Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3bdcd08123d...18.exe
windows7-x64
7bdcd08123d...18.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$SYSDIR/gtapi.dll
windows7-x64
3$SYSDIR/gtapi.dll
windows10-2004-x64
3$TEMP/Goog...ed.msi
windows7-x64
6$TEMP/Goog...ed.msi
windows10-2004-x64
6UUPlayer.dll
windows7-x64
3UUPlayer.dll
windows10-2004-x64
3UUSeePlayer.exe
windows7-x64
10UUSeePlayer.exe
windows10-2004-x64
10bass-plugins.exe
windows7-x64
7bass-plugins.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3CoCode.dll
windows7-x64
3CoCode.dll
windows10-2004-x64
3UFDeMux.dll
windows7-x64
3UFDeMux.dll
windows10-2004-x64
3Analysis
-
max time kernel
145s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
24/08/2024, 02:06
Static task
static1
Behavioral task
behavioral1
Sample
bdcd08123d21c1c5c7a1a3cd95096437_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
bdcd08123d21c1c5c7a1a3cd95096437_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$SYSDIR/gtapi.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral12
Sample
$SYSDIR/gtapi.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
$TEMP/GoogleToolbarInstaller_zh-CN_signed.msi
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral14
Sample
$TEMP/GoogleToolbarInstaller_zh-CN_signed.msi
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
UUPlayer.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral16
Sample
UUPlayer.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
UUSeePlayer.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral18
Sample
UUSeePlayer.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
bass-plugins.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral20
Sample
bass-plugins.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral22
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral24
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral26
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral28
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
CoCode.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral30
Sample
CoCode.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
UFDeMux.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral32
Sample
UFDeMux.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
$TEMP/GoogleToolbarInstaller_zh-CN_signed.msi
-
Size
1.1MB
-
MD5
ec1629e2086cad6ccc4c995630896213
-
SHA1
e0e1f7720072b85c04318d6d15b595d7e8f52670
-
SHA256
101fc387cb284a27c943ea087b751aefb5c106a214253b7e29e7381da95beaee
-
SHA512
3f7157a25a2d1f1fc345e9138ed5c1f17805256be985e8cfe54c60cb5a11d62e13472bdeee187c7b13e5746c8d9e08359d929410d3b5e5ab204cf4f91c02d9b1
-
SSDEEP
24576:FBkI5/nyOeMDyWd8Dce5HrY5w6Rsa31L5Dh66NIXiQcAqHVIYzgD:jhyOeMPacWHruwOsa31L5Dh66N+iVh1O
Malware Config
Signatures
-
Blocklisted process makes network request 4 IoCs
flow pid Process 13 1960 msiexec.exe 16 1960 msiexec.exe 24 1960 msiexec.exe 39 4580 msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e57c4b7.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{DBEA1034-5882-4A88-8033-81C4EF0CFA29} msiexec.exe File opened for modification C:\Windows\Installer\MSIDFA2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE010.tmp msiexec.exe File created C:\Windows\Installer\e57c4b7.msi msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 5044 MSIE010.tmp -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1960 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIE010.tmp -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000bf081c85bb6cd1e80000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000bf081c850000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900bf081c85000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dbf081c85000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000bf081c8500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Modifies data under HKEY_USERS 8 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MSIE010.tmp Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix MSIE010.tmp Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" MSIE010.tmp Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" MSIE010.tmp Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MSIE010.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MSIE010.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MSIE010.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MSIE010.tmp -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4580 msiexec.exe 4580 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 51 IoCs
description pid Process Token: SeShutdownPrivilege 1960 msiexec.exe Token: SeIncreaseQuotaPrivilege 1960 msiexec.exe Token: SeSecurityPrivilege 4580 msiexec.exe Token: SeCreateTokenPrivilege 1960 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1960 msiexec.exe Token: SeLockMemoryPrivilege 1960 msiexec.exe Token: SeIncreaseQuotaPrivilege 1960 msiexec.exe Token: SeMachineAccountPrivilege 1960 msiexec.exe Token: SeTcbPrivilege 1960 msiexec.exe Token: SeSecurityPrivilege 1960 msiexec.exe Token: SeTakeOwnershipPrivilege 1960 msiexec.exe Token: SeLoadDriverPrivilege 1960 msiexec.exe Token: SeSystemProfilePrivilege 1960 msiexec.exe Token: SeSystemtimePrivilege 1960 msiexec.exe Token: SeProfSingleProcessPrivilege 1960 msiexec.exe Token: SeIncBasePriorityPrivilege 1960 msiexec.exe Token: SeCreatePagefilePrivilege 1960 msiexec.exe Token: SeCreatePermanentPrivilege 1960 msiexec.exe Token: SeBackupPrivilege 1960 msiexec.exe Token: SeRestorePrivilege 1960 msiexec.exe Token: SeShutdownPrivilege 1960 msiexec.exe Token: SeDebugPrivilege 1960 msiexec.exe Token: SeAuditPrivilege 1960 msiexec.exe Token: SeSystemEnvironmentPrivilege 1960 msiexec.exe Token: SeChangeNotifyPrivilege 1960 msiexec.exe Token: SeRemoteShutdownPrivilege 1960 msiexec.exe Token: SeUndockPrivilege 1960 msiexec.exe Token: SeSyncAgentPrivilege 1960 msiexec.exe Token: SeEnableDelegationPrivilege 1960 msiexec.exe Token: SeManageVolumePrivilege 1960 msiexec.exe Token: SeImpersonatePrivilege 1960 msiexec.exe Token: SeCreateGlobalPrivilege 1960 msiexec.exe Token: SeBackupPrivilege 4660 vssvc.exe Token: SeRestorePrivilege 4660 vssvc.exe Token: SeAuditPrivilege 4660 vssvc.exe Token: SeBackupPrivilege 4580 msiexec.exe Token: SeRestorePrivilege 4580 msiexec.exe Token: SeRestorePrivilege 4580 msiexec.exe Token: SeTakeOwnershipPrivilege 4580 msiexec.exe Token: SeRestorePrivilege 4580 msiexec.exe Token: SeTakeOwnershipPrivilege 4580 msiexec.exe Token: SeRestorePrivilege 4580 msiexec.exe Token: SeTakeOwnershipPrivilege 4580 msiexec.exe Token: SeBackupPrivilege 512 srtasks.exe Token: SeRestorePrivilege 512 srtasks.exe Token: SeSecurityPrivilege 512 srtasks.exe Token: SeTakeOwnershipPrivilege 512 srtasks.exe Token: SeBackupPrivilege 512 srtasks.exe Token: SeRestorePrivilege 512 srtasks.exe Token: SeSecurityPrivilege 512 srtasks.exe Token: SeTakeOwnershipPrivilege 512 srtasks.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1960 msiexec.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5044 MSIE010.tmp 5044 MSIE010.tmp -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4580 wrote to memory of 512 4580 msiexec.exe 100 PID 4580 wrote to memory of 512 4580 msiexec.exe 100 PID 4580 wrote to memory of 5044 4580 msiexec.exe 102 PID 4580 wrote to memory of 5044 4580 msiexec.exe 102 PID 4580 wrote to memory of 5044 4580 msiexec.exe 102 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleToolbarInstaller_zh-CN_signed.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1960
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:512
-
-
C:\Windows\Installer\MSIE010.tmp"C:\Windows\Installer\MSIE010.tmp" /m /sid:S-1-5-21-2412658365-3084825385-3340777666-10002⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5044
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4660
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C3948BE6E525B8A8CEE9FAC91C9E392_ED584AAC2FBD1CBE20B4485E3FEDDA73
Filesize5B
MD55bfa51f3a417b98e7443eca90fc94703
SHA18c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA256bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
SHA5124cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
-
Filesize
1KB
MD51ba25895dc793e6826cbe8d61ddd8293
SHA16387cc55cbe9f71ae41b2425192b900a1eb3a54f
SHA256cc4c5c999ca59e5a62bc3ffe172a61f8cf13cc18c89fe48f628ff2a75bdc508a
SHA5121ff9b34fdbeae98fa8b534ba12501eb6df983cc67ce4f8ffc4c1ff12631aa8ed36ff349c39a2186e0ac8d9809437106578a746eec3854b54fef38a3cc0adb957
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C3948BE6E525B8A8CEE9FAC91C9E392_ED584AAC2FBD1CBE20B4485E3FEDDA73
Filesize416B
MD5bb369e2c4b0cd998cc63b951c88aba31
SHA1d2409133f52a35f73a40fec975f699f6c1064339
SHA256278cc63430d14ee8d96ed6c4b94f0ffe39fb9e75bed0742e6a50542379c99e95
SHA5122a8a727c37f7f8a70913f6dbbfefbd26f06b234debc239c295d43b9907aafa8afda18b7dd5074d3188f3d06759f541fd85ffea3849a2bfc9ea73c928428cf7ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\60E31627FDA0A46932B0E5948949F2A5
Filesize182B
MD513f97502a23f6e7a970b13e6eb3c006e
SHA1c301a7f56462313b764fe5f32fdd01b157f3d4d9
SHA256d5b2f1545d55b45388c6edcc709253624162eaba71b9c4940b8cc3c22cf1366e
SHA51226ca743a48e41d4e1e3976fa0bd8bdc6e11d13fb72d4d38dae2f08a26913faf040ca7c7d8bbaa51cce5b61d4d11e264c8c925ce933815a2ab17fcc07918ac600
-
Filesize
975KB
MD54e98bab8bd44b65009308965d7a290bd
SHA1fd18b75202981c5d5746ff784f603918f7fe7308
SHA2565ef44aa6c9d1dfd031a1f8c1d0d9e83f08b3e05658b67c3f9504f9c88f2e76ca
SHA512b363c0ba6b0cf702347de7fb002bd3c1af3315e53d69e005e94703c00c8e5b66e34b5c89ab3f11048a3c8c6fd622e3d9617ef91e9c621936acb43c6c48569c6d
-
Filesize
23.7MB
MD50be9e7459fa7cc7714a01f4d3d4514d9
SHA1f8fc3bbcbf2be8bf97904eb09c09523de455d38f
SHA25663fe0e737d35c2a1891b93325056445d9f552645acd75024e120e7431ed79bfb
SHA51254174f93db18aa4072f6094f5d58b741f6e9064f16a79b8ec7e7d7dad3ec05d4d79ac03bb80e9ee27e7fcf5e9c5d45d9c6843d2267b050712a7575520ba7edf2
-
\??\Volume{851c08bf-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{f949aec7-a8d0-4aee-ae37-fe80773b1177}_OnDiskSnapshotProp
Filesize6KB
MD593c7734a84f0201efd7637ce8bf77e26
SHA19a72ab0a35b9f1cd24e78210f9ac82210fea5d20
SHA2563ddbed21b214713d8cecd9aebfc54cdd9d0c00a2be9b0d97246a441928b06135
SHA51277869a3e297f409e55d3057865c7b53b6d82dfa1d2084a9c7995b36f441cfb17db0d4bd66544d9b10096d608dde4fe8df67c30d8b892cc34d524e1d57160859f