Analysis
- max time kernel
270s - max time network
234s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20251017-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20251017-enlocale:en-usos:windows10-ltsc_2021-x64system - submitted
27/10/2025, 14:29
Static task
static1
Behavioral task
behavioral1
Sample
Setup.msi
Resource
win10v2004-20251016-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
Setup.msi
Resource
win10ltsc2021-20251017-en
windows10-ltsc_2021-x64
19 signatures
150 seconds
Behavioral task
behavioral3
Sample
Setup.msi
Resource
win11-20251015-en
windows11-21h2-x64
19 signatures
150 seconds
General
- Target Setup.msi
- Size 2.9MB
- Sample251027-rtlk4axqft
- SHA256 ba699da64d44b039defd4f42340bc7bec888b8dcef135d5735f2af309ce8ce72
- MD5 d03145de36a8538aa2120a58e2f1030d
- SHA1 4c8c4b7dbcdc1984355f89ba7fe9d47625192025
- SHA512 f01d5e5598c1661cbe168dd77a96cd8b7b312332ab1fad50ba68228282235f7507dd3d59683c20e30c389dba38929036dafe574f807f3a35f6ceb48afdede4e8
- SSDEEP 49152:cBMntJOMhe50ckXRst4GXdy0lY9Jhjr/KLQixPPHb0bZtLUT81wkUHb0B35H9Skx:e6bOMhwEXRiXN0JQvlYUg1wkSbypHcpc
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
hijackloader
Attributes
-
directory
%APPDATA%\StreammakeXL_4
-
inject_dll
%windir%\SysWOW64\pla.dll
xor.hex
Signatures
- Detects HijackLoader (aka IDAT Loader) 1 IoCs
resource yara_rule behavioral2/files/0x0007000000028197-26.dat family_hijackloader - HijackLoader
HijackLoader is a multistage loader first seen in 2023.
- Hijackloader family
- SectopRAT payload 1 IoCs
resource yara_rule behavioral2/memory/4876-47-0x0000028BE4E90000-0x0000028BE4F68000-memory.dmp family_sectoprat - Sectoprat family
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2784 set thread context of 4876 2784 WizardCore.exe 95 - Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\Installer\e57b901.msi msiexec.exe File created C:\Windows\Installer\e57b8ff.msi msiexec.exe File opened for modification C:\Windows\Installer\e57b8ff.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{AF58FCFF-3077-44BB-B577-420D504A23AD} msiexec.exe File opened for modification C:\Windows\Installer\MSIBA86.tmp msiexec.exe - Executes dropped EXE 2 IoCs
pid Process 3212 WizardCore.exe 2784 WizardCore.exe - Loads dropped DLL 3 IoCs
pid Process 3212 WizardCore.exe 2784 WizardCore.exe 4876 StrInterface.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4336 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000e610ea5f4b6db8a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000ffffffff0000000027010100008838010e610ea50000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d083020000000000c050e1000000ffffffff000000000700010000e841010e610ea5000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4e30000000000000005000000ffffffff00000000070001000048ea710e610ea500000000000090d4e300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000e610ea500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 4472 msiexec.exe 4472 msiexec.exe 3212 WizardCore.exe 2784 WizardCore.exe 2784 WizardCore.exe 2784 WizardCore.exe 2784 WizardCore.exe 4876 StrInterface.exe 4876 StrInterface.exe 4876 StrInterface.exe 4876 StrInterface.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2784 WizardCore.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4336 msiexec.exe Token: SeIncreaseQuotaPrivilege 4336 msiexec.exe Token: SeSecurityPrivilege 4472 msiexec.exe Token: SeCreateTokenPrivilege 4336 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4336 msiexec.exe Token: SeLockMemoryPrivilege 4336 msiexec.exe Token: SeIncreaseQuotaPrivilege 4336 msiexec.exe Token: SeMachineAccountPrivilege 4336 msiexec.exe Token: SeTcbPrivilege 4336 msiexec.exe Token: SeSecurityPrivilege 4336 msiexec.exe Token: SeTakeOwnershipPrivilege 4336 msiexec.exe Token: SeLoadDriverPrivilege 4336 msiexec.exe Token: SeSystemProfilePrivilege 4336 msiexec.exe Token: SeSystemtimePrivilege 4336 msiexec.exe Token: SeProfSingleProcessPrivilege 4336 msiexec.exe Token: SeIncBasePriorityPrivilege 4336 msiexec.exe Token: SeCreatePagefilePrivilege 4336 msiexec.exe Token: SeCreatePermanentPrivilege 4336 msiexec.exe Token: SeBackupPrivilege 4336 msiexec.exe Token: SeRestorePrivilege 4336 msiexec.exe Token: SeShutdownPrivilege 4336 msiexec.exe Token: SeDebugPrivilege 4336 msiexec.exe Token: SeAuditPrivilege 4336 msiexec.exe Token: SeSystemEnvironmentPrivilege 4336 msiexec.exe Token: SeChangeNotifyPrivilege 4336 msiexec.exe Token: SeRemoteShutdownPrivilege 4336 msiexec.exe Token: SeUndockPrivilege 4336 msiexec.exe Token: SeSyncAgentPrivilege 4336 msiexec.exe Token: SeEnableDelegationPrivilege 4336 msiexec.exe Token: SeManageVolumePrivilege 4336 msiexec.exe Token: SeImpersonatePrivilege 4336 msiexec.exe Token: SeCreateGlobalPrivilege 4336 msiexec.exe Token: SeBackupPrivilege 4408 vssvc.exe Token: SeRestorePrivilege 4408 vssvc.exe Token: SeAuditPrivilege 4408 vssvc.exe Token: SeBackupPrivilege 4472 msiexec.exe Token: SeRestorePrivilege 4472 msiexec.exe Token: SeRestorePrivilege 4472 msiexec.exe Token: SeTakeOwnershipPrivilege 4472 msiexec.exe Token: SeRestorePrivilege 4472 msiexec.exe Token: SeTakeOwnershipPrivilege 4472 msiexec.exe Token: SeRestorePrivilege 4472 msiexec.exe Token: SeTakeOwnershipPrivilege 4472 msiexec.exe Token: SeRestorePrivilege 4472 msiexec.exe Token: SeTakeOwnershipPrivilege 4472 msiexec.exe Token: SeRestorePrivilege 4472 msiexec.exe Token: SeTakeOwnershipPrivilege 4472 msiexec.exe Token: SeRestorePrivilege 4472 msiexec.exe Token: SeTakeOwnershipPrivilege 4472 msiexec.exe Token: SeRestorePrivilege 4472 msiexec.exe Token: SeTakeOwnershipPrivilege 4472 msiexec.exe Token: SeRestorePrivilege 4472 msiexec.exe Token: SeTakeOwnershipPrivilege 4472 msiexec.exe Token: SeRestorePrivilege 4472 msiexec.exe Token: SeTakeOwnershipPrivilege 4472 msiexec.exe Token: SeRestorePrivilege 4472 msiexec.exe Token: SeTakeOwnershipPrivilege 4472 msiexec.exe Token: SeRestorePrivilege 4472 msiexec.exe Token: SeTakeOwnershipPrivilege 4472 msiexec.exe Token: SeRestorePrivilege 4472 msiexec.exe Token: SeTakeOwnershipPrivilege 4472 msiexec.exe Token: SeRestorePrivilege 4472 msiexec.exe Token: SeTakeOwnershipPrivilege 4472 msiexec.exe Token: SeRestorePrivilege 4472 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4336 msiexec.exe 4336 msiexec.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 4472 wrote to memory of 3324 4472 msiexec.exe 90 PID 4472 wrote to memory of 3324 4472 msiexec.exe 90 PID 4472 wrote to memory of 3212 4472 msiexec.exe 92 PID 4472 wrote to memory of 3212 4472 msiexec.exe 92 PID 3212 wrote to memory of 2784 3212 WizardCore.exe 93 PID 3212 wrote to memory of 2784 3212 WizardCore.exe 93 PID 2784 wrote to memory of 4876 2784 WizardCore.exe 95 PID 2784 wrote to memory of 4876 2784 WizardCore.exe 95 PID 2784 wrote to memory of 4876 2784 WizardCore.exe 95 PID 2784 wrote to memory of 4876 2784 WizardCore.exe 95 PID 2784 wrote to memory of 216 2784 WizardCore.exe 97 PID 2784 wrote to memory of 216 2784 WizardCore.exe 97 PID 2784 wrote to memory of 216 2784 WizardCore.exe 97 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Setup.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4336
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3324
-
-
C:\Users\Admin\AppData\Local\Pectolite\WizardCore.exe"C:\Users\Admin\AppData\Local\Pectolite\WizardCore.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\ProgramData\StreammakeXL_4\WizardCore.exeC:\ProgramData\StreammakeXL_4\WizardCore.exe3⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\StrInterface.exeC:\Users\Admin\StrInterface.exe4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4876
-
-
C:\Users\Admin\AppData\Roaming\StreammakeXL_4\XPFix.exe"C:\Users\Admin\AppData\Roaming\StreammakeXL_4\XPFix.exe" "C:\Users\Admin\AppData\Roaming\StreammakeXL_4\XPFix.exe" /u4⤵PID:216
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4408
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e57b900.rbs
- Size 8KB
- SHA256 574097f9df73022b96123e61af27848983b69f4a08170fec7f73b565bfc5b180
- MD5 e10775df015b05f1ed5deff9c9e9250f
- SHA1 146b62c5271cad34702819692298abb02cf8c331
- SHA512 5b1de9273caf56e2c1dc6bca2d1af9162fea8ac6e5d590329ec841560fac4a7ab4ce4e19ae9128e00156d1e029157cffd5ac72dcd7d6f74d942e63e4e411a016
- SSDEEP 96:OwLEQMJFOAlsG34e0IilIimhUiPoDY0CsThqGOUiPoDY0C6jtIi5IiNkThqG5Hx3:Ow7MJFieLaaoDY7IThaoDY7xTiB0Mpm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Pectolite\CCleanerReactivator.dll
- Size 2.2MB
- SHA256 7021a664010f20846bc357a1f0df121ab74819a268a983b42c685e414bac3cb6
- MD5 6f0af9484cc0c61a3f581d0e4ad9a765
- SHA1 ea6ce5adb13de3160d1a5b52cc64ac4e4a33e9bc
- SHA512 ea3734adb623db69b3a8e07767da979498e4ca013dd5cf029579171bf5c3a44024a744763fe580a4032510ec6406449303ac85d62e81cb6035726b6fa647c158
- SSDEEP 49152:Xt5eIYfSYc0ab7PXbO13wGZsQOv+e1cjy0SJm7U:9AIYW0abbO3nZsQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Pectolite\Cieslailjieb.fi
- Size 21KB
- SHA256 bfbd4e58b196f03c716e70df597f83e7ea6dabcf25ad1e0da40a076187edda58
- MD5 7995eb7541e6d62e7a1665b66e8ea690
- SHA1 1f8f01a2893d23d6575fd8c530ff9cdf0494e227
- SHA512 3e7079ef62591eb0194840b40152426251412ceb735b40c0144a6784458dcc7cb18bf4d24af96eecda00671986d387ad508bbeb8040c60cbfbc3ea3a52c43710
- SSDEEP 384:ik24muxOD2uQao4DdwYzJfzC4+1Zs4dl6LEnq2yxRW8D51z:ikT0D50TYztC3s4dl6LEqr1N1z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Pectolite\Eengvougbig.qmi
- Size 2.2MB
- SHA256 d535d7bbd118e075ac1818136eda1eefa4807656ecf80bc5f1c51bb4aae5a154
- MD5 a7991fd65841efceafbefa3569270d52
- SHA1 1adda51a69630f3912d325532fbd73e1d4d13bc9
- SHA512 df976a1cb2320cabc114896c6ab6fedddd99a905f20b3b75ffbacc5409ff9451bf4ebb1d12e3560dbdf89756e968f991292787b1d5e102af3e96abc3c75ba5fd
- SSDEEP 49152:X5sQDLzmh+T37jkLc8bG6rLDN41D/lj5tQCHYWGLP5y67+DWMbv:eQDLzmho3nkLcGG4PNED/Z9ULPMj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Pectolite\WizardCore.exe
- Size 186KB
- SHA256 9c8b68adcc8f1731db50fe129a0c3b2c304e7d7649ded5a599c741ce12917875
- MD5 3f21c2e85d1eebaaf59c0c7018f5d7dd
- SHA1 3b8b209338e0962d4d7433a2abe1f83c5492a6fe
- SHA512 1df74e511d2091811eb8fd7bdb817fee457c6db2a96701ed734b50b48bbd614215312ed7949c5629d453303f72cd389d7ef9c99d70cfac6022c90b04815d5c35
- SSDEEP 3072:7mXmcYjq2z6GUABcEd1ko+Mbkhk5XPKboNDCOSp3CvdHOcJn+UAQBRcZCBV:7mWcKzz6G7BcEd+ob55yqSpwlrJiA2oH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\539BDB2.tmp
- Size 3.0MB
- SHA256 2ebb101ca3634afc07ddd0624e3a5759fee5a1dcad2fbd221579048074d37552
- MD5 c42a712592d36eb3ce750c8c8fe34270
- SHA1 b86dc61ee67b6128e7dee2da5387ee2cde9ce6a6
- SHA512 a869590573b3ec21a4646ab93db8252c367cf4d94bb9374fc8030dad49882cff4269a6bba902ed016b452529ad39075141483ea9b88832992ce5efc45a58851d
- SSDEEP 98304:lEmz3YYvf+i7YlaSWsVvHGC+RFJ7fImUSG:auY42i0l+sVvHG/D5XG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\8DCE3DA.tmp
- Size 40B
- SHA256 e5ced7c0fe47a29e0ba9f399ef50d78f78e4a2cdc06962c2148cf948fc5255f7
- MD5 a33af4a5ce4fb177fb2f7503c9d9c610
- SHA1 95bc7e9d03214d766744915aec4f23f0c13985a0
- SHA512 de8cfccf3c159625c5a5d8793ac4a74ca2d8cd5fc2cf7fc5fe071f913436e5dc8ffa38e253280fe05eab9520cbdba9aea3510d6384eb473f1f94ff046e411012
- MD5 SHA1 SHA512
- Path C:\Users\Admin\StrInterface.exe
- Size 1.3MB
- SHA256 e189e7fe9cd6d63ecece8b8e8fafb773003db6009fb0c45dc2b21e77167938ba
- MD5 2c7bdaebb9e6614d38d5f1a253c24c7d
- SHA1 f8067f9807edbba1518537209b457f271a7a342b
- SHA512 12a3aa719751fdf459bcb6edf72290a9a358b6e782d4b1728e179b8fdeaa9827400935321fbd699349bba0af4477999c9237dfdba16aaa0f04d6258fddc2fc5a
- SSDEEP 24576:JEyXNImAx9NyoFP0gP/4C2bO1qIQP/JPlfg/OXnEm7n:JEydbMyuqIQbfMO0U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\e57b8ff.msi
- Size 2.9MB
- SHA256 ba699da64d44b039defd4f42340bc7bec888b8dcef135d5735f2af309ce8ce72
- MD5 d03145de36a8538aa2120a58e2f1030d
- SHA1 4c8c4b7dbcdc1984355f89ba7fe9d47625192025
- SHA512 f01d5e5598c1661cbe168dd77a96cd8b7b312332ab1fad50ba68228282235f7507dd3d59683c20e30c389dba38929036dafe574f807f3a35f6ceb48afdede4e8
- SSDEEP 49152:cBMntJOMhe50ckXRst4GXdy0lY9Jhjr/KLQixPPHb0bZtLUT81wkUHb0B35H9Skx:e6bOMhwEXRiXN0JQvlYUg1wkSbypHcpc
- MD5 SHA1 SHA512 SSDEEP
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.0MB
- SHA256 e0cda6f22dbd341c77574acab75707896d05a1f0f2a166b91cdd22e150ceafe4
- MD5 d5bc25be5d1c28e9dd7881b0db2bff30
- SHA1 551a0b36c4f13b0366d0d3775c183fee5fcd28ec
- SHA512 238003d52ad41d1c7bc9757829738c3e4ba522fcd9f7b7248b83166c0c2d7d8c26200512d590afa07116e2c9ba0eb972125d76cce71d287e000ae2ebb75cd248
- SSDEEP 24576:iDEmg3XMdoO/vvTL39Pe1Z2RHscayXAZTvIdpTD986aDDWx3Ya8Mq6xkjQ:oV
- MD5 SHA1 SHA512 SSDEEP
- Path \??\Volume{a50e610e-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{bcc5f2e0-baea-4287-ad65-43eb013f24df}_OnDiskSnapshotProp
- Size 6KB
- SHA256 53c681c6ad5e0a2bde002e907c1d857ae1f29ea62b18648243406c73c21a56b1
- MD5 dbce8b896e4c19d2eabc92e1816581ac
- SHA1 26152f0ffe913adf7384cf7f23d8b5719156406d
- SHA512 5323fb6ab45f40d31fb991bbe123b43002d54f982d2ad1d1209b00cedd756598b67d1ff8689c3ccf29bd47a1dacacde702d4adf9d02a4c566c70f965d6ed3bd3
- SSDEEP 96:F8hPxKMFDD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:KV1b++ZVmN
- MD5 SHA1 SHA512 SSDEEP