Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/10/2026, 00:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
quickb.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
quickb.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
General
- Target quickb.msi
- Size 3.5MB
- Sample261013-ap4gnsvsbx
- SHA256 5a9501fc85fb65db7f2afc288d3e1853c6a098bc7149f51fc01bb3b65ddadee6
- MD5 f5de4827c9c3a85418939a3111dcfe4c
- SHA1 6c6fdff54973ebdb305446650d92d9e55415c45c
- SHA512 e014855512912ff6bbf9c6fa624f542b5f5289faeec532b79f4d9c03ba7829650df8e755542228bac5be165b616b1ca209cc5c395ea1c191b08e12a031d3cc75
- SSDEEP 98304:zR5ysZz1CF8FhVrv2peNw7boU7E3gfFM33t5M2Fgw:zmsh1aMVrv2cwQH3txFgw
- TLSH T146F53397B5815FF1C62EF4709CBA560904392F528B24A8E37754B30837FB6B43A722D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
- Executes dropped EXE 1 IoCs
pid Process 1732 uclient.exe - Loads dropped DLL 5 IoCs
pid Process 1732 uclient.exe 1732 uclient.exe 1732 uclient.exe 1732 uclient.exe 1732 uclient.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NetSupport Client = "\"C:\\Users\\Admin\\AppData\\Local\\NetSupport\\NetSupport Manager\\uclient.exe\"" msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe - Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\Installer\e58aeb9.msi msiexec.exe File opened for modification C:\Windows\Installer\e58aeb9.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{525391A5-8242-48B6-AE70-D6C016212D4B} msiexec.exe File opened for modification C:\Windows\Installer\MSIAF94.tmp msiexec.exe File created C:\Windows\Installer\e58aebb.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4100 msiexec.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname uclient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain uclient.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uclient.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e01e56c99d3b8eb00000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e01e56c90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900e01e56c9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ae01e56c9000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de01e56c9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4868 msiexec.exe 4868 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4100 msiexec.exe Token: SeIncreaseQuotaPrivilege 4100 msiexec.exe Token: SeSecurityPrivilege 4868 msiexec.exe Token: SeCreateTokenPrivilege 4100 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4100 msiexec.exe Token: SeLockMemoryPrivilege 4100 msiexec.exe Token: SeIncreaseQuotaPrivilege 4100 msiexec.exe Token: SeMachineAccountPrivilege 4100 msiexec.exe Token: SeTcbPrivilege 4100 msiexec.exe Token: SeSecurityPrivilege 4100 msiexec.exe Token: SeTakeOwnershipPrivilege 4100 msiexec.exe Token: SeLoadDriverPrivilege 4100 msiexec.exe Token: SeSystemProfilePrivilege 4100 msiexec.exe Token: SeSystemtimePrivilege 4100 msiexec.exe Token: SeProfSingleProcessPrivilege 4100 msiexec.exe Token: SeIncBasePriorityPrivilege 4100 msiexec.exe Token: SeCreatePagefilePrivilege 4100 msiexec.exe Token: SeCreatePermanentPrivilege 4100 msiexec.exe Token: SeBackupPrivilege 4100 msiexec.exe Token: SeRestorePrivilege 4100 msiexec.exe Token: SeShutdownPrivilege 4100 msiexec.exe Token: SeDebugPrivilege 4100 msiexec.exe Token: SeAuditPrivilege 4100 msiexec.exe Token: SeSystemEnvironmentPrivilege 4100 msiexec.exe Token: SeChangeNotifyPrivilege 4100 msiexec.exe Token: SeRemoteShutdownPrivilege 4100 msiexec.exe Token: SeUndockPrivilege 4100 msiexec.exe Token: SeSyncAgentPrivilege 4100 msiexec.exe Token: SeEnableDelegationPrivilege 4100 msiexec.exe Token: SeManageVolumePrivilege 4100 msiexec.exe Token: SeImpersonatePrivilege 4100 msiexec.exe Token: SeCreateGlobalPrivilege 4100 msiexec.exe Token: SeBackupPrivilege 404 vssvc.exe Token: SeRestorePrivilege 404 vssvc.exe Token: SeAuditPrivilege 404 vssvc.exe Token: SeBackupPrivilege 4868 msiexec.exe Token: SeRestorePrivilege 4868 msiexec.exe Token: SeRestorePrivilege 4868 msiexec.exe Token: SeTakeOwnershipPrivilege 4868 msiexec.exe Token: SeRestorePrivilege 4868 msiexec.exe Token: SeTakeOwnershipPrivilege 4868 msiexec.exe Token: SeRestorePrivilege 4868 msiexec.exe Token: SeTakeOwnershipPrivilege 4868 msiexec.exe Token: SeRestorePrivilege 4868 msiexec.exe Token: SeTakeOwnershipPrivilege 4868 msiexec.exe Token: SeRestorePrivilege 4868 msiexec.exe Token: SeTakeOwnershipPrivilege 4868 msiexec.exe Token: SeRestorePrivilege 4868 msiexec.exe Token: SeTakeOwnershipPrivilege 4868 msiexec.exe Token: SeRestorePrivilege 4868 msiexec.exe Token: SeTakeOwnershipPrivilege 4868 msiexec.exe Token: SeRestorePrivilege 4868 msiexec.exe Token: SeTakeOwnershipPrivilege 4868 msiexec.exe Token: SeRestorePrivilege 4868 msiexec.exe Token: SeTakeOwnershipPrivilege 4868 msiexec.exe Token: SeRestorePrivilege 4868 msiexec.exe Token: SeTakeOwnershipPrivilege 4868 msiexec.exe Token: SeRestorePrivilege 4868 msiexec.exe Token: SeTakeOwnershipPrivilege 4868 msiexec.exe Token: SeRestorePrivilege 4868 msiexec.exe Token: SeTakeOwnershipPrivilege 4868 msiexec.exe Token: SeRestorePrivilege 4868 msiexec.exe Token: SeTakeOwnershipPrivilege 4868 msiexec.exe Token: SeRestorePrivilege 4868 msiexec.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4100 msiexec.exe 4100 msiexec.exe 1732 uclient.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4868 wrote to memory of 3284 4868 msiexec.exe 105 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\quickb.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4100
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3284
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:404
-
C:\Users\Admin\AppData\Local\NetSupport\NetSupport Manager\uclient.exe"C:\Users\Admin\AppData\Local\NetSupport\NetSupport Manager\uclient.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:1732
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58aeba.rbs
- Size 11KB
- SHA256 a4b97c49234116b5f1acba63c5fbf50543ada4debf1f2ffe2456188388cea61a
- MD5 4c158c02bd6884a8d83be1400a5d830a
- SHA1 dede7f212a1b2af9761d51a9bbfcf7d900f92059
- SHA512 b49fbbe3eb8ae593e565522d739f4b178ac74e9e2e4489db489e9bb0f7760ad205d23286646efbcb20dcf07b154f547f632b22ee3b615d948fb26e1b964099c3
- SSDEEP 96:q3WQTy+3euOXrAahjJjWFudZir3eYx//powGa1YIcROVHJLaNCW1fkI/kIU1U8n8:qGQTISXr4sp+QOUOItUOXzjZLpS
- TLSH T116321301F398D195D43E77B3F6A637D52361F3ABAF8462060A5D863C4E5271CEA4E282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\NetSupport\NetSupport Manager\HTCTL32.DLL
- Size 316KB
- SHA256 6562585009f15155eea9a489e474cebc4dd2a01a26d846fdd1b93fdc24b0c269
- MD5 051cdb6ac8e168d178e35489b6da4c74
- SHA1 38c171457d160f8a6f26baa668f5c302f6c29cd1
- SHA512 602ab9999f7164a2d1704f712d8a622d69148eefe9a380c30bc8b310eadedf846ce6ae7940317437d5da59404d141dc2d1e0c3f954ca4ac7ae3497e56fcb4e36
- SSDEEP 6144:WyspIr8g8imeKk9Fv8TamdF3xuHGAimnx30aaY5nFJl8NjzGrn0J/d3M1OGg:WyspIr8g8i191uzdwHGAimd0bY5FJl85
- TLSH T105646C21BD80C031F2966175C57EDBBA0D6DA430376860DBBBD909F96F686D3663830B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\NetSupport\NetSupport Manager\NSM.LIC
- Size 262B
- SHA256 fcc6afd664a8045bd61c398be3c37a97536a199a48d277e11977f93868ae1acc
- MD5 b9956282a0fed076ed083892e498ac69
- SHA1 d14a665438385203283030a189ff6c5e7c4bf518
- SHA512 7daa09113c0e8a36c91cc6d657c65851a20dff6b60ac3d2f40c5737c12c1613c553955f84d131ba2139959973fef9fc616ca5e968cb16c25acf2d4739eed87eb
- TLSH T18AD02BC991125222425106A16BF0689FA6D5B014CB99BCC5F5E917167D528300A8D05C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\NetSupport\NetSupport Manager\PCICAPI.dll
- Size 106KB
- SHA256 2dfdc169dfc27462adc98dde39306de8d0526dcf4577a1a486c2eef447300689
- MD5 67c53a770390e8c038060a1921c20da9
- SHA1 49e63af91169c8ce7ef7de3d6a6fb9f8f739fa3a
- SHA512 201e07dbccd83480d6c4d8562e6d0a9e4c52ed12895f0b91d875c2bbcc50b3b1802e11e5e829c948be302bf98ebde7fb2a99476065d1709b3bdbcd5d59a1612d
- SSDEEP 1536:LnzOfAUs8aONOb2H4NECHnTXg05rQMb2bbaPrw6BkJElFBIboKKGQ1w:LnSfAB8cb2YN7pSy8AuElFBIboKKGSw
- TLSH T1EFB38D01B192C5B2F5CA497806CB6B774F3D76A17E2450D3AB60D9810E7A7B37B1E20B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\NetSupport\NetSupport Manager\PCICHEK.DLL
- Size 14KB
- SHA256 0cff893b1e7716d09fb74b7a0313b78a09f3f48c586d31fc5f830bd72ce8331f
- MD5 3aabcd7c81425b3b9327a2bf643251c6
- SHA1 ea841199baa7307280fc9e4688ac75e5624f2181
- SHA512 97605b07be34948541462000345f1e8f9a9134d139448d4f331cefeeca6dad51c025fcab09d182b86e5a4a8e2f9412b3745ec86b514b0523497c821cb6b8c592
- SSDEEP 192:uuYr6062b6Z1HVF6RRHXPPr+13fnYe+PjPIrI9FlP4r9ZCspE+TMlr78Vkf:uuYe72u6r+5nYPL7NheMr
- TLSH T1D562F7835BB41015EAE38FB15AF7C2565E36B7916FB4D1EF1190418A2E84FE02E2531B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\NetSupport\NetSupport Manager\PCICL32.dll
- Size 3.3MB
- SHA256 b6d4ad0231941e0637485ac5833e0fdc75db35289b54e70f3858b70d36d04c80
- MD5 e7b92529ea10176fe35ba73fa4edef74
- SHA1 fc5b325d433cde797f6ad0d8b1305d6fb16d4e34
- SHA512 fb3a70e87772c1fb386ad8def6c7bdf325b8d525355d4386102649eb2d61f09ce101fce37ccc1f44d5878e604e2e426d96618e836367ab460cae01f627833517
- SSDEEP 49152:FwWtZSlgPoqxyszApD0Ew0J94KinCgqGBQTdTBOHa3clSToWZiwDA:FwWrSlgHyszApD090mCgqTUSPE9
- TLSH T19EF51832E5048872E1564079DC7D6AEC451A6DA00F1881EF798EF9AD2EF23D533B4F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\NetSupport\NetSupport Manager\client32.ini
- Size 730B
- SHA256 edef082fa6f5cdf747b94fe8357545947d428e94e04054eed6f1e87516e97bcd
- MD5 dd01ea235b24d411d52afd90dcf060e7
- SHA1 5a0d264169b18baff18bc8363a549bd6c63abdcf
- SHA512 9824ee04ea1201a13890bf7799e3646520b9a965a9cd18ad131d7f027b42d6363f4b8ffad7cc459918ca316be66a9c58ca8b42707480dc6fe4314a65c5a12869
- TLSH T19F01D0520D4FED9E2697B242F9B541442FD3C451982DF821A6181D0E9E77A78409E898
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\NetSupport\NetSupport Manager\msvcr100.dll
- Size 755KB
- SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
- MD5 0e37fbfa79d349d672456923ec5fbbe3
- SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
- SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
- SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
- TLSH T1D3F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C1EA277AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\NetSupport\NetSupport Manager\uclient.exe
- Size 33KB
- SHA256 275e5b085534f64313b50cbdcb08ecd59c57d21c96bb937f140ee92a3d27f792
- MD5 5a24676210bd317520fe30d048c9a106
- SHA1 067ddd3fdd5451c2f5bf43b4b316f2165c6c4470
- SHA512 28118405fa8446fd9d8ac37bc5ba26a8696732fa7c19e41aef3da4d049d23b21da1cc0def0a2fb66e2e4fbb0c0147f042ef5492bb537aba7376ba46ebc8f7648
- SSDEEP 192:JXvg84ZVe9LQTsZ98A2QakMnCaJbZToyowJL/8Qpkqs1I1jw+ebCfaFagU:FvwamdkjgZMYJLu1SmbCSRU
- TLSH T1FAF2D503A254A4A1D8954B30F4D3D2F2DE35FE01EF95468731E97EAB3F5B7A11B2110A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e58aebb.msi
- Size 3.5MB
- SHA256 5a9501fc85fb65db7f2afc288d3e1853c6a098bc7149f51fc01bb3b65ddadee6
- MD5 f5de4827c9c3a85418939a3111dcfe4c
- SHA1 6c6fdff54973ebdb305446650d92d9e55415c45c
- SHA512 e014855512912ff6bbf9c6fa624f542b5f5289faeec532b79f4d9c03ba7829650df8e755542228bac5be165b616b1ca209cc5c395ea1c191b08e12a031d3cc75
- SSDEEP 98304:zR5ysZz1CF8FhVrv2peNw7boU7E3gfFM33t5M2Fgw:zmsh1aMVrv2cwQH3txFgw
- TLSH T146F53397B5815FF1C62EF4709CBA560904392F528B24A8E37754B30837FB6B43A722D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 48916744b243d7b5f9c3472ad1a95c2e6c212bcedba72e0e72a11c343e87b7bb
- MD5 166eb49856a7f0c07bee9052276862f2
- SHA1 546156fdaad1cff139b6e26821bde1717bb19ce9
- SHA512 73ec1dff139bb9053180bfa5cc4f3c97ab064e60748f4745b87ae08cde9de9bf9154b6266e3dcaf7e3607816bc93e6a88b81b726f1635ad558aee64a2d76a5cf
- SSDEEP 24576:hu8m+1zPdoO/vvTLb2t+oGqZc0UjVVdSBLGtPic1l0asOqEgIP1UlbGRI:J
- TLSH T11247A3243AF92110E7B79E3C6CF0AA234D3A7D5B9C199E8D45411F4E0921FB0E972F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c9561ee0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{2b9b0b90-f832-49e4-baff-3bc9f355fe93}_OnDiskSnapshotProp
- Size 6KB
- SHA256 8aa6bfe0a347f9b406218a38d822f689a20d4b681575b15ebaffc7e4ad55b0ee
- MD5 e96a1453db6ca7610838d6e2b9012090
- SHA1 3661a39d68d0f42c0bddeafdf505e2555ae8b84e
- SHA512 60d9c5dfb146c8f7af6f18c43b676d54a08004c33a33da4efa2a18d5cd5ce6f25063eb30f22577b7ade5f435485054bae0574686889daa63a0fb18d005b596f3
- SSDEEP 96:FRLqIqvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:ncb++ZVmN
- TLSH T1A5D188085AF54311E2B3AB7229F18557A877B811EF33CB8E0198638E2671A10F935F5F
- MD5 SHA1 SHA512 SSDEEP TLSH