Analysis
- max time kernel
148s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/10/2026, 22:24
Static task
static1
Behavioral task
behavioral1
Sample
AdvancedIPScanner.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
AdvancedIPScanner.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
General
- Target AdvancedIPScanner.msi
- Size 57.5MB
- Sample261027-2bs8bsvy3q
- SHA256 698ba27e47db93bf9d0624e42b64037dd0b9e29d5a01e502d6a93dee3f96cb5d
- MD5 425a1389f41b65ad040f5e818ecc3fba
- SHA1 8d04816062e88d0446b9f2fee7f4e90453d6e3d3
- SHA512 63817af8a32ab06199479cf0a296127e119af4f0bdb46356d455e7e18a5248a99fb506294676605dba8e95f5780aa7a87f6808687ccc1e6e4555844142d19ed9
- SSDEEP 1572864:cmUCCbSahYDLwDI5NZXQH/ddjZm/4uROPyTnNAK6KsddzC+WRLd7r:axWa+BZa1JF7KTNNnsddzC+WRLdP
- TLSH T151D733B7D04E433AF92BF93581F82A1E91413C52770394BAF1527AA397B73D79A38046
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 4 860 msiexec.exe 10 860 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\W: msiexec.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation node.exe - Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\e591238.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{03178CAF-5CA5-48CA-86D7-957C4EEFD372} msiexec.exe File opened for modification C:\Windows\Installer\MSI1553.tmp msiexec.exe File created C:\Windows\Installer\e591236.msi msiexec.exe File opened for modification C:\Windows\Installer\e591236.msi msiexec.exe - Executes dropped EXE 3 IoCs
pid Process 380 Advanced_IP_Scanner_2.5.4594.1.exe 4416 node.exe 636 Advanced_IP_Scanner_2.5.4594.1.tmp - Loads dropped DLL 2 IoCs
pid Process 4416 node.exe 636 Advanced_IP_Scanner_2.5.4594.1.tmp - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 860 msiexec.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain node.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname node.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Advanced_IP_Scanner_2.5.4594.1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Advanced_IP_Scanner_2.5.4594.1.tmp - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral1/files/0x0007000000024525-28.dat innosetup behavioral1/memory/380-29-0x0000000000400000-0x000000000042D000-memory.dmp innosetup behavioral1/memory/380-57-0x0000000000400000-0x000000000042D000-memory.dmp innosetup - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000c311d2c4ba4812b50000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000c311d2c40000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900c311d2c4000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ac311d2c4000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dc311d2c4000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4620 msiexec.exe 4620 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 860 msiexec.exe Token: SeIncreaseQuotaPrivilege 860 msiexec.exe Token: SeSecurityPrivilege 4620 msiexec.exe Token: SeCreateTokenPrivilege 860 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 860 msiexec.exe Token: SeLockMemoryPrivilege 860 msiexec.exe Token: SeIncreaseQuotaPrivilege 860 msiexec.exe Token: SeMachineAccountPrivilege 860 msiexec.exe Token: SeTcbPrivilege 860 msiexec.exe Token: SeSecurityPrivilege 860 msiexec.exe Token: SeTakeOwnershipPrivilege 860 msiexec.exe Token: SeLoadDriverPrivilege 860 msiexec.exe Token: SeSystemProfilePrivilege 860 msiexec.exe Token: SeSystemtimePrivilege 860 msiexec.exe Token: SeProfSingleProcessPrivilege 860 msiexec.exe Token: SeIncBasePriorityPrivilege 860 msiexec.exe Token: SeCreatePagefilePrivilege 860 msiexec.exe Token: SeCreatePermanentPrivilege 860 msiexec.exe Token: SeBackupPrivilege 860 msiexec.exe Token: SeRestorePrivilege 860 msiexec.exe Token: SeShutdownPrivilege 860 msiexec.exe Token: SeDebugPrivilege 860 msiexec.exe Token: SeAuditPrivilege 860 msiexec.exe Token: SeSystemEnvironmentPrivilege 860 msiexec.exe Token: SeChangeNotifyPrivilege 860 msiexec.exe Token: SeRemoteShutdownPrivilege 860 msiexec.exe Token: SeUndockPrivilege 860 msiexec.exe Token: SeSyncAgentPrivilege 860 msiexec.exe Token: SeEnableDelegationPrivilege 860 msiexec.exe Token: SeManageVolumePrivilege 860 msiexec.exe Token: SeImpersonatePrivilege 860 msiexec.exe Token: SeCreateGlobalPrivilege 860 msiexec.exe Token: SeBackupPrivilege 748 vssvc.exe Token: SeRestorePrivilege 748 vssvc.exe Token: SeAuditPrivilege 748 vssvc.exe Token: SeBackupPrivilege 4620 msiexec.exe Token: SeRestorePrivilege 4620 msiexec.exe Token: SeRestorePrivilege 4620 msiexec.exe Token: SeTakeOwnershipPrivilege 4620 msiexec.exe Token: SeRestorePrivilege 4620 msiexec.exe Token: SeTakeOwnershipPrivilege 4620 msiexec.exe Token: SeBackupPrivilege 4752 srtasks.exe Token: SeRestorePrivilege 4752 srtasks.exe Token: SeSecurityPrivilege 4752 srtasks.exe Token: SeTakeOwnershipPrivilege 4752 srtasks.exe Token: SeBackupPrivilege 4752 srtasks.exe Token: SeRestorePrivilege 4752 srtasks.exe Token: SeSecurityPrivilege 4752 srtasks.exe Token: SeTakeOwnershipPrivilege 4752 srtasks.exe Token: SeRestorePrivilege 4620 msiexec.exe Token: SeTakeOwnershipPrivilege 4620 msiexec.exe Token: SeRestorePrivilege 4620 msiexec.exe Token: SeTakeOwnershipPrivilege 4620 msiexec.exe Token: SeRestorePrivilege 4620 msiexec.exe Token: SeTakeOwnershipPrivilege 4620 msiexec.exe Token: SeRestorePrivilege 4620 msiexec.exe Token: SeTakeOwnershipPrivilege 4620 msiexec.exe Token: SeRestorePrivilege 4620 msiexec.exe Token: SeTakeOwnershipPrivilege 4620 msiexec.exe Token: SeRestorePrivilege 4620 msiexec.exe Token: SeTakeOwnershipPrivilege 4620 msiexec.exe Token: SeRestorePrivilege 4620 msiexec.exe Token: SeTakeOwnershipPrivilege 4620 msiexec.exe Token: SeRestorePrivilege 4620 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 860 msiexec.exe 860 msiexec.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4620 wrote to memory of 4752 4620 msiexec.exe 97 PID 4620 wrote to memory of 380 4620 msiexec.exe 99 PID 4620 wrote to memory of 4416 4620 msiexec.exe 100 PID 380 wrote to memory of 636 380 Advanced_IP_Scanner_2.5.4594.1.exe 101 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\AdvancedIPScanner.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:860
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:4752
-
-
C:\ProgramData\NodeJS\Advanced_IP_Scanner_2.5.4594.1.exe"C:\ProgramData\NodeJS\Advanced_IP_Scanner_2.5.4594.1.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\is-CS4A7.tmp\Advanced_IP_Scanner_2.5.4594.1.tmp"C:\Users\Admin\AppData\Local\Temp\is-CS4A7.tmp\Advanced_IP_Scanner_2.5.4594.1.tmp" /SL5="$901BE,20439558,139776,C:\ProgramData\NodeJS\Advanced_IP_Scanner_2.5.4594.1.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:636
-
-
-
C:\ProgramData\NodeJS\node.exe"C:\ProgramData\NodeJS\node.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
PID:4416
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:748
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e591237.rbs
- Size 9KB
- SHA256 b425c54a9cf2b7cb95fa144f2c194fa995b902047f78150b959f5076f60a8763
- MD5 fff3b9fb3ded7ae0b59a697d27ed1ae6
- SHA1 cd2886c944c027a456aeca825982d89a3e93b2c1
- SHA512 7c6d381df34e36e264cbfcf717cdf837ff7471779eb4fed2a67945eb5eefd17f1cb19f70264bb80db57e948525fc9aa3faa3fa747b7c61270d7cb4608fc72509
- SSDEEP 192:hVexd71FSIlFSCJj5OcYmd3CR+DMHp9JwUTv652oL:hcdpFzFbj5jYmd3CR+DgwUTv652oL
- TLSH T195123306750086E2E6AA1772974B7B017B77F3F9A304B21F15AEC43C1F1279D9F8409A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\NodeJS\Advanced_IP_Scanner_2.5.4594.1.exe
- Size 20.1MB
- SHA256 26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b
- MD5 5537c708edb9a2c21f88e34e8a0f1744
- SHA1 86233a285363c2a6863bf642deab7e20f062b8eb
- SHA512 35f44c0df4635a1020f52743d7cf3e4346d1bdf9010161326e572250ac93e0285b202532a07d2db8dbc67f6f0ced864083769e904bd5d82611244339ca8d31a1
- SSDEEP 393216:Plu7Txs0NDmNh9D4HaSYz2Kj0Cz1gEVmWdQOjM/y3tFfs5IRRViGmMQZ+Bw5i:A7Th9mT97S7CzNwWCJK05IRTX+Fi
- TLSH T1B0273382B79A8A32FC5E2438496652E54F00FC547BD54127BE35F39E4F723A08DBA391
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\NodeJS\koffi.node
- Size 1.0MB
- SHA256 7e48475cb7efa0b148bf0ab1df4f95f0ceece3a1d3788967a067a61ddbf704a1
- MD5 c4f80d8c3c573c96a50ec63a16b8ab51
- SHA1 dbca9cc5437952b5c77681523b9a905553e27713
- SHA512 d480257ac18d28b9664068bcfe61a8b39573a06786a6d4926151ff298eb338548770c6ad06c76ef32ad5a764693f40541e3b706f27b005cce021058e2589438c
- SSDEEP 12288:1OHcorsvRUzgHBpfmrytFNXrfKh4O1nNJhdb/IMUs2Jb71WDecUq1vX:1OHcorsvRUz8OOt3rKiO1nNJ72J6ecJX
- TLSH T13235E342F71A96E8C55EC0344B7BC3113921F846077DA9D7D69CFE983E12ABC163A2E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013
- Size 765B
- SHA256 f8caf3e1526569d23605d27c58cd6917ee1234ae37a6aec6f47f1ec250eb615c
- MD5 66704632e49adaecd26d74252f30cd4d
- SHA1 0f693054fc3cb4717390e9623cef9877322fac57
- SHA512 9eeb112dd34e6c5859478bba94f9e097b6a25129ae63902d7774e7f0149e9a7fbba12fa3a37231033fbe9fcc830b69fb7a860f88f564abc406507b88ed0005c7
- TLSH T1BD016ADD8C146052EB113D754A6CDE764460F33530C40D9D652B7B902A85BEFF735406
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_9FEAC3C92A76320EE1D21675F706EB9F
- Size 638B
- SHA256 31b203156956585fc9e2a563a191447c545990698570823bb5769023176ce974
- MD5 e5a09197a2dd5e85edbaf66f9f5e8ee6
- SHA1 5e3226fe8feb853b30f9debd4fc02db57b0129f9
- SHA512 9405a0d5a99d86acc2a1fd48b2572b3c338e8db718e46dda6ffccee07b096a1f32cf472ab77c482df987fdeae3bdc17535d5a8076040852e582907db376e891d
- TLSH T146F06855CC1BF5EC9C86442E0E64DD1B1C40B5563DD270AF323EEA022DA43B39E14005
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013
- Size 484B
- SHA256 717946192e3e958306ddb749391f54edf7ac5f1982c63dff526c70a84a58114c
- MD5 154f37120a91001497afc456961e0204
- SHA1 dffcd187e205888021fad542977e87db1514d67e
- SHA512 ce7dddd3285a74a209eea2cd4ab4bb48753759f6737e42f28b9758acfc203e0bad215013a99ac10786f2ef5cc4af6acc698e4bfe1d70965652d3571b5e828830
- TLSH T19EF055380AE5813FF1A8C9B55EE5A4679C19F217280186B91AA343496A5AC04ACD1168
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_9FEAC3C92A76320EE1D21675F706EB9F
- Size 484B
- SHA256 f53715e060a264108cb6b9a6fb3e9862ebb42044f55419dd77e5f0d047fd6547
- MD5 2de25f8b7064e277590d1dd38ece0272
- SHA1 577f4d3a3172dc343016bb6bc94d758e755072a0
- SHA512 1d22607605d41e37ccdfcf8627caa0686dafda36f7f173e9fd1f324e395a1efe869ad273bee109f651ec8de2173cad036bf7273908f4b32ef780488de52bc0f1
- TLSH T15CF0A31D79EB00FFE4B4E47A02D85287F436F1313407B66E1AC003159A16701DCB1E46
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-4PQ2C.tmp\aips_is_install_dll.dll
- Size 149KB
- SHA256 3a7a8aa906c65124c4ee82aacb81d723ce69864ccaf041f631b8131de59e4a88
- MD5 57e73855fad786a59893d6581e9fb5b9
- SHA1 630e52b9e88a05add68401bd62790ed8e2c3282a
- SHA512 be0cf0925535dd667488175f2eac660d1ebf8429ce6725252c59fb70b00fc2f21b1e0b7ce632eaa53337ae25e44c641e13a3df0b415724498d30daf00b296f4d
- SSDEEP 3072:RMmLlzH5vVOS6vHZM+70gxvlou/xq+1f2auYpLAbPTxTTtFBImEQ3F65D:dZ/OSO7gK5q+N2ahjOF65D
- TLSH T181E37D117580C432E6BF19385878D6765B3E7930DF6089CB63981ABA5E30AC1DF34B7A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-CS4A7.tmp\Advanced_IP_Scanner_2.5.4594.1.tmp
- Size 1.1MB
- SHA256 ec8252a333f68865160e26dc95607f2c49af00f78c657f7f8417ab9d86e90bf7
- MD5 b87639f9a6cf5ba8c9e1f297c5745a67
- SHA1 ce4758849b53af582d2d8a1bc0db20683e139fcc
- SHA512 9626fc4aa4604eee7ededa62b9dc78a3f6fe388eaf1fa6c916a3715b0dff65c417eede156d82398c2400977a36457122565e15e0ed0e435b28cb9f796005c1c0
- SSDEEP 24576:Z4VN4kkKF3hDXq8xeidJLvkU99kkkkJE58dlX3IiAtp3Nq3E/HoQYx96BxYx9v1:iT90guMXEdqwHkUBK3
- TLSH T1CE454A22A3924437E5732F759D6BC6946C36BE202EB4D54A7EF89E0C0E38B417D35392
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 64968953455917db980f58eedec9bbe2f5b216b051948d26ca217e5c95ec92eb
- MD5 ddff3e2b2538d58f9e4060c69d4d3651
- SHA1 4844667956d7b364535273281de1bdf440c342d1
- SHA512 395eac05fd7c3e47000873183b0166ea2917b3b251183cce63178fc89d83a64ab1716a28f7e43a926501808b6a1da5cb73ae8231eb663d7e47572e197f6a9165
- SSDEEP 24576:0u8m+1zZdoO/vvTLr28epm649lUTE1MCQKGN+Ttl00aNOrFhIvVlk63xJ:q
- TLSH T10E47902837F92200E7F79E3D68F06A234D3A7D5B9C199E8D45451B4E0921FB0E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c4d211c3-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{aac052c2-237b-4122-91bc-bf8da36cd033}_OnDiskSnapshotProp
- Size 6KB
- SHA256 46a46acd54460b9cdac04631489e504db5eddc704c20260feccbaf7c8c6d8664
- MD5 82a20c8c0b290becb044a473a10aa50c
- SHA1 5999970f9e3c950b45b7626b576620c7fea936c6
- SHA512 219bbae00834cd67bf35578b0897cccd4842329248cd95a18c0a9c7a84b1f6d63fac84d881fb4d008218ef6a3fc2bbf2c23fe7db5400ad3859b640e929d47661
- SSDEEP 96:FEnaT6030vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:CnaZ3ub++ZVm
- TLSH T143D1790C5AE54311E2B3AB3229F14557A877B911EF33CB8E0198238E6670A14F975F6F
- MD5 SHA1 SHA512 SSDEEP TLSH