Analysis
- max time kernel
104s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20250610-en - resource tags
arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system - submitted
07/08/2025, 02:11
Static task
static1
Behavioral task
behavioral1
Sample
package_latest.msi
Resource
win10v2004-20250610-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
package_latest.msi
Resource
win11-20250610-en
windows11-21h2-x64
17 signatures
150 seconds
General
- Target package_latest.msi
- Size 2.7MB
- Sample250807-cmjqlavzhy
- SHA256 24e7b7702b0b3536e0cfbaaf88cec3ccca35da6daa4c22d811d44077f05d27ec
- MD5 f7ed671a94f2ca12415a624e9fd832dc
- SHA1 82dd51f57ca158ed72253047a8326bdc9dffb6f2
- SHA512 5a3998b827f402df73ab0dca8525699451a1ad3696db1dd89e6d486c945ce405a001bd6a35d9f0f9014c5f4ee777f60a5bff022480de3473cb4302f0a37eddc5
- SSDEEP 49152:f0MHYkZKumZr7ACI1KiJekeW7AJop/eH316hULWGU/akw:LYuK/ACIj1eWl/wqUaGU/akw
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
latrodectus
C2
-
https://sumgifaluis.com/work/
-
https://dumkaumkasrot.com/work/
Attributes
-
group
Ganymed
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)
rc4.plain
aes.hex
Signatures
- Detects Latrodectus 1 IoCs
Detects Latrodectus v1.4.
resource yara_rule behavioral1/memory/3324-92-0x000002A1A0F80000-0x000002A1A0F97000-memory.dmp family_latrodectus_1_4 - Latrodectus family
- Latrodectus loader
Latrodectus is a loader written in C++.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3001560346-2020497773-4190896137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\igfxSDK = "C:\\Users\\Admin\\AppData\\Roaming\\Intel\\igfxSDK.exe" msiexec.exe - Blocklisted process makes network request 6 IoCs
flow pid Process 4 3576 msiexec.exe 6 3576 msiexec.exe 8 3576 msiexec.exe 38 5056 MsiExec.exe 40 5056 MsiExec.exe 42 5056 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{258D465A-3F57-4704-87BB-E124AE7095C3} msiexec.exe File opened for modification C:\Windows\Installer\MSI7EA7.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI77BE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI781C.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\e5b75a9.msi msiexec.exe File opened for modification C:\Windows\Installer\e5b75a9.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI7636.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI786C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7DFA.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe - Executes dropped EXE 2 IoCs
pid Process 1736 igfxSDK.exe 3324 igfxSDK.exe - Loads dropped DLL 9 IoCs
pid Process 5056 MsiExec.exe 5056 MsiExec.exe 5056 MsiExec.exe 5056 MsiExec.exe 5056 MsiExec.exe 1736 igfxSDK.exe 1736 igfxSDK.exe 3324 igfxSDK.exe 3324 igfxSDK.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3576 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b729ca96c34b23d70000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000b729ca960000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900b729ca96000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1db729ca96000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000b729ca9600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4748 msiexec.exe 4748 msiexec.exe - Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeShutdownPrivilege 3576 msiexec.exe Token: SeIncreaseQuotaPrivilege 3576 msiexec.exe Token: SeSecurityPrivilege 4748 msiexec.exe Token: SeCreateTokenPrivilege 3576 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3576 msiexec.exe Token: SeLockMemoryPrivilege 3576 msiexec.exe Token: SeIncreaseQuotaPrivilege 3576 msiexec.exe Token: SeMachineAccountPrivilege 3576 msiexec.exe Token: SeTcbPrivilege 3576 msiexec.exe Token: SeSecurityPrivilege 3576 msiexec.exe Token: SeTakeOwnershipPrivilege 3576 msiexec.exe Token: SeLoadDriverPrivilege 3576 msiexec.exe Token: SeSystemProfilePrivilege 3576 msiexec.exe Token: SeSystemtimePrivilege 3576 msiexec.exe Token: SeProfSingleProcessPrivilege 3576 msiexec.exe Token: SeIncBasePriorityPrivilege 3576 msiexec.exe Token: SeCreatePagefilePrivilege 3576 msiexec.exe Token: SeCreatePermanentPrivilege 3576 msiexec.exe Token: SeBackupPrivilege 3576 msiexec.exe Token: SeRestorePrivilege 3576 msiexec.exe Token: SeShutdownPrivilege 3576 msiexec.exe Token: SeDebugPrivilege 3576 msiexec.exe Token: SeAuditPrivilege 3576 msiexec.exe Token: SeSystemEnvironmentPrivilege 3576 msiexec.exe Token: SeChangeNotifyPrivilege 3576 msiexec.exe Token: SeRemoteShutdownPrivilege 3576 msiexec.exe Token: SeUndockPrivilege 3576 msiexec.exe Token: SeSyncAgentPrivilege 3576 msiexec.exe Token: SeEnableDelegationPrivilege 3576 msiexec.exe Token: SeManageVolumePrivilege 3576 msiexec.exe Token: SeImpersonatePrivilege 3576 msiexec.exe Token: SeCreateGlobalPrivilege 3576 msiexec.exe Token: SeBackupPrivilege 4340 vssvc.exe Token: SeRestorePrivilege 4340 vssvc.exe Token: SeAuditPrivilege 4340 vssvc.exe Token: SeBackupPrivilege 4748 msiexec.exe Token: SeRestorePrivilege 4748 msiexec.exe Token: SeRestorePrivilege 4748 msiexec.exe Token: SeTakeOwnershipPrivilege 4748 msiexec.exe Token: SeRestorePrivilege 4748 msiexec.exe Token: SeTakeOwnershipPrivilege 4748 msiexec.exe Token: SeRestorePrivilege 4748 msiexec.exe Token: SeTakeOwnershipPrivilege 4748 msiexec.exe Token: SeRestorePrivilege 4748 msiexec.exe Token: SeTakeOwnershipPrivilege 4748 msiexec.exe Token: SeRestorePrivilege 4748 msiexec.exe Token: SeTakeOwnershipPrivilege 4748 msiexec.exe Token: SeBackupPrivilege 676 srtasks.exe Token: SeRestorePrivilege 676 srtasks.exe Token: SeSecurityPrivilege 676 srtasks.exe Token: SeTakeOwnershipPrivilege 676 srtasks.exe Token: SeBackupPrivilege 676 srtasks.exe Token: SeRestorePrivilege 676 srtasks.exe Token: SeSecurityPrivilege 676 srtasks.exe Token: SeTakeOwnershipPrivilege 676 srtasks.exe Token: SeRestorePrivilege 4748 msiexec.exe Token: SeTakeOwnershipPrivilege 4748 msiexec.exe Token: SeRestorePrivilege 4748 msiexec.exe Token: SeTakeOwnershipPrivilege 4748 msiexec.exe Token: SeRestorePrivilege 4748 msiexec.exe Token: SeTakeOwnershipPrivilege 4748 msiexec.exe Token: SeRestorePrivilege 4748 msiexec.exe Token: SeTakeOwnershipPrivilege 4748 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3576 msiexec.exe 3576 msiexec.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4748 wrote to memory of 676 4748 msiexec.exe 96 PID 4748 wrote to memory of 676 4748 msiexec.exe 96 PID 4748 wrote to memory of 5056 4748 msiexec.exe 98 PID 4748 wrote to memory of 5056 4748 msiexec.exe 98 PID 4748 wrote to memory of 5056 4748 msiexec.exe 98 PID 4748 wrote to memory of 1736 4748 msiexec.exe 100 PID 4748 wrote to memory of 1736 4748 msiexec.exe 100 PID 1764 wrote to memory of 3324 1764 cmd.exe 102 PID 1764 wrote to memory of 3324 1764 cmd.exe 102 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\package_latest.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3576
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:676
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A6C9E5BF1D1E36B11CA8D518732095632⤵
- Blocklisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5056
-
-
C:\Users\Admin\AppData\Roaming\intel\igfxSDK.exe"C:\Users\Admin\AppData\Roaming\intel\igfxSDK.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4340
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Intel\igfxSDK.exe1⤵
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Roaming\Intel\igfxSDK.exeC:\Users\Admin\AppData\Roaming\Intel\igfxSDK.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3324
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5b75ac.rbs
- Size 1KB
- SHA256 a9d37383f47a364bf42d13f6a5e670d147b032805513d3e2422b39ecc716f9c4
- MD5 f16ecbf3f4d94d2792fc6497cbca1fe3
- SHA1 fe56a541cdcc79bd185197945aaf890efea7368c
- SHA512 39b14dc7595810e2a38432c7eb180da6155eb50bf15bc442e4ad3f691dc623f3949470eaf7edbbcfb953e8a9e53f45b98a3f3d37928ea2ba8d5bca9e01a610e9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_B2B6295295D4E652C00445DB64205A13
- Size 1KB
- SHA256 b86401dbbf5e1c738490d72b7111a8fde361663859a6c8e24a7f592518e7e8a5
- MD5 93b1b539346886b93f1002daca73d9ac
- SHA1 3526916b57157eec650e4c2a506e0e5fe646251d
- SHA512 1364dac8343741796e9a60c015c3ab4f0fbaa0ecc461d87773f465ccfd6aeeb623ecfd6aa8ca548916ff6473444a2cd502abcf96732e8529c8b966b6b701cf19
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
- Size 1KB
- SHA256 11347b32e739796f1631b413df2bfe0c4bae21c19bd013227d373474cc53158e
- MD5 d1a2c759a8d6beb1d8bdb66b01414fdc
- SHA1 796d690ad2ed00ecbea91bd152f836fb4096cf54
- SHA512 2f95fe1d2199d2baf4706cac3aa39fa787c29cb5e0dc961713604733d0411f0d435d9918eb3db262fc065bcf8fd1dd66baf08a34a184ffd711bc4105ea595f1c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_B2B6295295D4E652C00445DB64205A13
- Size 536B
- SHA256 d49fa1b2cdee74a84ed7281d56c690ec30fdf0bb9c718cee14754c132ff14c61
- MD5 c3aead8ab05ccdf65c96899f93829d94
- SHA1 820f2a0a299c528ed5076a9738c545f58dc67499
- SHA512 b7f46c4dbb63b5502c6884b103cf9d9963b9b1072cbb3e2a396ffc65280cd7033831982067bc11594efca403f45a82b8172134303c1d0f013f21fdcae84f367a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
- Size 536B
- SHA256 15fb1ffc00d5e9244f5cc2ad226160ad1bcb2ec645e0def5e5b161146e8dd38c
- MD5 221c745cb9b24f505abd49087f295175
- SHA1 8b65ba7d4413495c43cad80aacaa41540980c740
- SHA512 c5fcb51c9ec283ebb251d60b81fc94f73a43b05ad83e526992df4bc52ac556df8a6dadb41c778b54f7023f4b997dacc8f313323a1339c98cfc33fd65862ff176
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\intel\WTSAPI32.dll
- Size 2.6MB
- SHA256 251eadf6b434016cf30dfa4749762ef4c8ae1ec3255ac42f5b5f714750b1a49d
- MD5 8d320c1d6a20690ea5e569d011422e03
- SHA1 3dcc21d0b1e50dd5431e459d373a8a2d662e705c
- SHA512 82e549a14a2afda6acd2e626a093a4c1b78acfd423342decb58d6fee6d161b37db2b3e56f5aa3345fc937903d0103aea01da872d5575b12bda4296e7f998d0b3
- SSDEEP 49152:JhCycMpGxL+zIpAY4c4TbzUQ9IcVDI8ObjSTNpGtlqatM0VwASOGmpTLMfIU6iD8:lHQtMWhb+DSqS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\intel\igfxSDK.exe
- Size 973KB
- SHA256 b7f8750851e70ec755343d322d7d81ea0fc1b12d4a1ab6a60e7c8605df4cd6a5
- MD5 e6133838440afc64ce9722343a1cb297
- SHA1 d1eccb3d907f0cd7e52d502b340624d5dc98f8dc
- SHA512 1e3a36b4ddefb34eb6e440d04dc330c89a159ad2e510e31e47987bb4143b5d3a5f2f61a5e6fcb6946b842b2490225cf20516823e65064cba1960ec2342f1358a
- SSDEEP 12288:dFd3Fup1V55BdPvaVx3vPwqDHfTlptUzZuRqqWziUU860yK1nTVPV:dz3Fu6PbD/rWzZu7AhTVPV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\intel\version.dll
- Size 31KB
- SHA256 af45a728552ccfdcd9435c40ace60a9354d7c1b52abf507a2f1cb371dada4fde
- MD5 ee901ff4ad552d0f8dc8fd5837ace5ab
- SHA1 699cf845d7320c0a7c1407dbf8f73c9fdfb5c754
- SHA512 a7f9bcfe7dfa74067fab32e313fa74e18c4ef10f6bc40a369f0a13c4fe96d2bb7bc7c25ed7e5f1f80cae7ecce2d18215388420d7ee4be23d7280f06a49e9c370
- SSDEEP 768:MrAO9JmckVPxIiTAqMwYyO2ulzxAHjo1PU/C9zJ3V:MrnJmckVPxIiTAqMwg2ulzxAHjwPU/e3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI7636.tmp
- Size 436KB
- SHA256 426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
- MD5 475d20c0ea477a35660e3f67ecf0a1df
- SHA1 67340739f51e1134ae8f0ffc5ae9dd710e8e3a08
- SHA512 99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
- SSDEEP 6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI786C.tmp
- Size 355KB
- SHA256 57c0d90010d3a476770c8085d2641cbf234b0ca47ec687ca4aabbf4db92df737
- MD5 cac65e61b287555ea0e2a7f1aa0645cc
- SHA1 0c93bdbfddd7e00ec30c81dbff8f3a1bfaf62519
- SHA512 e80076eb7e632e40f8dcb013b854a5825e7a19dd451505aa121a47a110032a1c571cd6d9e3e5aeacdb8f5897cb17ece4e65846b5d9080605e81176fe0811456a
- SSDEEP 6144:7ERhCG72KuIsAmf/uLwHM3KIfPiQFAOe3+Q1DvZ7PE:mvBuI0TKfFMzlPE
- MD5 SHA1 SHA512 SSDEEP
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 72c9b1cd5711f98fbe5cbaf39ed75dc85d2ea8ec65ae86452158f841629dd8f9
- MD5 60d126c2526d1d86d647bfbf35313b36
- SHA1 ac3c1adf05466de1b7cef00e56c17f59de43c349
- SHA512 64f48ccec880ccbafb4fb602ecedc89e3697034ecdb91ad518eefed553a868fc9f5dd67ce3fe5f94aae2580c6efe5aa2a521856d7709db7570459f8f0665e100
- SSDEEP 24576:FZxm+1L6doO/vvTLb2mOTWKCXf4S+VmC6w2tUJXF+EaHOx/JYPVF+zNhr:W
- MD5 SHA1 SHA512 SSDEEP
- Path \??\Volume{96ca29b7-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3569bf79-f187-4488-88f9-270011aa233c}_OnDiskSnapshotProp
- Size 6KB
- SHA256 83a42dd18e6ff132c68955d58fc46af5c00e1c8b65de67865cc5fa8f76356fd1
- MD5 63b6a33b96b06ce918c2a3ff3fba9e5a
- SHA1 49b77635c71bcaad3f10ca65caf01ba5c19c1fe9
- SHA512 e2fa1f11611c92628edcda427dbceb832d4729f63cc07249d62aff608ffc43fb6d708543fd53df55e5392c9920208bdb6a0a738d86aa35c5ab957f8f69e5d994
- SSDEEP 96:FoG7S3KMFDD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:nq1b++ZVm
- MD5 SHA1 SHA512 SSDEEP