Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
28/05/2023, 01:38
Static task
static1
Behavioral task
behavioral1
Sample
a9740680f1c75a1b5ceb136f04ab322d3dcec86bb4102e54de16c72cb3970dd5.msi
Resource
win7-20230220-en
windows7-x64
10 signatures
150 seconds
General
- Target a9740680f1c75a1b5ceb136f04ab322d3dcec86bb4102e54de16c72cb3970dd5.msi
- Size 416KB
- Sample230528-b2rjbaec5z
- SHA256 a9740680f1c75a1b5ceb136f04ab322d3dcec86bb4102e54de16c72cb3970dd5
- MD5 84f60d908dc7e65d585d1f1e51a1c211
- SHA1 09d7ae37353a93c2d3651cfb7c70b2a164a169c4
- SHA512 6a251b9facaf407fce79715a2bc9853133a66ba9edf4ce9465e23b4de9d0f663ff45b1bd7e620bce2f44e603e321592ff6414d0e17dd65a4c683f0b89d3044c3
- SSDEEP 12288:wvdk1JGCmmYrDTA+Dhh6HZ9G3UCng3wU:wFk1JL5YTDDhh6HZ9G3UurU
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
qakbot
Version
-
404.1249
Botnet
-
BB29
Campaign
-
1685100431
C2
-
50.68.186.195:443
-
66.180.234.51:2222
-
103.141.50.43:995
-
69.242.31.249:443
-
173.88.135.179:443
-
12.172.173.82:465
-
86.130.9.242:2222
-
92.27.86.48:2222
-
88.126.94.4:50000
-
113.11.92.30:443
-
12.172.173.82:995
-
92.154.17.149:2222
-
92.135.0.154:2222
-
212.169.233.141:3389
-
103.123.223.133:443
-
12.172.173.82:32101
-
70.28.50.223:3389
-
47.21.51.138:443
-
75.98.154.19:443
-
47.205.25.170:443
-
12.172.173.82:993
-
176.142.207.63:443
-
12.172.173.82:22
-
12.172.173.82:50001
-
190.199.228.254:2222
-
75.143.236.149:443
-
70.50.83.139:2222
-
184.153.132.82:443
-
122.184.143.86:443
-
70.28.50.223:2087
-
12.172.173.82:21
-
103.87.128.228:443
-
50.68.204.71:993
-
190.75.158.216:2222
-
73.41.215.237:443
-
186.75.95.6:443
-
90.29.86.138:2222
-
151.62.238.176:443
-
85.104.105.67:443
-
125.99.69.178:443
-
92.186.69.229:2222
-
78.130.215.67:443
-
27.99.32.26:2222
-
12.172.173.82:2087
-
50.68.204.71:443
-
69.119.123.159:2222
-
184.181.75.148:443
-
86.97.52.82:2222
-
92.20.204.198:2222
-
91.2.143.185:995
-
65.30.139.145:995
-
82.125.44.236:2222
-
89.36.206.69:995
-
104.35.24.154:443
-
197.0.76.189:443
-
89.129.109.27:2222
-
83.114.60.6:2222
-
151.65.69.12:443
-
87.202.101.164:50000
-
2.36.64.159:2078
-
69.133.162.35:443
-
87.223.86.50:443
-
105.101.34.87:443
-
75.141.227.169:443
-
105.186.138.188:995
-
172.115.17.50:443
-
95.45.50.93:2222
-
183.87.163.165:443
-
86.248.228.57:2078
-
24.198.114.130:995
-
78.192.109.105:2222
-
71.38.155.217:443
-
188.83.251.100:443
-
102.159.19.118:443
-
103.140.174.20:2222
-
92.9.45.20:2222
-
100.6.31.96:443
-
80.12.88.148:2222
-
70.112.206.5:443
-
198.2.51.242:993
-
197.164.217.136:995
-
86.128.15.167:2222
-
223.166.13.95:995
-
213.64.33.61:2222
-
72.134.124.16:443
-
70.28.50.223:2078
-
47.34.30.133:443
-
79.77.142.22:2222
-
31.17.195.13:8443
-
147.219.4.194:443
-
92.1.170.110:995
-
70.160.67.203:443
-
84.215.202.8:443
-
94.207.104.225:443
-
174.4.89.3:443
-
76.185.109.16:443
-
125.99.76.102:443
-
84.35.26.14:995
-
12.172.173.82:20
-
124.149.143.189:2222
-
96.56.197.26:2222
-
188.28.19.84:443
-
27.109.19.90:2078
-
70.48.46.235:2222
-
161.142.103.187:995
-
116.75.63.253:443
-
77.86.98.236:443
-
123.3.240.16:6881
-
83.110.223.61:443
-
109.50.128.59:2222
-
171.96.192.178:443
-
205.237.67.69:995
-
65.95.141.84:2222
-
74.58.71.237:443
-
91.169.12.198:32100
-
37.14.229.220:2222
-
70.28.50.223:32100
-
76.170.252.153:995
-
184.182.66.109:443
-
96.87.28.170:2222
Signatures
- Loads dropped DLL 1 IoCs
pid Process 1316 rundll32.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe - Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{05D3B360-669D-4503-A19D-084E352A3076} msiexec.exe File opened for modification C:\Windows\Installer\MSID844.tmp msiexec.exe File created C:\Windows\Installer\e56d72d.msi msiexec.exe File created C:\Windows\Installer\e56d72b.msi msiexec.exe File opened for modification C:\Windows\Installer\e56d72b.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000036d9561f42561000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000036d95610000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff000000000700010000680900036d9561000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000036d956100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000036d956100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4748 msiexec.exe 4748 msiexec.exe 4748 msiexec.exe 1316 rundll32.exe 1316 rundll32.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3800 msiexec.exe Token: SeIncreaseQuotaPrivilege 3800 msiexec.exe Token: SeSecurityPrivilege 4748 msiexec.exe Token: SeCreateTokenPrivilege 3800 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3800 msiexec.exe Token: SeLockMemoryPrivilege 3800 msiexec.exe Token: SeIncreaseQuotaPrivilege 3800 msiexec.exe Token: SeMachineAccountPrivilege 3800 msiexec.exe Token: SeTcbPrivilege 3800 msiexec.exe Token: SeSecurityPrivilege 3800 msiexec.exe Token: SeTakeOwnershipPrivilege 3800 msiexec.exe Token: SeLoadDriverPrivilege 3800 msiexec.exe Token: SeSystemProfilePrivilege 3800 msiexec.exe Token: SeSystemtimePrivilege 3800 msiexec.exe Token: SeProfSingleProcessPrivilege 3800 msiexec.exe Token: SeIncBasePriorityPrivilege 3800 msiexec.exe Token: SeCreatePagefilePrivilege 3800 msiexec.exe Token: SeCreatePermanentPrivilege 3800 msiexec.exe Token: SeBackupPrivilege 3800 msiexec.exe Token: SeRestorePrivilege 3800 msiexec.exe Token: SeShutdownPrivilege 3800 msiexec.exe Token: SeDebugPrivilege 3800 msiexec.exe Token: SeAuditPrivilege 3800 msiexec.exe Token: SeSystemEnvironmentPrivilege 3800 msiexec.exe Token: SeChangeNotifyPrivilege 3800 msiexec.exe Token: SeRemoteShutdownPrivilege 3800 msiexec.exe Token: SeUndockPrivilege 3800 msiexec.exe Token: SeSyncAgentPrivilege 3800 msiexec.exe Token: SeEnableDelegationPrivilege 3800 msiexec.exe Token: SeManageVolumePrivilege 3800 msiexec.exe Token: SeImpersonatePrivilege 3800 msiexec.exe Token: SeCreateGlobalPrivilege 3800 msiexec.exe Token: SeBackupPrivilege 5032 vssvc.exe Token: SeRestorePrivilege 5032 vssvc.exe Token: SeAuditPrivilege 5032 vssvc.exe Token: SeBackupPrivilege 4748 msiexec.exe Token: SeRestorePrivilege 4748 msiexec.exe Token: SeRestorePrivilege 4748 msiexec.exe Token: SeTakeOwnershipPrivilege 4748 msiexec.exe Token: SeRestorePrivilege 4748 msiexec.exe Token: SeTakeOwnershipPrivilege 4748 msiexec.exe Token: SeRestorePrivilege 4748 msiexec.exe Token: SeTakeOwnershipPrivilege 4748 msiexec.exe Token: SeRestorePrivilege 4748 msiexec.exe Token: SeTakeOwnershipPrivilege 4748 msiexec.exe Token: SeRestorePrivilege 4748 msiexec.exe Token: SeTakeOwnershipPrivilege 4748 msiexec.exe Token: SeRestorePrivilege 4748 msiexec.exe Token: SeTakeOwnershipPrivilege 4748 msiexec.exe Token: SeRestorePrivilege 4748 msiexec.exe Token: SeTakeOwnershipPrivilege 4748 msiexec.exe Token: SeRestorePrivilege 4748 msiexec.exe Token: SeTakeOwnershipPrivilege 4748 msiexec.exe Token: SeRestorePrivilege 4748 msiexec.exe Token: SeTakeOwnershipPrivilege 4748 msiexec.exe Token: SeRestorePrivilege 4748 msiexec.exe Token: SeTakeOwnershipPrivilege 4748 msiexec.exe Token: SeRestorePrivilege 4748 msiexec.exe Token: SeTakeOwnershipPrivilege 4748 msiexec.exe Token: SeRestorePrivilege 4748 msiexec.exe Token: SeTakeOwnershipPrivilege 4748 msiexec.exe Token: SeRestorePrivilege 4748 msiexec.exe Token: SeTakeOwnershipPrivilege 4748 msiexec.exe Token: SeRestorePrivilege 4748 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3800 msiexec.exe 3800 msiexec.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4748 wrote to memory of 5076 4748 msiexec.exe 88 PID 4748 wrote to memory of 5076 4748 msiexec.exe 88 PID 4748 wrote to memory of 3252 4748 msiexec.exe 90 PID 4748 wrote to memory of 3252 4748 msiexec.exe 90 PID 4748 wrote to memory of 4808 4748 msiexec.exe 91 PID 4748 wrote to memory of 4808 4748 msiexec.exe 91 PID 3252 wrote to memory of 1316 3252 rundll32.exe 92 PID 3252 wrote to memory of 1316 3252 rundll32.exe 92 PID 3252 wrote to memory of 1316 3252 rundll32.exe 92 PID 1316 wrote to memory of 460 1316 rundll32.exe 96 PID 1316 wrote to memory of 460 1316 rundll32.exe 96 PID 1316 wrote to memory of 460 1316 rundll32.exe 96 PID 1316 wrote to memory of 460 1316 rundll32.exe 96 PID 1316 wrote to memory of 460 1316 rundll32.exe 96 PID 1316 wrote to memory of 460 1316 rundll32.exe 96 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\a9740680f1c75a1b5ceb136f04ab322d3dcec86bb4102e54de16c72cb3970dd5.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3800
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:5076
-
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\ZoomDesktopClient\main.dll,next2⤵
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\ZoomDesktopClient\main.dll,next3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe4⤵
- Suspicious behavior: EnumeratesProcesses
PID:460
-
-
-
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\ZoomDesktopClient\notify.vbs2⤵PID:4808
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5032
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e56d72c.rbs
- Size 9KB
- SHA256 be0da65fc591bf6cb14217ba0a9eb1513a294e7c8fca40f5c41d414cb4d655ff
- MD5 7d71a9e0ea0e5154069a5c19c7b63099
- SHA1 79c2ae515e564211f761efdd9ebb7322d252c1d2
- SHA512 64463413f4f0ca24353483c7565d3cc880044db3e839c31eb9a1b2e499a7dceb8a2bb11f9e444e395bb6463d8a5c13e03077106f24eab65cdb3d3efa51c59006
- SSDEEP 192:32eJhpgRMhEhINRMhEhVZHrUMr8YBRmJIJKp/kYp1CpewB:3YRn2RnLX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\ZoomDesktopClient\main.dll
- Size 727KB
- SHA256 6c0d3531c95bf245d6413dc7f3bf5739fc41f6064bf6d8fc66443f8e46d9ffd2
- MD5 880aaeb61626ae9a43cc8aae144d949a
- SHA1 7f6bde013a551b9ecd609e364c8db8c568e1660b
- SHA512 b27b685bc27973c47ff6c53a9fd3a8d7aa963c27240d36eb9c1f78f3d2d24a79ca15374ec5bc88a70a1a3f4986acf60cb37807b294f658953f750810127b13a2
- SSDEEP 12288:oO64J3gxczy7M8pHuGK/q1Rok9JTJLr5pIxW1nsJEhFo2B3UCngrX3Qq:oO64JkczyZJK/q1TJLr58W5dxB3Uumwq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\ZoomDesktopClient\main.dll
- Size 727KB
- SHA256 6c0d3531c95bf245d6413dc7f3bf5739fc41f6064bf6d8fc66443f8e46d9ffd2
- MD5 880aaeb61626ae9a43cc8aae144d949a
- SHA1 7f6bde013a551b9ecd609e364c8db8c568e1660b
- SHA512 b27b685bc27973c47ff6c53a9fd3a8d7aa963c27240d36eb9c1f78f3d2d24a79ca15374ec5bc88a70a1a3f4986acf60cb37807b294f658953f750810127b13a2
- SSDEEP 12288:oO64J3gxczy7M8pHuGK/q1Rok9JTJLr5pIxW1nsJEhFo2B3UCngrX3Qq:oO64JkczyZJK/q1TJLr58W5dxB3Uumwq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\ZoomDesktopClient\notify.vbs
- Size 106B
- SHA256 6142d9959be3e3d6276d33b6a8f5feac0116da002ae847f96079d7371974919f
- MD5 81bc3c331877bbb6f1d9688813402d28
- SHA1 c06175deba61f3eb2ee47893d26dcfbf680d7b20
- SHA512 31da6db1ea4780852fd941f9a887693fae756c369b3c3ae71f76ba331445fa82b33bcea43c67df4c5df555055556242b172c0c256d0ea9f1bf190b70816bdf6f
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\e56d72b.msi
- Size 416KB
- SHA256 a9740680f1c75a1b5ceb136f04ab322d3dcec86bb4102e54de16c72cb3970dd5
- MD5 84f60d908dc7e65d585d1f1e51a1c211
- SHA1 09d7ae37353a93c2d3651cfb7c70b2a164a169c4
- SHA512 6a251b9facaf407fce79715a2bc9853133a66ba9edf4ce9465e23b4de9d0f663ff45b1bd7e620bce2f44e603e321592ff6414d0e17dd65a4c683f0b89d3044c3
- SSDEEP 12288:wvdk1JGCmmYrDTA+Dhh6HZ9G3UCng3wU:wFk1JL5YTDDhh6HZ9G3UurU
- MD5 SHA1 SHA512 SSDEEP
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 23.0MB
- SHA256 658cb90a38b031ca2387c0046d2a7ab3278530f8a9add362426bf6c2ac030324
- MD5 de16da3ae13c7bc3d18e76ef7b9d336b
- SHA1 3042d1b5c7ccfcbcbbbd099ff14a227d451bc82f
- SHA512 27ddda674ed9580f1965bdc01b7159548fcf108ce390b4dd3fe770983801d61cafe8175098be925f65e15a0aab5403612f76a57fb9c0aebd48139e976c4ce741
- SSDEEP 24576:njdmqn+kdoO/vvTLIvGuMVrr0hEv2rtTghA9EUmgv9qbT6OmozrZ5P4M2:n
- MD5 SHA1 SHA512 SSDEEP
- Path \??\Volume{61956d03-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{4e93c455-d588-47fb-8ee5-62b0f328783a}_OnDiskSnapshotProp
- Size 5KB
- SHA256 34c2d39685f27032f0eb1ec549ae107fa29e98578599734115fb553f0d9ed67c
- MD5 cd5ab7259e80d51577a16df87d6fd6ef
- SHA1 c69d52da8a3eab3e7fc98a73758ba2bbdff19afe
- SHA512 a01d92284531423faba7ef914c1c351980a97977e8a2f349bc1bd0dbfb625c3043b1ea49838e2028b72a1fba24f6d2a41199bb484b7ae6b7a497ac40a4b30c54
- SSDEEP 96:Fb4mntic3aDD84LTHzbOHXOHBlBRQb8Sa9XE56tRSVQEJN:2m2b++GzJN
- MD5 SHA1 SHA512 SSDEEP