Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
31/05/2026, 12:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
setup_DocusignInstall.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
setup_DocusignInstall.msi
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target setup_DocusignInstall.msi
- Size 8.2MB
- Sample260531-pexcyagv2w
- SHA256 1efd83aeebd71f5c6e6ac28e6d1637ba866399e63b0f3360b1c386a917b5d4ae
- MD5 95b56615a070ac780d4fa98cfd18a22c
- SHA1 c0686e7b68c1a8149bc0a471a5e75a63ea453478
- SHA512 64808b90a6ad496e18a92321277e1a517c8416f6c6a985e8839b24c272b737b0ae62006b359bfddea9f02598ff4bfd0aad707e88a236d8edce98436c142ef59d
- SSDEEP 196608:kW4kavHTZiV06F/Sn8gYasBQNE42hz0O5HyIfR1V:mkavHEV06FfM8z0O5rR1
- TLSH T17D862319BBE408BAE9B74276C4578025EFB2BC4C3761D2AF03A4710D8F36794717AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 1536 msiexec.exe 3 1536 msiexec.exe 4 1484 rundll32.exe - Loads dropped DLL 8 IoCs
pid Process 780 MsiExec.exe 4940 rundll32.exe 4940 rundll32.exe 4940 rundll32.exe 780 MsiExec.exe 1484 rundll32.exe 1484 rundll32.exe 1484 rundll32.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\S: msiexec.exe - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Installer\SFXCAD674AA148845919B009F5AEF43C055C9\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSI1014.tmp msiexec.exe File created C:\Windows\Installer\e590e1f.msi msiexec.exe File opened for modification C:\Windows\Installer\e590e1f.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIF0A.tmp msiexec.exe File opened for modification C:\Windows\Installer\SFXCAD674AA148845919B009F5AEF43C055C9\WixToolset.Dtf.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCABD109FBB894A1CB8A7E1D849AEF4E166\Atera.Agent.Installer.Msi.Ca.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCABD109FBB894A1CB8A7E1D849AEF4E166\WixToolset.Dtf.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCABD109FBB894A1CB8A7E1D849AEF4E166\CustomAction.config rundll32.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\SFXCAD674AA148845919B009F5AEF43C055C9\Atera.Agent.Installer.Msi.Ca.dll rundll32.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1536 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000588ba66725cf3d120000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000588ba6670000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900588ba667000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a588ba667000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d588ba667000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeShutdownPrivilege 1536 msiexec.exe Token: SeIncreaseQuotaPrivilege 1536 msiexec.exe Token: SeSecurityPrivilege 3944 msiexec.exe Token: SeCreateTokenPrivilege 1536 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1536 msiexec.exe Token: SeLockMemoryPrivilege 1536 msiexec.exe Token: SeIncreaseQuotaPrivilege 1536 msiexec.exe Token: SeMachineAccountPrivilege 1536 msiexec.exe Token: SeTcbPrivilege 1536 msiexec.exe Token: SeSecurityPrivilege 1536 msiexec.exe Token: SeTakeOwnershipPrivilege 1536 msiexec.exe Token: SeLoadDriverPrivilege 1536 msiexec.exe Token: SeSystemProfilePrivilege 1536 msiexec.exe Token: SeSystemtimePrivilege 1536 msiexec.exe Token: SeProfSingleProcessPrivilege 1536 msiexec.exe Token: SeIncBasePriorityPrivilege 1536 msiexec.exe Token: SeCreatePagefilePrivilege 1536 msiexec.exe Token: SeCreatePermanentPrivilege 1536 msiexec.exe Token: SeBackupPrivilege 1536 msiexec.exe Token: SeRestorePrivilege 1536 msiexec.exe Token: SeShutdownPrivilege 1536 msiexec.exe Token: SeDebugPrivilege 1536 msiexec.exe Token: SeAuditPrivilege 1536 msiexec.exe Token: SeSystemEnvironmentPrivilege 1536 msiexec.exe Token: SeChangeNotifyPrivilege 1536 msiexec.exe Token: SeRemoteShutdownPrivilege 1536 msiexec.exe Token: SeUndockPrivilege 1536 msiexec.exe Token: SeSyncAgentPrivilege 1536 msiexec.exe Token: SeEnableDelegationPrivilege 1536 msiexec.exe Token: SeManageVolumePrivilege 1536 msiexec.exe Token: SeImpersonatePrivilege 1536 msiexec.exe Token: SeCreateGlobalPrivilege 1536 msiexec.exe Token: SeBackupPrivilege 4300 vssvc.exe Token: SeRestorePrivilege 4300 vssvc.exe Token: SeAuditPrivilege 4300 vssvc.exe Token: SeBackupPrivilege 3944 msiexec.exe Token: SeRestorePrivilege 3944 msiexec.exe Token: SeRestorePrivilege 3944 msiexec.exe Token: SeTakeOwnershipPrivilege 3944 msiexec.exe Token: SeRestorePrivilege 3944 msiexec.exe Token: SeTakeOwnershipPrivilege 3944 msiexec.exe Token: SeDebugPrivilege 4940 rundll32.exe Token: SeRestorePrivilege 3944 msiexec.exe Token: SeTakeOwnershipPrivilege 3944 msiexec.exe Token: SeDebugPrivilege 1484 rundll32.exe Token: SeBackupPrivilege 1564 srtasks.exe Token: SeRestorePrivilege 1564 srtasks.exe Token: SeSecurityPrivilege 1564 srtasks.exe Token: SeTakeOwnershipPrivilege 1564 srtasks.exe Token: SeBackupPrivilege 1564 srtasks.exe Token: SeRestorePrivilege 1564 srtasks.exe Token: SeSecurityPrivilege 1564 srtasks.exe Token: SeTakeOwnershipPrivilege 1564 srtasks.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1536 msiexec.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3944 wrote to memory of 1564 3944 msiexec.exe 84 PID 3944 wrote to memory of 780 3944 msiexec.exe 86 PID 780 wrote to memory of 4940 780 MsiExec.exe 87 PID 780 wrote to memory of 1484 780 MsiExec.exe 88 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup_DocusignInstall.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1536
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:1564
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding D09130A22ECC2811CD53B148966AC6B32⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSIF0A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240717687 2 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.GenerateAgentId3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4940
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI1014.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240717875 6 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.ShouldContinueInstallation3⤵
- Badlisted process makes network request
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1484
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4300
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
- Size 471B
- SHA256 be6f3e7a27aade13538e4700fae68dbcf3b7370a48bab41d06abb3d80b45f5e0
- MD5 0db9d2f79d43267525679fdbf8db94eb
- SHA1 9404acd1ac7b18e36b6ca9e5e5f6a580a8b35165
- SHA512 81cf78cabbee491879af0aec0ebbf0ed0d0a8f93225f50b5a0e9e38e37b57f7db5b5adf89e6927b6c6becb694271465d2853b7337906cdaadfb6109f5e86f76b
- TLSH T1ECF0D4670CE761533D0D0D5C52F96C3564B2188E86CBC1F8343924CB02D15B67107E0E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_6FBFBE34ABAF2109B411B965FB39009E
- Size 727B
- SHA256 7b7a0ba6ecedc7bb1c3145579c5546f4c5dec890517a566c1143942081bc9509
- MD5 b52397fe139a38a6e51e32bf09a69578
- SHA1 4ea4c5583040f2580bdca0122125b4be1fca8c00
- SHA512 7683ff4f97e39f0545d7e367d36430b2b8eed16f89b4eb278a9b69bb3b4412b2d83c1bf2b3194c8a9fa0aca4513d5265da080804d48d8b05824c6b3f09ccfb72
- TLSH T1580115418D84B1D55D3285098BA8A75837C2813415CF194E61B89B45E611B734A0B86A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 727B
- SHA256 e23ab64b253e909188e7281e218829116c97336dc77763a071fc48331000d068
- MD5 ec75dba73c013d56202b6350b6aeddc4
- SHA1 c5ec89ce772d816452548920903b427f605fc45f
- SHA512 9bcc1b484331b9ea9248d3469cb48015a83850607a585bc559a745bb01174ad1341ac2e78a0e20c5ba52bccee3d56dc55faf4bab98333bd6d71e542ad5fc9ac6
- TLSH T1C601449F25FA59807910AE57E7FCB4B4606280CD6DC00316A76278DF10E8AE403BB990
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
- Size 400B
- SHA256 58fd01d7655de77c2fb507bb164b6b636181ee94bdc0e4c1a0ebe7c2de012846
- MD5 38c9cf858428dfdf10d117df76034078
- SHA1 2ea258c2e98f6e1b936e2091e9a76470e1323989
- SHA512 e4027d9f0c5d8d2e014d6f433ba10396a24d68949bf5d001eea61d4fa2a7f279aae1931d2acf6526d28e42bdcd0f2dcb114fb11f69ae96ff76df0f46bd36883e
- TLSH T10CE0C03017FE202EF1A0973402D5C0C99F2BF1032C6052BD0581582DA805D401CB6D38
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_6FBFBE34ABAF2109B411B965FB39009E
- Size 408B
- SHA256 0cc571e5580d45346eaeb79ab285d95e29f43491968da3734e0aed6628881079
- MD5 72d9289d62be511d0967b1dbd803f6a6
- SHA1 020d805d4c300ee72cdcf7c59f4114d672d6d6f9
- SHA512 d2aae79003ee53013933abbd3a1cc5717f8688659f81819363ca6bce7e14c629244c4d0d2768a9a8c083f559009628f3b0513eb509d28346f2332c1cecc07eaf
- TLSH T15CE0C6B832FE818CF0F0E43442F2BC62892AF3031802D77910806382BB11A00ACA2238
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 412B
- SHA256 b2c0dae986ed96a60ae86e1b89f382756e00aba42af8fa98e8ab1c7de8d91173
- MD5 40418857fa169c49ca9baa97935b8860
- SHA1 73effd10a9bdb2ddd5d81c12fe1d950f1404db18
- SHA512 416b3305bd5830210b655832f0f2effa40a3b8fff93a6cbf933f0d8352f6fcffdbae13a712f4a61f4531b5e348b31de9b62849cbde745e62d6cf6530cf0ff02f
- TLSH T16BE0683816AB740EF050C93485F9A0721E49E3011410A67801904709BB07F005C109B4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rundll32.exe.log
- Size 847B
- SHA256 16f4a7736a0c2aee54256d3d75ce4c0816fabf130b3b92340deca34c5f5fda43
- MD5 2940b232afa412901f8ae5651c790f93
- SHA1 f79bd5d1433c803515e2d9a016396344187beea2
- SHA512 553d5491c9bc358c7ce8a95caa445e882ab4bf744a2f5be1b2131c20f27321f65121389fd076558ba415f322fdad6ed36a05902e5c55cbbeace371182890af27
- TLSH T1B6018E722371B2D589163F43194D5B8827FF43197550ED0CB999721ED92A01B6F223F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSIF0A.tmp
- Size 340KB
- SHA256 1997e4959d6c187e9ae35097b4cc0702e8a1564acb1dec7b080adcaa9b973fd0
- MD5 5df8b056b8ad35f9ed4cfff03eeb0e0d
- SHA1 22910bbcbe382bde85770699ba70111ee1472b65
- SHA512 47e17b536b246a97e465426b8a25350e9889c127b54367a3ae491000b7aa9636712e0b5f852d8229966bb9bb7d045e0dc541ea02a1e52d5fa4a515a17336245d
- SSDEEP 6144:apUNpIx1IWpJHOrwIBaiRk7QDQz6VYsSK+kAoXyVk699nsS6:BNp21IWpJkBdk0DQz6QK+kAVv99g
- TLSH T17174BF1977F80DA5FC7B563A89630605E673BC515B70DB9F0360421E9F3B390A93AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCABD109FBB894A1CB8A7E1D849AEF4E166\CustomAction.config
- Size 956B
- SHA256 2dbc73a3bc444a9119c9b5e20276698384d9ad9535a8a7547c44d1b9a8d67346
- MD5 a9088b24614c12b70af6ae9669a4a4b1
- SHA1 d72efa4e0c7bd733ed3d51831ead7031175c27e0
- SHA512 14090969a71b6c80023da29dc8582aded6d26ca349966767ce22102080abce118b846a47ea2b9abe2d5f6a788bc083031d27fdee4103e2e4b99d29c2ac494d7c
- TLSH T10811D00D4A946B7724312793BFACA1C4E76194BA3994411CB49BB9151F39938176338F
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\SFXCABD109FBB894A1CB8A7E1D849AEF4E166\WixToolset.Dtf.WindowsInstaller.dll
- Size 193KB
- SHA256 a614884ea627da1925131ebf41e8ae202caeac0fe543b86384f5eb2bfaf1aa75
- MD5 ef8d5785ac8669f5fd54e22f52770e6b
- SHA1 4c94ae7ef233be33a56c0a5d9b8e2211d5d5792c
- SHA512 ab3b140bd6531f22e994606820e6511442c23d9015b1e1a38aaed43aa42ba29a996511151d0b3a383c05c2b11f670e52cdd7f507ad1a1ad8cebea57fb22ade5a
- SSDEEP 3072:8Of7tVL+l4lj19l4uDHYHj69UgoTqdda7CnfKlRUjW01KytaljYqCDPC:8gQQx54Hj6jomdrzalMqb
- TLSH T14A149C2A57F84B3ECEFF8778E2614252C7B1F1E67103DB1D9D8281A52163784B682397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCAD674AA148845919B009F5AEF43C055C9\Atera.Agent.Installer.Msi.Ca.dll
- Size 59KB
- SHA256 46a2844072f1be835debc683da08d7a37d866c6a4a2b1bff79f9e4bae60d9403
- MD5 c2ab0e13e39d5c93c352eb5e0ab16eae
- SHA1 9bbd3d30ad61be4c6f5d0c9f40132ff3d81130e8
- SHA512 14cd2ec84fbfdf1fc18e1d970e66488e2183bfa60f5ca9f82d6937bafd7e6fa70a16128b39debaae8a2257c0877ced098d67d90745b4d8de29a9720b863ce268
- SSDEEP 768:QUak5eO8oX5qqleywzEVf6zRqbpWJARn9b424nNzTX1W4n1RDvaW:QUderqlew8qbpF9b424nFZW4nbDSW
- TLSH T1B753D44073F84719F6FF2FB87E75555489B3BC676932EA4D1A60104E0AB2B80DA60B73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.6MB
- SHA256 55fcf507254916fb63499323a4c82284686721be0227725a74b152f23103ebaf
- MD5 d13b016703bc852f55be29e71f16c733
- SHA1 d62315064ac65c9a32b00cf084ccd4146a74769a
- SHA512 9b4756af80c208ec7a0f398025a1912bda8cd796062d3aeebeb60950592505a64fbf2ef396fc0a0e6a1e0e6f6770e9501a3fe74776e101313dc4080bce036414
- SSDEEP 24576:T2gmSp15doO/vvTLcW3OhkXafKJ8A4jt22kt3JkH+M64ErjS48mwLqtwx:T
- TLSH T1C047072436F92100E7F79E3CB8F06A27593A7D579C15EE8D05411B8D0922FB1E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{67a68b58-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{5bce1420-5325-4be1-a07f-c1cc789f6339}_OnDiskSnapshotProp
- Size 6KB
- SHA256 84fb120304af16b588bb6577ae21bbe7ff4f985b9426668000319f7e56598944
- MD5 96989b5f7ba3ada36baa2a2a52fb2116
- SHA1 3c040502c0b0156a8cb5e93ce71a471ca1f430c9
- SHA512 8234aeec51e1676aa32812abe607d4394cea3ca9def7b2de1fa64c6d8a1806f71439b77b2ae7b193dc16f9288e5b854f6e2ded3ba207d7fe83d3d8901b5a4813
- SSDEEP 96:FsczVvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:aUb++ZVm
- TLSH T1B2D199185AE54711E2B3AB7128F14557A477B911EF33CB8E0198238E2671A10F935F6F
- MD5 SHA1 SHA512 SSDEEP TLSH