Analysis
- max time kernel
268s - max time network
254s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system - submitted
27/10/2025, 14:29
Static task
static1
Behavioral task
behavioral1
Sample
Setup.msi
Resource
win10v2004-20251016-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
Setup.msi
Resource
win10ltsc2021-20251017-en
windows10-ltsc_2021-x64
19 signatures
150 seconds
Behavioral task
behavioral3
Sample
Setup.msi
Resource
win11-20251015-en
windows11-21h2-x64
19 signatures
150 seconds
General
- Target Setup.msi
- Size 2.9MB
- Sample251027-rtlk4axqft
- SHA256 ba699da64d44b039defd4f42340bc7bec888b8dcef135d5735f2af309ce8ce72
- MD5 d03145de36a8538aa2120a58e2f1030d
- SHA1 4c8c4b7dbcdc1984355f89ba7fe9d47625192025
- SHA512 f01d5e5598c1661cbe168dd77a96cd8b7b312332ab1fad50ba68228282235f7507dd3d59683c20e30c389dba38929036dafe574f807f3a35f6ceb48afdede4e8
- SSDEEP 49152:cBMntJOMhe50ckXRst4GXdy0lY9Jhjr/KLQixPPHb0bZtLUT81wkUHb0B35H9Skx:e6bOMhwEXRiXN0JQvlYUg1wkSbypHcpc
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
hijackloader
Attributes
-
directory
%APPDATA%\StreammakeXL_4
-
inject_dll
%windir%\SysWOW64\pla.dll
xor.hex
Signatures
- Detects HijackLoader (aka IDAT Loader) 1 IoCs
resource yara_rule behavioral3/files/0x001900000002b0ef-28.dat family_hijackloader - HijackLoader
HijackLoader is a multistage loader first seen in 2023.
- Hijackloader family
- SectopRAT payload 1 IoCs
resource yara_rule behavioral3/memory/2052-56-0x000001A29F490000-0x000001A29F568000-memory.dmp family_sectoprat - Sectoprat family
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4592 set thread context of 2052 4592 WizardCore.exe 86 - Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF2F321046AF9D730D.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIC582.tmp msiexec.exe File created C:\Windows\Installer\e57c4d8.msi msiexec.exe File created C:\Windows\SystemTemp\~DF823929414E6EC00B.TMP msiexec.exe File opened for modification C:\Windows\Installer\e57c4d6.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF92431CFEC2534AC4.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{AF58FCFF-3077-44BB-B577-420D504A23AD} msiexec.exe File created C:\Windows\SystemTemp\~DFE76AD9B9C3D5A1B2.TMP msiexec.exe File created C:\Windows\Installer\e57c4d6.msi msiexec.exe - Executes dropped EXE 2 IoCs
pid Process 4944 WizardCore.exe 4592 WizardCore.exe - Loads dropped DLL 3 IoCs
pid Process 4944 WizardCore.exe 4592 WizardCore.exe 2052 StrInterface.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2076 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000fa5c1b2a8018d2430000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000fa5c1b2a0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900fa5c1b2a000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dfa5c1b2a000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000fa5c1b2a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 4236 msiexec.exe 4236 msiexec.exe 4944 WizardCore.exe 4592 WizardCore.exe 4592 WizardCore.exe 4592 WizardCore.exe 4592 WizardCore.exe 2052 StrInterface.exe 2052 StrInterface.exe 2052 StrInterface.exe 2052 StrInterface.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4592 WizardCore.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2076 msiexec.exe Token: SeIncreaseQuotaPrivilege 2076 msiexec.exe Token: SeSecurityPrivilege 4236 msiexec.exe Token: SeCreateTokenPrivilege 2076 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2076 msiexec.exe Token: SeLockMemoryPrivilege 2076 msiexec.exe Token: SeIncreaseQuotaPrivilege 2076 msiexec.exe Token: SeMachineAccountPrivilege 2076 msiexec.exe Token: SeTcbPrivilege 2076 msiexec.exe Token: SeSecurityPrivilege 2076 msiexec.exe Token: SeTakeOwnershipPrivilege 2076 msiexec.exe Token: SeLoadDriverPrivilege 2076 msiexec.exe Token: SeSystemProfilePrivilege 2076 msiexec.exe Token: SeSystemtimePrivilege 2076 msiexec.exe Token: SeProfSingleProcessPrivilege 2076 msiexec.exe Token: SeIncBasePriorityPrivilege 2076 msiexec.exe Token: SeCreatePagefilePrivilege 2076 msiexec.exe Token: SeCreatePermanentPrivilege 2076 msiexec.exe Token: SeBackupPrivilege 2076 msiexec.exe Token: SeRestorePrivilege 2076 msiexec.exe Token: SeShutdownPrivilege 2076 msiexec.exe Token: SeDebugPrivilege 2076 msiexec.exe Token: SeAuditPrivilege 2076 msiexec.exe Token: SeSystemEnvironmentPrivilege 2076 msiexec.exe Token: SeChangeNotifyPrivilege 2076 msiexec.exe Token: SeRemoteShutdownPrivilege 2076 msiexec.exe Token: SeUndockPrivilege 2076 msiexec.exe Token: SeSyncAgentPrivilege 2076 msiexec.exe Token: SeEnableDelegationPrivilege 2076 msiexec.exe Token: SeManageVolumePrivilege 2076 msiexec.exe Token: SeImpersonatePrivilege 2076 msiexec.exe Token: SeCreateGlobalPrivilege 2076 msiexec.exe Token: SeBackupPrivilege 2284 vssvc.exe Token: SeRestorePrivilege 2284 vssvc.exe Token: SeAuditPrivilege 2284 vssvc.exe Token: SeBackupPrivilege 4236 msiexec.exe Token: SeRestorePrivilege 4236 msiexec.exe Token: SeRestorePrivilege 4236 msiexec.exe Token: SeTakeOwnershipPrivilege 4236 msiexec.exe Token: SeRestorePrivilege 4236 msiexec.exe Token: SeTakeOwnershipPrivilege 4236 msiexec.exe Token: SeRestorePrivilege 4236 msiexec.exe Token: SeTakeOwnershipPrivilege 4236 msiexec.exe Token: SeRestorePrivilege 4236 msiexec.exe Token: SeTakeOwnershipPrivilege 4236 msiexec.exe Token: SeRestorePrivilege 4236 msiexec.exe Token: SeTakeOwnershipPrivilege 4236 msiexec.exe Token: SeRestorePrivilege 4236 msiexec.exe Token: SeTakeOwnershipPrivilege 4236 msiexec.exe Token: SeRestorePrivilege 4236 msiexec.exe Token: SeTakeOwnershipPrivilege 4236 msiexec.exe Token: SeRestorePrivilege 4236 msiexec.exe Token: SeTakeOwnershipPrivilege 4236 msiexec.exe Token: SeRestorePrivilege 4236 msiexec.exe Token: SeTakeOwnershipPrivilege 4236 msiexec.exe Token: SeRestorePrivilege 4236 msiexec.exe Token: SeTakeOwnershipPrivilege 4236 msiexec.exe Token: SeRestorePrivilege 4236 msiexec.exe Token: SeTakeOwnershipPrivilege 4236 msiexec.exe Token: SeRestorePrivilege 4236 msiexec.exe Token: SeTakeOwnershipPrivilege 4236 msiexec.exe Token: SeRestorePrivilege 4236 msiexec.exe Token: SeTakeOwnershipPrivilege 4236 msiexec.exe Token: SeRestorePrivilege 4236 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2076 msiexec.exe 2076 msiexec.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 4236 wrote to memory of 4808 4236 msiexec.exe 82 PID 4236 wrote to memory of 4808 4236 msiexec.exe 82 PID 4236 wrote to memory of 4944 4236 msiexec.exe 84 PID 4236 wrote to memory of 4944 4236 msiexec.exe 84 PID 4944 wrote to memory of 4592 4944 WizardCore.exe 85 PID 4944 wrote to memory of 4592 4944 WizardCore.exe 85 PID 4592 wrote to memory of 2052 4592 WizardCore.exe 86 PID 4592 wrote to memory of 2052 4592 WizardCore.exe 86 PID 4592 wrote to memory of 2052 4592 WizardCore.exe 86 PID 4592 wrote to memory of 2052 4592 WizardCore.exe 86 PID 4592 wrote to memory of 2320 4592 WizardCore.exe 87 PID 4592 wrote to memory of 2320 4592 WizardCore.exe 87 PID 4592 wrote to memory of 2320 4592 WizardCore.exe 87 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Setup.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2076
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4808
-
-
C:\Users\Admin\AppData\Local\Pectolite\WizardCore.exe"C:\Users\Admin\AppData\Local\Pectolite\WizardCore.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\ProgramData\StreammakeXL_4\WizardCore.exeC:\ProgramData\StreammakeXL_4\WizardCore.exe3⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\StrInterface.exeC:\Users\Admin\StrInterface.exe4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2052
-
-
C:\Users\Admin\AppData\Roaming\StreammakeXL_4\XPFix.exe"C:\Users\Admin\AppData\Roaming\StreammakeXL_4\XPFix.exe" "C:\Users\Admin\AppData\Roaming\StreammakeXL_4\XPFix.exe" /u4⤵PID:2320
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2284
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e57c4d7.rbs
- Size 8KB
- SHA256 fb915dd207b029007c3031ee38e4cb5ce29ee080ddd9f5f48bd0e91791027c59
- MD5 4dfbe76b83a2db656440a835dbe9e43b
- SHA1 fb77035fab38b8e90eca36f6e7163558c647c734
- SHA512 c85a40044c1622683ee4757581b31f8c66a401655f146cb2d4a9bf974e03dd3394cd29f8bd321a3a5d06b6375adf57cb55dce20235695ce368d731b9fe5f8c9c
- SSDEEP 96:OwLdQMJFMOlsG3pCP+u+mhUiPoDY0CsThqGOUiPoDY0C6jL+X+NkThqG5HBM5+uy:OweMJFFCvaaoDY7IThaoDY7jTUk0Mpb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Pectolite\CCleanerReactivator.dll
- Size 2.2MB
- SHA256 7021a664010f20846bc357a1f0df121ab74819a268a983b42c685e414bac3cb6
- MD5 6f0af9484cc0c61a3f581d0e4ad9a765
- SHA1 ea6ce5adb13de3160d1a5b52cc64ac4e4a33e9bc
- SHA512 ea3734adb623db69b3a8e07767da979498e4ca013dd5cf029579171bf5c3a44024a744763fe580a4032510ec6406449303ac85d62e81cb6035726b6fa647c158
- SSDEEP 49152:Xt5eIYfSYc0ab7PXbO13wGZsQOv+e1cjy0SJm7U:9AIYW0abbO3nZsQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Pectolite\Cieslailjieb.fi
- Size 21KB
- SHA256 bfbd4e58b196f03c716e70df597f83e7ea6dabcf25ad1e0da40a076187edda58
- MD5 7995eb7541e6d62e7a1665b66e8ea690
- SHA1 1f8f01a2893d23d6575fd8c530ff9cdf0494e227
- SHA512 3e7079ef62591eb0194840b40152426251412ceb735b40c0144a6784458dcc7cb18bf4d24af96eecda00671986d387ad508bbeb8040c60cbfbc3ea3a52c43710
- SSDEEP 384:ik24muxOD2uQao4DdwYzJfzC4+1Zs4dl6LEnq2yxRW8D51z:ikT0D50TYztC3s4dl6LEqr1N1z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Pectolite\Eengvougbig.qmi
- Size 2.2MB
- SHA256 d535d7bbd118e075ac1818136eda1eefa4807656ecf80bc5f1c51bb4aae5a154
- MD5 a7991fd65841efceafbefa3569270d52
- SHA1 1adda51a69630f3912d325532fbd73e1d4d13bc9
- SHA512 df976a1cb2320cabc114896c6ab6fedddd99a905f20b3b75ffbacc5409ff9451bf4ebb1d12e3560dbdf89756e968f991292787b1d5e102af3e96abc3c75ba5fd
- SSDEEP 49152:X5sQDLzmh+T37jkLc8bG6rLDN41D/lj5tQCHYWGLP5y67+DWMbv:eQDLzmho3nkLcGG4PNED/Z9ULPMj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Pectolite\WizardCore.exe
- Size 186KB
- SHA256 9c8b68adcc8f1731db50fe129a0c3b2c304e7d7649ded5a599c741ce12917875
- MD5 3f21c2e85d1eebaaf59c0c7018f5d7dd
- SHA1 3b8b209338e0962d4d7433a2abe1f83c5492a6fe
- SHA512 1df74e511d2091811eb8fd7bdb817fee457c6db2a96701ed734b50b48bbd614215312ed7949c5629d453303f72cd389d7ef9c99d70cfac6022c90b04815d5c35
- SSDEEP 3072:7mXmcYjq2z6GUABcEd1ko+Mbkhk5XPKboNDCOSp3CvdHOcJn+UAQBRcZCBV:7mWcKzz6G7BcEd+ob55yqSpwlrJiA2oH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\234C8DE.tmp
- Size 3.0MB
- SHA256 18710858fcae3f846439e0eb0dfbb92c9fb5e8fcf67b546bae1e1c193a2cd893
- MD5 5de0bc2d3377cabb0797d27b3e8b1b40
- SHA1 76887e7d356b784e805f285724f38e59bc2792bc
- SHA512 4d164939cc92bf4606b3ae1e86d11c6b36095c85beafdd01eec50b0e6aea44d07c709564e0066dde8db9a23fbd70e9673d6357ca65f8b6a6ff99112e65c924e7
- SSDEEP 49152:9e+URiqf/CUwAjqyIGFLpEHU1Udl2FIHCo7ZnbA2iqqdZpZ/WdiDIFTDoh:G5fBqyM0ejdBpPBqdZUiDKQh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\5FAF06D.tmp
- Size 40B
- SHA256 58aca8b53ecbcde8d7606d42043180a9b94e8df064aa76a2381ab10bc52ade70
- MD5 9be686e34133acc4dc9c5f4573d5db0d
- SHA1 6b2a73b87718396b1c7578bec8794e7deca6a26f
- SHA512 b11ea1361c0a51964205c46acb72681b49ce1cb325a3db3d05a0026e460afcd544b3d0065cfe15a863664facf320d72be5cb011684eb90012dc6c61d246145d5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\StrInterface.exe
- Size 1.3MB
- SHA256 e189e7fe9cd6d63ecece8b8e8fafb773003db6009fb0c45dc2b21e77167938ba
- MD5 2c7bdaebb9e6614d38d5f1a253c24c7d
- SHA1 f8067f9807edbba1518537209b457f271a7a342b
- SHA512 12a3aa719751fdf459bcb6edf72290a9a358b6e782d4b1728e179b8fdeaa9827400935321fbd699349bba0af4477999c9237dfdba16aaa0f04d6258fddc2fc5a
- SSDEEP 24576:JEyXNImAx9NyoFP0gP/4C2bO1qIQP/JPlfg/OXnEm7n:JEydbMyuqIQbfMO0U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\e57c4d6.msi
- Size 2.9MB
- SHA256 ba699da64d44b039defd4f42340bc7bec888b8dcef135d5735f2af309ce8ce72
- MD5 d03145de36a8538aa2120a58e2f1030d
- SHA1 4c8c4b7dbcdc1984355f89ba7fe9d47625192025
- SHA512 f01d5e5598c1661cbe168dd77a96cd8b7b312332ab1fad50ba68228282235f7507dd3d59683c20e30c389dba38929036dafe574f807f3a35f6ceb48afdede4e8
- SSDEEP 49152:cBMntJOMhe50ckXRst4GXdy0lY9Jhjr/KLQixPPHb0bZtLUT81wkUHb0B35H9Skx:e6bOMhwEXRiXN0JQvlYUg1wkSbypHcpc
- MD5 SHA1 SHA512 SSDEEP
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.6MB
- SHA256 dd59100cfd05145443b91b91e0b2200616793cf1f9f5751c8ddeaaf9b66df738
- MD5 31131c10e5b40eeff5a0b9908fab253e
- SHA1 958bf7f072e9613c06ba6dbe04deb441ab6a0f0c
- SHA512 94bf96679680e342af71781ae408cf28314ccb7628b92ca41e498209f9303ea5b31f7df403006f4320d6d8d01174a4f2d51c57947c5941392d9bf504fdbcbb05
- SSDEEP 24576:dZ1mSpt4doO/vvTLMWHeBUXaf6V/wYjtWGUNHZ03ecq4EbDC4MGK7rtwb:e
- MD5 SHA1 SHA512 SSDEEP
- Path \??\Volume{2a1b5cfa-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3f10ddd4-1a7f-489a-95ed-51a22117044c}_OnDiskSnapshotProp
- Size 6KB
- SHA256 04aa038bcc8eb75e68e6bcec7e079344e4d39dc1d9a0f266b715e6cdc448e1d7
- MD5 be87362ddfb65e12cf46f67e27e1ae25
- SHA1 1e2022d0899687d0f02c3f2ab3025692497de899
- SHA512 e1fef576c61954ed081f61eef14ea5b07b0906987b7c39fe74776070edc0b30f681e8330baf68d32889e3dde3581aff78c6a43ac6f02e91d8e0b111260ccc283
- SSDEEP 96:FX7hDdl+MFDD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:p73/1b++ZVmN
- MD5 SHA1 SHA512 SSDEEP