Analysis
- max time kernel
141s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20250619-en - resource tags
arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system - submitted
26/09/2025, 06:38
Static task
static1
Behavioral task
behavioral1
Sample
da6fbd0983a51f8a5f00bbcb2e26f7cb4adee36fa515c7e8cf12b9b4ea3acdec.msi
Resource
win10v2004-20250619-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
da6fbd0983a51f8a5f00bbcb2e26f7cb4adee36fa515c7e8cf12b9b4ea3acdec.msi
Resource
win11-20250610-en
windows11-21h2-x64
17 signatures
150 seconds
General
- Target da6fbd0983a51f8a5f00bbcb2e26f7cb4adee36fa515c7e8cf12b9b4ea3acdec.msi
- Size 2.3MB
- Sample250926-hd3d8seq5x
- SHA256 da6fbd0983a51f8a5f00bbcb2e26f7cb4adee36fa515c7e8cf12b9b4ea3acdec
- MD5 707692d1c26817f55e9a069c71ed1d14
- SHA1 401263bce1da1726a3d092abc163b8e1a161ff86
- SHA512 ba19c5f9dc111809ebd139d31f320f5d7b326898586b4001952885253c11a96620feb102f1db1c2505ffc5e0a1481783b64d9072816a88c3044623601a9146d3
- SSDEEP 49152:9QhHYVZKumZr7AiI1KJJekN1LDiYVfhIKel:SYLK/AiIU1N1L3hI
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
latrodectus
C2
-
https://jojikloertoys.com/work/
-
https://djkloyfarelbister.com/work/
Attributes
-
group
Orion
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)
aes.hex
Signatures
- Detects Latrodectus 1 IoCs
Detects Latrodectus v1.4.
resource yara_rule behavioral1/memory/784-82-0x00000233F83D0000-0x00000233F83E7000-memory.dmp family_latrodectus_1_4 - Latrodectus family
- Latrodectus loader
Latrodectus is a loader written in C++.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\onedrive = "C:\\Users\\Admin\\AppData\\Roaming\\instance\\igfx.exe" msiexec.exe - Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 4 6056 msiexec.exe 8 6056 msiexec.exe 11 6056 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSICF37.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID070.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID1F8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID2B4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE311.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\e57ce8b.msi msiexec.exe File opened for modification C:\Windows\Installer\e57ce8b.msi msiexec.exe File created C:\Windows\Installer\SourceHash{AF6ED204-B63E-4AE5-B48E-77A2D496E580} msiexec.exe File opened for modification C:\Windows\Installer\MSIE370.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe - Executes dropped EXE 2 IoCs
pid Process 4328 igfx.exe 784 igfx.exe - Loads dropped DLL 7 IoCs
pid Process 4476 MsiExec.exe 4476 MsiExec.exe 4476 MsiExec.exe 4476 MsiExec.exe 4476 MsiExec.exe 4328 igfx.exe 784 igfx.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 6056 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000003c452df13e30c07c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800003c452df10000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809003c452df1000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d3c452df1000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000003c452df100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5360 msiexec.exe 5360 msiexec.exe - Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeShutdownPrivilege 6056 msiexec.exe Token: SeIncreaseQuotaPrivilege 6056 msiexec.exe Token: SeSecurityPrivilege 5360 msiexec.exe Token: SeCreateTokenPrivilege 6056 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 6056 msiexec.exe Token: SeLockMemoryPrivilege 6056 msiexec.exe Token: SeIncreaseQuotaPrivilege 6056 msiexec.exe Token: SeMachineAccountPrivilege 6056 msiexec.exe Token: SeTcbPrivilege 6056 msiexec.exe Token: SeSecurityPrivilege 6056 msiexec.exe Token: SeTakeOwnershipPrivilege 6056 msiexec.exe Token: SeLoadDriverPrivilege 6056 msiexec.exe Token: SeSystemProfilePrivilege 6056 msiexec.exe Token: SeSystemtimePrivilege 6056 msiexec.exe Token: SeProfSingleProcessPrivilege 6056 msiexec.exe Token: SeIncBasePriorityPrivilege 6056 msiexec.exe Token: SeCreatePagefilePrivilege 6056 msiexec.exe Token: SeCreatePermanentPrivilege 6056 msiexec.exe Token: SeBackupPrivilege 6056 msiexec.exe Token: SeRestorePrivilege 6056 msiexec.exe Token: SeShutdownPrivilege 6056 msiexec.exe Token: SeDebugPrivilege 6056 msiexec.exe Token: SeAuditPrivilege 6056 msiexec.exe Token: SeSystemEnvironmentPrivilege 6056 msiexec.exe Token: SeChangeNotifyPrivilege 6056 msiexec.exe Token: SeRemoteShutdownPrivilege 6056 msiexec.exe Token: SeUndockPrivilege 6056 msiexec.exe Token: SeSyncAgentPrivilege 6056 msiexec.exe Token: SeEnableDelegationPrivilege 6056 msiexec.exe Token: SeManageVolumePrivilege 6056 msiexec.exe Token: SeImpersonatePrivilege 6056 msiexec.exe Token: SeCreateGlobalPrivilege 6056 msiexec.exe Token: SeBackupPrivilege 1612 vssvc.exe Token: SeRestorePrivilege 1612 vssvc.exe Token: SeAuditPrivilege 1612 vssvc.exe Token: SeBackupPrivilege 5360 msiexec.exe Token: SeRestorePrivilege 5360 msiexec.exe Token: SeRestorePrivilege 5360 msiexec.exe Token: SeTakeOwnershipPrivilege 5360 msiexec.exe Token: SeRestorePrivilege 5360 msiexec.exe Token: SeTakeOwnershipPrivilege 5360 msiexec.exe Token: SeRestorePrivilege 5360 msiexec.exe Token: SeTakeOwnershipPrivilege 5360 msiexec.exe Token: SeBackupPrivilege 2824 srtasks.exe Token: SeRestorePrivilege 2824 srtasks.exe Token: SeSecurityPrivilege 2824 srtasks.exe Token: SeTakeOwnershipPrivilege 2824 srtasks.exe Token: SeRestorePrivilege 5360 msiexec.exe Token: SeTakeOwnershipPrivilege 5360 msiexec.exe Token: SeRestorePrivilege 5360 msiexec.exe Token: SeTakeOwnershipPrivilege 5360 msiexec.exe Token: SeBackupPrivilege 2824 srtasks.exe Token: SeRestorePrivilege 2824 srtasks.exe Token: SeSecurityPrivilege 2824 srtasks.exe Token: SeTakeOwnershipPrivilege 2824 srtasks.exe Token: SeRestorePrivilege 5360 msiexec.exe Token: SeTakeOwnershipPrivilege 5360 msiexec.exe Token: SeRestorePrivilege 5360 msiexec.exe Token: SeTakeOwnershipPrivilege 5360 msiexec.exe Token: SeRestorePrivilege 5360 msiexec.exe Token: SeTakeOwnershipPrivilege 5360 msiexec.exe Token: SeRestorePrivilege 5360 msiexec.exe Token: SeTakeOwnershipPrivilege 5360 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 6056 msiexec.exe 6056 msiexec.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 5360 wrote to memory of 2824 5360 msiexec.exe 98 PID 5360 wrote to memory of 2824 5360 msiexec.exe 98 PID 5360 wrote to memory of 4476 5360 msiexec.exe 100 PID 5360 wrote to memory of 4476 5360 msiexec.exe 100 PID 5360 wrote to memory of 4476 5360 msiexec.exe 100 PID 5360 wrote to memory of 4328 5360 msiexec.exe 102 PID 5360 wrote to memory of 4328 5360 msiexec.exe 102 PID 5196 wrote to memory of 784 5196 cmd.exe 104 PID 5196 wrote to memory of 784 5196 cmd.exe 104 PID 784 wrote to memory of 2844 784 igfx.exe 107 PID 784 wrote to memory of 2844 784 igfx.exe 107 PID 2844 wrote to memory of 6140 2844 cmd.exe 109 PID 2844 wrote to memory of 6140 2844 cmd.exe 109 PID 2844 wrote to memory of 1740 2844 cmd.exe 110 PID 2844 wrote to memory of 1740 2844 cmd.exe 110 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\da6fbd0983a51f8a5f00bbcb2e26f7cb4adee36fa515c7e8cf12b9b4ea3acdec.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:6056
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:2824
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding EFCD7D0BF698669BE7B2E9AB82DF8C952⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4476
-
-
C:\Users\Admin\AppData\Roaming\instance\igfx.exe"C:\Users\Admin\AppData\Roaming\instance\igfx.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4328
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1612
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\instance\igfx.exe1⤵
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Users\Admin\AppData\Roaming\instance\igfx.exeC:\Users\Admin\AppData\Roaming\instance\igfx.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Windows\System32\cmd.exe/c reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid | findstr MachineGuid3⤵
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid4⤵PID:6140
-
-
C:\Windows\system32\findstr.exefindstr MachineGuid4⤵PID:1740
-
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e57ce8e.rbs
- Size 1KB
- SHA256 c7c017fe401b3129fc767812c058f1d738dbdaea9d215899b464f5f178e8f30f
- MD5 eab7080de7e635bec11b759e34f6318e
- SHA1 c190158209abfd9966c2b140e6bec2e95dcb4956
- SHA512 56d57e639dc20823f5b3f4894f75b9d4461e0ab24cc231c257b094143ea3cf6cfa600fcf2ba15623a5bc9cde9924aa4a30316136f7be057af30e558aa7b1c10a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_EA055783B7C17D53E12240715BA01EE0
- Size 1KB
- SHA256 656cb0887ad0797669737f92323ead656071db0ca1188ea5236e946316578d6f
- MD5 7c97f3dd8e8267ed3cc81a0f1e2852fb
- SHA1 3ce57f037479ee92f024c1897ba57a57784ead21
- SHA512 b2f2138d9d07ad857b87096ccc6be43788357bed63c2760d03a2c66ccc36ecdfbdbeef34cbea02bc073f04d7f9c2fa57e76ab1c4dd93a8ae5e8e5c0aa391ce07
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
- Size 1KB
- SHA256 ce15e49f66308c08e91479fed1cf13e14b5485e039d652fbd1625915a27ab945
- MD5 412caa70c7cd0ecce288ff6d4c706c4e
- SHA1 c15da9ad3df2b07aff9e58a79bfa4a50e6972ea2
- SHA512 35dc643bd8ac0216b8197a186ff4013c388ee5b6315702d83de49488eb9b1324af0a2ad354aac35f53e39a1c0611f0443b84274cbc737c102d25fdba42fdc079
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_EA055783B7C17D53E12240715BA01EE0
- Size 540B
- SHA256 dd9a4ce6f4c8607846d9930e0eb750397609a53bc7d4c1149c54c09089949236
- MD5 6e0346852851de62e2ec94a11adcbbf6
- SHA1 11b2e3d4dec587e55fa82e2276e8ae1a311291a0
- SHA512 908d1cd1fc66dde0756bea10d23fd20a72ad0d927cd5c23933bea167e3690687ffa5b9691048854b4914d3a9037e1b9a5d02cc32446f60c3faed47d37f26380d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
- Size 536B
- SHA256 6a4be4b4c109cebaf1058e9b64ac20a10b0358fbbf98d5130d533153a099d0ac
- MD5 bcc00bf5e918a246d91d67ddb4138925
- SHA1 ebd4ebb46b27c1fb2880d586c96a18cd91c812a5
- SHA512 1f7d37879458051290f50038fa2f261ff3a3e73aea02658b94499bc6f4fc912bd73197a18a44410d1af1af5fe0ce574d888c2f50f9a65926064057dbe1b60bb2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\instance\WTSAPI32.dll
- Size 1.7MB
- SHA256 a3b7ad3ac10b437dbe004aa6ec90b480a14304f2d5c59b77cb8559e96e1a6841
- MD5 dd3135292600448019bc1282049a58c3
- SHA1 9ef07882a5504328507687b61d919b5853df4cdc
- SHA512 0df5ad27088e25a230c9ae90e44391a926443b6a6f2f9dd02f5cf82dbde5563119b4187b59c9b0997a063e6735727adc09560947c88b28476dfaae4f42713cd6
- SSDEEP 49152:Pp0AcYaNdm3+WiCTUEGByVuRl34w0Xn09ZSStGNhSsGEbhQ6:aRHvm3OTS3oq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\instance\igfx.exe
- Size 973KB
- SHA256 b7f8750851e70ec755343d322d7d81ea0fc1b12d4a1ab6a60e7c8605df4cd6a5
- MD5 e6133838440afc64ce9722343a1cb297
- SHA1 d1eccb3d907f0cd7e52d502b340624d5dc98f8dc
- SHA512 1e3a36b4ddefb34eb6e440d04dc330c89a159ad2e510e31e47987bb4143b5d3a5f2f61a5e6fcb6946b842b2490225cf20516823e65064cba1960ec2342f1358a
- SSDEEP 12288:dFd3Fup1V55BdPvaVx3vPwqDHfTlptUzZuRqqWziUU860yK1nTVPV:dz3Fu6PbD/rWzZu7AhTVPV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSICF37.tmp
- Size 436KB
- SHA256 426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
- MD5 475d20c0ea477a35660e3f67ecf0a1df
- SHA1 67340739f51e1134ae8f0ffc5ae9dd710e8e3a08
- SHA512 99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
- SSDEEP 6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSID2B4.tmp
- Size 355KB
- SHA256 57c0d90010d3a476770c8085d2641cbf234b0ca47ec687ca4aabbf4db92df737
- MD5 cac65e61b287555ea0e2a7f1aa0645cc
- SHA1 0c93bdbfddd7e00ec30c81dbff8f3a1bfaf62519
- SHA512 e80076eb7e632e40f8dcb013b854a5825e7a19dd451505aa121a47a110032a1c571cd6d9e3e5aeacdb8f5897cb17ece4e65846b5d9080605e81176fe0811456a
- SSDEEP 6144:7ERhCG72KuIsAmf/uLwHM3KIfPiQFAOe3+Q1DvZ7PE:mvBuI0TKfFMzlPE
- MD5 SHA1 SHA512 SSDEEP
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 0aca261f75fcafc2bd557f1d4b997be158214bcf0a8e67cf03ffd764958aec17
- MD5 eafbf5b8f5c0dc4d05139826e942ede2
- SHA1 8aa47646139b16d4907df0807c66680f7bab3852
- SHA512 3c7fe47812186d6f73762cbf3393511779777a66936e4ecc9f0754d7d4ce36b755a63ac3a9a614ea644228d78e5ce8c1cab77c66ed67c63b3ec3bc1d8b0eff85
- SSDEEP 24576:WZxm+1LgdoO/vvTLr2tOIWaZMkoZlVdSh7mNPC8VFUas+K0po/F+ljWRb:b
- MD5 SHA1 SHA512 SSDEEP
- Path \??\Volume{f12d453c-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{e13ce079-790a-419f-90ad-5cdf3582178f}_OnDiskSnapshotProp
- Size 6KB
- SHA256 ecd34dbc18c4adccd10b315a68eafdfcef2d78f7cec8bc5bac173bb1c31fb72b
- MD5 ab598691693ee3f96c1fbc9465521221
- SHA1 22e2edec8de6b6215af09595c86fe3e55ea0fe58
- SHA512 155b65a9a0a9140645e23ec69b75ba1534298e30a672924aba1ca56178852a091ec2e5e2ece76dbb0a3a970d622293efd1e313ef3d85bfd2fa7871dc3a247aef
- SSDEEP 96:Fg++DMFDD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:uK1b++ZVm
- MD5 SHA1 SHA512 SSDEEP