Overview
overview
8Static
static
3Agisoft Me...60.rar
windows10-2004-x64
7Agisoft Me...60.rar
windows11-ltsc_2024-x64
8Setup.msi
windows10-2004-x64
7Setup.msi
windows11-ltsc_2024-x64
7iphlpapi.dll
windows10-2004-x64
5iphlpapi.dll
windows11-ltsc_2024-x64
8metashape.lic
windows10-2004-x64
3metashape.lic
windows11-ltsc_2024-x64
3Analysis
- max time kernel
516s - max time network
488s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
14/10/2026, 17:11
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Agisoft Metashape Professional 2.2.2 Build 20760.rar
Resource
win10v2004-20260911-en
windows10-2004-x64
23 signatures
900 seconds
Behavioral task
behavioral2
Sample
Agisoft Metashape Professional 2.2.2 Build 20760.rar
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
900 seconds
Behavioral task
behavioral3
Sample
Setup.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
15 signatures
900 seconds
Behavioral task
behavioral4
Sample
Setup.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
900 seconds
Behavioral task
behavioral5
Sample
iphlpapi.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral6
Sample
iphlpapi.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
900 seconds
Behavioral task
behavioral7
Sample
metashape.lic
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
900 seconds
Behavioral task
behavioral8
Sample
metashape.lic
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
900 seconds
General
- Target Setup.msi
- Size 187.7MB
- Sample261014-vqpp5aws5j
- SHA256 6109dfcf2e4a079d0fc1f3129ceb21e7426ded30cf7c0829bd05d309f9ebb77e
- MD5 9e4f85fc119bbeb16184e09b5df5a2a0
- SHA1 9d182b8b0d6cbee1b4e1e13af5668917c37cefbc
- SHA512 04868bc9b8d63648628ae7d58223f0aa388e7187d914a455b981d765cc08a258aad488669e8ee912eb5e63e46b291362118dda539efceb8be0106ba90909abee
- SSDEEP 3145728:nb3VLHnHn1kJAsjWSCyzRfIJp+ct8/e0l65xlWA4j6dw9n8E3jC67XEIqdtcCbAg:nbFbVKAK4yzRfIJwU8EoA4j6dwt77iN7
- TLSH T1F2983341DE41EC96F5B5823A5332E205CA73FD696786041929B8B21C5C7F7C92EBEC0B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 3244 MsiExec.exe - Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 8 3772 msiexec.exe 11 3772 msiexec.exe 14 3772 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Agisoft\Metashape Pro\python\Doc\library\html.rst msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\debugpy\_vendored\pydevd\_pydev_bundle\pydev_console_utils.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\IPython\core\tests\test_hooks.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\PySide2\Qt5Xml.dll msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\debugpy\_vendored\pydevd\pydevd_attach_to_process\winappdbg\event.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\typeshed\stdlib\3\unittest\signals.pyi msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Include\osdefs.h msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\encodings\cp856.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Tools\scripts\lll.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\tcl\tix8.4.3\demos\samples\ComboBox.tcl msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pythonwin\pywin\idle\AutoExpand.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\typeshed\stdlib\2and3\_bisect.pyi msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\tcl\tcl8.6\tzdata\MST msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Tools\msi\tcltk\tcltk_files.wxs msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\lang\metashape_it.qm msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pip\__init__.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\tcl\tcl8.6\tzdata\Etc\GMT-10 msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pygments\lexers\webmisc.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\typeshed\third_party\3\six\moves\html_parser.pyi msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Doc\library\queue.rst msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\typeshed\third_party\2and3\boto\s3\bucketlogging.pyi msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\licenses\libtiff\license.txt msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\xml\dom\domreg.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pythonwin\pywin\dialogs\__init__.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\win32\test\test_win32file.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\ctypes\test\test_buffers.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pip\_vendor\chardet\euckrprober.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\hatchling\cli\dep\__init__.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\ctypes\test\test_prototypes.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\onnxruntime.dll msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\typeshed\third_party\2and3\werkzeug\middleware\shared_data.pyi msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\typeshed\third_party\3\docutils\parsers\rst\states.pyi msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pip\_vendor\chardet\universaldetector.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\django-stubs\django-stubs\db\migrations\operations\base.pyi msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\tcl\tk8.6\text.tcl msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\tornado\test\ioloop_test.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\IPython\terminal\interactiveshell.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\typeshed\stdlib\2and3\xml\etree\ElementPath.pyi msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\sqlite3\test\__init__.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\tcl\tcl8.6\tzdata\Europe\Nicosia msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\typeshed\third_party\2and3\requests\packages\urllib3\packages\ssl_match_hostname\_implementation.pyi msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\IPython\utils\_process_posix.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\ctypes\test\test_python_api.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\win32\Demos\service\pipeTestServiceClient.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\psutil-5.9.1.dist-info\RECORD msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\typeshed\stdlib\3\posix.pyi msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\venv\scripts\common\activate msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\django-stubs\django-stubs\db\models\utils.pyi msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Tools\msi\exe\exe_reg.wxs msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Doc\contents.rst msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\tcl\tcl8.6\tzdata\Europe\Madrid msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pip\_vendor\urllib3\contrib\securetransport.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Doc\library\asyncio-eventloop.rst msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\crashreporter.ini msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\email\mime\audio.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Tools\msi\core\core_pdb.wixproj msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\debugpy\_vendored\pydevd\_pydevd_frame_eval\vendored\bytecode\concrete.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\licenses\geographiclib\license.txt msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\licenses\qt\license.txt msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\typeshed\stdlib\2\popen2.pyi msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\django-stubs\django-stubs\db\migrations\__init__.pyi msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Tools\peg_generator\pegen\sccutils.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\typeshed\third_party\2and3\paramiko\sftp_server.pyi msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\typeshed\stdlib\2and3\numbers.pyi msiexec.exe - Drops file in Windows directory 40 IoCs
description ioc Process File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\vcruntime140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\SourceHash{298426DB-4948-4D93-9699-F8A208F6DC5D} msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\vcruntime140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\{298426DB-4948-4D93-9699-F8A208F6DC5D}\metashape.ico msiexec.exe File opened for modification C:\Windows\Installer\{298426DB-4948-4D93-9699-F8A208F6DC5D}\metashapepsx.ico msiexec.exe File created C:\Windows\Installer\{298426DB-4948-4D93-9699-F8A208F6DC5D}\viewer.ico msiexec.exe File created C:\Windows\Installer\{298426DB-4948-4D93-9699-F8A208F6DC5D}\monitor.ico msiexec.exe File opened for modification C:\Windows\Installer\{298426DB-4948-4D93-9699-F8A208F6DC5D}\monitor.ico msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\msvcp140_codecvt_ids.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\e596a0d.msi msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\{298426DB-4948-4D93-9699-F8A208F6DC5D}\metashape.ico msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\msvcp140_atomic_wait.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\{298426DB-4948-4D93-9699-F8A208F6DC5D}\metashapepsz.ico msiexec.exe File created C:\Windows\Installer\e596a0b.msi msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\vcomp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\{298426DB-4948-4D93-9699-F8A208F6DC5D}\metashapepsz.ico msiexec.exe File opened for modification C:\Windows\Installer\{298426DB-4948-4D93-9699-F8A208F6DC5D}\viewer.ico msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\msvcp140_atomic_wait.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\msvcp140_codecvt_ids.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\vcomp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\{298426DB-4948-4D93-9699-F8A208F6DC5D}\metashapepsx.ico msiexec.exe File opened for modification C:\Windows\Installer\e596a0b.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI797C.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3772 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000c311d2c4ba4812b50000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000c311d2c40000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900c311d2c4000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ac311d2c4000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dc311d2c4000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe - Modifies registry class 54 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psz\shell\open\command\command = 28002800330045003100450031003f007800400049003100340048005d0062002e003800320046004d006500740061007300680061007000650046006500610074007500720065003e004700300070007d005f0038004800390045004600310062004f0079002d00760030006800600071002000220025003100220000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.psz\ = "Metashape.psz" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psx\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psz\ = "Metashape Archive" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\SourceList\PackageName = "Setup.msi" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psz\shell\open\ = "&Open" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psx\DefaultIcon\ = "C:\\Windows\\Installer\\{298426DB-4948-4D93-9699-F8A208F6DC5D}\\metashapepsx.ico,0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psz\shell msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psx msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psx\shell\open\command\command = 28002800330045003100450031003f007800400049003100340048005d0062002e003800320046004d006500740061007300680061007000650046006500610074007500720065003e004700300070007d005f0038004800390045004600310062004f0079002d00760030006800600071002000220025003100220000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.psx\Metashape.psx msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.psx\ = "Metashape.psx" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psz\DefaultIcon msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BD624892849439D469998F2A806FCDD5\MonitorFeature msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psx\ = "Metashape Project" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BD624892849439D469998F2A806FCDD5\MetashapeFeature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BD624892849439D469998F2A806FCDD5\ViewerFeature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BD624892849439D469998F2A806FCDD5\VCRedist msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D2399D4A622365E41A4E9FC7273D49CB msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psz msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.psx\Metashape.psx\ShellNew msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\Version = "33685506" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D2399D4A622365E41A4E9FC7273D49CB\BD624892849439D469998F2A806FCDD5 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psz\shell\open msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psx\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psz\DefaultIcon\ = "C:\\Windows\\Installer\\{298426DB-4948-4D93-9699-F8A208F6DC5D}\\metashapepsz.ico,0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psx\DefaultIcon msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\ProductName = "Agisoft Metashape Professional" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\PackageCode = "F65D5439C74338741B76223E9ADA1C71" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.psz\Metashape.psz\ShellNew msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.psz msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.psz\Metashape.psz msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psx\shell\open\command\ = "\"C:\\Program Files\\Agisoft\\Metashape Pro\\metashape.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psx\shell\open\ = "&Open" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BD624892849439D469998F2A806FCDD5 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\ProductIcon = "C:\\Windows\\Installer\\{298426DB-4948-4D93-9699-F8A208F6DC5D}\\metashape.ico" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psz\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psz\shell\open\command\ = "\"C:\\Program Files\\Agisoft\\Metashape Pro\\metashape.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psx\shell msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.psx msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\SourceList\Media\1 = ";" msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3524 msiexec.exe 3524 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3772 msiexec.exe Token: SeIncreaseQuotaPrivilege 3772 msiexec.exe Token: SeSecurityPrivilege 3524 msiexec.exe Token: SeCreateTokenPrivilege 3772 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3772 msiexec.exe Token: SeLockMemoryPrivilege 3772 msiexec.exe Token: SeIncreaseQuotaPrivilege 3772 msiexec.exe Token: SeMachineAccountPrivilege 3772 msiexec.exe Token: SeTcbPrivilege 3772 msiexec.exe Token: SeSecurityPrivilege 3772 msiexec.exe Token: SeTakeOwnershipPrivilege 3772 msiexec.exe Token: SeLoadDriverPrivilege 3772 msiexec.exe Token: SeSystemProfilePrivilege 3772 msiexec.exe Token: SeSystemtimePrivilege 3772 msiexec.exe Token: SeProfSingleProcessPrivilege 3772 msiexec.exe Token: SeIncBasePriorityPrivilege 3772 msiexec.exe Token: SeCreatePagefilePrivilege 3772 msiexec.exe Token: SeCreatePermanentPrivilege 3772 msiexec.exe Token: SeBackupPrivilege 3772 msiexec.exe Token: SeRestorePrivilege 3772 msiexec.exe Token: SeShutdownPrivilege 3772 msiexec.exe Token: SeDebugPrivilege 3772 msiexec.exe Token: SeAuditPrivilege 3772 msiexec.exe Token: SeSystemEnvironmentPrivilege 3772 msiexec.exe Token: SeChangeNotifyPrivilege 3772 msiexec.exe Token: SeRemoteShutdownPrivilege 3772 msiexec.exe Token: SeUndockPrivilege 3772 msiexec.exe Token: SeSyncAgentPrivilege 3772 msiexec.exe Token: SeEnableDelegationPrivilege 3772 msiexec.exe Token: SeManageVolumePrivilege 3772 msiexec.exe Token: SeImpersonatePrivilege 3772 msiexec.exe Token: SeCreateGlobalPrivilege 3772 msiexec.exe Token: SeCreateTokenPrivilege 3772 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3772 msiexec.exe Token: SeLockMemoryPrivilege 3772 msiexec.exe Token: SeIncreaseQuotaPrivilege 3772 msiexec.exe Token: SeMachineAccountPrivilege 3772 msiexec.exe Token: SeTcbPrivilege 3772 msiexec.exe Token: SeSecurityPrivilege 3772 msiexec.exe Token: SeTakeOwnershipPrivilege 3772 msiexec.exe Token: SeLoadDriverPrivilege 3772 msiexec.exe Token: SeSystemProfilePrivilege 3772 msiexec.exe Token: SeSystemtimePrivilege 3772 msiexec.exe Token: SeProfSingleProcessPrivilege 3772 msiexec.exe Token: SeIncBasePriorityPrivilege 3772 msiexec.exe Token: SeCreatePagefilePrivilege 3772 msiexec.exe Token: SeCreatePermanentPrivilege 3772 msiexec.exe Token: SeBackupPrivilege 3772 msiexec.exe Token: SeRestorePrivilege 3772 msiexec.exe Token: SeShutdownPrivilege 3772 msiexec.exe Token: SeDebugPrivilege 3772 msiexec.exe Token: SeAuditPrivilege 3772 msiexec.exe Token: SeSystemEnvironmentPrivilege 3772 msiexec.exe Token: SeChangeNotifyPrivilege 3772 msiexec.exe Token: SeRemoteShutdownPrivilege 3772 msiexec.exe Token: SeUndockPrivilege 3772 msiexec.exe Token: SeSyncAgentPrivilege 3772 msiexec.exe Token: SeEnableDelegationPrivilege 3772 msiexec.exe Token: SeManageVolumePrivilege 3772 msiexec.exe Token: SeImpersonatePrivilege 3772 msiexec.exe Token: SeCreateGlobalPrivilege 3772 msiexec.exe Token: SeCreateTokenPrivilege 3772 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3772 msiexec.exe Token: SeLockMemoryPrivilege 3772 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3772 msiexec.exe 3772 msiexec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3524 wrote to memory of 3244 3524 msiexec.exe 97 PID 3524 wrote to memory of 3760 3524 msiexec.exe 103 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Setup.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3772
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 116C606BD70F4985B8870E6E3D0355DA C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3244
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3760
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:3332
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e596a0c.rbs
- Size 1.8MB
- SHA256 794fafca221f3bc574ccf01ab797a1e015249514ceaabefe4488501fbfffd925
- MD5 e5cdc7a88905fada332209d22e8b4e81
- SHA1 34a30fcf3de9b393169c914627ff09204d69c1f6
- SHA512 a51d169c7753eefd9a76cd464ca7b518c964b7e6094b37ff55ab6a6d5b748392638289d3167ab0f30089ce4276df923077c45d96783d009bad89a6393ac94ad6
- SSDEEP 6144:C+y5DT/30gL5Pstban7rCOIxe2ZTVWCSkO/QxtXJPnfLZS4pgZYjfcjvtxtgO4HX:mtmtz9VfLNpmsfcjMTRGz3cCg3CiV
- TLSH T162953A02FE00D3EB721FB45593663A754A097C9AB7F514A32BBD633B5940A1B133FA60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\django-stubs\django-stubs\core\mail\backends\locmem.pyi
- Size 103B
- SHA256 ae9de027f591acfedc0ba387099c4398c0841a9c126535d313ffbdb18184eea0
- MD5 7f6526c1bbcb2aa7ba6a8cde268765bc
- SHA1 cfc87c1fd110239d47886e0c5ebcad54bd453bbe
- SHA512 3c6f26b5f0ab2bc22e72e116ffe28624e5d971a86b9d85e5f733844827e784b8349c46fa46ca5390bc972607b7fb5b37a6fb47b410e105f02b147dfe77a737c7
- TLSH T193B0924460A342810FF69AE230F431905998340B8D38980A4F0031140B30C463E0A11E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\typeshed\stdlib\2\ntpath.pyi
- Size 2KB
- SHA256 ba96ee35c718a0964e11e6ae5d5b9e800b9350cafd2ec0d9e84d1cf4f0ac2702
- MD5 85d6a21f1a4f58f9e3ffbeb89cf82345
- SHA1 db8ae818a67210b61b2a538d49b608825de04a31
- SHA512 995047f50de368444bad3fedb2c5b7f8efa807cdd35bb3647b1223897e4d27a94f93a48b0b12fc9121281f4f447632edf878dc54268716b67ecfb28a388c744f
- TLSH T10951A95DBD64A7F08BFE9375550A13A6AE18B3F12B69F414E09A1454084F36CA0BDBCC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\typeshed\stdlib\2and3\xml\dom\pulldom.pyi
- Size 77B
- SHA256 c08fdebb51bcc9a6aab911e667d9984608f2e3334d8490b7f394e348ca1a9918
- MD5 0244548e1dba18ff5c58d98bcc50b931
- SHA1 37494fb84b8b2a811e2cfa2be49477ce29138af7
- SHA512 a88c7f3fad1047e18794184f33787b68e9c3260d47d68e6f519d99143b928aa97fcd1ebcc3b730f0c23eabb303352ba3cf9263b16e7c9f276f9108ed616a567c
- TLSH T147A0220B0038B8EC8B3C0C3C8E3F00B02A283280830A0820A0C0220823CF208CC383EC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\typeshed\third_party\3\docutils\__init__.pyi
- Size 63B
- SHA256 ddf071712a6926be84384714a23bdf946dc47a083b96fd90a7474d41020bacfe
- MD5 84a27291937d76e46b277653002601f2
- SHA1 fe60efb40aeeee2998bb07245d4f9571ad08825f
- SHA512 e489e83fd33fdc8ba88954725f79c2132bc4162ba713c72b190b790b4a368e3ceb024d7b8bceec4544123a5435fdfd987876f1b2542da06cba899f5ac72945be
- TLSH T168A00247543970EC8B7D5D795D3F05B12925158457165921A4C4621563CB158C83536D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\packaging\_structures.py
- Size 1KB
- SHA256 ab77953666d62461bf4b40e2b7f4b7028f2a42acffe4f6135c500a0597b9cabe
- MD5 de664fedc083927d3d084f416190d876
- SHA1 fe0c3747cf14e696276cb6806c6775503de002b8
- SHA512 cff19a724fac387599d98c0a365849078dbcbea65efca1ee445f158268b9241e552212a99e7e0b34394d246e3a06c999a7f1a967f64b2724ca9b623d62996c6f
- TLSH T1A721A7B4675BF4A7D365D1364852F883E30D3D93452E306074ACF8A4BF67A14DAD00EA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\packaging\specifiers.py
- Size 29KB
- SHA256 2d1434905b07ae5e6a7dc14d10426b20562c9c81d05095d8f5f22c6a44ebaea1
- MD5 7acafe408d6d5dd64238fd689638b177
- SHA1 04ffe4f1c2e6d8796ae64b8d3ccd1b9791f31445
- SHA512 b3cbe5fd1627f46f3bed6b5d12341d45f42070b5acb37266a6884d2d32e422672f656c00e99aa56894ddc12398e9f76d46c4089095df6c225e5a37f2e5d30f2f
- SSDEEP 768:ZKP01L5VlEpRuhdwhOuh0Iul8vwcKwbmVX:Z0qLT9Iul87KwC1
- TLSH T178D2877B7785963E8142433ACC56E082771EC6DF9288927D75BC802C6F0B13D86B39E9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\parso\python\grammar311.txt
- Size 7KB
- SHA256 4305da1ea25c27fce08bd14001b76fd54fe42a0724bbd5168c76680a56eda5be
- MD5 663bd8e6c3008a6849caeb04b084aed8
- SHA1 bf5f44f35aa2e1649c780e87a779da4a97adae0b
- SHA512 7a61aa2176d1fe366eddf6e6c1ba87185790ec375a9a430038b618e382030b369fb67862c735191e3622f522f6760337e97e700ff40629b76d8c505beb174826
- SSDEEP 96:d8cvbzNX3X1pR3SylUHu5riFl69BFmlETSX6MckQlb99c83OiEhNhfO5ZCBv2OGf:d8cFX3X1pR3SylUrgM4B9hUF+
- TLSH T1C4F1911CA6D70B450BD150B7554CF3BA49C9D18E203B8176FBCD92FD8FCB0982622B6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pip-22.2.2.dist-info\top_level.txt
- Size 4B
- SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
- MD5 365c9bfeb7d89244f2ce01c1de44cb85
- SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
- SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
- MD5 SHA1 SHA512
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pip\_vendor\packaging\version.py
- Size 14KB
- SHA256 fdf2d136b16bc5870755fca8f2f93d8fcb3a24cf0dff1b12c5516be91272728f
- MD5 8fb00e724a7af8d0b43fa3365fd3eff0
- SHA1 161edb467745642554aff7ee33a3eb69ff9e7287
- SHA512 cc785380e70f1f716079d789de11e4c6b1a5e20003beb9871efecb12c490d4ea64ba0f33d795c07d5de94c2ac66b5802474158bf71358a258b82837bbc1855d3
- SSDEEP 384:FpB0O1ceOvOvEYj7XYzStXzEjlrr6UcMn:10reOvOvEYj7ozStXzQlrr6Ub
- TLSH T125624329A747C07B83A74B6C8987F183A7296A57155C623D347CA1682F0397CC2F2DE8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pip\_vendor\pyparsing\actions.py
- Size 6KB
- SHA256 c14f62df67b4cb5ca6c4a137394c121cef92148aedd61ff0bfa5acd06423a4d5
- MD5 146786b5a4aada43d8288351dc8ef13e
- SHA1 1e77e225960e39fd3ef93455425542c211f0e18d
- SHA512 9d91565bac5f66a1c3c434ba63e22d590083c55a7ffff5cf8cce9986e12efb559a16ed5b3b246d0c34ebb9dd1f5dfffc39acd4970972d142ae70cebfcd6de12f
- SSDEEP 96:Hub2SjGvsVS8/asbyQKScTYeFOPhTJJ2M/HgScYGZhlpj74SnVJBhMVC:HLvUJyQ28NjFYdj79hgC
- TLSH T19DD18322E9417AF60E97C261CCDBE4913B61C1274106A4B3BCFCC05B2F4A476C5B759E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pip\_vendor\pyparsing\common.py
- Size 12KB
- SHA256 9452fdee8a08791ef90a65b986351166ac0309382bbaa96d713099fae94b3b64
- MD5 0120420547c1fcfef162005c34d72753
- SHA1 de8dd9838210119b7befcd0946e7c9f379339d27
- SHA512 60db163a69ea1e1336e94181710dea2d7fb50794453b60cdf2ea6ac4c490a009927363cd5f444eb641f00d6945f12cde20f4da2d0710f4f05349f19a594a18cd
- SSDEEP 384:JAardEkZDU04HsfLZcQ0YYZOVhHRWk8nTh:JZ+SHgZ8Wk+
- TLSH T1A1426452E49178AC038F95424CD7A404633500FB46CC19A87DFCD6F41FA1DBA9AEBAAD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pkg_resources\_vendor\packaging\__about__.py
- Size 661B
- SHA256 ba001220edb0d685321fcfc23aa4365ffb34ac38636e1402df2268703d378767
- MD5 68d5fc8a7ddb919bb241078b4e4db9cc
- SHA1 65369f014ea304064474d47c719401803c999ed8
- SHA512 ba9e26df6282c298bc52f7b1f3b47648118dcb65eaff1cbf0fb17007a39f46787596295e54a097e674af2565c024fb49a1e39a6e44bdfceb20295060b96f2c1f
- TLSH T17501787688184DB28A8048EDA44BC48BE764112F5ECE352BB37009DDBF0197B43F9148
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pkg_resources\_vendor\packaging\__init__.py
- Size 497B
- SHA256 6fd2a4e4c17b2b18612e07039a2516ba437e2dab561713dd36e8348e83e11d29
- MD5 b85796f8d9d4e7556c6ad5ec9f0c5371
- SHA1 9501323e7783213ab6c7c8e8fd05cd95d7a76ba1
- SHA512 eb02053d616708ed5c51da204e1dae2072bb2263e1466024e3bc363a35ceffba509794aec153e6a36cf49474cd73e4f63f3e2daa34d6d18de83fbfb055321263
- TLSH T1BEF0E51699897D728654C5DA560BC4EBD736114F0E8E3812376009ECDF2F92F43F419C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pkg_resources\_vendor\packaging\_musllinux.py
- Size 4KB
- SHA256 fca1a063fa9ceef84c1a9a2ab2cdb99f68622c234a46dbf3f660ab4bb824ab27
- MD5 0210636ea49cabb88154105b88045e64
- SHA1 d446d94e2b0fe0ec6286292877c3926268ecab4a
- SHA512 2ffc53a4c2b3600b20c8efe9c92d77ddac659c42c74dbc7abb2478017ac4050d7debc190b134369f4ad8e3d6c53ecf4e06c683938c5bde99dd7675739d6a1c73
- SSDEEP 96:syyas9WG17I6e+2YvMFtiboTCRhsMMkRZjgPk81iz5Sg:sA0zrlC2oTCRhjRZGksiz5Sg
- TLSH T1649165179D90F97AD381CA2CE8C5C945B73A2A67B9154D38F8AD40246F4512CC3B9FE8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pkg_resources\_vendor\packaging\tags.py
- Size 15KB
- SHA256 966b2718d889f02e03fcf7fd3db334aa06d9bc3f64981f65a590505196b747f6
- MD5 e38b04681f4e31b77b316c978f6749bd
- SHA1 1a2cecedf2686b5de23beb435957d92894bc990e
- SHA512 6eee7a6b90d1676b18eaa84fa010b348207bc88b7dc206696eba87f85b33cfced6e297e757a95891b609d7e9647b377001507853c8121d93739d20adaeef26a2
- SSDEEP 384:F1dQiA/tDvve/XYdoSwddAhy85lV37oQYKMKEpXlp1tzeVze2XzuWCUDxfvc33:Hd6dvYYdDwddAhy85lV37oQ3D6Xlpnz/
- TLSH T17B624116C692DD77C3A24E3A4CDAD146673869536A52622C7C9D81282F17CACC3F4BAC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pkg_resources\_vendor\packaging\utils.py
- Size 4KB
- SHA256 7498de6addc14be4d89f546b505570b9f50c6ac6edccb7d8468cbf1d710d7854
- MD5 359296260a63d16f5149ccdd7ae70762
- SHA1 5979c6b8353210e327b4689a66207c56a7c8e3d1
- SHA512 f91a368431fcf74f3214dac61427a3a81188eed8ecd2dd8f3036ec32bf149b0c34837ec965c4a4102b64e37f649df4e90fe4b4104cb46e68b17079b52c5c9401
- SSDEEP 96:FxdJdP1B7ynoaWBo3EQrdip7ARAfb90Cni6excWscJY:Fbb6aTBNAPC/2r3JY
- TLSH T1F181661F9C1908B6C3E657A80DAB519427A1652B16414E2C3CCC85507F97EAE32F6ADC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pkg_resources\_vendor\pyparsing\core.py
- Size 208KB
- SHA256 bbc1a9b5013f1fac0c925f0e661c5e2b56803c80d75cd83075284e441c01552e
- MD5 4d5ead9e8640267157f07cef2440eca0
- SHA1 ee174885aad35e095388c229e02274be0371389a
- SHA512 f29635cf1dea3acd8701e0ea91eebeae7ac39cee0ba912cf13b70eadf3e66667f7f643e359c8672393b20fec5e31e3004211cc3a2ab67249cdb1360d46565b5d
- SSDEEP 6144:xonDdvtPErcE0UpwyhLnWMh/9xVPyGGGY4WCe0dYJqEZzVxXF+vkymHa:hwGGVCezNIka
- TLSH T14424D927F9022A618A87C87A4CD7E057672AA817471C6471FDFC91A43F06935C2F7EE8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pkg_resources\_vendor\pyparsing\results.py
- Size 24KB
- SHA256 1e036f5955c17503fe43a3ed25fa0211e3899369f012f1bed8a54a0b9b06037d
- MD5 96e34a817b72247caed38833a8382a82
- SHA1 a0b0f883175cc685dcb9781126bdebdfabd5b859
- SHA512 52a1f19c1ffd8c397babe8ed502d19088dab53e7048f357a4740d84b65b1b65bf12af8705f2182eb9cfcdda8434e8782de4927bcbe23f1b5dccf14ccaa90e345
- SSDEEP 384:RmeUdaTIXT4QY87UNkeEbf7CLulGcvbYHgmx0GhAWh3Ui:RmeUgf87Oke0jl1vb0gM0Gvd
- TLSH T1B5B242626912682297879E2A5C87E807532FBC13505C3534BCBC64A43F56936E3FBDF8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pkg_resources\_vendor\pyparsing\util.py
- Size 6KB
- SHA256 92aefbd8ee5849e5ce49d3fe337d445a96c7fdaca3ec1307226058a3dc4f0f93
- MD5 e2b2a33736ac783f177601797818720f
- SHA1 001eab2eabbf7018d2f36596c5c304ecd51116af
- SHA512 b18355a3a4f698929cc5b66fdd485239d1f8ff9eb10db69a965519aadee6788045c59e2b609e0e71e7232c0f770d7787e73c9d62c18811bf98b846aaf6f5647d
- SSDEEP 96:qOb7JIBwf2VAy5FY6mcP2kgbsYqCWsaRhafcntkDB/yOR/Qhb8lWIepoAHf:qAu+yjYvceklMDfctkDB/7Sb/IAoAHf
- TLSH T153E13F13E9269962EA43D67F4DD3E282671D2D27521819B9FCFC41282F06538C2F5EF8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pyparsing\helpers.py
- Size 38KB
- SHA256 42950e8d6d3ea6cbee78cc166fd6d0a54da7a2a282bfdf3fc27c35552cd2755a
- MD5 74ecbf6fbfa002c53e5aafc144b62c57
- SHA1 2ea00bcb4e8e22b0688c3cb6c8b5d711e3e7397a
- SHA512 b153d90e13a1ac5c878ba9eb045f9933de7c831204cbd47e57e189b774c3bad531c21460c9934a6069eee82537ed2bb82826bd7fc77c8b93e2763301ea04fb2b
- SSDEEP 768:UVFXTkgqBql2LXcaajVVlz8moG3xDntYl8XqDBoe76Q:GVzqgcLXcaajV7z7Fh6l8Xqtv
- TLSH T10E03F727F9911671438B822A5CDFD0406326A927974464B4BD9CC0F83F1AAB987F76FC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\setuptools\_vendor\packaging\_manylinux.py
- Size 11KB
- SHA256 5dc6e25c1faa723bf76dca21a7a37df1332938fe3f8f79be88e03ca6d2b61966
- MD5 80df840e0ac823fa34bcfa543296ba35
- SHA1 0ff6c9ceb0819aef9d68cee59d7942fa0544661f
- SHA512 cd5bf95d0a51b0f6dac148f0706dc18298a4f3e5b8ed0271af0f54cda46078afe22831d29aa5ab65afa837c0e9f7dc26aaf655af9c2683714eeef0232a4a9848
- SSDEEP 192:lc/LH1a9flJKXeK6nOTp3K26nOTkJLeNNh/FUBCLlw61QQdEQjvBxRRmVpzWAa3/:lyLHYB9vOSOOL+XtUBaQIEUnOpnmR2C5
- TLSH T10E329656A844B637E363865E948FE185AB78A54F058C0438F9AE826A1F8147883F5FDC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\setuptools\_vendor\pyparsing\exceptions.py
- Size 8KB
- SHA256 dcb6d269f0f7d8d61bd53cedf39187364844014d5e6644ed352936e1c3cc7a6a
- MD5 f1f31bb05d818ebbc7cad0eac3c6364c
- SHA1 5cde38103af5472ed38061b38d1d2ac3f2637e85
- SHA512 d5ac511201f01675f1bee9cb671841f884522a5242f24e52ecf94715f1105f9c7a977f55654c4dcf2ebc54eed42a7fb914eb60f3c75d67b71623b308b11add79
- SSDEEP 192:AsZbAudvk/RhdULmzBB3FOzvk/OYHzoloK:AsZbr+RPUKj3HFjK
- TLSH T14A124107D9554B6781D7807D48AEA49A637A9E2712681432FEFCD2382F82635C2F2CDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\setuptools\_vendor\pyparsing\testing.py
- Size 13KB
- SHA256 eedbb801ba78b9278957437fc843d19a6354869775f1940fdc2ad7e350ccf35e
- MD5 5e9b66d292513af743fe21b61f00463d
- SHA1 dc3596cfdc8504ab6e344acf512605b00cc412ac
- SHA512 fdc0f7949c5570415981bc78d4ee672e05b651af44aecbe079b81e235b96a98a41ad2f68d2708ac0550790b260b262510e060b57e25bb86393701f8175905cbf
- SSDEEP 192:Zz3aqFdLGsdiBvo9NdnzV6SSMj7QT1hsq1aNnm58fyyhY/rMi5lLDuT0Ek:Zz35FWho93L7QTNqhwrH7ST0Ek
- TLSH T1F152611399060D226787547A5CAEE482E32AEE07624429B0FDFC151C2FC9576D1F3EEA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\setuptools\_vendor\pyparsing\unicode.py
- Size 10KB
- SHA256 7f0ba1323df4490d7ae42bfb1c9a6efab4b119b466f7790df4be048bb5467356
- MD5 c9b7c7bbc75393e592411b5f900b5372
- SHA1 44ccfc1d65fbb06d19c94f0e229d8c72de251b04
- SHA512 880660ef7e79e76b0aff96f3bee5407a6b863467e574eddaf389318c8de71fd8946c520a8aa9aad1e0efb29eafc139653f76c8d0d86dab18ee32bce42ce36c19
- SSDEEP 192:XZ/nCNjWQP79km1HKXexgRMnUM7feyM+I3ZKJlucAAR1s/HVieVslhJ9wJ0:XRCNj9TbgeUM72yT6ZQohMldi0
- TLSH T1F322A943E64909927383B12922DBBC11A61D84EBD8457D0C7F9CE3D86F0E9BC8979D2C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\shiboken2-5.15.2.1-py3.9.egg-info\dependency_links.txt
- Size 1B
- SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
- MD5 68b329da9893e34099c7d8ad5cb9c940
- SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
- SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
- MD5 SHA1 SHA512
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\stack_data-0.4.0.dist-info\WHEEL
- Size 92B
- SHA256 1b5e87e00dc87a84269cead8578b9e6462928e18a95f1f3373c9eef451a5bcc0
- MD5 4d57030133e279ceb6a8236264823dfd
- SHA1 0fdc3988857c560e55d6c36dcc56ee21a51c196d
- SHA512 cd98f2a416ac1b13ba82af073d0819c0ea7c095079143cab83037d48e9a5450d410dc5cf6b6cff3f719544edf1c5f0c7e32e87b746f1c04fe56fafd614b39826
- TLSH T103B0121401404AFA0160EE038024E5311260854A94990035F0822140550BE4406C9C5A
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\wheel-0.37.1.dist-info\WHEEL
- Size 110B
- SHA256 cfd8f4c406bf26650a3299b3ef62b464600b48cfe7fb04159866e5797c765478
- MD5 8cfa23cb3a9e0e9f30077848a14be857
- SHA1 e5ac311ba9eec5c0ccddc091ac7c0d62a72ecf72
- SHA512 039cb61c67f02b3b349102fa40fbb55fca46d54007309fd08b2707e2cac74fdddbb39b18730704209db4852bb9bb18078ef6a6a57acf0f0ba4951d7a249521bd
- TLSH T1CDB0122403408EFA4170FF438038E9311270C94A9CDD1136F4872180D50BE4916C9E5F
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\win32comext\axcontrol\__init__.py
- Size 135B
- SHA256 f0bb50af1caea5b284bd463e5938229e7d22cc610b2d767ee1778e92a85849b4
- MD5 f45c606ffc55fd2f41f42012d917bce9
- SHA1 ca93419cc53fb4efef251483abe766da4b8e2dfd
- SHA512 ba7bebe62a6c2216e68e2d484c098662ba3d5217b39a3156b30e776d2bb3cf5d4f31dcdc48a2eb99bc5d80fffe388b212ec707b7d10b48df601430a07608fd46
- TLSH T1EBC02B10D050224050332D9212320BE3075DACEE100690C1533C97082F111AD04D7014
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Scripts\jupyter-kernel.exe
- Size 105KB
- SHA256 d0cc7351cb75e315eac5fff92f12131beab3a93adf9b65d95f56f2f82718438d
- MD5 347e90841b2e929c6dd2a096006f2729
- SHA1 6fef1bb1b9c38e4aea02806b704790a7989d8373
- SHA512 b3c92b1e6972c6d48c782d7501fb8e77f75e7847d1219e77c41ec75563a5dccfc17eb19d33abc64ad5c7f951d70f273d02379d081830f703877dd9ea24c1fd6d
- SSDEEP 3072:CVS1/eI4pnTfEFYJE3nwzPdCNU/efHYTo+Md:aEHGnTcFYOXwJigTi
- TLSH T11DB36B4633D020FDD06A9274CDB69615D3B2BC278274934F27A47B6A5F333526D2BB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Scripts\pyside2-lupdate.exe
- Size 73KB
- SHA256 28b001bb9a72ae7a24242bfab248d767a1ac5dec981c672a3944f7a072375e9a
- MD5 d2778164ef643ba8f44cc202ec7ef157
- SHA1 31eee7114eed6b0d2fb77c9f3605057639050786
- SHA512 cb2a5a2aeba9d6f6bfc4a3a4576961244c109aafb59f02134b03ebac4d16602ee7f141cc4adc519f15030c20e7e7d6585778870706b2ea4c74c1161729101635
- SSDEEP 1536:PnDpvQm1Gk/NAIL5ZFR+Emf1rFX6YczDo87h2nO/Hda5QO6F:PDpv5tFA25ZA1J6Ho87kO/HdqQ5
- TLSH T182738D5AB39084F9C84B8275CCD16A95F372B41A0775838F072886A74F333B1AD3E366
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_A784AE3E993E9BBF7162E8F9F9758D3D
- Size 1KB
- SHA256 499008443dbba54263a4ec01acdafdbd960b13af2a686c0c16205e2bb1357838
- MD5 f840971a6bcc48eb08573cd18ae60bad
- SHA1 1a351c48d71de4ef2ad42cd374dbab500721302d
- SHA512 ce318f62cf0dec3476e3acb17034e9bf622a2c0db8d49968777170a3f087edef13f137ff41c4c921ba47bc7c896a24d044256b871ffbece2ca885dac6e33e306
- TLSH T14B31BA1AEE7435535E90A6E45AE6F1337CAC77D15DDA31406435450670913B33F85C8E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_0280B1903B52025320CB6FA6404D35EA
- Size 1KB
- SHA256 5a1f7a1051dd2b5dcdf91a539c3f9d5747f4de20f98333672add64e334dce033
- MD5 873219f32627ee43c0b1d5129248484c
- SHA1 510d6cc9403baa47edf17b0fcf30405036140ab4
- SHA512 a577758d0915461f691ad2b7ed8c88e18edba7c90b605cb3180c48db0140460fda30a2a606911efd4f8a8158a259395047a648b8133607482547175ae76287e9
- TLSH T10F31944A8AB93A03BB09C95555D2AD736CF026ACC5ED26AB24971AC938903B28E17015
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_A784AE3E993E9BBF7162E8F9F9758D3D
- Size 532B
- SHA256 a35fded874a8a1f6f9843acc8718bc9e8ba97f4b1bc8365dd1bbd4d9c2c054ac
- MD5 7524abcc5823be30137a88a16aeafc9c
- SHA1 6c1050076ec1ff7efd7f4463a7d5fff4e3d2df2a
- SHA512 27339e671cd61f2b138d561b9fa80ab76cd5ba7212870faa9e628f4a5a4f1d3c3da6b765dca3197c35ae36d024570fac4647ba622cc51228ee3af1579d0ee001
- TLSH T1DCF05C3813FA020FF07AD5FD0EC0A7229966FD12140997B7039B479C9E75B405CA722E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1D627669EFC8CD4F21BCF387D97F9B5_0280B1903B52025320CB6FA6404D35EA
- Size 540B
- SHA256 c4aedf0dcdb79deab64ceba46b59921ac65d0c9636c856b0bcf698fb22ead4b1
- MD5 e97a3d108db2b20055bcf070cd24b1b0
- SHA1 a1aed9f94233369b9a4bf54e15cf671dd937a641
- SHA512 dc5811342687dfd498ac891bbed136d0357ed9df478a61437f0575e5d5602518bf02553e9b814b56354cae489c3789475d64e338b3e35ae83d88638240bcf9f6
- TLSH T157F0972805B6001FF1B2C8B802C4605B4F66F81728059EA81BA5830C6951F107D91A35
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI1553.tmp
- Size 61KB
- SHA256 1b046ae315f314b86d122fcde918a1334b25ac03d3953073da41a7a6e6d15154
- MD5 2883dfbf67c96e80ea7ef4482e9a3719
- SHA1 fea590dafb00576d16b2d760b7ed3136e0033985
- SHA512 81754334fb04123117db0ebe66cfd7b13e4b93fc7d5ea38c71b37d1d894117b7498e028a8666ff3bac6e75a6c0309851259f5c6ecc18ec4c8f39c4276b89eada
- SSDEEP 768:ytwE/7Tpprsq2SLGQKYWSgwM/G8uOUIPnfAq+wTjhFPMnPkUWpmnjEDsUVX3nJJS:EHZGPvwdcNnfJTldaPjVZe3nJBu
- TLSH T1AD535B117350C036E1631A34A8B8D3721E7E7C222BF585CB7F96176E5FB05C2AAB9316
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 960eb43550f465ec694132c43f2f67dcdd51f6aabfa99e7b8457863b373821a9
- MD5 0bddd2ff3e170f20c5614226a63a071c
- SHA1 d87869fb668392c56df5430271fb8dfa0ab9db11
- SHA512 b01d7ca6bda0e5d2bf4cd888c69c6b6219faebb483e39563e684fc9d33efbde21cb551735828c7cbe14c9ebe4f89c03e6858315fe3f5bd0ea3af36df42ee84d1
- SSDEEP 24576:Pu8m+1zGdoO/vvTLr28epm649lUTE1MCQKGN+Ttl00aNOrFhIvVlk63xJ:C
- TLSH T15A47902837F92200E7F79E3D68F06A234D3A7D5B9C199E8D45451B4E0921FB0E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c4d211c3-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{947d6fc2-325e-4b67-a71e-e38140e46f4b}_OnDiskSnapshotProp
- Size 6KB
- SHA256 99438a48c342cf7e250887c1f5a2ef1967381578390d1c54fce27a6f7f539530
- MD5 4558dc7aed4453afabff8cfb2fa563d9
- SHA1 7d645fb7d450561dd64b939cf7f205dd8fe0a85b
- SHA512 edfbcaa8fe777c2f71549d05d0f726f1fe66d0d88dfb1c05afddcc459d72f7cce4b9fe5151e103880a14351a545734e159e7d96cb1f297dc369d24d07d8f068f
- SSDEEP 96:FLOrje6U0vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:BOHGub++ZVm
- TLSH T1A0D198085AE54311E2F3AB3229F18557A877B911EF33CB8E0198638E2670A10F935F5F
- MD5 SHA1 SHA512 SSDEEP TLSH