Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/07/2026, 00:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Document.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
Document.msi
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target Document.msi
- Size 8.2MB
- Sample260701-aps1yacy91
- SHA256 494a60d50bb6706086692d1fd2f957dd891a37acb549106052d662130f2d071c
- MD5 7e5348891fd197c26cfc72842fdeee4a
- SHA1 2466596972214eaf4a362a02025d84375e7e4998
- SHA512 083b93abfc846213ca1867eedff947d63ce6c35428818a72dcc89312262cac3c3e1db1d1927260782d049dd1b7b3291a76544593f3c347c653cafe745b9b893c
- SSDEEP 196608:sW+PiNKQW/VGfv3Ebh1Sv8/7iej+7xM1bJDVCTx4:71/oSOh4xMLUTx4
- TLSH T149963329B7D409AAE8778275C8674121EF717C493720DA9F47A4B11C9F3B7A0B5BB302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 5 1300 msiexec.exe 7 1300 msiexec.exe 39 2796 rundll32.exe - Loads dropped DLL 8 IoCs
pid Process 536 MsiExec.exe 4428 rundll32.exe 4428 rundll32.exe 4428 rundll32.exe 536 MsiExec.exe 2796 rundll32.exe 2796 rundll32.exe 2796 rundll32.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e58c176.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIC213.tmp msiexec.exe File opened for modification C:\Windows\Installer\SFXCAB7A91ACACD403ADB09B5196C0FA75A14\Atera.Agent.Installer.Msi.Ca.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCAB7A91ACACD403ADB09B5196C0FA75A14\WixToolset.Dtf.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCAB7A91ACACD403ADB09B5196C0FA75A14\CustomAction.config rundll32.exe File created C:\Windows\Installer\e58c176.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIC417.tmp msiexec.exe File opened for modification C:\Windows\Installer\SFXCAB299C2EFF34FE71A8D17D69302523C5C\Atera.Agent.Installer.Msi.Ca.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCAB299C2EFF34FE71A8D17D69302523C5C\WixToolset.Dtf.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCAB299C2EFF34FE71A8D17D69302523C5C\CustomAction.config rundll32.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1300 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000524fef632b0bf5150000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000524fef630000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900524fef63000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a524fef63000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d524fef63000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeShutdownPrivilege 1300 msiexec.exe Token: SeIncreaseQuotaPrivilege 1300 msiexec.exe Token: SeSecurityPrivilege 824 msiexec.exe Token: SeCreateTokenPrivilege 1300 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1300 msiexec.exe Token: SeLockMemoryPrivilege 1300 msiexec.exe Token: SeIncreaseQuotaPrivilege 1300 msiexec.exe Token: SeMachineAccountPrivilege 1300 msiexec.exe Token: SeTcbPrivilege 1300 msiexec.exe Token: SeSecurityPrivilege 1300 msiexec.exe Token: SeTakeOwnershipPrivilege 1300 msiexec.exe Token: SeLoadDriverPrivilege 1300 msiexec.exe Token: SeSystemProfilePrivilege 1300 msiexec.exe Token: SeSystemtimePrivilege 1300 msiexec.exe Token: SeProfSingleProcessPrivilege 1300 msiexec.exe Token: SeIncBasePriorityPrivilege 1300 msiexec.exe Token: SeCreatePagefilePrivilege 1300 msiexec.exe Token: SeCreatePermanentPrivilege 1300 msiexec.exe Token: SeBackupPrivilege 1300 msiexec.exe Token: SeRestorePrivilege 1300 msiexec.exe Token: SeShutdownPrivilege 1300 msiexec.exe Token: SeDebugPrivilege 1300 msiexec.exe Token: SeAuditPrivilege 1300 msiexec.exe Token: SeSystemEnvironmentPrivilege 1300 msiexec.exe Token: SeChangeNotifyPrivilege 1300 msiexec.exe Token: SeRemoteShutdownPrivilege 1300 msiexec.exe Token: SeUndockPrivilege 1300 msiexec.exe Token: SeSyncAgentPrivilege 1300 msiexec.exe Token: SeEnableDelegationPrivilege 1300 msiexec.exe Token: SeManageVolumePrivilege 1300 msiexec.exe Token: SeImpersonatePrivilege 1300 msiexec.exe Token: SeCreateGlobalPrivilege 1300 msiexec.exe Token: SeBackupPrivilege 4360 vssvc.exe Token: SeRestorePrivilege 4360 vssvc.exe Token: SeAuditPrivilege 4360 vssvc.exe Token: SeBackupPrivilege 824 msiexec.exe Token: SeRestorePrivilege 824 msiexec.exe Token: SeRestorePrivilege 824 msiexec.exe Token: SeTakeOwnershipPrivilege 824 msiexec.exe Token: SeRestorePrivilege 824 msiexec.exe Token: SeTakeOwnershipPrivilege 824 msiexec.exe Token: SeDebugPrivilege 4428 rundll32.exe Token: SeRestorePrivilege 824 msiexec.exe Token: SeTakeOwnershipPrivilege 824 msiexec.exe Token: SeDebugPrivilege 2796 rundll32.exe Token: SeBackupPrivilege 3060 srtasks.exe Token: SeRestorePrivilege 3060 srtasks.exe Token: SeSecurityPrivilege 3060 srtasks.exe Token: SeTakeOwnershipPrivilege 3060 srtasks.exe Token: SeBackupPrivilege 3060 srtasks.exe Token: SeRestorePrivilege 3060 srtasks.exe Token: SeSecurityPrivilege 3060 srtasks.exe Token: SeTakeOwnershipPrivilege 3060 srtasks.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1300 msiexec.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 824 wrote to memory of 3060 824 msiexec.exe 100 PID 824 wrote to memory of 536 824 msiexec.exe 102 PID 536 wrote to memory of 4428 536 MsiExec.exe 103 PID 536 wrote to memory of 2796 536 MsiExec.exe 104 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Document.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1300
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:3060
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding D24EECB3F15B1DCB1ADA4C01F1E765032⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSIC213.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240698046 2 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.GenerateAgentId3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4428
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSIC417.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240698390 6 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.ShouldContinueInstallation3⤵
- Badlisted process makes network request
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2796
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4360
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
- Size 471B
- SHA256 6294d27eaad40cb327b2a467d13e55095d53540b5c5b2c240c427a5bc9e8ed07
- MD5 5067adb0c1ee88c83e868d3829622e21
- SHA1 66d78b69fd2c1cbd1aed5da300ed846789ee863c
- SHA512 beffec7c4e620dcf60d43c49fe00b7217fbe65dc17e3b26121e74b25a5b0617d48ffb0ccc4e475e7c37101d4f70bca17c1fd98814f794b10928e92758aac619e
- TLSH T1C7F0DCFB94A725E2351A582814F88DB634F3658806DA82317476088746972E7120B10A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_6FBFBE34ABAF2109B411B965FB39009E
- Size 727B
- SHA256 3b4bf639e88a16653626c5f8e8b5a7851dfe54fac813917686eb416202b8c7bc
- MD5 9ccc2f4f472395df9f248df7ad1ecab9
- SHA1 9298c64c25e9077a1827c917def30ce78604d321
- SHA512 d71cb2cbf72e1460490f63e9b23687e6aef7d529e6ddf576099568ae43d38f26d56aa31583c2a6ca78dc9343bb7938eb8ada2f88cde936198a4683114fd5d914
- TLSH T1580194A33F388AC471DE44E8782CB7163F80950A2F5F69A8676660C6D344F0F10C94CC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 727B
- SHA256 fd5c4945208e766bd727f9108d4f080d4ede0f28f2f2e41c1d6280f47e8304d1
- MD5 586186370eac5fa0c87f59227ef3f5a8
- SHA1 1e2f9084ccd9e10728567bc41f20748da973d908
- SHA512 7d7988123497d08fb44fa15c82eb36086447ce63c4ccd2cbf38c86d9547222bf8b1ded5a130865d61d8611163cdf1da7d4c1ec8c6ba42c34924a11414c8ccb21
- TLSH T1BC012C5B01B8EC5030261E12EEEC84F2F17FC5A92CDCA68F296B1EC904C8355A203A98
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
- Size 400B
- SHA256 cbfb63ec936969cce46b71f2ea440dab5d073c297b7e09aadc48b3cfd9058d15
- MD5 d90bb7b2e8a29bbac117f21a73e99cba
- SHA1 0f8dd8296718435f5083ec60075f7853cee40f12
- SHA512 f690915fc66ee42250de4be7a6fa36f911f777ae6761f9f59f77db0543071658d54c3099567f162a0299db4333a1be947a472bf84dad55461ed1816453e08676
- TLSH T15FE0C02423FE111FF1B4AFB803D590896F2AF0073C0052BD4D82242D580DF040C92C30
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_6FBFBE34ABAF2109B411B965FB39009E
- Size 408B
- SHA256 563330895976e403eeb7ad6c3cb8ff15bdd10e47a4ebf3f0e191fcaf5d2933eb
- MD5 e7fe7c898a7985d43723104dda2c097b
- SHA1 aae0e45d8d278b9884de4e5fdd2d521615afffd4
- SHA512 9c8e75975cb59b868f0b0cc9194790b2d000350e2a5ce2fbde6d04e6eae78241fa639b018d5df83ae3e9db0808263bf136f7700690f6aee3f20e2f2031c619f5
- TLSH T11EE0C03C31F6419DF0F1D57443F17866945DF30B2401827511903341AB16A40CCE2274
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 412B
- SHA256 f7cc06ddb482a7ce53362f72a413bf8082295654295cc347527811fc28262847
- MD5 99282c243dc60d57b825be0108052120
- SHA1 39d7b07eb09110bce6f39ccc752c7fdc2ae5c915
- SHA512 39a2e18bf158a4b5d96d3418f435692bd87f3304a74cf3a86aa98e76b7f5b7b8d43854a16690c31e433b575b1a8f00117ae3ec5c862e48e306a80e9bfbf7db85
- TLSH T159E0DF2C26EBB52EF490D87546FAA17A1E99E2066404E6B916A14718AB4AE405C20AB4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rundll32.exe.log
- Size 847B
- SHA256 f0ab05c32d6af3c2b559dbce4dec025ce3e730655a2430ade520e89a557cace8
- MD5 66a0a4aa01208ed3d53a5e131a8d030a
- SHA1 ef5312ba2b46b51a4d04b574ca1789ac4ff4a6b1
- SHA512 626f0dcf0c6bcdc0fef25dc7da058003cf929fd9a39a9f447b79fb139a417532a46f8bca1ff2dbde09abfcd70f5fb4f8d059b1fe91977c377df2f5f751c84c5c
- TLSH T193018EB12361F1D589133F461D9C264407FF4728BA50EE1CB5A9625ED9260275F222F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSIC213.tmp
- Size 345KB
- SHA256 a0574813737fe8e23677412214bef4ae410b7eb4dfb09706f2d24cb99aaf5f2c
- MD5 665daf5fbebbdd23080244555069d3d1
- SHA1 7669842fe526034e5e3ba84581ba0281d2b1ce42
- SHA512 ccbd9216d88555941808736aca0ec07f47ba15b0f6c635efd9cfb65dcc6773846672989e643e69cc2c76dc150d25053c9262064f06fe937aa507eadfae72a5e3
- SSDEEP 6144:apUNpIx1IWpJHOrwIBaiRdZi2LsJoKepBC0:BNp21IWpJkBdFoozpBC0
- TLSH T18A74BE1577F809B9FCBB563998630905D6737C515B31CB9F03A0424E9F3B790AA3AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCAB299C2EFF34FE71A8D17D69302523C5C\CustomAction.config
- Size 956B
- SHA256 2dbc73a3bc444a9119c9b5e20276698384d9ad9535a8a7547c44d1b9a8d67346
- MD5 a9088b24614c12b70af6ae9669a4a4b1
- SHA1 d72efa4e0c7bd733ed3d51831ead7031175c27e0
- SHA512 14090969a71b6c80023da29dc8582aded6d26ca349966767ce22102080abce118b846a47ea2b9abe2d5f6a788bc083031d27fdee4103e2e4b99d29c2ac494d7c
- TLSH T10811D00D4A946B7724312793BFACA1C4E76194BA3994411CB49BB9151F39938176338F
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\SFXCAB299C2EFF34FE71A8D17D69302523C5C\WixToolset.Dtf.WindowsInstaller.dll
- Size 193KB
- SHA256 a614884ea627da1925131ebf41e8ae202caeac0fe543b86384f5eb2bfaf1aa75
- MD5 ef8d5785ac8669f5fd54e22f52770e6b
- SHA1 4c94ae7ef233be33a56c0a5d9b8e2211d5d5792c
- SHA512 ab3b140bd6531f22e994606820e6511442c23d9015b1e1a38aaed43aa42ba29a996511151d0b3a383c05c2b11f670e52cdd7f507ad1a1ad8cebea57fb22ade5a
- SSDEEP 3072:8Of7tVL+l4lj19l4uDHYHj69UgoTqdda7CnfKlRUjW01KytaljYqCDPC:8gQQx54Hj6jomdrzalMqb
- TLSH T14A149C2A57F84B3ECEFF8778E2614252C7B1F1E67103DB1D9D8281A52163784B682397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCAB7A91ACACD403ADB09B5196C0FA75A14\Atera.Agent.Installer.Msi.Ca.dll
- Size 71KB
- SHA256 f9284bb2085a89a1462ec562e3e8ac5eca849e42e22bd084d5e7d8904b64e0c8
- MD5 fabcf16e4c1cff13a1a9f6ae03668821
- SHA1 3bccd51b86c238a407cf5b8bd48a3f23e53581cb
- SHA512 52fe3b3a38f86f6484e685f02cbf94796e032d642dac7bcfa5a0cb1c9370fd7b8bf94c530e062e0e5fdbe9011980868653c30a6c2913ba50d93d6d741b824253
- SSDEEP 1536:JK+zKxP9Zmxkwd/ebJOQMGaAOeZ6bFn0OZWDDRM7:JKHNyxIJFOG6b50mWDE
- TLSH T1A263F48177F84629F2FF6F78BD7454044AB3BD166831EA5E1A50205E0A73BC0EA60B77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 ff05199e8936417547132335cdaa8fce1da5cbffe479ee843483683b7835c2d5
- MD5 fba899cfb3fa2217f167d577d5250a30
- SHA1 aac15f89bfa203f3e54a2ea2b643a8163ebeb8bf
- SHA512 93d427cc6114eab58a553763d4340539cc81c76e7bba2f505d4c56fa058ea2fb3c1cbabdb5933f65af5046041f38467b487500071f9243f49505c0026a3cbf66
- SSDEEP 24576:Cu8m+1zTdoO/vvTLrW2ez2qCHvkTel2y6AGt0JXVuUKX+R/r4vFvuw9Bz:+
- TLSH T19E47A42436F92140E7F79F3C68F06A23493A7D6B9C19DE8D45811B4E0921FB1E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{63ef4f52-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{587fb749-0c97-404a-8269-a7cd3b7d41bd}_OnDiskSnapshotProp
- Size 6KB
- SHA256 6fda8c610de30ccbcf21ad21d785e8fa7350d0c742d9141dd341979217f6b39e
- MD5 7a84eae11fa2f6910e5c084281ed48ee
- SHA1 7f2497d285d2eddabc469467d9f9e3c6de851cf5
- SHA512 d443b26d94b6e61a1be8dada9adf12d29cd41714f1e01097f8e885ffbf9a1ba1470cd063b7e0c34a9fca7c28980662f742f1cf6fb18049dc6dd1fa258ea92deb
- SSDEEP 96:F9mcM2vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:Pmeb++ZVm
- TLSH T145D1780C5AE54711E2B3AB3229F14557A477B911EF33CB8E0298238E6670910F876F6B
- MD5 SHA1 SHA512 SSDEEP TLSH