Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/04/2026, 18:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Test.msi
Resource
win10v2004-20260130-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
Test.msi
Resource
win11-20260130-en
windows11-21h2-x64
14 signatures
150 seconds
General
- Target Test.msi
- Size 466KB
- Sample260416-w15d1ab12t
- SHA256 ddf1967721baa3579812474e24d6bac823dd732399a5601bff34945fe1cf4858
- MD5 e5a39566562c12e567781868f6aa64e2
- SHA1 fcd26699d65315f783486cd09cb93929f55a66a7
- SHA512 420ed4b9c0260c3973fabc064d821a8fb8c07faa44d20bc66ae3373053539bc2fbc220f2006bb97b2839089575631bac64d0eb0c49fae74bf3570779c535d6ba
- SSDEEP 6144:QdKYBL1TYVk76YjUSb3hWAOmc4a+rzrCWAS4oh1gWjUgJPACoZ1lwBZp:QYYt1TYl4USbYka+rzrdAxg15B
- TLSH T119A4BF0272D78737E4BF02305B1B57615BB9FC244B71853B62D87A0E2DB07906AA77E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5504 CEPlusWin.exe - Loads dropped DLL 8 IoCs
pid Process 744 MsiExec.exe 744 MsiExec.exe 744 MsiExec.exe 744 MsiExec.exe 744 MsiExec.exe 5740 MsiExec.exe 5740 MsiExec.exe 744 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\ID Cyber Ltd for Cyber Essentials LIVE\CE Plus\CEPlusWin.exe msiexec.exe - Drops file in Windows directory 10 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{A1819618-2FC0-4858-ADCC-462ED9EE03EC} msiexec.exe File created C:\Windows\Installer\e58878c.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI87D8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8856.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI88F4.tmp msiexec.exe File created C:\Windows\Installer\e58878a.msi msiexec.exe File opened for modification C:\Windows\Installer\e58878a.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4740 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEPlusWin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000007d3725990023bfe00000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800007d3725990000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809007d372599000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a7d372599000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d7d372599000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 23 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8169181A0CF28584DACC64E29DEE30CE\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\21F024289EF8BD9498B52EFFFDFA50E8 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8169181A0CF28584DACC64E29DEE30CE\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8169181A0CF28584DACC64E29DEE30CE\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8169181A0CF28584DACC64E29DEE30CE\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8169181A0CF28584DACC64E29DEE30CE msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8169181A0CF28584DACC64E29DEE30CE\MainFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8169181A0CF28584DACC64E29DEE30CE\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8169181A0CF28584DACC64E29DEE30CE\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\21F024289EF8BD9498B52EFFFDFA50E8\8169181A0CF28584DACC64E29DEE30CE msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8169181A0CF28584DACC64E29DEE30CE\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8169181A0CF28584DACC64E29DEE30CE\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8169181A0CF28584DACC64E29DEE30CE\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8169181A0CF28584DACC64E29DEE30CE msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8169181A0CF28584DACC64E29DEE30CE\Language = "2057" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8169181A0CF28584DACC64E29DEE30CE\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8169181A0CF28584DACC64E29DEE30CE\SourceList\PackageName = "Test.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8169181A0CF28584DACC64E29DEE30CE\SourceList\Media msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8169181A0CF28584DACC64E29DEE30CE\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8169181A0CF28584DACC64E29DEE30CE\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8169181A0CF28584DACC64E29DEE30CE\ProductName = "CE Plus" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8169181A0CF28584DACC64E29DEE30CE\PackageCode = "C92FD4C5C7510BB48A85A78515E2703A" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8169181A0CF28584DACC64E29DEE30CE\Version = "16777216" msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5060 msiexec.exe 5060 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4740 msiexec.exe Token: SeIncreaseQuotaPrivilege 4740 msiexec.exe Token: SeSecurityPrivilege 5060 msiexec.exe Token: SeCreateTokenPrivilege 4740 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4740 msiexec.exe Token: SeLockMemoryPrivilege 4740 msiexec.exe Token: SeIncreaseQuotaPrivilege 4740 msiexec.exe Token: SeMachineAccountPrivilege 4740 msiexec.exe Token: SeTcbPrivilege 4740 msiexec.exe Token: SeSecurityPrivilege 4740 msiexec.exe Token: SeTakeOwnershipPrivilege 4740 msiexec.exe Token: SeLoadDriverPrivilege 4740 msiexec.exe Token: SeSystemProfilePrivilege 4740 msiexec.exe Token: SeSystemtimePrivilege 4740 msiexec.exe Token: SeProfSingleProcessPrivilege 4740 msiexec.exe Token: SeIncBasePriorityPrivilege 4740 msiexec.exe Token: SeCreatePagefilePrivilege 4740 msiexec.exe Token: SeCreatePermanentPrivilege 4740 msiexec.exe Token: SeBackupPrivilege 4740 msiexec.exe Token: SeRestorePrivilege 4740 msiexec.exe Token: SeShutdownPrivilege 4740 msiexec.exe Token: SeDebugPrivilege 4740 msiexec.exe Token: SeAuditPrivilege 4740 msiexec.exe Token: SeSystemEnvironmentPrivilege 4740 msiexec.exe Token: SeChangeNotifyPrivilege 4740 msiexec.exe Token: SeRemoteShutdownPrivilege 4740 msiexec.exe Token: SeUndockPrivilege 4740 msiexec.exe Token: SeSyncAgentPrivilege 4740 msiexec.exe Token: SeEnableDelegationPrivilege 4740 msiexec.exe Token: SeManageVolumePrivilege 4740 msiexec.exe Token: SeImpersonatePrivilege 4740 msiexec.exe Token: SeCreateGlobalPrivilege 4740 msiexec.exe Token: SeCreateTokenPrivilege 4740 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4740 msiexec.exe Token: SeLockMemoryPrivilege 4740 msiexec.exe Token: SeIncreaseQuotaPrivilege 4740 msiexec.exe Token: SeMachineAccountPrivilege 4740 msiexec.exe Token: SeTcbPrivilege 4740 msiexec.exe Token: SeSecurityPrivilege 4740 msiexec.exe Token: SeTakeOwnershipPrivilege 4740 msiexec.exe Token: SeLoadDriverPrivilege 4740 msiexec.exe Token: SeSystemProfilePrivilege 4740 msiexec.exe Token: SeSystemtimePrivilege 4740 msiexec.exe Token: SeProfSingleProcessPrivilege 4740 msiexec.exe Token: SeIncBasePriorityPrivilege 4740 msiexec.exe Token: SeCreatePagefilePrivilege 4740 msiexec.exe Token: SeCreatePermanentPrivilege 4740 msiexec.exe Token: SeBackupPrivilege 4740 msiexec.exe Token: SeRestorePrivilege 4740 msiexec.exe Token: SeShutdownPrivilege 4740 msiexec.exe Token: SeDebugPrivilege 4740 msiexec.exe Token: SeAuditPrivilege 4740 msiexec.exe Token: SeSystemEnvironmentPrivilege 4740 msiexec.exe Token: SeChangeNotifyPrivilege 4740 msiexec.exe Token: SeRemoteShutdownPrivilege 4740 msiexec.exe Token: SeUndockPrivilege 4740 msiexec.exe Token: SeSyncAgentPrivilege 4740 msiexec.exe Token: SeEnableDelegationPrivilege 4740 msiexec.exe Token: SeManageVolumePrivilege 4740 msiexec.exe Token: SeImpersonatePrivilege 4740 msiexec.exe Token: SeCreateGlobalPrivilege 4740 msiexec.exe Token: SeCreateTokenPrivilege 4740 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4740 msiexec.exe Token: SeLockMemoryPrivilege 4740 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4740 msiexec.exe 4740 msiexec.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5060 wrote to memory of 744 5060 msiexec.exe 86 PID 5060 wrote to memory of 64 5060 msiexec.exe 93 PID 5060 wrote to memory of 5740 5060 msiexec.exe 95 PID 744 wrote to memory of 5504 744 MsiExec.exe 97 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Test.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4740
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F41AD65EF63E9E29BEC70855E5FDBDA9 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Program Files (x86)\ID Cyber Ltd for Cyber Essentials LIVE\CE Plus\CEPlusWin.exe"C:\Program Files (x86)\ID Cyber Ltd for Cyber Essentials LIVE\CE Plus\CEPlusWin.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5504
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:64
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5EB36B0018B7FE09B21A4B8FE11DD57E2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5740
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:6012
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58878b.rbs
- Size 8KB
- SHA256 c0f1006aaa96240d6d369b4fef448e7f2c0b5673a01833d7016d7cb403371a87
- MD5 0753b11f4303c911ac64bfbac580ebc5
- SHA1 4fb0cd129234eb713fec6e55a5e46fa0f9fe93fc
- SHA512 1b3b1918819451ed9d1fbedd9d72373f4207b3739cb362ffb14edbf25ec86befd31aa1ed22a78228470ff807e6af443335f2d431176a769f3cd037e4113a35b5
- SSDEEP 96:f6P1Jp1+evwtzOpUGaTCpThqqpUGaTC3jOiR+qfThqEHQH5bC/wWWQ5W0cCppljf:f6PBAeuOi1OJ9i1OFmI/B1zppRz
- TLSH T176022002B244C1E2E8629B74C70317523762D6D9E7906B4F58CE91649FD23C86FBE29F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ID Cyber Ltd for Cyber Essentials LIVE\CE Plus\CEPlusWin.exe
- Size 223KB
- SHA256 eed4bb664109dcdb1006d22d41b23b8ae64d9a1960d5e1f6ba02cebea60a9a1d
- MD5 6fde343217ce08fb0bdc2c27b0653682
- SHA1 a92657a8926bce10c096a92007017f3eedab012d
- SHA512 f4d85d39b27a96f30659466fbc67822bd15098afa2275894986bf85e92c2c426b86749dd4c185b33b2f1b2b9ba32cfde3a2f887e2ce86a465adafe0cf7977c4c
- SSDEEP 3072:0XeAo2TBjMh9jJRra9jJRrFzpvE7OVl94ue1ynjMi:0XeAo29WjJejJPdvrl6ne
- TLSH T1DF24E79176045B2BD3C439B49851E0BAF0739C46BB2373E66BC1BE194EB22F1AF416D1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIF7BE.tmp
- Size 242KB
- SHA256 1afddd9333f9d503690449b0bb1079f9e1e6328bba133466a2a91469834ad518
- MD5 ecc2ea125c88d370cfbf7e9b3e8da730
- SHA1 5be848f91b706c1c8dc3c0a0a068b8b1373b6769
- SHA512 9495eaafab088a6c86d8ab6b7999ff1e4a4230b9400509920608284ee5e927e14e1d41ea56e4ae2481d1499254a44ca7236079eb046b5b697c2c1bf1200eff23
- SSDEEP 3072:opE/9SS1TsNISeB7IXrMjU/VZyKK3VTAwEXUKAg0FuboJlEkgsQtpcFuLT4a+rzz:xL1TYVk76YjUSb3hWAOmc4a+rzrCe
- TLSH T1D1348D0035E5C476F1BF1A745B7B97515BBEF8200E31C8AFA3E45D1E4DB0A82AA25732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e58878a.msi
- Size 466KB
- SHA256 ddf1967721baa3579812474e24d6bac823dd732399a5601bff34945fe1cf4858
- MD5 e5a39566562c12e567781868f6aa64e2
- SHA1 fcd26699d65315f783486cd09cb93929f55a66a7
- SHA512 420ed4b9c0260c3973fabc064d821a8fb8c07faa44d20bc66ae3373053539bc2fbc220f2006bb97b2839089575631bac64d0eb0c49fae74bf3570779c535d6ba
- SSDEEP 6144:QdKYBL1TYVk76YjUSb3hWAOmc4a+rzrCWAS4oh1gWjUgJPACoZ1lwBZp:QYYt1TYl4USbYka+rzrdAxg15B
- TLSH T119A4BF0272D78737E4BF02305B1B57615BB9FC244B71853B62D87A0E2DB07906AA77E2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 53e8544ba75dae8b90d442406eda0bc2e25053ffe2ae172c46265cd842fd3a69
- MD5 23fad110ac43675011f58be8e7ee0783
- SHA1 c153863ee08dc9a821c9c1f879b2e9c0ea43b377
- SHA512 88d04a543c2f7933b1f4a7d26f356ade4743cf8b975171262ac1beac2218fbecd4879d6e556119f3dc30da2e3def7066f152bc86a5816953028378c15fd68f73
- SSDEEP 24576:Bu8m+1zadoO/vvTLr2deomap8UkzFltiBrm9vSsll068u6kA4PFUF7WhY:E
- TLSH T17447D82836F92110E7F79E3C78F05A13893A7D579C16DE8D05811B8E0961BB1E872F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{9925377d-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{946df5c6-084b-4848-a37b-7fffd417886c}_OnDiskSnapshotProp
- Size 6KB
- SHA256 e14b1c15041d9958fcbf9167d34c4d0806441a39d43b03516dbf3dd580e06dd1
- MD5 5b03ebc53c8e7e44adb18112ab211258
- SHA1 4c5d4cbd98b531f508001e4de5dc3d64724e3515
- SHA512 0c88f3e04de4651d472c0b2758eda60cd306d6a629d9e92151758cd6b45e1ac10118e2648b57d9af291df7c5225143be75eea881f679eae6800d817646b9aaaf
- SSDEEP 96:FHCJEyrAvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:BCJab++ZVm
- TLSH T10FD19A185AE54311E2F3AB3128F14553A837B911EF33CB8E0198238E6670A14F876F6F
- MD5 SHA1 SHA512 SSDEEP TLSH