Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - submitted
10/05/2024, 22:03
Static task
static1
Behavioral task
behavioral1
Sample
MSI.msi
Resource
win7-20240215-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
MSI.msi
Resource
win10v2004-20240426-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target MSI.msi
- Size 1.5MB
- Sample240510-1yb2wsfa93
- SHA256 ead5ebf464c313176174ff0fdc3360a3477f6361d0947221d31287eeb04691b3
- MD5 b4a482a7e96cfdef632a7af286120156
- SHA1 73e3639a9388af84b9c0f172b3aeaf3823014596
- SHA512 15661f1dc751a48f5d213ec99c046e0b9fa1a2201d238d26bee0f15341e9d84611c30f152c463368c6d59f3e7cccb5ae991b1f3127ad65eb3a2ea7823d3b598b
- SSDEEP 49152:oIR3YuW8zBQSc0ZnSKYZKumZr7ANCuyspI:FY90ZniK/A8uR
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
latrodectus
C2
-
https://workspacin.cloud/live/
-
https://illoskanawer.com/live/
Signatures
- Brute Ratel C4
A customized command and control framework for red teaming and adversary simulation.
- Bruteratel family
- Detect BruteRatel badger 2 IoCs
resource yara_rule behavioral2/memory/4916-47-0x000000026E7A0000-0x000000026E7EA000-memory.dmp family_bruteratel behavioral2/memory/4916-48-0x000000026E7A0000-0x000000026E7EA000-memory.dmp family_bruteratel - Latrodectus family
- Latrodectus loader
Latrodectus is a loader written in C++.
- Detect larodectus Loader variant 2 3 IoCs
resource yara_rule behavioral2/memory/4916-95-0x00007FF48D0C0000-0x00007FF48D0D2000-memory.dmp family_latrodectus_v2 behavioral2/memory/3424-100-0x0000000002350000-0x0000000002362000-memory.dmp family_latrodectus_v2 behavioral2/memory/3424-101-0x0000000002350000-0x0000000002362000-memory.dmp family_latrodectus_v2 - Blocklisted process makes network request 48 IoCs
flow pid Process 41 4916 rundll32.exe 43 4916 rundll32.exe 45 4916 rundll32.exe 50 4916 rundll32.exe 51 4916 rundll32.exe 54 4916 rundll32.exe 59 4916 rundll32.exe 72 4916 rundll32.exe 73 4916 rundll32.exe 74 4916 rundll32.exe 75 4916 rundll32.exe 79 4916 rundll32.exe 81 4916 rundll32.exe 82 4916 rundll32.exe 83 4916 rundll32.exe 84 4916 rundll32.exe 85 4916 rundll32.exe 88 4916 rundll32.exe 91 4916 rundll32.exe 102 4916 rundll32.exe 103 4916 rundll32.exe 104 4916 rundll32.exe 105 4916 rundll32.exe 106 4916 rundll32.exe 107 4916 rundll32.exe 108 4916 rundll32.exe 109 4916 rundll32.exe 110 4916 rundll32.exe 113 4916 rundll32.exe 115 4916 rundll32.exe 116 4916 rundll32.exe 117 4916 rundll32.exe 118 4916 rundll32.exe 130 4916 rundll32.exe 131 4916 rundll32.exe 132 4916 rundll32.exe 133 4916 rundll32.exe 134 4916 rundll32.exe 135 4916 rundll32.exe 136 4916 rundll32.exe 137 4916 rundll32.exe 138 4916 rundll32.exe 139 4916 rundll32.exe 140 4916 rundll32.exe 141 4916 rundll32.exe 142 4916 rundll32.exe 143 4916 rundll32.exe 144 4916 rundll32.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "rundll32 \"C:\\Users\\Admin\\AppData\\Roaming\\upfilles.dll\", stow" rundll32.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI6851.tmp msiexec.exe File created C:\Windows\Installer\e5766d8.msi msiexec.exe File opened for modification C:\Windows\Installer\e5766d8.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\SourceHash{504D9754-A0CB-45E6-A9EE-947C54F5F0C6} msiexec.exe File opened for modification C:\Windows\Installer\MSI68CF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6726.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6794.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe - Executes dropped EXE 1 IoCs
pid Process 4164 MSI68CF.tmp - Loads dropped DLL 9 IoCs
pid Process 1388 MsiExec.exe 1388 MsiExec.exe 1388 MsiExec.exe 1388 MsiExec.exe 1388 MsiExec.exe 1388 MsiExec.exe 3296 MsiExec.exe 3296 MsiExec.exe 4916 rundll32.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4316 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI68CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000d9d47eb9a1a06eb40000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000d9d47eb90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900d9d47eb9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dd9d47eb9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000d9d47eb900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4456 msiexec.exe 4456 msiexec.exe 4164 MSI68CF.tmp 4164 MSI68CF.tmp 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 3424 Explorer.EXE 3424 Explorer.EXE 3424 Explorer.EXE 3424 Explorer.EXE 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4316 msiexec.exe Token: SeIncreaseQuotaPrivilege 4316 msiexec.exe Token: SeSecurityPrivilege 4456 msiexec.exe Token: SeCreateTokenPrivilege 4316 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4316 msiexec.exe Token: SeLockMemoryPrivilege 4316 msiexec.exe Token: SeIncreaseQuotaPrivilege 4316 msiexec.exe Token: SeMachineAccountPrivilege 4316 msiexec.exe Token: SeTcbPrivilege 4316 msiexec.exe Token: SeSecurityPrivilege 4316 msiexec.exe Token: SeTakeOwnershipPrivilege 4316 msiexec.exe Token: SeLoadDriverPrivilege 4316 msiexec.exe Token: SeSystemProfilePrivilege 4316 msiexec.exe Token: SeSystemtimePrivilege 4316 msiexec.exe Token: SeProfSingleProcessPrivilege 4316 msiexec.exe Token: SeIncBasePriorityPrivilege 4316 msiexec.exe Token: SeCreatePagefilePrivilege 4316 msiexec.exe Token: SeCreatePermanentPrivilege 4316 msiexec.exe Token: SeBackupPrivilege 4316 msiexec.exe Token: SeRestorePrivilege 4316 msiexec.exe Token: SeShutdownPrivilege 4316 msiexec.exe Token: SeDebugPrivilege 4316 msiexec.exe Token: SeAuditPrivilege 4316 msiexec.exe Token: SeSystemEnvironmentPrivilege 4316 msiexec.exe Token: SeChangeNotifyPrivilege 4316 msiexec.exe Token: SeRemoteShutdownPrivilege 4316 msiexec.exe Token: SeUndockPrivilege 4316 msiexec.exe Token: SeSyncAgentPrivilege 4316 msiexec.exe Token: SeEnableDelegationPrivilege 4316 msiexec.exe Token: SeManageVolumePrivilege 4316 msiexec.exe Token: SeImpersonatePrivilege 4316 msiexec.exe Token: SeCreateGlobalPrivilege 4316 msiexec.exe Token: SeCreateTokenPrivilege 4316 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4316 msiexec.exe Token: SeLockMemoryPrivilege 4316 msiexec.exe Token: SeIncreaseQuotaPrivilege 4316 msiexec.exe Token: SeMachineAccountPrivilege 4316 msiexec.exe Token: SeTcbPrivilege 4316 msiexec.exe Token: SeSecurityPrivilege 4316 msiexec.exe Token: SeTakeOwnershipPrivilege 4316 msiexec.exe Token: SeLoadDriverPrivilege 4316 msiexec.exe Token: SeSystemProfilePrivilege 4316 msiexec.exe Token: SeSystemtimePrivilege 4316 msiexec.exe Token: SeProfSingleProcessPrivilege 4316 msiexec.exe Token: SeIncBasePriorityPrivilege 4316 msiexec.exe Token: SeCreatePagefilePrivilege 4316 msiexec.exe Token: SeCreatePermanentPrivilege 4316 msiexec.exe Token: SeBackupPrivilege 4316 msiexec.exe Token: SeRestorePrivilege 4316 msiexec.exe Token: SeShutdownPrivilege 4316 msiexec.exe Token: SeDebugPrivilege 4316 msiexec.exe Token: SeAuditPrivilege 4316 msiexec.exe Token: SeSystemEnvironmentPrivilege 4316 msiexec.exe Token: SeChangeNotifyPrivilege 4316 msiexec.exe Token: SeRemoteShutdownPrivilege 4316 msiexec.exe Token: SeUndockPrivilege 4316 msiexec.exe Token: SeSyncAgentPrivilege 4316 msiexec.exe Token: SeEnableDelegationPrivilege 4316 msiexec.exe Token: SeManageVolumePrivilege 4316 msiexec.exe Token: SeImpersonatePrivilege 4316 msiexec.exe Token: SeCreateGlobalPrivilege 4316 msiexec.exe Token: SeCreateTokenPrivilege 4316 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4316 msiexec.exe Token: SeLockMemoryPrivilege 4316 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4316 msiexec.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3424 Explorer.EXE - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4456 wrote to memory of 1388 4456 msiexec.exe 85 PID 4456 wrote to memory of 1388 4456 msiexec.exe 85 PID 4456 wrote to memory of 1388 4456 msiexec.exe 85 PID 4456 wrote to memory of 1208 4456 msiexec.exe 103 PID 4456 wrote to memory of 1208 4456 msiexec.exe 103 PID 4456 wrote to memory of 3296 4456 msiexec.exe 105 PID 4456 wrote to memory of 3296 4456 msiexec.exe 105 PID 4456 wrote to memory of 3296 4456 msiexec.exe 105 PID 4456 wrote to memory of 4164 4456 msiexec.exe 106 PID 4456 wrote to memory of 4164 4456 msiexec.exe 106 PID 4456 wrote to memory of 4164 4456 msiexec.exe 106 PID 4916 wrote to memory of 3424 4916 rundll32.exe 56 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:3424 -
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\MSI.msi2⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4316
-
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\upfilles.dll, stow2⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4916
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6A64616CDF632EACC7FA327BE8AFA80C C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1388
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1208
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BD5371EFA3EFC8A97BAD83D5CF0191B52⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3296
-
-
C:\Windows\Installer\MSI68CF.tmp"C:\Windows\Installer\MSI68CF.tmp" C:/Windows/System32/rundll32.exe C:\Users\Admin\AppData\Roaming\upfilles.dll, stow2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4164
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:2832
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSI31FD.tmp
- Size 436KB
- SHA256 426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
- MD5 475d20c0ea477a35660e3f67ecf0a1df
- SHA1 67340739f51e1134ae8f0ffc5ae9dd710e8e3a08
- SHA512 99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
- SSDEEP 6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\upfilles.dll
- Size 508KB
- SHA256 f4cb6b684ea097f867d406a978b3422bbf2ecfea39236bf3ab99340996b825de
- MD5 ccb6d3cb020f56758622911ddd2f1fcb
- SHA1 4a013f752c2bf84ca37e418175e0d9b6f61f636d
- SHA512 6ed929967005eaa6407e273b53a1fedcb2b084d775bed17272fd05b1ce143dbf921ac201246dfbfdbe663c7351e44c12f162e6f03343548b69b5d4598bb3492e
- SSDEEP 12288:8XG3MpAOIQ1LjbJFqzqUtYP4VnRk62yoK2:SpAOfFJIq/Py8K2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI68CF.tmp
- Size 389KB
- SHA256 1e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a
- MD5 b9545ed17695a32face8c3408a6a3553
- SHA1 f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83
- SHA512 f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04
- SSDEEP 6144:gMvZx0Flyv/UB8zBQSnuJnO6n4ZSaHwLvFnNLqrFWeyp1uBxfAOT3VDqO1:gMvZx0FlS68zBQSncb4ZPQTpAjZxqO1
- MD5 SHA1 SHA512 SSDEEP
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 23.7MB
- SHA256 63062eda12d748a8b174e573606d1304254ea7a825d97822a6c830d171e6ffa1
- MD5 06a95dee0cc76ebf1c9b984230d844c8
- SHA1 99385b1f4556fb87f5a113c22a8fe6c02bf65227
- SHA512 89a6e743cc06258af0a64588c074ee48bac38682f50df5b743121e73c4661896fbce11febdd6f73bbe1e02ea308bcdc4c24244edd09929ef519f030ae200dc36
- SSDEEP 24576:9Sqm41xxdoO/vvTLkNtuanWduOCZvgK6JTNN52A2aW6x8eRWoBli7aNoa:x
- MD5 SHA1 SHA512 SSDEEP
- Path \??\Volume{b97ed4d9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{2913869e-1294-499d-93cb-950db74b8587}_OnDiskSnapshotProp
- Size 6KB
- SHA256 e7637034aa66eb14c4a9a1ce6648d77bcb63a6d237428ec9e5c8343a37b2fbda
- MD5 f58aede003d28314dd901e835336688a
- SHA1 97842623d5ec8062755d2da5647b7612bcec84a8
- SHA512 9470b8a065caabf4752b65af2f90ad2b76eb9bbcd0c63c2adb2f96fd0405a89865aa329e837b2b3c77b7b45584a5b19eef5a7badba68972f793a663ca7af1274
- SSDEEP 96:Fv9ICc4xDD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:pbb++1VmN
- MD5 SHA1 SHA512 SSDEEP