Analysis
-
max time kernel
203s -
max time network
200s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
18-01-2024 14:47
Static task
static1
Behavioral task
behavioral1
Sample
nvim-win64.msi
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
nvim-win64.msi
Resource
win10v2004-20231215-en
General
-
Target
nvim-win64.msi
-
Size
40.5MB
-
MD5
460beecd80d3207814ae27f57b71bc08
-
SHA1
f6f2f0c6f86967690b433aa8a5a72636c0e1ffc0
-
SHA256
006b8578f0b6717bc5a987f12bc0746c61c20e6ba777fde6d4aa53ee54b937cd
-
SHA512
06548d2fe22d330e32ec0463848d4e9550148565a63656b91fc35fec94ecdfa8631e5c1ff47b9afab20fa7a7bf4c0ffa3f44eadc32b7f251d13fb84234bded7c
-
SSDEEP
786432:MBEnLMhcai1lT0CY+LdZ4/i9m/X+etaxnlOKuxB6:CSEa1loCBiiM/VvB6
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2044 nvim-qt.exe 4460 nvim.exe -
Loads dropped DLL 26 IoCs
pid Process 1412 MsiExec.exe 2044 nvim-qt.exe 2044 nvim-qt.exe 2044 nvim-qt.exe 2044 nvim-qt.exe 2044 nvim-qt.exe 2044 nvim-qt.exe 2044 nvim-qt.exe 2044 nvim-qt.exe 2044 nvim-qt.exe 2044 nvim-qt.exe 2044 nvim-qt.exe 2044 nvim-qt.exe 2044 nvim-qt.exe 2044 nvim-qt.exe 2044 nvim-qt.exe 2044 nvim-qt.exe 2044 nvim-qt.exe 2044 nvim-qt.exe 2044 nvim-qt.exe 2044 nvim-qt.exe 2044 nvim-qt.exe 2044 nvim-qt.exe 2044 nvim-qt.exe 2044 nvim-qt.exe 4460 nvim.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Neovim\share\nvim\runtime\lua\editorconfig.lua msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\macros\shellmenu.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\syntax\loginaccess.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\syntax\manual.vim msiexec.exe File created C:\Program Files\Neovim\bin\xxd.exe msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\doc\pi_spec.txt msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\doc\support.txt msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\ftplugin\apache.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\syntax\slice.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\syntax\cterm.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\syntax\mp.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\syntax\sm.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\autoload\README.txt msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\compiler\cucumber.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\ftplugin\gitcommit.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\ftplugin\tutor.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\ftplugin\zimbu.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\delmenu.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\syntax\antlr.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\syntax\lhaskell.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\syntax\viminfo.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\syntax\falcon.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\doc\lsp.txt msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\doc\pi_tar.txt msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\doc\usr_40.txt msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\syntax\bitbake.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\doc\usr_26.txt msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\doc\usr_29.txt msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\ftplugin\libao.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\syntax\lftp.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\syntax\wvdial.vim msiexec.exe File created C:\Program Files\Neovim\share\locale\ko.UTF-8\LC_MESSAGES\nvim.mo msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\colors\desert.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\macros\editexisting.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\syntax\debsources.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\doc\usr_12.txt msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\makemenu.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\syntax\kwt.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\syntax\prolog.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\syntax\wsh.vim msiexec.exe File created C:\Program Files\Neovim\bin\libstdc++-6.dll msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\ftplugin\vb.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\queries\lua\highlights.scm msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\syntax\fvwm.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\doc\pi_tutor.txt msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\doc\term.txt msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\syntax\muttrc.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\syntax\raml.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\lua\vim\lsp\_watchfiles.lua msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\syntax\upstreamrpt.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\syntax\abc.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\syntax\ch.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\syntax\icemenu.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\syntax\ist.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\ftplugin\nginx.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\syntax\htmldjango.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\syntax\php.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\syntax\rng.vim msiexec.exe File created C:\Program Files\Neovim\share\locale\it\LC_MESSAGES\nvim.mo msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\doc\quickfix.txt msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\doc\usr_10.txt msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\doc\usr_25.txt msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\syntax\tmux.vim msiexec.exe File created C:\Program Files\Neovim\share\nvim\runtime\syntax\grub.vim msiexec.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\Installer\e599a52.msi msiexec.exe File opened for modification C:\Windows\Installer\e599a52.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{61E403FD-BD2B-46B9-9688-B6AE1D7DBB40} msiexec.exe File opened for modification C:\Windows\Installer\MSI9E78.tmp msiexec.exe File created C:\Windows\Installer\e599a54.msi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005cf4f6141e81f6580000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800005cf4f6140000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809005cf4f614000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d5cf4f614000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000005cf4f61400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2044 nvim-qt.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2244 msiexec.exe 2244 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5020 msiexec.exe Token: SeIncreaseQuotaPrivilege 5020 msiexec.exe Token: SeSecurityPrivilege 2244 msiexec.exe Token: SeCreateTokenPrivilege 5020 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5020 msiexec.exe Token: SeLockMemoryPrivilege 5020 msiexec.exe Token: SeIncreaseQuotaPrivilege 5020 msiexec.exe Token: SeMachineAccountPrivilege 5020 msiexec.exe Token: SeTcbPrivilege 5020 msiexec.exe Token: SeSecurityPrivilege 5020 msiexec.exe Token: SeTakeOwnershipPrivilege 5020 msiexec.exe Token: SeLoadDriverPrivilege 5020 msiexec.exe Token: SeSystemProfilePrivilege 5020 msiexec.exe Token: SeSystemtimePrivilege 5020 msiexec.exe Token: SeProfSingleProcessPrivilege 5020 msiexec.exe Token: SeIncBasePriorityPrivilege 5020 msiexec.exe Token: SeCreatePagefilePrivilege 5020 msiexec.exe Token: SeCreatePermanentPrivilege 5020 msiexec.exe Token: SeBackupPrivilege 5020 msiexec.exe Token: SeRestorePrivilege 5020 msiexec.exe Token: SeShutdownPrivilege 5020 msiexec.exe Token: SeDebugPrivilege 5020 msiexec.exe Token: SeAuditPrivilege 5020 msiexec.exe Token: SeSystemEnvironmentPrivilege 5020 msiexec.exe Token: SeChangeNotifyPrivilege 5020 msiexec.exe Token: SeRemoteShutdownPrivilege 5020 msiexec.exe Token: SeUndockPrivilege 5020 msiexec.exe Token: SeSyncAgentPrivilege 5020 msiexec.exe Token: SeEnableDelegationPrivilege 5020 msiexec.exe Token: SeManageVolumePrivilege 5020 msiexec.exe Token: SeImpersonatePrivilege 5020 msiexec.exe Token: SeCreateGlobalPrivilege 5020 msiexec.exe Token: SeCreateTokenPrivilege 5020 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5020 msiexec.exe Token: SeLockMemoryPrivilege 5020 msiexec.exe Token: SeIncreaseQuotaPrivilege 5020 msiexec.exe Token: SeMachineAccountPrivilege 5020 msiexec.exe Token: SeTcbPrivilege 5020 msiexec.exe Token: SeSecurityPrivilege 5020 msiexec.exe Token: SeTakeOwnershipPrivilege 5020 msiexec.exe Token: SeLoadDriverPrivilege 5020 msiexec.exe Token: SeSystemProfilePrivilege 5020 msiexec.exe Token: SeSystemtimePrivilege 5020 msiexec.exe Token: SeProfSingleProcessPrivilege 5020 msiexec.exe Token: SeIncBasePriorityPrivilege 5020 msiexec.exe Token: SeCreatePagefilePrivilege 5020 msiexec.exe Token: SeCreatePermanentPrivilege 5020 msiexec.exe Token: SeBackupPrivilege 5020 msiexec.exe Token: SeRestorePrivilege 5020 msiexec.exe Token: SeShutdownPrivilege 5020 msiexec.exe Token: SeDebugPrivilege 5020 msiexec.exe Token: SeAuditPrivilege 5020 msiexec.exe Token: SeSystemEnvironmentPrivilege 5020 msiexec.exe Token: SeChangeNotifyPrivilege 5020 msiexec.exe Token: SeRemoteShutdownPrivilege 5020 msiexec.exe Token: SeUndockPrivilege 5020 msiexec.exe Token: SeSyncAgentPrivilege 5020 msiexec.exe Token: SeEnableDelegationPrivilege 5020 msiexec.exe Token: SeManageVolumePrivilege 5020 msiexec.exe Token: SeImpersonatePrivilege 5020 msiexec.exe Token: SeCreateGlobalPrivilege 5020 msiexec.exe Token: SeCreateTokenPrivilege 5020 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5020 msiexec.exe Token: SeLockMemoryPrivilege 5020 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5020 msiexec.exe 5020 msiexec.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2044 nvim-qt.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2244 wrote to memory of 1412 2244 msiexec.exe 99 PID 2244 wrote to memory of 1412 2244 msiexec.exe 99 PID 2244 wrote to memory of 1412 2244 msiexec.exe 99 PID 2244 wrote to memory of 4684 2244 msiexec.exe 102 PID 2244 wrote to memory of 4684 2244 msiexec.exe 102 PID 2044 wrote to memory of 4460 2044 nvim-qt.exe 107 PID 2044 wrote to memory of 4460 2044 nvim-qt.exe 107 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\nvim-win64.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5020
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6A5BB417F8EFCF7A05BD2F81DD6FDDE9 C2⤵
- Loads dropped DLL
PID:1412
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4684
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4472
-
C:\Program Files\Neovim\bin\nvim-qt.exe"C:\Program Files\Neovim\bin\nvim-qt.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Program Files\Neovim\bin\nvim.exenvim --embed --cmd "let &rtp.=',C:/Program Files/Neovim/bin/../share/nvim-qt/runtime'" --cmd "set termguicolors"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4460
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
324KB
MD5dd000432aafc932d55c31d06cb6dd964
SHA13fe22decaf7a35ef6ac07e9dcf91c897a352c8f9
SHA256d66fff3fc065cac307234719d259b8cfcb6bc9ce2f0867eb88c398edfb62b7f4
SHA512824155f49a5da7871047da2b671a12cc88100817cc558c7817a73dbbf26265cd72f963309705d0196684bc87c238594d70c3ddcae319673a48ca4eda31277329
-
Filesize
904KB
MD5b3f5a63ddd2239365cb4da6824f486c2
SHA10489ce105e16550457527de5bc823bd99d00b723
SHA2564394a4affc26cec1290e6808a52a875b7f9488ce5978ddc3e8fb8752610d5f5a
SHA51248095ffd806ed9006dd5534fc50cb46622eb71b5d6393f9a2fcea06c47815b0278716d40def6c06442426849ad83e71a83d4b94aa9ecf9285a38792b3615677d
-
Filesize
880KB
MD5c4c3d0268088f2ccf4f25378e121aa58
SHA13560c2180eb3de69c59a7f37f0fddf72ad834916
SHA25632135d8b25b89239dc8a6cb0a9c7e7695178649dde52d9e242d941f5f5d55807
SHA512668a14fc58d8cbba5dc2c263924f265cb0a98ce3d85fdc0044f494b4ad5162675d97ce3b5dbb4ea95ac89d010d1d028c04a040fea2763834e56c71dc19e213ce
-
Filesize
675KB
MD5905083b663099443378718781270607d
SHA17e166335a3a8108bb81675f85775ad94a86bf4f6
SHA25644d9465f12f68b17ffb5bd4f6d1eb736b7b52323500d3c2eb0db825f1a18d99b
SHA512a33819ec527ce30fbde8258b2a69dba655fd10c38cc86fa239a1fb35019f28e3305fd55b02aef700955f481814bf54adf8181a2ae065ba741964d33b6c677f50
-
Filesize
881KB
MD555b2a149f13e69b0e6d53be7c23d9fb0
SHA1d1c9ea788486644a2b48c9316b9e6baf613737d7
SHA256884435d55464575d91673996853967268347a9fe4bd7ae414672de8114a73e51
SHA512c33ec190817806e6333afe939968421495f7934bcf5751906ebc5ca335eb8881f4f7b48b5bca48d5b397e9543a23c5ab052167e305e65070db435d319406579d
-
Filesize
524KB
MD560ef446ab8c03062daf5d97347430b68
SHA16cca6309c76c8d0328595654fb8c3dbe13ace558
SHA256c85e87b97d13d1113c5aebfb83f84b7db7e1ba6781bdc94e4d3966113ea1d311
SHA51271251399e796222d4c475dfeea9be19846e6a30618d6d74a0ea96a8c3e800358533527df60dfa3c5009454851b7fb43c85bc9dd0a1885c09921038fb10abbdcc
-
Filesize
516KB
MD5d4920bde15e886925c6d4675800f0486
SHA1e387585ba16cdb7c4e39077958057abdf04dff88
SHA256b20cb695e8f76a6ff1dd7857556f055ce6f37beba6c111a66fe4894a88419755
SHA5123f1809ecde5d151f946a10b9bfb59c9df4a9d551ac272c6bddc3faff2c4e3c220e87bbee5da25adcb97aa4b8f8ebbee6db485d97d6f0750fffa24fdb188d5d88
-
Filesize
452KB
MD5e5691ea5a17202177b0303b4659013a0
SHA1d325feb88163e138c69b96f91377e9c6d227901b
SHA2560d0b9c90983f1f39868db14e7769c8ebdd3ad2b32b0258579a11b4ce40ac7664
SHA512cc06147d8135b170c02cf014aea9cf75091817b7af12b0abb80d478c968769b12cec2a4ba033e9fdba0f648ed08f2e17cb98bac39eade42ab95aaad21f14dec8
-
Filesize
566KB
MD57b80103c5e287dc427a6e9435ab05f35
SHA1272f90165ff6d440e2d4ce21f69eeb44ac8a5c9b
SHA25625ad9cf13bbef3b7f7f99c8effc25aedd20dcf8b2455e4b685ebb27d510f9ecc
SHA512522037c7aa50cbf122d1e11e1b0284afe7b7f77dc6f1fafd89d803816e8ab92a98b8f9a14c2cca45bcc475405f4b6c89ba9da3973572982a903d38fd6bfff2cd
-
Filesize
479KB
MD5e0c18af1e399c7f3330ff54d4d7b4b97
SHA16325fb49310c6ad377a85f9b6f7eeb972f433ca5
SHA2562b5eff51cf1b9bc8796dc89c1354999c725f36bbd7fab6e56ff6e3343a9189a3
SHA512ab20f81afc7ce07e66651303dc77708710a9fc06ceaec3aede1d178b24a12617defdf0b9df7e3c6e8b6f074d68b0dbd8e3f6299737d2f6249706ea51813f9b9c
-
Filesize
328KB
MD5d4c20d7a78c84ef5945df996d419ac89
SHA129adcbe1d922ddbe3972bbd6f9668b360472f737
SHA25628cb7b4b4b358081249277f7579f2ecaec4991b562abe667c85d1e9415dfddb5
SHA5125efed3e792e58fc8c9c89ec9cfbf5068eed6d4bee817cf1bec0e0e2692b7aae655602e25e2de411795111286833c8417b21367d3fd93b47f9c6a63638c65da27
-
Filesize
366KB
MD54223c0c79c6df9eeaf22690724cbbbe3
SHA17563e2290d8284c720ba404731597d7e98873a69
SHA2565ab2ca557d94760d20da01954228409c00f2911043fe094d39add3b766c31fa4
SHA512367a2069ff583b56e86505472a3a0d5ac350508fa1ab1c873da79dfd4bb0679c0d0d3f8286aadc34dd585c1d23935a35ce6f5404b92eddd8b80ca4604063d296
-
Filesize
269KB
MD5351aa8c90c6258eb6661fb86ffddf4c3
SHA12122915db8f02afce89ac87ba1f4d927f1df9968
SHA256712f1dc869bf02028df5c4e884ccbe948d4a6f8eebbb7805efeca3111b1ed4fa
SHA512725be457aa2a4dd0ce2b96deb7a897906f10939622b899f5819e1e72280267fe9cd71383481a3fc9d7b9c312e6cacb061ba39fe12786e84842c029aa9aa5d70a
-
Filesize
97KB
MD54f717969032d4cb764a58a88b69c9389
SHA12125a9b44e5fbd5c30d2a1704e9546dccfb5edb5
SHA256e458a825d98be0c0a60e8fa50ded20d21f36a84141ba78422466611a6f790968
SHA512bd4d40c7d6791ac243c75aa1e529e6264fd8a7b33cbfc7970989d49bb040a8e33b8a0b1f40ea2cea77c6dcc24f155c2a30e4c809aaf7d1e13e931f83fa189eda
-
Filesize
78KB
MD56643793ba0c0d45dd5cccde0a5b25d33
SHA192cc3a8febb2178e90da189ba8a1bd2bd7732ea2
SHA256d50521b169a6326aef57437e6e51efd4bfad298f958cf51b778a5990c3311a68
SHA5125dd99c63ed9b915e2678195be7815e7abc2f2b1f71441679810be215b840d28830c230ceb56f67ffc3c1d4a2067971e31e6a861563396990447a5130d841e543
-
Filesize
97KB
MD56cad5fde4760196bef345ba4aaf8b921
SHA1ed2fd0a2166ade2d7debbf3db9342a471c7f9fc9
SHA256497013b978978761e372779d724232a1874f0c00624e83dd66bc30915c672f4e
SHA5128b30fcbf1b4393ee258716e8c37a4c5b63b4707987664799f3b9d14cb779d7ffece1efdca0fa6cc01d5d8697782a9a6e76b7b8a284c8b4d0cd4e0cc8591f1167
-
Filesize
81KB
MD57da403414b84b57eaee35fef9a907152
SHA119dab25959851e5c5876131ae6479e2809ac51eb
SHA256a721b24ca1fa0187891ec899a8a0e969e4e2c3a7d1d01edc97ceffea9e379026
SHA5122b1037bff4e07e3f91a52140770f755e03f54204d91d0a81ebad472aaae73ad5b20d450de5a9748434a7d1727046bb1a0342608c578377b02854364a3f2ef1fa
-
Filesize
297KB
MD5654ea2a17a378c592f87c6a74895a0cc
SHA18615912c399820c940af91e18d8ad9991bdfc136
SHA256bb23c5eac5fedef4662e71f842fc0b63acffe175fa5cf6213d07efa7810264b6
SHA5127cd41bff410d2d2e51768856dc6e59f1bf4f8972d7a3e506f7bcee181c6ae4d9c174fe62a2e912739f38da90ff0256ce7c370b60f1b7a0dddfad8ff67b178cdb
-
Filesize
177KB
MD57c48bbcf5280d0827f99fbd40b93f6f7
SHA1aea8675f859a4f931a5d79e05cd9fca6a3c3ff87
SHA256f7e9e43575777a1b047fba890d966e83f4f51fdb08eaf1642ce2e94d781b8308
SHA512a6e4cfc8fe8d18549f1c97f67ba13123d39f450522a92d494fd4a82018e635c9aa626cbda7af566cf11ecd39379b11a4088610eaeefb33b328bca3932dc8d3be
-
Filesize
74KB
MD50cf17da428a03ff8825abca5405da38a
SHA1ba397600e84587c4dec0bdcaa4b645dac2bfb42c
SHA256eb6861b1577f7ebc210a8120198c199e24b666f79b67b28f64aaeb77331378ad
SHA512fc04d23e3809808f337790ad62570237f4fc6d87802e6fbce9a49d8bc973165e13b3311feb8803f1c12241d56ca7073928006d70a945024be9d10b5c50bf8575
-
Filesize
72KB
MD586ee3c496d61bfc93bbad3c1234d8710
SHA1aa355bc436c4aa4a97fd0b5988300580c0269904
SHA256b70dc43d84d08222b7175a2a5e2452db95f3ebecf0dedf4485ae087acaa76f74
SHA512edf2a141f71dd95e728cc4c5c5855779ab20aa1d74e7d29c3d545158fb4c958ba084b2a7755818d119675cd7b482af85480526e3cbdd802715497ade5f975fbc
-
Filesize
300KB
MD5393a44a8b9fd63c614ed5c85f5680e49
SHA12f10d75e28d5c01d17c960ad8c4ecfff3e3594c1
SHA2563d150b9092a922758fdbe8a04ebc734c2c8c8b16666b5b3cc37ebc886c02aee4
SHA512866743792f58c34c0bdcc97c43a92422ea712266143479007a915502ac1d50a52d84f5f0da4da57a46c75fd37b2ed7f6877f9b57e461ef9a15928e91de5a23c7
-
Filesize
229KB
MD52a8f469f3de2b0cb60873590363d74d6
SHA17b750912a7e0f075107a71712135b5c125170902
SHA256d1bbbac2e719dc09ae2009e7da5cfe0ded0d5e73b0e67ff4c8b72c276e435819
SHA51297d5a0c91b11fc8f11d1fa8e310fc76d10826df7cbb94e48d01d8bc510d0a9250242301b449841312d0b6f7e597ad3984ec68169a4a8b1fd8cc275d24b88902b
-
Filesize
69KB
MD5226ac86d3401242f3ef518adbaacb4e7
SHA11a02cdec82469b96edbd3569668cee41b5c7bb00
SHA256de00e10787fcab379b14eccaa1dddf508a93dc05b94a35bacc71e6a3781f686d
SHA5128cd7b1975bab9bfe0e0bc37c85d8422940717df8be4009c883d6b66e7f7fa541191445d88873505cc6004eddbb2598ab61de5a635a30306a1ecf71bd4c9dec53
-
Filesize
334KB
MD5a2332f55f07ad32cc8a1fc75dafdaf86
SHA1840cd769cd899bc1bfd6a545c716b8c6a798b66e
SHA256bd766bd540556669de959494aafc79b846d84cdef79e6be6c8aeaf480b54ee4a
SHA5127f883d9b451ab547534711d8bd7de4a28dd92dd882addc4438c6b10f31059e798f66f9be7c2bedeae1b229fa2fc9365efe8ba6aa36e9d4d563abe4682a8028b2
-
Filesize
213KB
MD5913892b1584a1d51d6c4b5930077cf43
SHA1101ffd39683002fa5b0672f3dd14c07e3303df73
SHA256a32a8876aa46a333e089fc0c3c3dc77cc5ddad5db734213bbc5947d21978cce5
SHA512d839daac0d8491b8c42c2e4c48d6a95306af7b5b593b021c311cf6cebc8b967f4b42dbf2a4a1bbe5dd45aa87dd8b46b0041cb716907e2d222e86412754c94d14
-
Filesize
74KB
MD5534b365361004828059600f05b34006d
SHA1d8ff411b0939a021f47c845c6a90f1240bab5268
SHA256438ae82ffd621a2413199155574cc85681f8986f05420b1485aa4be936c3bc0b
SHA5121ccb3732a82f2fedca85c27afdd48e65dde70d5b1620e436d457624a2cb796887c5e7dc2983a0794ebbbcade3e5b9f9fc9320b390894471993c7b1e85268592d
-
Filesize
284KB
MD56232423fe3802eaa87c58fdf951cf763
SHA12ff4ebc26f38d1e8a22c5d2784d6da0e3c88de8c
SHA256f986c31a28103f989cef4b2b943dbe360066fef026b0e3b12a9a10379496c716
SHA5124542d8c8daccce4615c726856d816d3b3f44cff02358214ed780e7dab461e28d53ae08ba57fb27567631fefb1d782d5690fea8486679667467fda10ddbfa3329
-
Filesize
340KB
MD5126be5c57d3f6141774f0dcdb6ed4e8f
SHA1fc4f8a56da892453352abe8e2f9299b6119080d7
SHA2567e7893e7e0b564e4fcf90c09bb2e54df029f19d8c80da5a3af8d04c3e4bb4906
SHA5122e3490ce234fb837464579698264f821ac3a55a3e77885ea336cc3c839de63d4c7efc7f0844f01e939a1d58b82243a9da5053e33d535bf510abe51457b9b1963
-
Filesize
320KB
MD5b4d69ced454d995ec8b875e24d6e3d21
SHA163ed022b415d20a6f219a2252e91df49612912b0
SHA256c631d4e86487eb94a599d5c3ad6a3131ac32b3a43845a2aa74b9e0ff09d3153e
SHA5122050df04f24ee22a919d32644d93929bac515ca281e41a7dcf99c1744ed5a26abf94bf3a1c615d3a47d59d6f6a50de1b71613d2ac99cc130b70aefbcf6e9cfeb
-
Filesize
51KB
MD5db18b7ec5f93127e6099744ea9568c1b
SHA1e9143c76e308a816837e2f1a19dd0c5e2306ed08
SHA2565bbef249a0d00e2d32c699d0bbe89f714ebeb872b3990a5cbeccb1d89f63e5e8
SHA512ee1e645bed0bc3ad9e959d6342153e608ad21a7f5aef60b4cd8cc96fde7aeec4bbbb7474b59cab8ced8f28dc9f66cab32f4825333c891524901dcc40e70a1580
-
Filesize
169KB
MD55c38466e4aa1c038c4397b3fbe6d78a3
SHA12064ff400d686f16b1f583c7527cb771018b0834
SHA256c02f328f510d62883ff59165262d64953142a12b3dd48febdf12f6a68a9708b6
SHA512322144950e7e14990277265a04a310620938830c05b72dba0b042df08d12b0d1d47805033b7e52d42e74ab55fd46c4e8054832fb06a9dda5f276f4e15758a214
-
Filesize
107KB
MD5762da1a21eb03a1964535a1066dcb2f0
SHA12e3f3dae771ed31b5834de8657a12cb216977965
SHA2563d69a5f190d892210bdffd6519b41b62110830a59b2e4f0534eec13a7f28d7ee
SHA512151f7e5920f0f91637ee68db5f2f725426b8b096f192062a0efaccb9b7e6e3165559476d5f6ff134c2c18921217d8d58fd26b0ca5bd44c3c9f7ce8203bee6c01
-
Filesize
2.2MB
MD50f39e0aa57a4d1abf58a0c7b57548d88
SHA108ed23b5f46f5126f97417f598edebb3a854360a
SHA256ce1e586850b422e4b32658afabdd9c92bad2a181365cf863b42df0934153ecac
SHA51202e3ec203e6c35365f17fe2018aa67e586e0bfca30adc9aa62c686c8e214190fa5e9f5e53425562d4c5ea6d3f82c812597bc73af17e29567dc0b8f61637851b3
-
Filesize
597KB
MD577a625452c531675fa74586fca2bf696
SHA1bf8b91e6fc58d078601d6684c2e0e0a606b5940a
SHA256d33c256629433f1da623065bb239fdc13ac1fc96d1929355468b4de7646044a2
SHA51289510ed93e9a0f80449ad15929e861dd1396e10f152bbbe17b98d63664cd5e7ca63b6b9e228f4789cc2fc2c838ad133ceb1fc46c7695b8bee93a7becbfa296d9
-
Filesize
568KB
MD5c9f19d2ac04b3d662580fa976a8eb5e0
SHA17e777440f5b5439325c3045e648c95a8f1e403aa
SHA256b2395121f2b0bdf78e36afec98746b4251bbce2586886cfc5e4b305819a55641
SHA51225938fd7693d140275d7ebedaccfe89cb7c964c26efe5a71f9a1bf1a038273e4be5a8cd56f2ec08560af1c9870c050a910db3e8f4f7bf0c0500e4b86687cc4f8
-
Filesize
325KB
MD5daaf206b149e7660e92db8154ef2b995
SHA151301d39aa7abe9620b620593a83478ebc5ea67c
SHA25636a035bf55f4fef9955b4d73a8d63ad80b63de748801b611dec48bf2556ac8dd
SHA51248b0b00344a229e448d29061ba4ecf9b9d84232ce27f48125d3539616bf3c60c7bf3338fae53a6ff76fad8fc6f1f3981f498e3e7ae1f7a2d4fe596d204fcf619
-
Filesize
265KB
MD5ecc808fe6e8730d01f8689298a8f73ee
SHA10f98958561e0a1900dbfd288f529c0eebb2fd6e2
SHA256e262b4241c0646227639f0d187b49b4d95cb24c33680d68405ca88be291a7911
SHA512d06ff670b301bf4dd562e4e1085152822c2beea2ed6d5abf1e3dba39774ddbe36ac0c1f014786b685224845a4d63944e61211ba60ce175effaf9582e088ba511
-
Filesize
471KB
MD5acefced3e6196a849e7e84d122e80723
SHA1b5241c34a7dd617aefee397da210793c1f5ab8d9
SHA25610ecd00b242623da996aed9e391f1efed717596b246d0dd3d16a6d9a8883e6b9
SHA512d0baecf666cc091e90e2a42f6c3172eb982c12926084d40797734477e1f21243e770d0714d50b3821a0073adf756ccdfc5489d1d63e518397f80f22bea5bbf76
-
Filesize
389KB
MD5efdce4969462bad9ea814a1e3525531c
SHA1a679109d6613a5475450683106afbab728010297
SHA2569952bf69ff4cb8ea1270a88a85aa5866a8f0f9c3e5502edb22f940bd658e532a
SHA512d84aeb0aed645f4d45fbea0f674da42736c6f26bc98b143cec55cc1be9df2821a50399d5d403bc095f24b53092d9cae77a76380e4e893ebb839f1e22a201f33a
-
Filesize
307KB
MD5feb4726f427184278dc3f5cf001429df
SHA1d0a94a60a0c2b0c9db468aa491930b207a62f5b8
SHA2561622ebfa4b5430ced830fd447b20e1618059507b642babb4aa55f02550eafae2
SHA51211f56bb75830ec1fc2dad42103a25aebe29dc61fdc137e17e6e81147b2feb7556278fa1146ffa987ece669261576dc1a78bec26edb9202172168cfbccccc50e2
-
Filesize
1KB
MD5a085c2e8fa74457c5ced7d5a5bf821ad
SHA18d746fe4731b00918ce7673cad1b74471bea5b57
SHA2569978caec98b4f72ffd5d48a9c21b4e4bbd1f68e159077186d5e39eb566fd35b0
SHA5129db64b3c38bc4011464d0fa0a574bddf808ecd45bf6eb83569589d5acbdf40400da64f9ee9a249eb0e33dbe4e5c851dacbdd2e1d448d00982dbb6a0a87cb0d2f
-
Filesize
1KB
MD50ae7beb1c8e74b02403e620db221ebd3
SHA1e63fa421492f9a1d821313c928f78812ff559727
SHA2561566d175dad524601032259bc3cf6b4a309ad70efc7a7cb2a22cadb4331eb44f
SHA5123a7409ce10e13c7abb2a6987a88760c6dfceb6a1c13dfd9ab08a47d0ecd0e196c81c83a8e0088eebd2c781c5511005719ac2393ac793bb642a206daef6b60e54
-
Filesize
33B
MD58352b5a6f13d67ad2c73f072796a1a39
SHA1d0e47d775fc6606c71416c4daa0adbb15189f453
SHA2562eff59bce8ddee7f0a539f1d31e20db6d3d07bd03215df2f661bf02c5499d345
SHA512276c8eab9aa94a4658a4c900f5f6feee56a5c80663a9332f22484dcf1af28cc497ad59042ab88b06e27f6e8725d0fd6ae448fe8e015358be7ede5e5f3496fa83
-
Filesize
853B
MD5a7b06de83d52dd6c655d16e5fb8d62e9
SHA1e3704557d2ae36c59f5db41c78f5b4b59c7afb73
SHA256fb877d8ba1018ba3d12bacad93c8b5dfe86ecfd5d05b7cf479c24e59a2c497db
SHA512e0f185a1480d7812e6da4a608026a1ed2eb7c8878b179c6587856d9fec3308c61467fa4ba791a5be0449f56b9be358b026cb9dc8788bb5e732d90d3e8f6b35c1
-
Filesize
3KB
MD5b31c928331e0a8a713a8c72704452431
SHA12343b2cb054f14a93e544fb44d772b8d861cf1f5
SHA2564a781f53c9ae5378789d3ba6feddca1d453f2b9ac40ccf9e030eecc083285986
SHA51280a81d1f7106f62951e01fca1d83497dad3b6c89d85d5ae82b4f2ce773e41d413c7b487c05f5971c09b4dcf917d061fdf024580fc8d4210c709beda9807dd02c
-
Filesize
46B
MD5d77e555eb0f5bd70e92a7a7784f41288
SHA1c8ba6d54b76a2c074071def89971c883ad9ddd19
SHA2569a7f978f9c0dfb41b3f768db19a1aed1f8c61d46d898450ef3b68c3240533bd5
SHA5126697a2af7f607d24bc0b9a8cdafdb7f3b2faa57344aa8e9b46c7c36acafea9ff51803f470850661583df8379096839a95ac7b7e28da40f365fd5a3f231872dfa
-
Filesize
142B
MD510098e16b3e15b74ea5b67786ab479ff
SHA10d17dc130d1d2d18bebaf486455180b8a75f303c
SHA256731967ae8a887dde3a870a65ba34ef3659e6de836cede6aad01e68c7644a2219
SHA51241b7d6ab2b03e8a2e68fba86a74b44056e7e1beae45396b03357dfbd745357eb39fde89730698d4f068ec37607d6e0313b7b52ee8f5010b2d168282037d4c0f8
-
Filesize
1KB
MD5ecc8807dfb4c616ac1823a31f767d247
SHA113d5cacc4854d01e3d5655417b00f98540a1da85
SHA25646f97f4070fc190018ae064a9067551fecc59ce6009f97178b5a18c673f6607e
SHA51264235de663313db2fa76710a4c9cb09007cb6a6b1106101de5836fd449c61ed7ff1865b46f6a39863e49841d32c1acbd2d6c82e6c019e07d2ff507d0052e2490
-
Filesize
1KB
MD540aca0e11e506bf5942e0ec68967fb5f
SHA129de293cbf5d679a20cbb0da7e6b4530ac83cf36
SHA256ec8547cc62d41f82564f9e4253f692d4f44134a40ee718f31ba28b3b9bb650ad
SHA512f8357db0f5ec8de5db307c46d18861759bbb5e43751340f9c2f695c4546ee7c5c0bc84e70b9fecb07938caa02e4499d60d0a584f57c86b3a4e28349bf927e572
-
Filesize
113KB
MD54fdd16752561cf585fed1506914d73e0
SHA1f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424
SHA256aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7
SHA5123695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600
-
Filesize
33.0MB
MD5c633402bc07d4455a88db18f4a95108c
SHA1025de228c5450504b5a500975538bf3193aacd95
SHA256f80f40bc04bd2b31284a898809d8b83ae3b45c16638beac6504b78adfe5cfe14
SHA51299734df497cc37c7b2785f3d94caecba52e183223a559740052e42bac5b8332cb56baaae555c120ac8162b9d9a6617b6e54d60a678dfab85c427977ca0c719e1
-
Filesize
17.3MB
MD5fe8902b4f89e7b51cd827fc78a038208
SHA14474eedfd58f5efcd364beb9fcc8fb3e632a09f8
SHA2568dd027d66a107bd93b47eb4b272f58dda428e0a64e8ff38b74b4f113e9d20bd6
SHA512faf160546b2054156036c555aaee61c8acc8b0a74c4f1f1e5aadb89e6af737a4053ff4582c9bb82761f0836936f7e1632780b2edbdff7f18f9db2de0af2cb3d3
-
\??\Volume{14f6f45c-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{f55ae8d6-69f4-428b-aa6b-0625a941b632}_OnDiskSnapshotProp
Filesize6KB
MD5642c888de3cac24cbd8f95592094e47e
SHA1d65064c79d85090271ae7fa8fcf967a8f2d0e4b5
SHA2564548b38a4b3111e96d5d4dfb401517879145d489fcb5e9b3eef8b7287612d0ec
SHA512740fa83624d113d3485942bedffc5194bac0a7bfa9641c113d62521478c24ea0dff5413fb7cfd6c4a3e93f597bc83d9832547fc786963dd79d3e466458982b5c