: SeSystemtimePrivilege 4988 msiexec.exe Token: SeProfSingleProcessPrivilege 4988 msiexec.exe Token: SeIncBasePriorityPrivilege 4988 msiexec.exe Token: SeCreatePagefilePrivilege 4988 msiexec.exe Token: SeCreatePermanentPrivilege 4988 msiexec.exe Token: SeBackupPrivilege 4988 msiexec.exe Token: SeRestorePrivilege 4988 msiexec.exe Token: SeShutdownPrivilege 4988 msiexec.exe Token: SeDebugPrivilege 4988 msiexec.exe Token: SeAuditPrivilege 4988 msiexec.exe Token: SeSystemEnvironmentPrivilege 4988 msiexec.exe Token: SeChangeNotifyPrivilege 4988 msiexec.exe Token: SeRemoteShutdownPrivilege 4988 msiexec.exe Token: SeUndockPrivilege 4988 msiexec.exe Token: SeSyncAgentPrivilege 4988 msiexec.exe Token: SeEnableDelegationPrivilege 4988 msiexec.exe Token: SeManageVolumePrivilege 4988 msiexec.exe Token: SeImpersonatePrivilege 4988 msiexec.exe Token: SeCreateGlobalPrivilege 4988 msiexec.exe Token: SeCreateTokenPrivilege 4988 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4988 msiexec.exe Token: SeLockMemoryPrivilege 4988 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid Process 4988 msiexec.exe 4988 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
msiexec.exeMsiExec.exedescription pid Process procid_target PID 4332 wrote to memory of 4364 4332 msiexec.exe 86 PID 4332 wrote to memory of 4364 4332 msiexec.exe 86 PID 4332 wrote to memory of 4364 4332 msiexec.exe 86 PID 4332 wrote to memory of 4204 4332 msiexec.exe 91 PID 4332 wrote to memory of 4204 4332 msiexec.exe 91 PID 4364 wrote to memory of 1012 4364 MsiExec.exe 100 PID 4364 wrote to memory of 1012 4364 MsiExec.exe 100 PID 4364 wrote to memory of 1012 4364 MsiExec.exe 100
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\putty-64bit-0.78-installer.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4988
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0865A550A9C133D6A8F0FC65BC977C4B C2⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\PuTTY\README.txt3⤵PID:1012
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4204
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:3796
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD56cf727766580b6019becca7e62c49e70
SHA16842fa969ca4a83a8780e59b75bd30d8859917c1
SHA25611bdf4f12d34f617cf81f0c30aef7b596dbd00d0d19cf9e3c2e4648d672b3809
SHA5120710ad72f032f54946b089aed10dc3da00f54d9bf835e09cd6fcc90603afb2ca91a6efd0a496b71d51275828f545996885a8718468d69edb45bd4070234b9234
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
Filesize765B
MD56b96e3a43086909705986a8a985ceaba
SHA1e8402eff9ccc53babe53f8f87bd871d31d6c842b
SHA2561e356db238ff8ac64709fcb8da8cb7c75b356811f0c8e1809f2e22c3aefbdad4
SHA512af9d4504c20a694dd29fdab87e04e72595cf1ac139094990009c63417cf2a6e370dfab1de51b13fc88dc5e268ecb67b6cc304db3fedfa40d8d0ea8c73bd5097b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AEACCDA8653DD8D7B2EA32F21D15D44F_383EB3891E16580A90C892D349C28A00
Filesize638B
MD52dac9568887b7ea426d4459ca4f4b21d
SHA19a9dc949f21df6384f8144504de8bca23e310b6d
SHA2569fd1b00a3a7a777e29a7d1df4a03b1591a654093fcda0def5f21bdf4687bb071
SHA5122ab5c83c5315bd9b2d45925bbe6ced1a4eef3a63494fb7a4d61ee6278b050c00fdf30c2b4fe2752bce053b887ef03bd49a885111684ba7553572cbcd3a0376d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Filesize1KB
MD58fb3a86ce7b6785067346c17899ee6a9
SHA1999b35d80b5bbf1056f3257dcc85d5d5f09cb381
SHA2563cab9a1f3a0e14ad1bb08f4201a4c3ecfbd4f6093d97c3395cd6c76fd509bba0
SHA51275731b1feafa376544c720d53151dd44b351173c7158481b5c6a8349d6d617f7566990e769edfe853f2f3273aab3b09ab857c2b8ce89c97000573e75f4bb4f27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
Filesize484B
MD5a1c54a133398a7fa6cf30e2a46cf2ceb
SHA1583ddfc69d24f8f10dd30f308b1f9a46bb10af31
SHA256568473ceb6f420132d20a07f28482192e67679aec4c435d5068e182062949cd5
SHA51201c6e391260e2b7cfacefa10a22e76fc7b900996926df540eba00f74aeaf886acf1529e05787fa92c3b7a14232e1c2ead5413fa593bb2d2ebdad5d63a596269f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AEACCDA8653DD8D7B2EA32F21D15D44F_383EB3891E16580A90C892D349C28A00
Filesize488B
MD59673f278f2711cc9c00d7c58e5d16ebf
SHA1adda3624a3b928efaa7842159b874ddf87b4bb73
SHA256c47538454f5073b0b4224ac840986fd5668c29c8f1280eef234f262ded64108c
SHA512a849b847fe8eb2b2ec78340ff80424476e5307e8bd4ca3465e72b1a2fd4288cc1605d99c4d535b1d84ea5c6032d86a52c13422596cdaecfb3acaa9ea508e5be8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Filesize482B
MD5f44356a7cc7f9a711896eba97b4c3445
SHA1bda239b6012d53e2555d99c3f1e4dd596c37edb6
SHA256ea0d7b9d7cb5ee83f36be17f9f6a479f0ec1e872c732f0aab08e2c87266421f5
SHA512a2b79ca469d9802c2957360863b5a1d60ac19f539ef412962270218ddf4a9da3287aeac123ac5811106feeb7b6caaba1cdeab6e0258c3673d12f44327b22ff74
-
Filesize
102KB
MD5d9ac1b56edf330a6eb7894ab293f14f6
SHA1022d8944e3927fff2b330dab54716ddcbb366d16
SHA256097f1c3f27b18010448d77e3f70c4d9f774cb9c5ab435c62baa1c00e4cadd5ef
SHA512e434410e2b2c2bb1fba4f3fc7c277b978c45b1df1d3c3994d6dc1530558393d7d42a713506bf95d013b2e40e9da36fd3e588fea8d8dc062a24ad931e4d76c328
-
Filesize
102KB
MD5d9ac1b56edf330a6eb7894ab293f14f6
SHA1022d8944e3927fff2b330dab54716ddcbb366d16
SHA256097f1c3f27b18010448d77e3f70c4d9f774cb9c5ab435c62baa1c00e4cadd5ef
SHA512e434410e2b2c2bb1fba4f3fc7c277b978c45b1df1d3c3994d6dc1530558393d7d42a713506bf95d013b2e40e9da36fd3e588fea8d8dc062a24ad931e4d76c328
-
Filesize
199KB
MD53a4e61909500d677745ef2ab508f3f3b
SHA1ee398e1a153ca96c2592816eb8e8b2b7bb845e1e
SHA256fb7a6eb19d1d1042d3bd8b3add9271116b8b6db3714dfcc0b6fee8e088d4a2cc
SHA512feba07bba5007a20e0a1e2ca8c9050ae8624e8fbb0f24aada5dc7c2bde3be561b844453a573cab2a24c3769a8dba401db4eeef0d22ef86e2109b67e54392ee45
-
Filesize
199KB
MD53a4e61909500d677745ef2ab508f3f3b
SHA1ee398e1a153ca96c2592816eb8e8b2b7bb845e1e
SHA256fb7a6eb19d1d1042d3bd8b3add9271116b8b6db3714dfcc0b6fee8e088d4a2cc
SHA512feba07bba5007a20e0a1e2ca8c9050ae8624e8fbb0f24aada5dc7c2bde3be561b844453a573cab2a24c3769a8dba401db4eeef0d22ef86e2109b67e54392ee45
-
Filesize
23.0MB
MD5df5073f5f842edcaff438d76b55b51e5
SHA1ab98524831a623d991d99da8801e4e26321dbde9
SHA256905123874be28ad1dbbaf6846594cf93d305f70c063221909652ef944d6f4aa2
SHA51207e8e1e6fa47cd94cc2cd96e87f489886df8910ad43c057384150f9335d47827183a87621dc4d412525b431164c8be0f4696bfe7428fe3c64a6993e1983f741d
-
\??\Volume{d26ecb05-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{a6839d1d-2beb-455e-aab9-5156c3ce32e4}_OnDiskSnapshotProp
Filesize5KB
MD50536dc204747d679b845c03e75e564ea
SHA18cf204b2465c68f97528acedc69cf6d67efc1b2f
SHA2562a1fa5329ac5ca45709b583404b5b7c48d0bc7fa45d565772fc5150dc7fe313b
SHA51243a82e6fd7bf5c9673bc2cf6b15cfd9083de9e620fa0ae34a4c39c85f1ac95e767cecc3be9d1d5ec1f7482ad2900cc4cd5ed70a9a914e3e6935a11c8683c3445