Analysis
- max time kernel
150s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
01/06/2023, 16:48
Static task
static1
Behavioral task
behavioral1
Sample
yohlef.msi
Resource
win7-20230220-en
windows7-x64
10 signatures
150 seconds
General
- Target yohlef.msi
- Size 404KB
- Sample230601-va38ksfd62
- SHA256 30384e44c5df96b7809a94c2320caeb8ea94d6c9a2d0bf5a10206bee397f1c26
- MD5 1ddfcbdbe07f551e561be159a73d1c99
- SHA1 1ffea8c6ba224b4a9e6bb402b030a8c12f2523e2
- SHA512 aa92c5f5fb036ce0d83afd7c804cc07940d62291b1c431249bb4fc982721ac117f7fde6fb28d7a30261e8ccdddca694879d382b2bb8b1d09179b4913bd495264
- SSDEEP 12288:MxCriEQzPJLNee9Lp1NjAyefvDz7n5DY:sdzFLPNjAyef7z7FY
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
qakbot
Version
-
404.1346
Botnet
-
obama266
Campaign
-
1685611378
C2
-
24.234.220.88:990
-
70.28.50.223:2078
-
96.56.197.26:2083
-
103.123.223.133:443
-
83.249.198.100:2222
-
199.27.66.213:443
-
90.104.151.37:2222
-
94.204.202.106:443
-
72.205.104.134:443
-
65.95.141.84:2222
-
82.131.141.209:443
-
77.126.99.230:443
-
71.38.155.217:443
-
205.237.67.69:995
-
84.215.202.8:443
-
24.234.220.88:465
-
76.178.148.107:2222
-
116.74.163.130:443
-
70.28.50.223:2087
-
147.147.30.126:2222
-
173.88.135.179:443
-
103.140.174.20:2222
-
77.86.98.236:443
-
92.149.250.113:2222
-
96.87.28.170:2222
-
86.168.210.41:443
-
176.142.207.63:443
-
12.172.173.82:32101
-
86.132.236.117:443
-
70.50.83.216:2222
-
161.142.103.187:995
-
45.62.70.33:443
-
12.172.173.82:465
-
178.175.187.254:443
-
83.110.223.61:443
-
105.184.209.194:995
-
41.186.88.38:443
-
102.156.10.183:443
-
27.109.19.90:2078
-
47.205.25.170:443
-
12.172.173.82:993
-
76.170.252.153:995
-
69.242.31.249:443
-
24.234.220.88:995
-
125.99.69.178:443
-
79.168.224.165:2222
-
75.143.236.149:443
-
14.192.241.76:995
-
124.122.47.148:443
-
81.229.117.95:2222
-
98.145.23.67:443
-
114.143.176.236:443
-
103.144.201.48:2078
-
122.186.210.254:443
-
69.160.121.6:61201
-
12.172.173.82:21
-
72.253.126.216:443
-
75.109.111.89:443
-
76.86.31.59:443
-
116.120.145.170:995
-
12.172.173.82:50001
-
81.101.185.146:443
-
201.244.108.183:995
-
68.203.69.96:443
-
103.139.242.6:443
-
103.42.86.42:995
-
85.61.165.153:2222
-
76.16.49.134:443
-
125.99.76.102:443
-
184.182.66.109:443
-
70.28.50.223:32100
-
50.68.204.71:993
-
85.57.212.13:3389
-
41.227.190.59:443
-
70.28.50.223:3389
-
31.53.29.235:2222
-
89.79.229.50:443
-
50.68.186.195:443
-
47.199.241.39:443
-
93.147.235.8:443
-
75.141.227.169:443
-
45.243.142.31:995
-
79.92.15.6:443
-
85.104.105.67:443
-
89.129.109.27:2222
-
86.176.83.44:2222
-
24.234.220.88:993
-
89.32.156.5:995
-
12.172.173.82:22
-
103.101.203.177:443
-
70.28.50.223:2083
-
98.187.21.2:443
-
70.49.205.198:2222
-
96.56.197.26:2222
-
92.9.45.20:2222
-
86.195.14.72:2222
-
172.115.17.50:443
-
100.4.163.158:2222
-
80.12.88.148:2222
-
213.64.33.92:2222
-
113.11.92.30:443
-
78.192.109.105:2222
-
47.34.30.133:443
-
122.184.143.86:443
-
198.2.51.242:993
-
165.120.169.171:2222
-
88.126.94.4:50000
-
82.125.44.236:2222
-
117.195.17.148:993
-
147.219.4.194:443
-
80.167.196.79:443
-
92.154.17.149:2222
-
184.181.75.148:443
-
95.45.50.93:2222
-
84.35.26.14:995
-
201.143.215.69:443
-
12.172.173.82:2087
-
50.68.204.71:443
-
64.121.161.102:443
Signatures
- Loads dropped DLL 1 IoCs
pid Process 4776 rundll32.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{62DCEDC9-FEC5-4895-BD65-195FFE6B36FF} msiexec.exe File opened for modification C:\Windows\Installer\MSIEF75.tmp msiexec.exe File created C:\Windows\Installer\e56ede1.msi msiexec.exe File created C:\Windows\Installer\e56eddf.msi msiexec.exe File opened for modification C:\Windows\Installer\e56eddf.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000009865abc95f2d4b980000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800009865abc90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff0000000007000100006809009865abc9000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009865abc900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009865abc900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4332 msiexec.exe 4332 msiexec.exe 4776 rundll32.exe 4776 rundll32.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe 4152 wermgr.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4660 msiexec.exe Token: SeIncreaseQuotaPrivilege 4660 msiexec.exe Token: SeSecurityPrivilege 4332 msiexec.exe Token: SeCreateTokenPrivilege 4660 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4660 msiexec.exe Token: SeLockMemoryPrivilege 4660 msiexec.exe Token: SeIncreaseQuotaPrivilege 4660 msiexec.exe Token: SeMachineAccountPrivilege 4660 msiexec.exe Token: SeTcbPrivilege 4660 msiexec.exe Token: SeSecurityPrivilege 4660 msiexec.exe Token: SeTakeOwnershipPrivilege 4660 msiexec.exe Token: SeLoadDriverPrivilege 4660 msiexec.exe Token: SeSystemProfilePrivilege 4660 msiexec.exe Token: SeSystemtimePrivilege 4660 msiexec.exe Token: SeProfSingleProcessPrivilege 4660 msiexec.exe Token: SeIncBasePriorityPrivilege 4660 msiexec.exe Token: SeCreatePagefilePrivilege 4660 msiexec.exe Token: SeCreatePermanentPrivilege 4660 msiexec.exe Token: SeBackupPrivilege 4660 msiexec.exe Token: SeRestorePrivilege 4660 msiexec.exe Token: SeShutdownPrivilege 4660 msiexec.exe Token: SeDebugPrivilege 4660 msiexec.exe Token: SeAuditPrivilege 4660 msiexec.exe Token: SeSystemEnvironmentPrivilege 4660 msiexec.exe Token: SeChangeNotifyPrivilege 4660 msiexec.exe Token: SeRemoteShutdownPrivilege 4660 msiexec.exe Token: SeUndockPrivilege 4660 msiexec.exe Token: SeSyncAgentPrivilege 4660 msiexec.exe Token: SeEnableDelegationPrivilege 4660 msiexec.exe Token: SeManageVolumePrivilege 4660 msiexec.exe Token: SeImpersonatePrivilege 4660 msiexec.exe Token: SeCreateGlobalPrivilege 4660 msiexec.exe Token: SeBackupPrivilege 1356 vssvc.exe Token: SeRestorePrivilege 1356 vssvc.exe Token: SeAuditPrivilege 1356 vssvc.exe Token: SeBackupPrivilege 4332 msiexec.exe Token: SeRestorePrivilege 4332 msiexec.exe Token: SeRestorePrivilege 4332 msiexec.exe Token: SeTakeOwnershipPrivilege 4332 msiexec.exe Token: SeRestorePrivilege 4332 msiexec.exe Token: SeTakeOwnershipPrivilege 4332 msiexec.exe Token: SeRestorePrivilege 4332 msiexec.exe Token: SeTakeOwnershipPrivilege 4332 msiexec.exe Token: SeRestorePrivilege 4332 msiexec.exe Token: SeTakeOwnershipPrivilege 4332 msiexec.exe Token: SeRestorePrivilege 4332 msiexec.exe Token: SeTakeOwnershipPrivilege 4332 msiexec.exe Token: SeRestorePrivilege 4332 msiexec.exe Token: SeTakeOwnershipPrivilege 4332 msiexec.exe Token: SeRestorePrivilege 4332 msiexec.exe Token: SeTakeOwnershipPrivilege 4332 msiexec.exe Token: SeRestorePrivilege 4332 msiexec.exe Token: SeTakeOwnershipPrivilege 4332 msiexec.exe Token: SeRestorePrivilege 4332 msiexec.exe Token: SeTakeOwnershipPrivilege 4332 msiexec.exe Token: SeRestorePrivilege 4332 msiexec.exe Token: SeTakeOwnershipPrivilege 4332 msiexec.exe Token: SeRestorePrivilege 4332 msiexec.exe Token: SeTakeOwnershipPrivilege 4332 msiexec.exe Token: SeRestorePrivilege 4332 msiexec.exe Token: SeTakeOwnershipPrivilege 4332 msiexec.exe Token: SeRestorePrivilege 4332 msiexec.exe Token: SeTakeOwnershipPrivilege 4332 msiexec.exe Token: SeRestorePrivilege 4332 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4660 msiexec.exe 4660 msiexec.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4332 wrote to memory of 2584 4332 msiexec.exe 95 PID 4332 wrote to memory of 2584 4332 msiexec.exe 95 PID 4332 wrote to memory of 1188 4332 msiexec.exe 98 PID 4332 wrote to memory of 1188 4332 msiexec.exe 98 PID 4332 wrote to memory of 4940 4332 msiexec.exe 97 PID 4332 wrote to memory of 4940 4332 msiexec.exe 97 PID 1188 wrote to memory of 4776 1188 rundll32.exe 99 PID 1188 wrote to memory of 4776 1188 rundll32.exe 99 PID 1188 wrote to memory of 4776 1188 rundll32.exe 99 PID 4776 wrote to memory of 4152 4776 rundll32.exe 100 PID 4776 wrote to memory of 4152 4776 rundll32.exe 100 PID 4776 wrote to memory of 4152 4776 rundll32.exe 100 PID 4776 wrote to memory of 4152 4776 rundll32.exe 100 PID 4776 wrote to memory of 4152 4776 rundll32.exe 100 PID 4776 wrote to memory of 4152 4776 rundll32.exe 100 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\yohlef.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4660
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2584
-
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs2⤵PID:4940
-
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next2⤵
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4152
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1356
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e56ede0.rbs
- Size 9KB
- SHA256 e455d2869edabbe03939ce0b68d3f0045659eab617f7b068f6741f4095f9b617
- MD5 a02037d8adecc4d9ba87ae5a97e5cb4a
- SHA1 d731bab855f45e8c08ca97c501717d2e52749bda
- SHA512 a46fd0f4192d65479192d91c4b769d1620512d1ca267c56212b9952d9b1fb520b80814318a1eb4426cc961aab835d7a6665221d2ff323a384b5be2fcb6a38c1b
- SSDEEP 96:+AbOB7KeQS5SgAUMerSQPw9CsThqoUMerSQPw9C6jfzMSjU/Thq4HVPSIDvloRcI:+CeTfMnkwgIcMnkwgUGrHLmUVpLa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll
- Size 752KB
- SHA256 3449a237b8e97a0bc08f3867f884b68cf4d1770bfaa7c0834786d105a741f273
- MD5 befad0feb0409d9676a166365e76a746
- SHA1 b938403c00cbf4923cf89d39c7bfb4fa29c1ce29
- SHA512 4ee9832211a056d4185ed3232b4f16815816780f3e92b326957135c8ce8cdced73feada7686ec0747b907621fb96f1df975e6bf9e69fae8515d345c384d92cc8
- SSDEEP 12288:ovXYcP7kXn89DhAw1vUN3RFEycMFSDXxqEbfRh+NjAyejvDYTrH0chn:mvTkXnyDPORDccmEsP+NjAyej7Yf0a
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll
- Size 752KB
- SHA256 3449a237b8e97a0bc08f3867f884b68cf4d1770bfaa7c0834786d105a741f273
- MD5 befad0feb0409d9676a166365e76a746
- SHA1 b938403c00cbf4923cf89d39c7bfb4fa29c1ce29
- SHA512 4ee9832211a056d4185ed3232b4f16815816780f3e92b326957135c8ce8cdced73feada7686ec0747b907621fb96f1df975e6bf9e69fae8515d345c384d92cc8
- SSDEEP 12288:ovXYcP7kXn89DhAw1vUN3RFEycMFSDXxqEbfRh+NjAyejvDYTrH0chn:mvTkXnyDPORDccmEsP+NjAyej7Yf0a
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs
- Size 132B
- SHA256 d24e3399060b51f3a1c9d41a67de2601888a35c99da8db70070d757bb3f1913a
- MD5 0d4c9f15ce74465c59ae36a27f98c817
- SHA1 9cce8eefa4d3d9c5e161c5dbb860cfe1489c6b1a
- SHA512 9bed0eafc2cf2a2360850ca1070ffb04ac14f04c78379485998a93f45012b5c11cc7f6f68129f65b8b5f90437cb965908c6a1bb9d83a56b068d6bde1d5fdad1f
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\e56eddf.msi
- Size 404KB
- SHA256 30384e44c5df96b7809a94c2320caeb8ea94d6c9a2d0bf5a10206bee397f1c26
- MD5 1ddfcbdbe07f551e561be159a73d1c99
- SHA1 1ffea8c6ba224b4a9e6bb402b030a8c12f2523e2
- SHA512 aa92c5f5fb036ce0d83afd7c804cc07940d62291b1c431249bb4fc982721ac117f7fde6fb28d7a30261e8ccdddca694879d382b2bb8b1d09179b4913bd495264
- SSDEEP 12288:MxCriEQzPJLNee9Lp1NjAyefvDz7n5DY:sdzFLPNjAyef7z7FY
- MD5 SHA1 SHA512 SSDEEP
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 23.0MB
- SHA256 2b273fc4d63a6dbceb3fd7390482e5764a6ba765902ed8cf733a8aaae832a121
- MD5 2b63d8e6a1f5841e9df1acbdf5d4195a
- SHA1 0066752b85e22af95146a7e72ea52e72eb4b7baf
- SHA512 cb7f2a58ea9078334b203ac57fa501066ed9b75b5453a7781c620a0db142d996f954c95db2218f554f28d5d98280d23608ec92259f063c386da282487baaa958
- SSDEEP 24576:Kjdmqn+bdoO/vvTLZem+dVbr1RVeGadDBBwNEF3get67Sr+24j6oIfJsH:F
- MD5 SHA1 SHA512 SSDEEP
- Path \??\Volume{c9ab6598-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{a96b8759-8781-4b41-b78e-34b8f0d68f45}_OnDiskSnapshotProp
- Size 5KB
- SHA256 6fb84a36555f474814b2be0e469e5fd22609cf0a44082d6ee2d911bd33410c3a
- MD5 57c2547ce405a8d7e2e1e52c1ebde32f
- SHA1 2745c176c3fe3c48ddf6458555c709ee9ad0f59c
- SHA512 917c99766f0122d6b0e17f80254157af2adadbdddaf41849fc7401bd9bde2d75d38be58e983e2397e243264b47f9831365ac8643c17577ff934f5bb9614e16ba
- SSDEEP 96:F5lF13aDD84LTHzbOHXOHBlBRQb8Sa9XE56tRSVQEJN:H4b++GzJN
- MD5 SHA1 SHA512 SSDEEP