Overview

overview

6

Static

static

1

Zamzar-1.1...up.exe

windows7-x64

6

Zamzar-1.1...up.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    174s
  • max time network
    167s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-05-2024 12:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Zamzar-1.1.0.Setup.exe

  • Size

    120.7MB

  • MD5

    3980ea90d6a3cd78ae4043efc820876f

  • SHA1

    e40c66343b6ed66982cc89a36c97badf3a95ded6

  • SHA256

    3a5f51e46b9314228955b6e42ba9cf5c37566a69a2f49acb9ad0ee8c3132ba24

  • SHA512

    7389a28392cfd8c0022e5b8955ceb3cbfa8170768fd132190e137771d0ea1d7e9bd7085208c44d4d68e34d0082e437d55658b7a9ce25eab8d8ac6b903a694f7e

  • SSDEEP

    3145728:qtwOduAgm/T6gLxYbW/uR6SOOlo/KNVR18XD0otBEL6H8:N0r6gL0bY1qDN7otOLm8

Score
6/10
persistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in Windows directory 16 IoCs
  • Executes dropped EXE 15 IoCs
  • Loads dropped DLL 57 IoCs
  • Registers COM server for autorun 1 TTPs 3 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 22 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 42 IoCs
  • Suspicious use of SendNotifyMessage 44 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Zamzar-1.1.0.Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Zamzar-1.1.0.Setup.exe"
    1⤵
    • Enumerates connected drives
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1632
    • C:\Users\Admin\AppData\Local\Temp\Zamzar-1.1.0.Setup.exe
      C:\Users\Admin\AppData\Local\Temp\Zamzar-1.1.0.Setup.exe /i "C:\Users\Admin\AppData\Roaming\Zamzar Ltd\Zamzar 1.1.0\install\x64-build.msi" /L*V C:\Users\Admin\AppData\Local\Temp\zamzar_install.log AI_EUIMSI=1 AI_SETUPEXEPATH="C:\Users\Admin\AppData\Local\Temp\Zamzar-1.1.0.Setup.exe" PrimaryVolumeSpaceRequired="535761" PrimaryVolumeSpaceAvailable="41702840" TARGETDIR="F:\" AppsShutdownOption="All" CustomActionData="Zamzar.exe" AI_SETUPEXEPATH_ORIGINAL="C:\Users\Admin\AppData\Local\Temp\Zamzar-1.1.0.Setup.exe" AI_INSTALL="1" APPDIR="C:\Users\Admin\AppData\Roaming\Zamzar" SHORTCUTDIR="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Zamzar" SECONDSEQUENCE="1" CLIENTPROCESSID="1632" CHAINERUIPROCESSID="1632Chainer" ACTION="INSTALL" EXECUTEACTION="INSTALL" CLIENTUILEVEL="0" ADDLOCAL="MainFeature" PRIMARYFOLDER="APPDIR" ROOTDRIVE="F:\" AI_DETECTED_ADMIN_USER="1" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1716226903 "
      2⤵
      • Enumerates connected drives
      • Modifies system certificate store
      PID:2984
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1060
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding D84875A40C3F3169129038CACBB7D664 C
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:4580
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4768
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 74BB20B38A7473A735040A38F9EBEE4D
        2⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:3596
      • C:\Windows\Installer\MSIF257.tmp
        "C:\Windows\Installer\MSIF257.tmp" /RunAsAdmin "C:\Users\Admin\AppData\Local\Zamzar\resources\app\installer\Zamzar Installer.exe" --install "C:\Users\Admin\AppData\Local\Zamzar\resources\app\installer\zamzar.dll" "C:\Users\Admin\AppData\Roaming\Zamzar\DLL\\zamzar.dll"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3976
        • C:\Users\Admin\AppData\Local\Zamzar\resources\app\installer\Zamzar Installer.exe
          "C:\Users\Admin\AppData\Local\Zamzar\resources\app\installer\Zamzar Installer.exe" --install "C:\Users\Admin\AppData\Local\Zamzar\resources\app\installer\zamzar.dll" "C:\Users\Admin\AppData\Roaming\Zamzar\DLL\\zamzar.dll"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3400
          • C:\Windows\System32\regsvr32.exe
            "C:\Windows\System32\regsvr32.exe" "C:\Users\Admin\AppData\Roaming\Zamzar\DLL\\zamzar.dll" /s
            4⤵
            • Loads dropped DLL
            • Registers COM server for autorun
            • Modifies registry class
            PID:2764
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:2680
    • C:\Users\Admin\AppData\Local\Zamzar\Zamzar.exe
      "C:\Users\Admin\AppData\Local\Zamzar\Zamzar.exe" --firstrun
      1⤵
      • Adds Run key to start application
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4052
      • C:\Users\Admin\AppData\Local\Zamzar\Zamzar.exe
        "C:\Users\Admin\AppData\Local\Zamzar\Zamzar.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Zamzar" --mojo-platform-channel-handle=2268 --field-trial-handle=2272,i,8773584946124502188,1308467090614240076,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2136
      • C:\Users\Admin\AppData\Local\Zamzar\Zamzar.exe
        "C:\Users\Admin\AppData\Local\Zamzar\Zamzar.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Zamzar" --app-user-model-id=electron.app.Zamzar --app-path="C:\Users\Admin\AppData\Local\Zamzar\resources\app" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2460 --field-trial-handle=2272,i,8773584946124502188,1308467090614240076,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:4212
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://secure.zamzar.com/signup/?dsk-cl2
          3⤵
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:1368
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa4a7946f8,0x7ffa4a794708,0x7ffa4a794718
            4⤵
              PID:3456
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,862957450799353856,8549718547295465593,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2016 /prefetch:2
              4⤵
                PID:652
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,862957450799353856,8549718547295465593,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2460 /prefetch:3
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:2204
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,862957450799353856,8549718547295465593,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
                4⤵
                  PID:3036
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,862957450799353856,8549718547295465593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
                  4⤵
                    PID:5016
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,862957450799353856,8549718547295465593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
                    4⤵
                      PID:2744
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,862957450799353856,8549718547295465593,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
                      4⤵
                        PID:5920
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,862957450799353856,8549718547295465593,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
                        4⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:6068
                  • C:\Users\Admin\AppData\Local\Zamzar\Zamzar.exe
                    "C:\Users\Admin\AppData\Local\Zamzar\Zamzar.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Zamzar" --app-user-model-id=electron.app.Zamzar --app-path="C:\Users\Admin\AppData\Local\Zamzar\resources\app" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2664 --field-trial-handle=2272,i,8773584946124502188,1308467090614240076,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
                    2⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:2156
                  • C:\Users\Admin\AppData\Local\Zamzar\Zamzar.exe
                    "C:\Users\Admin\AppData\Local\Zamzar\Zamzar.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Zamzar" --app-user-model-id=Zamzar --app-path="C:\Users\Admin\AppData\Local\Zamzar\resources\app" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=4180 --field-trial-handle=2272,i,8773584946124502188,1308467090614240076,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
                    2⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:5384
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
                  1⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2852
                  • C:\Windows\system32\dashost.exe
                    dashost.exe {be0432eb-c839-4539-adf2e01abcd16b04}
                    2⤵
                      PID:2104
                  • C:\Users\Admin\AppData\Local\Zamzar\Zamzar.exe
                    C:\Users\Admin\AppData\Local\Zamzar\Zamzar.exe "C:\Users\Admin\Desktop\InitializeSkip.midi" mp3
                    1⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of WriteProcessMemory
                    PID:3592
                    • C:\Users\Admin\AppData\Local\Zamzar\Zamzar.exe
                      "C:\Users\Admin\AppData\Local\Zamzar\Zamzar.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Zamzar" --mojo-platform-channel-handle=1940 --field-trial-handle=1952,i,15316911074992812285,15748314512794287929,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
                      2⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:3512
                  • C:\Windows\System32\CompPkgSrv.exe
                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                    1⤵
                      PID:4784
                    • C:\Windows\System32\CompPkgSrv.exe
                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                      1⤵
                        PID:5300
                      • C:\Users\Admin\AppData\Local\Zamzar\Zamzar.exe
                        C:\Users\Admin\AppData\Local\Zamzar\Zamzar.exe "C:\Users\Admin\Desktop\InitializeSkip.midi" wma
                        1⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:1796
                        • C:\Users\Admin\AppData\Local\Zamzar\Zamzar.exe
                          "C:\Users\Admin\AppData\Local\Zamzar\Zamzar.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Zamzar" --mojo-platform-channel-handle=1976 --field-trial-handle=1980,i,2842013454892296587,15036386574929886874,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
                          2⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:5880
                      • C:\Users\Admin\AppData\Local\Zamzar\Zamzar.exe
                        C:\Users\Admin\AppData\Local\Zamzar\Zamzar.exe "C:\Users\Admin\Desktop\CopyPing.jpeg" png
                        1⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:6132
                        • C:\Users\Admin\AppData\Local\Zamzar\Zamzar.exe
                          "C:\Users\Admin\AppData\Local\Zamzar\Zamzar.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Zamzar" --mojo-platform-channel-handle=2352 --field-trial-handle=2356,i,16609393815172564885,18139422136437486749,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
                          2⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:5296
                      • C:\Users\Admin\AppData\Local\Zamzar\Zamzar.exe
                        C:\Users\Admin\AppData\Local\Zamzar\Zamzar.exe "C:\Users\Admin\Desktop\UnprotectRegister.gif" png
                        1⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:5768
                        • C:\Users\Admin\AppData\Local\Zamzar\Zamzar.exe
                          "C:\Users\Admin\AppData\Local\Zamzar\Zamzar.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Zamzar" --mojo-platform-channel-handle=1872 --field-trial-handle=1876,i,569537639151568797,18433108222625296103,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
                          2⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:5892

                      Network

                      MITRE ATT&CK Matrix ATT&CK v13

                      Initial Access

                      Execution

                      Persistence

                      Boot or Logon Autostart Execution

                      2
                      T1547

                      Registry Run Keys / Startup Folder

                      2
                      T1547.001

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      2
                      T1547

                      Registry Run Keys / Startup Folder

                      2
                      T1547.001

                      Defense Evasion

                      Modify Registry

                      2
                      T1112

                      Subvert Trust Controls

                      1
                      T1553

                      Install Root Certificate

                      1
                      T1553.004

                      Credential Access

                      Discovery

                      Query Registry

                      4
                      T1012

                      Peripheral Device Discovery

                      2
                      T1120

                      System Information Discovery

                      5
                      T1082

                      Lateral Movement

                      Collection

                      Exfiltration

                      Command and Control

                      Impact

                      Resource Development

                      Reconnaissance

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Config.Msi\e57d62d.rbs
                        Filesize

                        770KB

                        MD5

                        a4fb3b3a18263be39f69f50315a76d5f

                        SHA1

                        610377b3074e5befdfee28a4b4659b4336102304

                        SHA256

                        fb09124758cd530a5ad864368535c610317a9218aae3d621dd94cf80aab5f9a3

                        SHA512

                        be79a2aefb8c2e0beffc92dc9f463e57afb1464a58b4de6db38ab23d0cb5eb6fc4df22ab435f6cd5d602cee28af6fa3c584cd349652993ab9aa7b746e0b6c2ce

                        Download Submit
                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013
                        Filesize

                        765B

                        MD5

                        fb00a41203de2ca6ba2e37eebb980c5e

                        SHA1

                        6fd8847fe3416380d9a5c3900fb6720294a23b29

                        SHA256

                        f42d926a9f6a7c3cb66c9e636a6e381635a72c5109c6a061ad26a73286becf38

                        SHA512

                        fddb430ca2a54d997623d7172802025750166466f9126b2f0d9e36f4362b1484538f52aa0b1032aa187494913c2df62f692ba9be0a384948fabdecedfe48d0cc

                        Download Submit
                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_86BCE08710C034B983D3ACE46F762A2C
                        Filesize

                        637B

                        MD5

                        188a7ed7bbe4c1889bc332527a76c965

                        SHA1

                        353d05f7fd970f7087ed4773cf3f1daf0f00954d

                        SHA256

                        694656bde1e6fb96d565e64604aa2014f4f05d3e27c33a8392cbea8a30157ba3

                        SHA512

                        4c686a7fb4bbf044675cdfabec833b6763836ef2882ddb87ef2c9a09fd061c2ea4b29ed1e3073e40b69f03d3144a4ea36995edbd3103c7e007bbfe796c66caec

                        Download Submit
                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
                        Filesize

                        1KB

                        MD5

                        34e20e69972adc0f322919147ce48a60

                        SHA1

                        0ad714ccc91e6230d313128ca37efa1c2225870d

                        SHA256

                        3f235a2df38aed18fb79aa083e233c0972e95a8b5887c8dae743be9ef0a94bbc

                        SHA512

                        c30fde9c600bc37a9bff262a920fd0a1fa05e17c557ae1adf39515383d9044c2adb6be3536570c246dec5c84b0d9f625508ebb79bf96c3980d117068286df830

                        Download Submit
                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013
                        Filesize

                        484B

                        MD5

                        67685add702b029b4fab5d8487cb317b

                        SHA1

                        201f2001fc32a6dfd159d5447439c13fa77d323b

                        SHA256

                        4bc4c57da477e75321267bb30dfb0c2627dc8f7a815d3a5a6b6cdfb7a3282d98

                        SHA512

                        3e9d17a3f5102cfa946e31c59a0c957b11392d9da7858d6926e2a51037cf89dfc8d69b8c37ecf6528a26d64a39aee46d3e35f7f979cce40d36d503b53aa9ca69

                        Download Submit
                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_86BCE08710C034B983D3ACE46F762A2C
                        Filesize

                        480B

                        MD5

                        d64920b453eeda5cfb99bdf05e6c43d5

                        SHA1

                        a7dc71714747750cb8301da749b5992c05fbf69a

                        SHA256

                        e44db5057fed92bb670df3e8a58f8f49aeecab2411ef19127ff3f98c8267f315

                        SHA512

                        20d5a9c25db082bbdb195f972514d63eca0f0ab2f75c99da165951fac5a7e44aba9250f388581a884adb8d6510e38c090145cb64bddcb5a5b5f006a9873bd029

                        Download Submit
                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
                        Filesize

                        482B

                        MD5

                        bdc5bf224f130d9ef74e5f3b60856be2

                        SHA1

                        be4b4cbe45331d002827492dc38800bdd5c140eb

                        SHA256

                        325490304c0a6f1cc9e53798d15a93628431520d3de7225881aa5db209a869e3

                        SHA512

                        4cbe1b797044606305e81a5c472b8cf436fabbb399056d00bd0649f4ef7237a3932410f8489da5305ae1fe3910abab74d4a838fd6f59594b1b6d989c9f148054

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                        Filesize

                        152B

                        MD5

                        ea98e583ad99df195d29aa066204ab56

                        SHA1

                        f89398664af0179641aa0138b337097b617cb2db

                        SHA256

                        a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

                        SHA512

                        e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                        Filesize

                        152B

                        MD5

                        4f7152bc5a1a715ef481e37d1c791959

                        SHA1

                        c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

                        SHA256

                        704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

                        SHA512

                        2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                        Filesize

                        696B

                        MD5

                        7a1c4541258a0f88ae0fda1e60372b46

                        SHA1

                        d30ade49303abad95756953e84a3518c373ba62e

                        SHA256

                        d4058c48c2f35e516c7a5ca44dc8a6f94158ff7fff1fcf5e3709c298c74e478d

                        SHA512

                        8b21d5b5191961a23d371214d052115186e0475ed54e333cca556b5f29909b7d65298594d91a577f7c40082d7c96615b01b700006a52f30b2b106ba6e8aaab2f

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                        Filesize

                        2KB

                        MD5

                        9360f16f2b0c12a686108a649d3fee32

                        SHA1

                        6bf30910ee40f70f376342b87816acda521c8237

                        SHA256

                        5625fc4db8832ee3d32dc48bda76d3eea3516814d45900dceebb39d94d429f70

                        SHA512

                        4b23ec62b07b2f5ac5759b0a4e2874fcd1c0c034b03682ad6c8d55493b06ca6540325d7cf3bb3d1f16fbc95d9cf83a0131e6ba4b934077789a4e2a2f5253fc77

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                        Filesize

                        5KB

                        MD5

                        36b1b8b4908e5a1055494b23adc6948c

                        SHA1

                        64baac3a853ad6c4ba131ea04a636069874e705e

                        SHA256

                        5c1abee0064c7ea1da225d9449ff6543299184c4703d58e5dc748386e8ac1af9

                        SHA512

                        009c53e75bcc1059a06c432a89d4d600bb757b9ea6c55dde7b57a6d0f1f70a5624adaa3da7030d4ca5200f7a80d41abd9c596b00c2591679892951a8b1572243

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                        Filesize

                        7KB

                        MD5

                        bb92df3ef5d9f7e04b7dcd787dd3d954

                        SHA1

                        20e69efce22a51cd9f39fe36eff01f621d2e7aa1

                        SHA256

                        8c86343dde2fff97bdd091c8d27595863aba009717184891d62ebbf48d84af99

                        SHA512

                        a7ac53d60c6fce5875593fff3a1f54d221d99cc70965a54127d9e5518eb023713ca6d1e490410f9ffb698cd1be2b9670c99c17758153c75430a80e37f6090714

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                        Filesize

                        16B

                        MD5

                        206702161f94c5cd39fadd03f4014d98

                        SHA1

                        bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                        SHA256

                        1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                        SHA512

                        0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000001
                        Filesize

                        41B

                        MD5

                        5af87dfd673ba2115e2fcf5cfdb727ab

                        SHA1

                        d5b5bbf396dc291274584ef71f444f420b6056f1

                        SHA256

                        f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                        SHA512

                        de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                        Filesize

                        11KB

                        MD5

                        581ebf4610912ed19b83f2e122652f40

                        SHA1

                        8d00f878260fb6db7f133d30c2355a3f12ef52cb

                        SHA256

                        7afde54489e8b72e522f5d045e87565f21ef98fe5617dbc90616b266831dcf3e

                        SHA512

                        b2c6f0ab0806ecdb3fc51ace6ae65abc944b62718ac60644a84b48077f674c608a58be0706f432ed7b69f401d138ae27133e78e44eb53de62b586e580a3a4165

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
                        Filesize

                        264KB

                        MD5

                        f50f89a0a91564d0b8a211f8921aa7de

                        SHA1

                        112403a17dd69d5b9018b8cede023cb3b54eab7d

                        SHA256

                        b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                        SHA512

                        bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_1632\background
                        Filesize

                        29KB

                        MD5

                        34363136d896a1de743489e2aff7d849

                        SHA1

                        2678a41eec6d6d7f3267347f5ea2f7ca770323bb

                        SHA256

                        ae4355bc29fc0b409605faf5c69664a97a44c914e855b474b24281d17b7dcb15

                        SHA512

                        2711c50013f9b763e2eb7eed136f120dbe71b45ed0669655b07393e75f4e704877e7af473133469a012fd13d6bc50f2f715e8244395061a0067a480778759448

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_1632\exitbackground
                        Filesize

                        27KB

                        MD5

                        24103f71a86c20089528c96c0dbe1445

                        SHA1

                        007d7a930dcae7684477347f4f2bd58d4ee5d184

                        SHA256

                        8542e195ef15dfd3ed9b246d3539295f266a19f3bde524c3f41b99adb6719c11

                        SHA512

                        94267aa20fb17e2db9ac31bb20b17e108f99c17f181c8f1612d9ecc9ac1375703b2ec7af3795b7c4ab379723c4c764a137025fb21df3e60859d0480ca546eb10

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_1632\icon150.ico_1
                        Filesize

                        90KB

                        MD5

                        3a341c26e2544bdf7a50e07e8c3f32f3

                        SHA1

                        0ab1c2ca67acc45963b6d913f4d44177d37a9ba4

                        SHA256

                        dd8326f111c92822fc5b46f0dec8998a7fe923be70ddefdf99a9a4ae2d83fad8

                        SHA512

                        c22d40cd6cb9d4877a4b86bead50dc62fb0a0a070d637b2ce72c50407ea3f2de8b137f3d113f67547d7702d0537947c23da57445dd7ade3573bbf90eef39771c

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\MSI544B.tmp
                        Filesize

                        719KB

                        MD5

                        c9c085c00bc24802f066e5412defcf50

                        SHA1

                        557f02469f3f236097d015327d7ca77260e2aecc

                        SHA256

                        a412b642de0e94db761ebd2834dde72eed86e65fc4a580670a300015b874ba24

                        SHA512

                        a6fa1f34cd630a7509a6441be7ad060de7e039967d2ec015e27c2a643b04e0eecf53902b7173c4c2e92e3a890bd7acb6a3307d9923838f0bfc71496fb184b1de

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\MSI5557.tmp
                        Filesize

                        1.1MB

                        MD5

                        6bb65410717bb2c62ed92cdbc9c41652

                        SHA1

                        1f0d56a24588c0c07e878f348df6bb0c3e4f693a

                        SHA256

                        91a6c5daebe89b7d9157188a2b3fa8e47d53b4d20c29bcc244635d1943397f7b

                        SHA512

                        1a864c6d010e3d62337a2067f53e82067ab01a556edee65036658bb7dd863bf22379d16aaf6385fda23060148c68c7225610058a153420e7b125c038285ceb38

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\shiA662.tmp
                        Filesize

                        4.8MB

                        MD5

                        77d6c08c6448071b47f02b41fa18ed37

                        SHA1

                        e7fdb62abdb6d4131c00398f92bc72a3b9b34668

                        SHA256

                        047e2df9ccf0ce298508ee7f0db0abcb2ff9cff9916b6e8a1fbd806b7a9d064b

                        SHA512

                        e1aeb8e8b441d755a119f45a465ca5660678f4131984322252bfb6d2cec52e7ee54d65a64b98429b23915eb5707b04b5cd62a85446c60de8842314130a926dbd

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\zamzar_install.log
                        Filesize

                        102KB

                        MD5

                        9e962c225b6d81269bc2978da36f531f

                        SHA1

                        ad230379024c204fc70a69a9179f0e2155c9f03f

                        SHA256

                        117442b2cbc83849f155a4445300c5c2c647b7bbac79fbc71433aba5bbb819f6

                        SHA512

                        4699be8c5dda41e42a0030f8e95ad8b5415da98ed84d23f1b2ab7fd14da0f6fa759b61eaee73363c7308a8752aba55712a222b52dcfe43994868eb5c9f087a91

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\zamzar_install.log
                        Filesize

                        157KB

                        MD5

                        687f122335785df84265372f373259e4

                        SHA1

                        40e7d0ef83ed05e49a6a6724320dad10b935a820

                        SHA256

                        b8af98dcc0c7ec4720995e4ffc2de062ba2406a7bd8e6b86a8d210a7030adb7b

                        SHA512

                        ae2ec2c5068e71a78c7c4513fe76006e743f4c7658b21b13c2c6a53479a4d803b6367c796bf35e976e471e4d1cf04ff4c6c84b9cc98b6afed611dcaf8a86589a

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Zamzar\ffmpeg.dll
                        Filesize

                        2.7MB

                        MD5

                        4ef50858947386b833d2ad653342dd77

                        SHA1

                        e2123e6fd7d28fb928b0fc30fcb3115b770e0566

                        SHA256

                        33988694bcedb747a56abfa5351127fef6038a888b69ddfe53c5e259a1341477

                        SHA512

                        c4c6b715e4fa7cf4fed2f2484026e42ff640e2e44fa3002a4b69bdabe4b3fd3b7d5a9ada829dfa91a6f1ef283325fe6e31d73f398e551bc1f047b64898c8e259

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Zamzar\resources\app\installer\Zamzar Installer.exe
                        Filesize

                        151KB

                        MD5

                        c52ad210c8f5bf88ddcb6520dd551ee1

                        SHA1

                        b6e16f10ffb2e0eb44f5cfbd6fed551acb531142

                        SHA256

                        bcd787e2f0d499fc668d0829af01e2647d3ee09881fcebfd33fa7242dc38042f

                        SHA512

                        37814936f499e7ecd30562ba240a6f4f29d4ab454baaf5a8ba00bc948ba3e08afbd6e4d74dc2fc789a59053b03d4bb47bc49e0cd668d5ce81ee5b7351566ac3b

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Zamzar\resources\app\installer\zamzar.dll
                        Filesize

                        329KB

                        MD5

                        99697a38605e4de0476e46716ec94f2b

                        SHA1

                        7dee49a866848a49cab5dcad2d00c5617a6673f3

                        SHA256

                        13292f05f24e642a04fdb3a546270b81113a716087bd3d165802c8aeb8d1baaf

                        SHA512

                        fd0042852381cc73238b99af7f303f50bd6585dcf791d034e1c706348c04e02c8d45014cd2269032eb96f3fe705074403083bd27e9c6ef4658aa27538f6d9b9e

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Zamzar\resources\app\installer\zamzar.msix
                        Filesize

                        1.2MB

                        MD5

                        486b88d824b0ed9c1c3a8b78774d4133

                        SHA1

                        29c407785c87831f4530e36eaf335fd97456c4f0

                        SHA256

                        7073e1462c5605f682ec25f423ec6876326cc9f0796e8dd3b8e8f2a74aac3bc5

                        SHA512

                        746b183ea3d1866deac0a97fc3725e6a26f23a0daf11705801d93f4680a04751ab0ce9300afe2c06e88e6ad2d0a0206362bb74f7e9def0b8e8281f3855cb94e3

                        Download Submit
                      • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                        Filesize

                        2B

                        MD5

                        f3b25701fe362ec84616a93a45ce9998

                        SHA1

                        d62636d8caec13f04e28442a0a6fa1afeb024bbb

                        SHA256

                        b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                        SHA512

                        98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                        Download Submit
                      • C:\Users\Admin\AppData\Roaming\Zamzar Ltd\Zamzar 1.1.0\install\x64-build.msi
                        Filesize

                        4.9MB

                        MD5

                        e12656736172ae06246b1bee4fa9a518

                        SHA1

                        744c874132bdc1a44959ee7b2e8c866c9ba859cf

                        SHA256

                        6fe4eb1a3fbe1960b5a5321d88272c29845d661335b0cc05ca23424d49c35af2

                        SHA512

                        f775019810351cb54e8799375028ec388a8d3a75913316765509a73f3ca3c5bfea2857af28c0a70437a21ceefaee829aa92e9d5493734dbc45cef6d5fa971435

                        Download Submit
                      • C:\Users\Admin\AppData\Roaming\Zamzar\Network\Network Persistent State
                        Filesize

                        300B

                        MD5

                        5e9e6fb02e6fcb63a25f02ab3e14b287

                        SHA1

                        19345802a7cbd93be2fe78e0b73651591b098d41

                        SHA256

                        ca921b8e513b9c05a4423c10ba8bf7f903e1759e35881e2ed5b1ffe7143d81ca

                        SHA512

                        743be80f6298befcc0bca36fc0a5249145791a34e866debbb5624f255d4bb41ced8f77d6a25a60793fb2f8815dc9e5f420bea848c715ded9628d562af6237534

                        Download Submit
                      • C:\Users\Admin\AppData\Roaming\Zamzar\Network\Network Persistent State~RFe593687.TMP
                        Filesize

                        59B

                        MD5

                        2800881c775077e1c4b6e06bf4676de4

                        SHA1

                        2873631068c8b3b9495638c865915be822442c8b

                        SHA256

                        226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

                        SHA512

                        e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

                        Download Submit
                      • C:\Users\Admin\AppData\Roaming\Zamzar\Session Storage\CURRENT
                        Filesize

                        16B

                        MD5

                        46295cac801e5d4857d09837238a6394

                        SHA1

                        44e0fa1b517dbf802b18faf0785eeea6ac51594b

                        SHA256

                        0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                        SHA512

                        8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                        Download Submit
                      • C:\Users\Admin\AppData\Roaming\Zamzar\ZamzarAutoUpdater.ini
                        Filesize

                        309B

                        MD5

                        ad8cf9ab04a9ce24e1c5c45b8d1c1057

                        SHA1

                        cd66ce17264d32cef5fda05f9f70a739cb5e711e

                        SHA256

                        bab3197405c7944735fc0ab8d6de7e1a47d9166f57b655ce4473fd31fc90218c

                        SHA512

                        15c8ffe0a79c06e18e4304f9bec7a4f3b90064a8413c9153b92dfc4d11fba61dc0b3363e2ef657dcd9a0a6bc4dfcf8e3853fac3bb22eb5cd022969b531d873ce

                        Download Submit
                      • C:\Windows\Installer\MSID814.tmp
                        Filesize

                        837KB

                        MD5

                        2557173f4299722afce46cc3c0616406

                        SHA1

                        b0343c9a9552be977834e415783b486c4714fe97

                        SHA256

                        e25369e33c7ef36151769a86d833189b275f85045f35873e9e931547e0a6d591

                        SHA512

                        24a46359cb8e22534cbd875fe092d096e3280ca4c24936159894ba95832233ee318494a3eabbdf73ae6010e39a1b5897b4488b2771b416b472bb7f60ceddf40e

                        Download Submit
                      • C:\Windows\Installer\MSIE3EE.tmp
                        Filesize

                        729KB

                        MD5

                        165f730f078c7019ea5f2642f8208cda

                        SHA1

                        370f2e4d1f298b62c1d4743d0e23d2a2d41f950d

                        SHA256

                        48f509d74ca1afa44b3053e5fb0ddc15d56ca8844e9d150419891c5a38a071a6

                        SHA512

                        36868c499b28f96853fb77a1dacef2ad2a06ee7b1be41ff2782ac0f90dd247f522dc64951fa72bb77a85d930ddffe28b06eb391e5bf803e396adaa7211c183b6

                        Download Submit
                      • C:\Windows\Installer\MSIF257.tmp
                        Filesize

                        408KB

                        MD5

                        8cbaf2c688804a0a2f1ca3ad190de71a

                        SHA1

                        f97717a68a25b50ea524e8dc0722cd4c809df0f5

                        SHA256

                        9c221af5f9e8ff37969576703ca47123a3ca7706076275b0365168660bbcfc14

                        SHA512

                        1539f3eda5f8b191dc3eb25b081cec6875518bc46ed006326c3c66495fe54dc8b1d3747fb0bd83d8232aef844688601e2eb13e98cf441519797bf6aa6bb13784

                        Download Submit
                      • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                        Filesize

                        23.7MB

                        MD5

                        2091f58025555b3987305c3374d352ab

                        SHA1

                        b0161e24500f2d1f8d02cae1c35209ff68623c6a

                        SHA256

                        b05d4fe3e42c9caef41862673f7b8dac6459aab278008c0970b5643b8a4b8231

                        SHA512

                        259ecf520a5f2ef1b304e981d977598b9927b5eed09e2d268bd2afbe2eb43109fa3619bf015362674def4c907c4e75470d93c8ecd9da075ffb43f22e4c8bf1fe

                        Download Submit
                      • \??\Volume{b9e6a081-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{ef55369c-a769-401f-a517-13f87ad34dec}_OnDiskSnapshotProp
                        Filesize

                        6KB

                        MD5

                        0f7bc88e739b1434a9a32b336a57c8be

                        SHA1

                        90ae3711782e57ed34da374eecf3b43eee5400c0

                        SHA256

                        8bf945398612b373ae58a53bd3a14ac45c945f2ea4238f5373f2ddf57062ddd1

                        SHA512

                        bf02b654f7fb93f55c272cfc7404fb59346383e33959a9b3eadd9eb563cdd3fe47f53641112add765a9d4eeb2f9d434b17cb37e8fdf6052c8d719f728baba351

                        Download Submit