Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
81s -
max time network
56s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
26/10/2023, 14:53
Static task
static1
Behavioral task
behavioral1
Sample
stopdoingthis.msi
Resource
win10v2004-20231020-en
General
-
Target
stopdoingthis.msi
-
Size
7.7MB
-
MD5
599423697dafc91edf9cc90aba306646
-
SHA1
a6f3060af91d9bbea8e72a23b5f92896edf4c3a9
-
SHA256
12f5d9383518e88b0b7b857b946d33de8c9a075b1b348a7df83ae983c5fefeaa
-
SHA512
862f6452f8bb0108d8b5535a5bdd35e0c452c0993fa0d6ec5b6f9d059c2711fe4748e25ab201a16bace528c81abd4fb21e60e384eb123185dda19d5bb2af4a80
-
SSDEEP
98304:TpFKjsEZcgsdUqakFRFawTV82ASqQBW9vpWzxjFycvniqy33XglSB2CiU39hItDb:61NsUqai/pTOryNnxyXxBTiWKmbSQMR
Malware Config
Extracted
darkgate
user_871236672
http://onlineserviceboonkers.com
-
alternative_c2_port
8080
-
anti_analysis
true
-
anti_debug
true
-
anti_vm
true
-
c2_port
2351
-
check_disk
true
-
check_ram
true
-
check_xeon
true
-
crypter_au3
false
-
crypter_dll
false
-
crypter_rawstub
true
-
crypto_key
yBhTbTZsxrLjqz
-
internal_mutex
txtMut
-
minimum_disk
35
-
minimum_ram
6000
-
ping_interval
4
-
rootkit
true
-
startup_persistence
true
-
username
user_871236672
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3124 windbg.exe 3292 Autoit3.exe -
Loads dropped DLL 4 IoCs
pid Process 888 MsiExec.exe 3124 windbg.exe 3124 windbg.exe 888 MsiExec.exe -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 696 ICACLS.EXE 392 ICACLS.EXE -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{0D2CD633-D568-4483-BB11-12F8A4A396E2} msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIF935.tmp msiexec.exe File opened for modification C:\Windows\LOGS\DPX\setupact.log EXPAND.EXE File created C:\Windows\Installer\e57f695.msi msiexec.exe File opened for modification C:\Windows\Installer\e57f695.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIE83.tmp msiexec.exe File opened for modification C:\Windows\LOGS\DPX\setuperr.log EXPAND.EXE File opened for modification C:\Windows\Installer\MSIE84.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000299f28d78dcfadf0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800000299f28d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809000299f28d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d0299f28d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000299f28d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Autoit3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Autoit3.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings Autoit3.exe Key created \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2148 msiexec.exe 2148 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeShutdownPrivilege 736 msiexec.exe Token: SeIncreaseQuotaPrivilege 736 msiexec.exe Token: SeSecurityPrivilege 2148 msiexec.exe Token: SeCreateTokenPrivilege 736 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 736 msiexec.exe Token: SeLockMemoryPrivilege 736 msiexec.exe Token: SeIncreaseQuotaPrivilege 736 msiexec.exe Token: SeMachineAccountPrivilege 736 msiexec.exe Token: SeTcbPrivilege 736 msiexec.exe Token: SeSecurityPrivilege 736 msiexec.exe Token: SeTakeOwnershipPrivilege 736 msiexec.exe Token: SeLoadDriverPrivilege 736 msiexec.exe Token: SeSystemProfilePrivilege 736 msiexec.exe Token: SeSystemtimePrivilege 736 msiexec.exe Token: SeProfSingleProcessPrivilege 736 msiexec.exe Token: SeIncBasePriorityPrivilege 736 msiexec.exe Token: SeCreatePagefilePrivilege 736 msiexec.exe Token: SeCreatePermanentPrivilege 736 msiexec.exe Token: SeBackupPrivilege 736 msiexec.exe Token: SeRestorePrivilege 736 msiexec.exe Token: SeShutdownPrivilege 736 msiexec.exe Token: SeDebugPrivilege 736 msiexec.exe Token: SeAuditPrivilege 736 msiexec.exe Token: SeSystemEnvironmentPrivilege 736 msiexec.exe Token: SeChangeNotifyPrivilege 736 msiexec.exe Token: SeRemoteShutdownPrivilege 736 msiexec.exe Token: SeUndockPrivilege 736 msiexec.exe Token: SeSyncAgentPrivilege 736 msiexec.exe Token: SeEnableDelegationPrivilege 736 msiexec.exe Token: SeManageVolumePrivilege 736 msiexec.exe Token: SeImpersonatePrivilege 736 msiexec.exe Token: SeCreateGlobalPrivilege 736 msiexec.exe Token: SeBackupPrivilege 4772 vssvc.exe Token: SeRestorePrivilege 4772 vssvc.exe Token: SeAuditPrivilege 4772 vssvc.exe Token: SeBackupPrivilege 2148 msiexec.exe Token: SeRestorePrivilege 2148 msiexec.exe Token: SeRestorePrivilege 2148 msiexec.exe Token: SeTakeOwnershipPrivilege 2148 msiexec.exe Token: SeRestorePrivilege 2148 msiexec.exe Token: SeTakeOwnershipPrivilege 2148 msiexec.exe Token: SeRestorePrivilege 2148 msiexec.exe Token: SeTakeOwnershipPrivilege 2148 msiexec.exe Token: SeRestorePrivilege 2148 msiexec.exe Token: SeTakeOwnershipPrivilege 2148 msiexec.exe Token: SeBackupPrivilege 2336 srtasks.exe Token: SeRestorePrivilege 2336 srtasks.exe Token: SeSecurityPrivilege 2336 srtasks.exe Token: SeTakeOwnershipPrivilege 2336 srtasks.exe Token: SeBackupPrivilege 2336 srtasks.exe Token: SeRestorePrivilege 2336 srtasks.exe Token: SeSecurityPrivilege 2336 srtasks.exe Token: SeTakeOwnershipPrivilege 2336 srtasks.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 736 msiexec.exe 736 msiexec.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2776 OpenWith.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2148 wrote to memory of 2336 2148 msiexec.exe 95 PID 2148 wrote to memory of 2336 2148 msiexec.exe 95 PID 2148 wrote to memory of 888 2148 msiexec.exe 98 PID 2148 wrote to memory of 888 2148 msiexec.exe 98 PID 2148 wrote to memory of 888 2148 msiexec.exe 98 PID 888 wrote to memory of 696 888 MsiExec.exe 100 PID 888 wrote to memory of 696 888 MsiExec.exe 100 PID 888 wrote to memory of 696 888 MsiExec.exe 100 PID 888 wrote to memory of 3016 888 MsiExec.exe 102 PID 888 wrote to memory of 3016 888 MsiExec.exe 102 PID 888 wrote to memory of 3016 888 MsiExec.exe 102 PID 888 wrote to memory of 3124 888 MsiExec.exe 104 PID 888 wrote to memory of 3124 888 MsiExec.exe 104 PID 888 wrote to memory of 3124 888 MsiExec.exe 104 PID 3124 wrote to memory of 3292 3124 windbg.exe 105 PID 3124 wrote to memory of 3292 3124 windbg.exe 105 PID 3124 wrote to memory of 3292 3124 windbg.exe 105 PID 888 wrote to memory of 392 888 MsiExec.exe 106 PID 888 wrote to memory of 392 888 MsiExec.exe 106 PID 888 wrote to memory of 392 888 MsiExec.exe 106 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\stopdoingthis.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:736
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:2336
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CC923B027BCE9E004C095052B31DED9E2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-8de026c8-095f-41f6-a872-7d0fad89de26\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
PID:696
-
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
- Drops file in Windows directory
PID:3016
-
-
C:\Users\Admin\AppData\Local\Temp\MW-8de026c8-095f-41f6-a872-7d0fad89de26\files\windbg.exe"C:\Users\Admin\AppData\Local\Temp\MW-8de026c8-095f-41f6-a872-7d0fad89de26\files\windbg.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\tmpa\Autoit3.exec:\tmpa\Autoit3.exe c:\tmpa\script.au34⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies registry class
PID:3292
-
-
-
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-8de026c8-095f-41f6-a872-7d0fad89de26\." /SETINTEGRITYLEVEL (CI)(OI)LOW3⤵
- Modifies file permissions
PID:392
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4772
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2776
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2672
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding1⤵PID:3588
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.4MB
MD58f95ee581b60c84c7aae8e7f73c18f8a
SHA1e3384841b67b57b5a55c9f75eb7feb48e756b6a4
SHA256b1d5669a662282a88729a6babfd6b9233f91656620232b41b88fec0c23f37363
SHA51261de833db0f5f645faae076f9599da3d0693584136c8dc40cd1d7dd94f009d9927ef387b055a349cccc1b7dfcdee86c2a519597e1140abe500dd66469498d6bd
-
C:\Users\Admin\AppData\Local\Temp\MW-8de026c8-095f-41f6-a872-7d0fad89de26\files\00147-1040811655.png
Filesize1.3MB
MD57ec930b1536750116c13b06313286cf5
SHA1adc543581e4acbaffd5593d07346296bbda1ede5
SHA2561d18677415ff9d03c8e3accde3ab0786d33985f3d6b3855eca632c07fc4de547
SHA512531887e99339aa19cef104226074cdbfb74d8e31cb535cf232b241f4cb05550ac33504ad58dc9b3eaa2c5dbb0a2eb32e9cc06a754b00618485d625ca4c3415db
-
C:\Users\Admin\AppData\Local\Temp\MW-8de026c8-095f-41f6-a872-7d0fad89de26\files\00148-1040811656.png
Filesize1.2MB
MD5bb581ea56d0940dc4d002a902e0fb0c9
SHA1226afeb98300bc51a4e80e112b38bfbf9ef8f706
SHA25684e19377a78d441de940eb1943edddc5720aafb67aed7dc30c281b98c3d0a201
SHA5123237d3a234549704af058e64c4e190f07023e44164bae66e31c87a733ed215c827d2c29facce53a1dc781cc31f538f8f17e4a389ca21354c111ed9da04429511
-
Filesize
1.2MB
MD55cf577304c7231e35ab9296db1207993
SHA16deec1a72be8e657dcb484d58e81d138cfd8f25d
SHA256ad7544c407ec1655adc699e70b75b5d75c3a7f28538a9738925b5f020b5e571c
SHA512e1615432911024c9ad9abca3f851a94647f22b2600160dca9ad6ac18c2830d78e6e87f96cc4ecb2d9b597b66b0a7ddf5774299415cc0bd40d4e19741352aa37f
-
Filesize
1.2MB
MD509f104f5af838fc714ba3d17623008b9
SHA1842bcd3e250ab2ee598947ba241cafb274dda591
SHA256caf1252510b1be93214fc9d464a20fdbf81a89839f7e0bc9156190762af3714f
SHA512c37105eeaf8659546922066ffc712f88527adb59954c74381a53afa3623b8bedbdad548f26d3ecfd43cb0f0eca7f052ddf953358ece96d1199ff1e5e76e5604c
-
Filesize
1.1MB
MD564d144051485b81b8a7c83476ba59427
SHA1044bd6b794414b82d1579d309d3762d02e39d292
SHA256f63482d06fbe08336aa1b7b7ec813bad196bba9f60a6a27363a82c9da9cc17f0
SHA512d38f9ca097277cf6500258e16cb183deaa07b10e2060d93810af3eb97e8c97285817b32ab5876d5f42b0ca504dd5b562f421b7eb2ad65be5d950eb52f6ead1db
-
Filesize
92KB
MD58b305b67e45165844d2f8547a085d782
SHA192b8ed7652e61fdf3acb4ce74f48bcc9ed14b722
SHA256776622a88a71b989ae022dae2bfbe52d5f00024970548a465046b742089aa50b
SHA5122bd688ab072464ed54ea111a07e44f130a6db2c51e6f5ede1d8583b31791ad3eb2ea51114e6ac624a50118f17dfd3ec3d72c7df00d8be3b4ef4dcd7b72a0dfe6
-
Filesize
1.8MB
MD578ed007015a6be04035921a5c9881a3e
SHA13a3a7a8c84f192eaf3e399aacd630b95ee848005
SHA25643ebb3f62d6ddfc43ffea5b7de0c4992db1920591f19552148c36863ef16f454
SHA5126b8453a28db2a154667c794c12c73f9426fc145f56f7a3d884eef8d7fff9076feec202f1c2e90899701caf952c6778266e851c852c1858b5aef0caafd3bb3e39
-
Filesize
736KB
MD50e15cf36767154814fb8e6b61c726e19
SHA11f7bae6cb38aa8da60723ead126840f49e7af07d
SHA256036ba93b0ffb331a11ce1ddabc19fc6fd41824dd053fdce3c1d3942910480f7b
SHA5124135b5d3f3081369060ee915f8595fd86353277c2910cedd524b1df3494a51d56ef11247efac01770c3d4be43e6911ee1f2f77495d7250dd170c3965a8cd3d58
-
Filesize
736KB
MD50e15cf36767154814fb8e6b61c726e19
SHA11f7bae6cb38aa8da60723ead126840f49e7af07d
SHA256036ba93b0ffb331a11ce1ddabc19fc6fd41824dd053fdce3c1d3942910480f7b
SHA5124135b5d3f3081369060ee915f8595fd86353277c2910cedd524b1df3494a51d56ef11247efac01770c3d4be43e6911ee1f2f77495d7250dd170c3965a8cd3d58
-
Filesize
736KB
MD50e15cf36767154814fb8e6b61c726e19
SHA11f7bae6cb38aa8da60723ead126840f49e7af07d
SHA256036ba93b0ffb331a11ce1ddabc19fc6fd41824dd053fdce3c1d3942910480f7b
SHA5124135b5d3f3081369060ee915f8595fd86353277c2910cedd524b1df3494a51d56ef11247efac01770c3d4be43e6911ee1f2f77495d7250dd170c3965a8cd3d58
-
Filesize
474KB
MD504ec4f58a1f4a87b5eeb1f4b7afc48e0
SHA158dcb1cbbec071d036a07f0e8feb858e4c5b96e7
SHA256bd1af3dba56b129e6c624297eeed40c898fa2981fce5caafe467d88a748988a4
SHA5125b572a504fac599e7e3f726d391e8ffdc2d083745609315a203000e8dc79b94d777fc520eb6530444d84f1ac9aad51406b91b527d8434077a58524feeccbbd80
-
Filesize
474KB
MD504ec4f58a1f4a87b5eeb1f4b7afc48e0
SHA158dcb1cbbec071d036a07f0e8feb858e4c5b96e7
SHA256bd1af3dba56b129e6c624297eeed40c898fa2981fce5caafe467d88a748988a4
SHA5125b572a504fac599e7e3f726d391e8ffdc2d083745609315a203000e8dc79b94d777fc520eb6530444d84f1ac9aad51406b91b527d8434077a58524feeccbbd80
-
Filesize
1KB
MD5d866efe502559b4a3246fa9703c0457f
SHA1192181175fd7f27a009221e9d474773a7deff4ad
SHA256a11675e879cfaa1e2c638125d8aeaab5b64f3080afc83de1ec49c98dcb4957bc
SHA5125b586f9924039cec3cd33922511f948a2a9747d68f18134ccf1866416b2fd5b0a18807a8b5197003aa16ffca5e35e8e596b17b91a5f33a8916e5be1deed3785a
-
Filesize
1010B
MD51d57042278d85673528fdd0287c9afde
SHA1c5ba2c0183dfc9c48488f4d13bc46f5e8ec89a31
SHA2564e827e5ba0b6f04c66ff3b7c05cc0bdc6500937e74f9e86ca81be147ad63b430
SHA51299d8f7a15ccbfed1b7e53f0062b0c7c5c56244a06dcca28f16a90450a82ee0aac9672d1a1651c55394ce742b4536fe193c5253e785af30548d0e2a135096f2a6
-
Filesize
1KB
MD5305a39e5d3312872040c01833f029afe
SHA11d5ba7472a65c161676a1736930af4a8ca166c8d
SHA256935f745a0ab98d471af874cc2579d54ce321b235c5f4764c94fc06fe40057871
SHA512e75849537ed9ea413f914ad6b804875d3ec41eb17a3ded68e0397ef46899ec08e3af5bf69f003c34ae1620791018d0e8e4f7f023f5d8bed8fae65e7eeb671a99
-
Filesize
1KB
MD5305a39e5d3312872040c01833f029afe
SHA11d5ba7472a65c161676a1736930af4a8ca166c8d
SHA256935f745a0ab98d471af874cc2579d54ce321b235c5f4764c94fc06fe40057871
SHA512e75849537ed9ea413f914ad6b804875d3ec41eb17a3ded68e0397ef46899ec08e3af5bf69f003c34ae1620791018d0e8e4f7f023f5d8bed8fae65e7eeb671a99
-
Filesize
208KB
MD5d82b3fb861129c5d71f0cd2874f97216
SHA1f3fe341d79224126e950d2691d574d147102b18d
SHA256107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c
SHA512244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b
-
Filesize
208KB
MD5d82b3fb861129c5d71f0cd2874f97216
SHA1f3fe341d79224126e950d2691d574d147102b18d
SHA256107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c
SHA512244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b
-
Filesize
208KB
MD5d82b3fb861129c5d71f0cd2874f97216
SHA1f3fe341d79224126e950d2691d574d147102b18d
SHA256107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c
SHA512244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b
-
Filesize
208KB
MD5d82b3fb861129c5d71f0cd2874f97216
SHA1f3fe341d79224126e950d2691d574d147102b18d
SHA256107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c
SHA512244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b
-
Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
Filesize
23.0MB
MD5a1918ecd1833aaee67a1bc814967a304
SHA1eb2a734c540024f7babaca9e8e9201fa21f2a3f0
SHA2564887d0edb9e4142fe183795be050768120eb4c34a54835e634017406c0709454
SHA5127bcc21f945f8f92ce2a1192978032a99eb2ce6b3a524790604641f97698614d664da5226387c3dc86cf54876af115515771df661a2cfb07d993ef749903c87e2
-
\??\Volume{8df29902-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{fa549691-7de9-42be-84f3-b1120c688593}_OnDiskSnapshotProp
Filesize5KB
MD5eb1d34edf466e1cdc2fc0eb28324a2aa
SHA163928a3c0ed527017fa7612a9c16a205d601b98b
SHA256066a0e69f57eb95c15fa69e1aa47a78d3ba4da68f7a638ae51b6b563240b50b2
SHA512ac553d8526e3d3504abfa692e25cae268d15284d8fdb0f79499203d9cec2f7b3d7b4cb3da8005a818bb3d691584c238647f6b5d454b5023ffbae4231a0281d1a
-
Filesize
499KB
MD5dadd841301a9e91a1f2fee0ac37a94a5
SHA164f43876eeaae2b091cfc820353bf903290482d3
SHA25653e48b6b1edb8299333b19bca07327a3e706d42ee57bc44e239e7de642405fe5
SHA512c6b26acea5ff78ec9d03db93b27ef864ba0fae1b7b5ee724c8be208d51dbedd7ef380b6aace17a1b3641308c75a538ee6c2259adb073b4fdef9ae1f54cd3e30e