Resubmissions
14/07/2026, 19:57
260714-yprpwafs3y714/07/2026, 04:43
260714-fckfxsgx7t714/07/2026, 03:04
260714-dk5eyscz9p714/07/2026, 02:55
260714-dem9gse181714/07/2026, 02:51
260714-dce54acy5p714/07/2026, 02:33
260714-c2afgaey4t714/07/2026, 02:30
260714-czl2gscw3r714/07/2026, 02:27
260714-cxvwlscw2n714/07/2026, 02:21
260714-cs1w3aex8x714/07/2026, 02:00
260714-cfd7jacv5q8Analysis
- max time kernel
148s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 02:00
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
XZP-Tool-v2.0/Setup.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
XZP-Tool-v2.0/Setup.msi
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral3
Sample
XZP-Tool-v2.0/XzpTool 2.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
XZP-Tool-v2.0/XzpTool 2.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target XZP-Tool-v2.0/Setup.msi
- Size 698KB
- Sample260714-cfd7jacv5q
- SHA256 1f4bf89c8c3f2b41d95e0bb2dc3bf5923edfdbdfb0d73ff135ad8c79772fa4ee
- MD5 1fbec85b530f27cefc35ba5e4f30c4c5
- SHA1 049035bd43504ca5e1a41d99474f5f54d5953a72
- SHA512 1e0cb7ddb9de4d903ec2d90113f17b47a77c314e420a6b0b2833702f10a5764c7ed246f75c5fb44489203e172334d803aa54394f01db500b5a43c572669cd466
- SSDEEP 12288:hS9MMNI3Nn7ByIuyBlpOuq+8gMMNXpMMNKezwLvEA0tGS/ZE:hS9MMNI3Nn7BjlpOu37MMNXpMMNKezwn
- TLSH T1F8E4CF6232C68B33C49301B545AFA370167DFC305B708687A2907B9E5E727D16B35B9B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 4 IoCs
pid Process 4708 MsiExec.exe 4708 MsiExec.exe 5808 MsiExec.exe 5808 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Xzp Tool\Xzp Tool.ico msiexec.exe File created C:\Program Files (x86)\Xzp Tool\XzpTool 2.exe msiexec.exe - Drops file in Windows directory 14 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI6F99.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA} msiexec.exe File created C:\Windows\SystemTemp\~DFF7831D7658930298.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI7017.tmp msiexec.exe File created C:\Windows\Installer\e596b35.msi msiexec.exe File opened for modification C:\Windows\Installer\e596b33.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI6CD9.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFF6A0911D06156A41.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF9ECF73D30B5906B0.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF96C9F80CF7B5A83D.TMP msiexec.exe File created C:\Windows\Installer\e596b33.msi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3596 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000085dc765dd76e689e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380185dc765d0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410185dc765d000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e385dc765d00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e685dc765d00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\.xzp msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Xzp\shell\open\command\command = 210030005f003f007b00210030005f003f007b00210030005f003f007b0079005b002600620079003e004f0058002e002a0041006a0074004f00660079004a005200760073005500500021002500360033002000220025003100220000000000 msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\.xzp\Xzp\ShellNew msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Xzp\ = "Xzp Archive" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Xzp\DefaultIcon msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\.xzp\Xzp msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Xzp\shell\open\command msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Xzp msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Xzp\shell\open msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Xzp\shell\ = "open" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Xzp\DefaultIcon\ = "%APPDATA%\\Microsoft\\Installer\\{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA}\\_853F67D554F05449430E7E.exe,0" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\.xzp\ = "Xzp" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Xzp\shell msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Xzp\shell\open\command\ = "\"C:\\Program Files (x86)\\Xzp Tool\\XzpTool 2.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Xzp\shell\open\ = "&Open" msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5924 msiexec.exe 5924 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3596 msiexec.exe Token: SeIncreaseQuotaPrivilege 3596 msiexec.exe Token: SeSecurityPrivilege 5924 msiexec.exe Token: SeCreateTokenPrivilege 3596 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3596 msiexec.exe Token: SeLockMemoryPrivilege 3596 msiexec.exe Token: SeIncreaseQuotaPrivilege 3596 msiexec.exe Token: SeMachineAccountPrivilege 3596 msiexec.exe Token: SeTcbPrivilege 3596 msiexec.exe Token: SeSecurityPrivilege 3596 msiexec.exe Token: SeTakeOwnershipPrivilege 3596 msiexec.exe Token: SeLoadDriverPrivilege 3596 msiexec.exe Token: SeSystemProfilePrivilege 3596 msiexec.exe Token: SeSystemtimePrivilege 3596 msiexec.exe Token: SeProfSingleProcessPrivilege 3596 msiexec.exe Token: SeIncBasePriorityPrivilege 3596 msiexec.exe Token: SeCreatePagefilePrivilege 3596 msiexec.exe Token: SeCreatePermanentPrivilege 3596 msiexec.exe Token: SeBackupPrivilege 3596 msiexec.exe Token: SeRestorePrivilege 3596 msiexec.exe Token: SeShutdownPrivilege 3596 msiexec.exe Token: SeDebugPrivilege 3596 msiexec.exe Token: SeAuditPrivilege 3596 msiexec.exe Token: SeSystemEnvironmentPrivilege 3596 msiexec.exe Token: SeChangeNotifyPrivilege 3596 msiexec.exe Token: SeRemoteShutdownPrivilege 3596 msiexec.exe Token: SeUndockPrivilege 3596 msiexec.exe Token: SeSyncAgentPrivilege 3596 msiexec.exe Token: SeEnableDelegationPrivilege 3596 msiexec.exe Token: SeManageVolumePrivilege 3596 msiexec.exe Token: SeImpersonatePrivilege 3596 msiexec.exe Token: SeCreateGlobalPrivilege 3596 msiexec.exe Token: SeCreateTokenPrivilege 3596 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3596 msiexec.exe Token: SeLockMemoryPrivilege 3596 msiexec.exe Token: SeIncreaseQuotaPrivilege 3596 msiexec.exe Token: SeMachineAccountPrivilege 3596 msiexec.exe Token: SeTcbPrivilege 3596 msiexec.exe Token: SeSecurityPrivilege 3596 msiexec.exe Token: SeTakeOwnershipPrivilege 3596 msiexec.exe Token: SeLoadDriverPrivilege 3596 msiexec.exe Token: SeSystemProfilePrivilege 3596 msiexec.exe Token: SeSystemtimePrivilege 3596 msiexec.exe Token: SeProfSingleProcessPrivilege 3596 msiexec.exe Token: SeIncBasePriorityPrivilege 3596 msiexec.exe Token: SeCreatePagefilePrivilege 3596 msiexec.exe Token: SeCreatePermanentPrivilege 3596 msiexec.exe Token: SeBackupPrivilege 3596 msiexec.exe Token: SeRestorePrivilege 3596 msiexec.exe Token: SeShutdownPrivilege 3596 msiexec.exe Token: SeDebugPrivilege 3596 msiexec.exe Token: SeAuditPrivilege 3596 msiexec.exe Token: SeSystemEnvironmentPrivilege 3596 msiexec.exe Token: SeChangeNotifyPrivilege 3596 msiexec.exe Token: SeRemoteShutdownPrivilege 3596 msiexec.exe Token: SeUndockPrivilege 3596 msiexec.exe Token: SeSyncAgentPrivilege 3596 msiexec.exe Token: SeEnableDelegationPrivilege 3596 msiexec.exe Token: SeManageVolumePrivilege 3596 msiexec.exe Token: SeImpersonatePrivilege 3596 msiexec.exe Token: SeCreateGlobalPrivilege 3596 msiexec.exe Token: SeCreateTokenPrivilege 3596 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3596 msiexec.exe Token: SeLockMemoryPrivilege 3596 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3596 msiexec.exe 3596 msiexec.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3596 msiexec.exe 5924 msiexec.exe 4708 MsiExec.exe 5808 MsiExec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5924 wrote to memory of 4708 5924 msiexec.exe 88 PID 5924 wrote to memory of 244 5924 msiexec.exe 94 PID 5924 wrote to memory of 5808 5924 msiexec.exe 96 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\XZP-Tool-v2.0\Setup.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3596
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FC4E4B8D8079D4DEB405C1B873698D5E C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4708
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:244
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9056A925F54E2F6CE454FCE6C9F810ED2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5808
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4660
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e596b34.rbs
- Size 12KB
- SHA256 0a16786e06405d72b39b9c38423eae38e24cd635c90e4534818be415a7daeed8
- MD5 a50787e9e65c2a635ea6c0229fffb8bd
- SHA1 67bdf868d467fc11a5133f6958d58fa2c54b1d22
- SHA512 1d2866c7c53af7d05b71328e85f3435593261f1f9c1e0fc82718ee8ebb051c7416c2ee8b03833fed8903971c33a70b7bc77e751f0a472f1f4d44d3e9142da381
- SSDEEP 384:bU30uJTHKqPJ9pGEpGGxMvTedG/2cK5oNQnjWr2KB:bU30uJTHKqPJ9bLxMvTeY/2cK+NQnjW/
- TLSH T17742CD02B14486C2DC2A2731C716176633A7D3DCF391A67F8D8F8071DF87BA89A6918D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIDC13.tmp
- Size 231KB
- SHA256 97a55524e0bf06419143b1b71778c0ec867716079ab477e8404a0f3125da7dc3
- MD5 0a2626fc9e4e0ca18386c029e9efffd9
- SHA1 ac5576497afac2456f485cdb14bf52d895769651
- SHA512 40b25e507e64b5634e13e83d4bc420196b1294d533e60b01dae8898a8eed939417aec8341b409f59a722d14fb63884c24c5a31985da63933b761f1fc3acb24da
- SSDEEP 3072:Z7PyQaeLAxV9EcU95qWCn7B1kkJQGGhKTWAvdEhMqmc1wtI6M/CoKpixBrnQYaeW:8n3Nn7ByILdEODlcOnlpOuodL+8Y
- TLSH T140346D2036D4DA32E4E321B456BCE67519BEF4705B30C1C7A3941BEE9EA96C0AB34747
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Installer\{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA}\_756133834B381C2B267A80.exe
- Size 24KB
- SHA256 4d2b7456984f643ce10de64a94c33a284b08b332354c97971d27bb2a8413098a
- MD5 f7a7da276ab923c5bbf7bbdc1c479e99
- SHA1 5a4c70f4283183c49731042f37c900fff2f3aedd
- SHA512 8948926ec678e78c401810c6340ec372aa1e8c7bb46c0c69b38117f06d405108af84152c4b7f3857709f42fd8a96e62b199e29bd6bc6e9c3d48f1c92cb0b1729
- SSDEEP 384:4URa3dI2hfSMMQXb5J5PhzmZFImNEOqCC1KPC4Ay7:C3q2EMMQaFImNEOqCCp4Ay7
- TLSH T188B2F8E3B2804A77CC3441FA45D74467650AEC3696812E4BD2E1E72E053362B9D2F95F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e596b33.msi
- Size 698KB
- SHA256 1f4bf89c8c3f2b41d95e0bb2dc3bf5923edfdbdfb0d73ff135ad8c79772fa4ee
- MD5 1fbec85b530f27cefc35ba5e4f30c4c5
- SHA1 049035bd43504ca5e1a41d99474f5f54d5953a72
- SHA512 1e0cb7ddb9de4d903ec2d90113f17b47a77c314e420a6b0b2833702f10a5764c7ed246f75c5fb44489203e172334d803aa54394f01db500b5a43c572669cd466
- SSDEEP 12288:hS9MMNI3Nn7ByIuyBlpOuq+8gMMNXpMMNKezwLvEA0tGS/ZE:hS9MMNI3Nn7BjlpOu37MMNXpMMNKezwn
- TLSH T1F8E4CF6232C68B33C49301B545AFA370167DFC305B708687A2907B9E5E727D16B35B9B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 87396d6bd36c9e2b27f4c021d5e2df0946ddb735d28d1114ca09b0eb8a615a3a
- MD5 1759afd1819af12eaa733eae4d5d4d7d
- SHA1 588699f61150615bf82aaad7be25641f3c9c9ee7
- SHA512 9672951efd327e4a433d81eb81c975890a04170677de675fa2ecb9fc247b499eb477c76ae146d1672f926a40a29e280b04d314494b8edee61059e92bbf7a1dbc
- SSDEEP 24576:UFo3DMPZdoO/vvTL/yQAQiFAvLeqrLXzU9WCtNuYm1ua5nxg8IhWwpKx0ua:IHY
- TLSH T1C257A52476F92200E7B79E3CA8F06A238D397D579C15DE8D45421B4E0922F71E872F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{5d76dc85-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{a1f6d269-c970-4696-ba9f-2ecc6c71a546}_OnDiskSnapshotProp
- Size 6KB
- SHA256 511734751323f030bd1ccefe8459e02fa2d4bea7fd0f8a0cf1f356abc8409e6b
- MD5 132d177346be68bcd93215899c262f0b
- SHA1 6ce0ff76fae1e361f4e62a24a310ff3ab177cbf0
- SHA512 a53a76ae24898cf28ebfaa7ec16303558b50fa3fd3a8ce01bdb3fe3e84d009742fc138be86896599531e5f941eeda53e3cbed76e68a3a097c0547f29f5b8ac34
- SSDEEP 96:FhP0cvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:XNb++uVmN
- TLSH T100D187185AF54711E2B3AB3228F14557A877B911EF33CB8E0198238E6631A10F935F6F
- MD5 SHA1 SHA512 SSDEEP TLSH