Overview
overview
10Static
static
748c616cbb1...9e.exe
windows7-x64
748c616cbb1...9e.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$SYSDIR/gpyapi.dll
windows7-x64
3$SYSDIR/gpyapi.dll
windows10-2004-x64
3$SYSDIR/gtapi.dll
windows7-x64
3$SYSDIR/gtapi.dll
windows10-2004-x64
3$TEMP/Goog...er.exe
windows7-x64
8$TEMP/Goog...er.exe
windows10-2004-x64
$TEMP/Goog...ed.msi
windows7-x64
6$TEMP/Goog...ed.msi
windows10-2004-x64
6$TEMP/setu...20.exe
windows7-x64
7$TEMP/setu...20.exe
windows10-2004-x64
7ies_uni.exe
windows7-x64
7ies_uni.exe
windows10-2004-x64
7iesuper.dll
windows7-x64
6iesuper.dll
windows10-2004-x64
6UUPlayer.dll
windows7-x64
3UUPlayer.dll
windows10-2004-x64
3UUSeePlayer.exe
windows7-x64
10UUSeePlayer.exe
windows10-2004-x64
10bass-plugins.exe
windows7-x64
7bass-plugins.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3Analysis
-
max time kernel
144s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
22/08/2024, 06:51
Behavioral task
behavioral1
Sample
48c616cbb15b33f9f8001ae8074e8f68657f604bb20b923ddb6722f752427a9e.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
48c616cbb15b33f9f8001ae8074e8f68657f604bb20b923ddb6722f752427a9e.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$SYSDIR/gpyapi.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral10
Sample
$SYSDIR/gpyapi.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$SYSDIR/gtapi.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral12
Sample
$SYSDIR/gtapi.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
$TEMP/GooglePinyinDownloader.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral14
Sample
$TEMP/GooglePinyinDownloader.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
$TEMP/GoogleToolbarInstaller_zh-CN_signed.msi
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral16
Sample
$TEMP/GoogleToolbarInstaller_zh-CN_signed.msi
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
$TEMP/setup_iesuper_1020.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral18
Sample
$TEMP/setup_iesuper_1020.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
ies_uni.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral20
Sample
ies_uni.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
iesuper.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral22
Sample
iesuper.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
UUPlayer.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral24
Sample
UUPlayer.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
UUSeePlayer.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral26
Sample
UUSeePlayer.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
bass-plugins.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral28
Sample
bass-plugins.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral30
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral32
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
$TEMP/GoogleToolbarInstaller_zh-CN_signed.msi
-
Size
1.1MB
-
MD5
ec1629e2086cad6ccc4c995630896213
-
SHA1
e0e1f7720072b85c04318d6d15b595d7e8f52670
-
SHA256
101fc387cb284a27c943ea087b751aefb5c106a214253b7e29e7381da95beaee
-
SHA512
3f7157a25a2d1f1fc345e9138ed5c1f17805256be985e8cfe54c60cb5a11d62e13472bdeee187c7b13e5746c8d9e08359d929410d3b5e5ab204cf4f91c02d9b1
-
SSDEEP
24576:FBkI5/nyOeMDyWd8Dce5HrY5w6Rsa31L5Dh66NIXiQcAqHVIYzgD:jhyOeMPacWHruwOsa31L5Dh66N+iVh1O
Malware Config
Signatures
-
Blocklisted process makes network request 4 IoCs
flow pid Process 6 1948 msiexec.exe 8 1948 msiexec.exe 26 1948 msiexec.exe 45 2708 msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e580625.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{DBEA1034-5882-4A88-8033-81C4EF0CFA29} msiexec.exe File opened for modification C:\Windows\Installer\MSIA5B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB18.tmp msiexec.exe File created C:\Windows\Installer\e580625.msi msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 3588 MSIB18.tmp -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1948 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIB18.tmp -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000082ad35faf8c7b7730000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000082ad35fa0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090082ad35fa000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d82ad35fa000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000082ad35fa00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe -
Modifies data under HKEY_USERS 8 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MSIB18.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MSIB18.tmp Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix MSIB18.tmp Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" MSIB18.tmp Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" MSIB18.tmp Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MSIB18.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MSIB18.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MSIB18.tmp -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2708 msiexec.exe 2708 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 51 IoCs
description pid Process Token: SeShutdownPrivilege 1948 msiexec.exe Token: SeIncreaseQuotaPrivilege 1948 msiexec.exe Token: SeSecurityPrivilege 2708 msiexec.exe Token: SeCreateTokenPrivilege 1948 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1948 msiexec.exe Token: SeLockMemoryPrivilege 1948 msiexec.exe Token: SeIncreaseQuotaPrivilege 1948 msiexec.exe Token: SeMachineAccountPrivilege 1948 msiexec.exe Token: SeTcbPrivilege 1948 msiexec.exe Token: SeSecurityPrivilege 1948 msiexec.exe Token: SeTakeOwnershipPrivilege 1948 msiexec.exe Token: SeLoadDriverPrivilege 1948 msiexec.exe Token: SeSystemProfilePrivilege 1948 msiexec.exe Token: SeSystemtimePrivilege 1948 msiexec.exe Token: SeProfSingleProcessPrivilege 1948 msiexec.exe Token: SeIncBasePriorityPrivilege 1948 msiexec.exe Token: SeCreatePagefilePrivilege 1948 msiexec.exe Token: SeCreatePermanentPrivilege 1948 msiexec.exe Token: SeBackupPrivilege 1948 msiexec.exe Token: SeRestorePrivilege 1948 msiexec.exe Token: SeShutdownPrivilege 1948 msiexec.exe Token: SeDebugPrivilege 1948 msiexec.exe Token: SeAuditPrivilege 1948 msiexec.exe Token: SeSystemEnvironmentPrivilege 1948 msiexec.exe Token: SeChangeNotifyPrivilege 1948 msiexec.exe Token: SeRemoteShutdownPrivilege 1948 msiexec.exe Token: SeUndockPrivilege 1948 msiexec.exe Token: SeSyncAgentPrivilege 1948 msiexec.exe Token: SeEnableDelegationPrivilege 1948 msiexec.exe Token: SeManageVolumePrivilege 1948 msiexec.exe Token: SeImpersonatePrivilege 1948 msiexec.exe Token: SeCreateGlobalPrivilege 1948 msiexec.exe Token: SeBackupPrivilege 1436 vssvc.exe Token: SeRestorePrivilege 1436 vssvc.exe Token: SeAuditPrivilege 1436 vssvc.exe Token: SeBackupPrivilege 2708 msiexec.exe Token: SeRestorePrivilege 2708 msiexec.exe Token: SeRestorePrivilege 2708 msiexec.exe Token: SeTakeOwnershipPrivilege 2708 msiexec.exe Token: SeBackupPrivilege 1172 srtasks.exe Token: SeRestorePrivilege 1172 srtasks.exe Token: SeSecurityPrivilege 1172 srtasks.exe Token: SeTakeOwnershipPrivilege 1172 srtasks.exe Token: SeRestorePrivilege 2708 msiexec.exe Token: SeTakeOwnershipPrivilege 2708 msiexec.exe Token: SeBackupPrivilege 1172 srtasks.exe Token: SeRestorePrivilege 1172 srtasks.exe Token: SeSecurityPrivilege 1172 srtasks.exe Token: SeTakeOwnershipPrivilege 1172 srtasks.exe Token: SeRestorePrivilege 2708 msiexec.exe Token: SeTakeOwnershipPrivilege 2708 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1948 msiexec.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3588 MSIB18.tmp 3588 MSIB18.tmp -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2708 wrote to memory of 1172 2708 msiexec.exe 102 PID 2708 wrote to memory of 1172 2708 msiexec.exe 102 PID 2708 wrote to memory of 3588 2708 msiexec.exe 104 PID 2708 wrote to memory of 3588 2708 msiexec.exe 104 PID 2708 wrote to memory of 3588 2708 msiexec.exe 104 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleToolbarInstaller_zh-CN_signed.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1948
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:1172
-
-
C:\Windows\Installer\MSIB18.tmp"C:\Windows\Installer\MSIB18.tmp" /m /sid:S-1-5-21-2718105630-359604950-2820636825-10002⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3588
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1436
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C3948BE6E525B8A8CEE9FAC91C9E392_ED584AAC2FBD1CBE20B4485E3FEDDA73
Filesize5B
MD55bfa51f3a417b98e7443eca90fc94703
SHA18c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA256bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
SHA5124cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
-
Filesize
1KB
MD51ba25895dc793e6826cbe8d61ddd8293
SHA16387cc55cbe9f71ae41b2425192b900a1eb3a54f
SHA256cc4c5c999ca59e5a62bc3ffe172a61f8cf13cc18c89fe48f628ff2a75bdc508a
SHA5121ff9b34fdbeae98fa8b534ba12501eb6df983cc67ce4f8ffc4c1ff12631aa8ed36ff349c39a2186e0ac8d9809437106578a746eec3854b54fef38a3cc0adb957
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C3948BE6E525B8A8CEE9FAC91C9E392_ED584AAC2FBD1CBE20B4485E3FEDDA73
Filesize416B
MD58d56c595db416d810aac6b08dc839ac2
SHA13e89214607fa31224fba51e6e0d08245f9d5a8ea
SHA25630b8bb4fe1d04ea722551fd358070bc7b9c90d60640bfad473850685dda9f706
SHA512bcce815a48bd2bcf81160e9674c222ca97c481b539601f133bda65821112b0c558cf3e1faf225772e0d1157e334099a6791bb581c8945144cc08dad9ff1d1e49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\60E31627FDA0A46932B0E5948949F2A5
Filesize182B
MD5e66f93169f7b3e28d60184c8d7cbf72b
SHA106d124c197444abc5ffe9afcd5b960ac0d25b5b4
SHA256a84172a46e818a3e4e1874a0d6c82cf6e9f10bb4aeff44e3a7268d9700308e14
SHA512b0d09976ea3b7154a5c35619f8f68efb59069a33bf6994d0b614e7b32c2eadc2f23eb41c166053670327707f8f6e495289fc3d23e0fa0998c53e78c04c2aa1a6
-
Filesize
975KB
MD54e98bab8bd44b65009308965d7a290bd
SHA1fd18b75202981c5d5746ff784f603918f7fe7308
SHA2565ef44aa6c9d1dfd031a1f8c1d0d9e83f08b3e05658b67c3f9504f9c88f2e76ca
SHA512b363c0ba6b0cf702347de7fb002bd3c1af3315e53d69e005e94703c00c8e5b66e34b5c89ab3f11048a3c8c6fd622e3d9617ef91e9c621936acb43c6c48569c6d
-
Filesize
23.7MB
MD5b2b5216fde392c95e4e0a174418f653a
SHA19c2945a1a1fc22878a5c27cadb7b66b780006a09
SHA256b0d76a40c273a5094fca27270440104d4dc39e5590eaf1441eca0905d1798017
SHA512154df30a0109d202082d11e0f1a1a868a1aba77207b5bfad71f8c38773cd488d3b34c00366017a51cdf93988bf48c6f00308b8685f36edd5c39e381434998a44
-
\??\Volume{fa35ad82-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{d6ccba0c-63a4-44fc-97a0-67dfa97bc241}_OnDiskSnapshotProp
Filesize6KB
MD5ae29a6be273e513d46a46efa219409c7
SHA1a2d3450d9f60e33d14468069781cc3a8620dcc6e
SHA256966dfe3970030f32e086d355d6b5e7e2f868749fc59e843b3de8947753bc2973
SHA5124ff22ca717eee4b4a69aa74d6b4c836a72476decfb0ca8847aaced58f5955b2afbb9577bf15324b101c0503aa141487f8297691503e45168257e16d7652f5eeb