Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/06/2026, 00:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
setup_Unassigned.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
setup_Unassigned.msi
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target setup_Unassigned.msi
- Size 8.2MB
- Sample260604-amsbmaf13t
- SHA256 a32103c537d72a55f7572df209daf30caadd8c167c4e37ccc6bba518832a8b13
- MD5 85fa48c737601958e5462734692979c6
- SHA1 736e0e380a784e2af7333f35f50f6424401477bf
- SHA512 7e03a9417a41a94dd655a87a1b0cae9143cb9cba3d18219e5e39fa49f426b79e8609c76ce571da93264746e715fc1cc1f2d6f25bc431dc05b6b4683e19193134
- SSDEEP 196608:DW5kavHTZiV06F/Sn8gYasBQNE42hz0O5HyIfR1V:OkavHEV06FfM8z0O5rR1
- TLSH T1DC862319BBE408BAE9B74276C4578025EFB2BC4C3761D2AF03A4710D8F36794717AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 5076 msiexec.exe 3 5076 msiexec.exe 4 3356 rundll32.exe - Loads dropped DLL 8 IoCs
pid Process 4328 MsiExec.exe 5104 rundll32.exe 5104 rundll32.exe 5104 rundll32.exe 4328 MsiExec.exe 3356 rundll32.exe 3356 rundll32.exe 3356 rundll32.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI78F4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7A0E.tmp msiexec.exe File opened for modification C:\Windows\Installer\SFXCA65DFB6D93B4CA759CBA9336768753745\WixToolset.Dtf.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA65DFB6D93B4CA759CBA9336768753745\CustomAction.config rundll32.exe File created C:\Windows\Installer\e5877fa.msi msiexec.exe File opened for modification C:\Windows\Installer\e5877fa.msi msiexec.exe File opened for modification C:\Windows\Installer\SFXCA941B5B384D437B6BA7D5E81A6F311D75\Atera.Agent.Installer.Msi.Ca.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA941B5B384D437B6BA7D5E81A6F311D75\WixToolset.Dtf.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA941B5B384D437B6BA7D5E81A6F311D75\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\SFXCA65DFB6D93B4CA759CBA9336768753745\Atera.Agent.Installer.Msi.Ca.dll rundll32.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 5076 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000588ba66725cf3d120000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000588ba6670000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900588ba667000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a588ba667000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d588ba667000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeShutdownPrivilege 5076 msiexec.exe Token: SeIncreaseQuotaPrivilege 5076 msiexec.exe Token: SeSecurityPrivilege 2196 msiexec.exe Token: SeCreateTokenPrivilege 5076 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5076 msiexec.exe Token: SeLockMemoryPrivilege 5076 msiexec.exe Token: SeIncreaseQuotaPrivilege 5076 msiexec.exe Token: SeMachineAccountPrivilege 5076 msiexec.exe Token: SeTcbPrivilege 5076 msiexec.exe Token: SeSecurityPrivilege 5076 msiexec.exe Token: SeTakeOwnershipPrivilege 5076 msiexec.exe Token: SeLoadDriverPrivilege 5076 msiexec.exe Token: SeSystemProfilePrivilege 5076 msiexec.exe Token: SeSystemtimePrivilege 5076 msiexec.exe Token: SeProfSingleProcessPrivilege 5076 msiexec.exe Token: SeIncBasePriorityPrivilege 5076 msiexec.exe Token: SeCreatePagefilePrivilege 5076 msiexec.exe Token: SeCreatePermanentPrivilege 5076 msiexec.exe Token: SeBackupPrivilege 5076 msiexec.exe Token: SeRestorePrivilege 5076 msiexec.exe Token: SeShutdownPrivilege 5076 msiexec.exe Token: SeDebugPrivilege 5076 msiexec.exe Token: SeAuditPrivilege 5076 msiexec.exe Token: SeSystemEnvironmentPrivilege 5076 msiexec.exe Token: SeChangeNotifyPrivilege 5076 msiexec.exe Token: SeRemoteShutdownPrivilege 5076 msiexec.exe Token: SeUndockPrivilege 5076 msiexec.exe Token: SeSyncAgentPrivilege 5076 msiexec.exe Token: SeEnableDelegationPrivilege 5076 msiexec.exe Token: SeManageVolumePrivilege 5076 msiexec.exe Token: SeImpersonatePrivilege 5076 msiexec.exe Token: SeCreateGlobalPrivilege 5076 msiexec.exe Token: SeBackupPrivilege 2460 vssvc.exe Token: SeRestorePrivilege 2460 vssvc.exe Token: SeAuditPrivilege 2460 vssvc.exe Token: SeBackupPrivilege 2196 msiexec.exe Token: SeRestorePrivilege 2196 msiexec.exe Token: SeRestorePrivilege 2196 msiexec.exe Token: SeTakeOwnershipPrivilege 2196 msiexec.exe Token: SeRestorePrivilege 2196 msiexec.exe Token: SeTakeOwnershipPrivilege 2196 msiexec.exe Token: SeDebugPrivilege 5104 rundll32.exe Token: SeBackupPrivilege 5112 srtasks.exe Token: SeRestorePrivilege 5112 srtasks.exe Token: SeSecurityPrivilege 5112 srtasks.exe Token: SeTakeOwnershipPrivilege 5112 srtasks.exe Token: SeRestorePrivilege 2196 msiexec.exe Token: SeTakeOwnershipPrivilege 2196 msiexec.exe Token: SeDebugPrivilege 3356 rundll32.exe Token: SeBackupPrivilege 5112 srtasks.exe Token: SeRestorePrivilege 5112 srtasks.exe Token: SeSecurityPrivilege 5112 srtasks.exe Token: SeTakeOwnershipPrivilege 5112 srtasks.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5076 msiexec.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2196 wrote to memory of 5112 2196 msiexec.exe 84 PID 2196 wrote to memory of 4328 2196 msiexec.exe 86 PID 4328 wrote to memory of 5104 4328 MsiExec.exe 87 PID 4328 wrote to memory of 3356 4328 MsiExec.exe 88 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup_Unassigned.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5076
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:5112
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding CD08654A3641A62445D8766A1D22E7452⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI78F4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240679250 2 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.GenerateAgentId3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5104
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI7A0E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240679453 6 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.ShouldContinueInstallation3⤵
- Badlisted process makes network request
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3356
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2460
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
- Size 471B
- SHA256 4e593ca0dc9f3fcf33df5720194918f4c81e5c6798437b076a65618e986a6dcb
- MD5 e9743edc82be4033b4c5c43235298fc7
- SHA1 e47e6345ae0006095d24f0c3766790ce45d14c80
- SHA512 c18dc0a36b7b0078e2b06ff2490b00866b9cfb36d764b1062e00dc58708b1adf0961abd6ab2a682eec794443e53ab307039de297fc2a00189bd2c1f309af44a3
- TLSH T169F0D45F1897F0523E25A03C13F4DC2325E0D40E89C351731C3458D8CB6E690318F417
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_6FBFBE34ABAF2109B411B965FB39009E
- Size 727B
- SHA256 cbecae06db08d487e7c79cfa107369693f8b89ffff4a8e3deb6d29959d73aa64
- MD5 41568a92cff3f6b178622d1d1ae5ffad
- SHA1 3f7f40c71a1f63653b1dbe362f17d5a821ee51c7
- SHA512 0f096b42552b9c290950e45d230a40f786c409f096626b50a48761d57e5aba9eea50cf52a782f1280727354de10a84cc9b8069ed459155facb209e526249cfab
- TLSH T1D301602F3F68D60667478C05AFE88BBAB6A1D96236492B1F522A018042C16284B208B9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 727B
- SHA256 4b642558ead3bb575c3ccd601c655effbe506e5434a5afa0c3accab7b7ef1005
- MD5 26f2b7b44c8411b5134400f1c1b6e161
- SHA1 fc80ba8cce26e54cc754f3feefcb2b062f4f1525
- SHA512 1b34c1feb56cc03bd13e1b8a14dc19d7f94c7ce822806ff7d164a33f58bb766b5cba96437096042254db119fc4d717d4524ec63034a543a9ff09edabd24b8bbb
- TLSH T1BB01657788F89B6034420600A7ADF6A03D6CD5A55CD54B0938F0088B629853EFA179B0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
- Size 400B
- SHA256 b42192f9ce4ca72cc9238115f6efde45e6f26764647f796d8f376667b7f3cc18
- MD5 3be7f1dd51f37eb278e2b2b9408dcd8e
- SHA1 70410a1d382f2d0fbda6ce8db5d94494ae608cf7
- SHA512 cedef22f9b57717dfdd4a5fbc2abf2d83b71e5ceb9337f00ed7ce505ada8a96d26ff66f21aeb29cc448404653a1f7c7f57bee5ff6acac210af0be0703ff83576
- TLSH T19EE0203417FE201EF1749B7803D5D0D5AB2AF1462CA667BE1891141DF516E005C96E35
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_6FBFBE34ABAF2109B411B965FB39009E
- Size 408B
- SHA256 73c5e9d59ac7682fcad8d8e531c805e5c1e9de7807448f50264c60faeb6b267c
- MD5 9a2c74876fbfd8806b613491edad1bdf
- SHA1 b6e189825e68b720af5443cfb76384e6d9820ce5
- SHA512 796c43dae79f6d7da97ad562eb7771e494622016aa2488dab2a35e23b912443238602a6c3f01d5c2e0fcb85665847489e5866e0763e83d437f3fe9a40d5e8ab7
- TLSH T16CE0C03431F9454DF0F0D53441F2BD23941EF3170456836410901743B721A404CA5234
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 412B
- SHA256 a8283f94836645738f4d839ca09f1a724f4046a9336cf2e0bb7b08317ef67a78
- MD5 0a824365ebf65ab7260eab901a90835b
- SHA1 34d227ffdb06c76d0e7c6cd4ab69c900de32f273
- SHA512 7bcbaa78bf3263a16c43fda996cebc695046f92e93284e2a6730f8312a4dc9f2d2e3876b670b5058130ccdc0183a10c25c3c0fe96dc830b9c55172e69b54b377
- TLSH T12CE0683C15EF600EF0609D3446F6F0712AA9E3021010D37901808709F703F004C51EB0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rundll32.exe.log
- Size 847B
- SHA256 16f4a7736a0c2aee54256d3d75ce4c0816fabf130b3b92340deca34c5f5fda43
- MD5 2940b232afa412901f8ae5651c790f93
- SHA1 f79bd5d1433c803515e2d9a016396344187beea2
- SHA512 553d5491c9bc358c7ce8a95caa445e882ab4bf744a2f5be1b2131c20f27321f65121389fd076558ba415f322fdad6ed36a05902e5c55cbbeace371182890af27
- TLSH T1B6018E722371B2D589163F43194D5B8827FF43197550ED0CB999721ED92A01B6F223F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSI78F4.tmp
- Size 340KB
- SHA256 1997e4959d6c187e9ae35097b4cc0702e8a1564acb1dec7b080adcaa9b973fd0
- MD5 5df8b056b8ad35f9ed4cfff03eeb0e0d
- SHA1 22910bbcbe382bde85770699ba70111ee1472b65
- SHA512 47e17b536b246a97e465426b8a25350e9889c127b54367a3ae491000b7aa9636712e0b5f852d8229966bb9bb7d045e0dc541ea02a1e52d5fa4a515a17336245d
- SSDEEP 6144:apUNpIx1IWpJHOrwIBaiRk7QDQz6VYsSK+kAoXyVk699nsS6:BNp21IWpJkBdk0DQz6QK+kAVv99g
- TLSH T17174BF1977F80DA5FC7B563A89630605E673BC515B70DB9F0360421E9F3B390A93AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCA65DFB6D93B4CA759CBA9336768753745\CustomAction.config
- Size 956B
- SHA256 2dbc73a3bc444a9119c9b5e20276698384d9ad9535a8a7547c44d1b9a8d67346
- MD5 a9088b24614c12b70af6ae9669a4a4b1
- SHA1 d72efa4e0c7bd733ed3d51831ead7031175c27e0
- SHA512 14090969a71b6c80023da29dc8582aded6d26ca349966767ce22102080abce118b846a47ea2b9abe2d5f6a788bc083031d27fdee4103e2e4b99d29c2ac494d7c
- TLSH T10811D00D4A946B7724312793BFACA1C4E76194BA3994411CB49BB9151F39938176338F
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\SFXCA65DFB6D93B4CA759CBA9336768753745\WixToolset.Dtf.WindowsInstaller.dll
- Size 193KB
- SHA256 a614884ea627da1925131ebf41e8ae202caeac0fe543b86384f5eb2bfaf1aa75
- MD5 ef8d5785ac8669f5fd54e22f52770e6b
- SHA1 4c94ae7ef233be33a56c0a5d9b8e2211d5d5792c
- SHA512 ab3b140bd6531f22e994606820e6511442c23d9015b1e1a38aaed43aa42ba29a996511151d0b3a383c05c2b11f670e52cdd7f507ad1a1ad8cebea57fb22ade5a
- SSDEEP 3072:8Of7tVL+l4lj19l4uDHYHj69UgoTqdda7CnfKlRUjW01KytaljYqCDPC:8gQQx54Hj6jomdrzalMqb
- TLSH T14A149C2A57F84B3ECEFF8778E2614252C7B1F1E67103DB1D9D8281A52163784B682397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCA941B5B384D437B6BA7D5E81A6F311D75\Atera.Agent.Installer.Msi.Ca.dll
- Size 59KB
- SHA256 46a2844072f1be835debc683da08d7a37d866c6a4a2b1bff79f9e4bae60d9403
- MD5 c2ab0e13e39d5c93c352eb5e0ab16eae
- SHA1 9bbd3d30ad61be4c6f5d0c9f40132ff3d81130e8
- SHA512 14cd2ec84fbfdf1fc18e1d970e66488e2183bfa60f5ca9f82d6937bafd7e6fa70a16128b39debaae8a2257c0877ced098d67d90745b4d8de29a9720b863ce268
- SSDEEP 768:QUak5eO8oX5qqleywzEVf6zRqbpWJARn9b424nNzTX1W4n1RDvaW:QUderqlew8qbpF9b424nFZW4nbDSW
- TLSH T1B753D44073F84719F6FF2FB87E75555489B3BC676932EA4D1A60104E0AB2B80DA60B73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.6MB
- SHA256 3f787db2eada8b508c0764d8c59e56abae72f926833ddf72c211192f3cf93f5b
- MD5 96e5e39fcfcb2394c33b88c3edda69c4
- SHA1 4ee49ef147bb349ad380c9176a5b7afa5858a74a
- SHA512 d814e8df70eca303d5817a31414e73f5a7a03445dec459e936d2694dec1a1078692cd4f16e30bb601f03187318d21df18decff248c3ace524a4fff00302a5b69
- SSDEEP 24576:F2gmSp1JdoO/vvTLcW3OhkXafKJ8A4jt22kt3JkH+M64ErjS48mwLqtwx:9
- TLSH T1B947072436F92100E7F79E3CB8F06A27593A7D579C15EE8D05411B8D0922FB1E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{67a68b58-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{8394216d-f696-417e-a45b-2957dabc7d63}_OnDiskSnapshotProp
- Size 6KB
- SHA256 bae353efd4e1d88ac1f788e2a65c56956385950d92ad27b028837e29c91f0a60
- MD5 57d83fdb59a11174d5b27a65ab8b2098
- SHA1 9a7a086b086d7bbde0f990b6fcbc66306b1ba054
- SHA512 d8f9224a621a1ed6d92e6b6ddac4a0f66a3c43fe7b68daeabc2463921645b38b025a26e20ae9766629fdd30e6791bc9361a9d7fe208d0642b1d6d002061ca5d8
- SSDEEP 96:Fycz/vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:wub++ZVm
- TLSH T1F7D199085AF54311E2B3AB3228F18557A437B911EF33CB8E0198238E6671A10F875F6F
- MD5 SHA1 SHA512 SSDEEP TLSH