Resubmissions
14/07/2026, 19:57
260714-yprpwafs3y714/07/2026, 04:43
260714-fckfxsgx7t714/07/2026, 03:04
260714-dk5eyscz9p714/07/2026, 02:55
260714-dem9gse181714/07/2026, 02:51
260714-dce54acy5p714/07/2026, 02:33
260714-c2afgaey4t714/07/2026, 02:30
260714-czl2gscw3r714/07/2026, 02:27
260714-cxvwlscw2n714/07/2026, 02:21
260714-cs1w3aex8x714/07/2026, 02:00
260714-cfd7jacv5q8Analysis
- max time kernel
148s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 02:21
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
XZP-Tool-v2.0/Setup.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
XZP-Tool-v2.0/Setup.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral3
Sample
XZP-Tool-v2.0/XzpTool 2.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
XZP-Tool-v2.0/XzpTool 2.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target XZP-Tool-v2.0/Setup.msi
- Size 698KB
- Sample260714-cs1w3aex8x
- SHA256 1f4bf89c8c3f2b41d95e0bb2dc3bf5923edfdbdfb0d73ff135ad8c79772fa4ee
- MD5 1fbec85b530f27cefc35ba5e4f30c4c5
- SHA1 049035bd43504ca5e1a41d99474f5f54d5953a72
- SHA512 1e0cb7ddb9de4d903ec2d90113f17b47a77c314e420a6b0b2833702f10a5764c7ed246f75c5fb44489203e172334d803aa54394f01db500b5a43c572669cd466
- SSDEEP 12288:hS9MMNI3Nn7ByIuyBlpOuq+8gMMNXpMMNKezwLvEA0tGS/ZE:hS9MMNI3Nn7BjlpOu37MMNXpMMNKezwn
- TLSH T1F8E4CF6232C68B33C49301B545AFA370167DFC305B708687A2907B9E5E727D16B35B9B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 4 IoCs
pid Process 5076 MsiExec.exe 5076 MsiExec.exe 3612 MsiExec.exe 3612 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Xzp Tool\Xzp Tool.ico msiexec.exe File created C:\Program Files (x86)\Xzp Tool\XzpTool 2.exe msiexec.exe - Drops file in Windows directory 14 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA} msiexec.exe File created C:\Windows\SystemTemp\~DFD57F8C7DEA322570.TMP msiexec.exe File created C:\Windows\Installer\e59af22.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIB0D8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB31B.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF1EF04EB3E88E26F7.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIB3C8.tmp msiexec.exe File created C:\Windows\Installer\e59af24.msi msiexec.exe File created C:\Windows\SystemTemp\~DFA9AB2503B1295D23.TMP msiexec.exe File opened for modification C:\Windows\Installer\e59af22.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFBCB151F136FEF81E.TMP msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4308 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000031a81fc62ba3bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380131a81fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410131a81fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e331a81fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e631a81fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe - Modifies registry class 15 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Xzp\shell\ = "open" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\.xzp\Xzp msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Xzp\ = "Xzp Archive" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Xzp\shell\open\command msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Xzp\shell msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Xzp\shell\open\command\ = "\"C:\\Program Files (x86)\\Xzp Tool\\XzpTool 2.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Xzp\DefaultIcon msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Xzp msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\.xzp\Xzp\ShellNew msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Xzp\DefaultIcon\ = "%APPDATA%\\Microsoft\\Installer\\{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA}\\_853F67D554F05449430E7E.exe,0" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Xzp\shell\open msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Xzp\shell\open\command\command = 210030005f003f007b00210030005f003f007b00210030005f003f007b0079005b002600620079003e004f0058002e002a0041006a0074004f00660079004a005200760073005500500021002500360033002000220025003100220000000000 msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\.xzp msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\.xzp\ = "Xzp" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Xzp\shell\open\ = "&Open" msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2672 msiexec.exe 2672 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4308 msiexec.exe Token: SeIncreaseQuotaPrivilege 4308 msiexec.exe Token: SeSecurityPrivilege 2672 msiexec.exe Token: SeCreateTokenPrivilege 4308 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4308 msiexec.exe Token: SeLockMemoryPrivilege 4308 msiexec.exe Token: SeIncreaseQuotaPrivilege 4308 msiexec.exe Token: SeMachineAccountPrivilege 4308 msiexec.exe Token: SeTcbPrivilege 4308 msiexec.exe Token: SeSecurityPrivilege 4308 msiexec.exe Token: SeTakeOwnershipPrivilege 4308 msiexec.exe Token: SeLoadDriverPrivilege 4308 msiexec.exe Token: SeSystemProfilePrivilege 4308 msiexec.exe Token: SeSystemtimePrivilege 4308 msiexec.exe Token: SeProfSingleProcessPrivilege 4308 msiexec.exe Token: SeIncBasePriorityPrivilege 4308 msiexec.exe Token: SeCreatePagefilePrivilege 4308 msiexec.exe Token: SeCreatePermanentPrivilege 4308 msiexec.exe Token: SeBackupPrivilege 4308 msiexec.exe Token: SeRestorePrivilege 4308 msiexec.exe Token: SeShutdownPrivilege 4308 msiexec.exe Token: SeDebugPrivilege 4308 msiexec.exe Token: SeAuditPrivilege 4308 msiexec.exe Token: SeSystemEnvironmentPrivilege 4308 msiexec.exe Token: SeChangeNotifyPrivilege 4308 msiexec.exe Token: SeRemoteShutdownPrivilege 4308 msiexec.exe Token: SeUndockPrivilege 4308 msiexec.exe Token: SeSyncAgentPrivilege 4308 msiexec.exe Token: SeEnableDelegationPrivilege 4308 msiexec.exe Token: SeManageVolumePrivilege 4308 msiexec.exe Token: SeImpersonatePrivilege 4308 msiexec.exe Token: SeCreateGlobalPrivilege 4308 msiexec.exe Token: SeCreateTokenPrivilege 4308 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4308 msiexec.exe Token: SeLockMemoryPrivilege 4308 msiexec.exe Token: SeIncreaseQuotaPrivilege 4308 msiexec.exe Token: SeMachineAccountPrivilege 4308 msiexec.exe Token: SeTcbPrivilege 4308 msiexec.exe Token: SeSecurityPrivilege 4308 msiexec.exe Token: SeTakeOwnershipPrivilege 4308 msiexec.exe Token: SeLoadDriverPrivilege 4308 msiexec.exe Token: SeSystemProfilePrivilege 4308 msiexec.exe Token: SeSystemtimePrivilege 4308 msiexec.exe Token: SeProfSingleProcessPrivilege 4308 msiexec.exe Token: SeIncBasePriorityPrivilege 4308 msiexec.exe Token: SeCreatePagefilePrivilege 4308 msiexec.exe Token: SeCreatePermanentPrivilege 4308 msiexec.exe Token: SeBackupPrivilege 4308 msiexec.exe Token: SeRestorePrivilege 4308 msiexec.exe Token: SeShutdownPrivilege 4308 msiexec.exe Token: SeDebugPrivilege 4308 msiexec.exe Token: SeAuditPrivilege 4308 msiexec.exe Token: SeSystemEnvironmentPrivilege 4308 msiexec.exe Token: SeChangeNotifyPrivilege 4308 msiexec.exe Token: SeRemoteShutdownPrivilege 4308 msiexec.exe Token: SeUndockPrivilege 4308 msiexec.exe Token: SeSyncAgentPrivilege 4308 msiexec.exe Token: SeEnableDelegationPrivilege 4308 msiexec.exe Token: SeManageVolumePrivilege 4308 msiexec.exe Token: SeImpersonatePrivilege 4308 msiexec.exe Token: SeCreateGlobalPrivilege 4308 msiexec.exe Token: SeCreateTokenPrivilege 4308 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4308 msiexec.exe Token: SeLockMemoryPrivilege 4308 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4308 msiexec.exe 4308 msiexec.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4308 msiexec.exe 2672 msiexec.exe 5076 MsiExec.exe 3612 MsiExec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2672 wrote to memory of 5076 2672 msiexec.exe 88 PID 2672 wrote to memory of 3840 2672 msiexec.exe 94 PID 2672 wrote to memory of 3612 2672 msiexec.exe 96 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\XZP-Tool-v2.0\Setup.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4308
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3201D8471C0D3FD4331F837FBE61A97F C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5076
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3840
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5850C6E4D25E00FD119CEB22FE618BFB2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3612
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:3220
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59af23.rbs
- Size 12KB
- SHA256 0609b174cc0a8332daf94032936d0b7ff69903e8aa6ac4edfda295349f547f83
- MD5 642dd0e5968837df4eed9c8ea360bf90
- SHA1 db2bbaba9c55d06195fd35eaa4417e682f884e8b
- SHA512 bdaa8e5c6434c31cb36016bd466bfabf2f9a62896d64654b84bacdcaa18a00cf47e686fb02d58d88d67fd3cd4c103a77ba3117d951d3f3cd5f2d32b1d53bcbaa
- SSDEEP 192:Lft6QZ/4m4UOVQpC1IpGhIxpGhDV9n8VepKUp3:LFpGEpG9yfa
- TLSH T14E420102B204D1C6D8762731C667271A77B3D3D8F354A37BC54F8061EE93BBDA689085
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI2272.tmp
- Size 231KB
- SHA256 97a55524e0bf06419143b1b71778c0ec867716079ab477e8404a0f3125da7dc3
- MD5 0a2626fc9e4e0ca18386c029e9efffd9
- SHA1 ac5576497afac2456f485cdb14bf52d895769651
- SHA512 40b25e507e64b5634e13e83d4bc420196b1294d533e60b01dae8898a8eed939417aec8341b409f59a722d14fb63884c24c5a31985da63933b761f1fc3acb24da
- SSDEEP 3072:Z7PyQaeLAxV9EcU95qWCn7B1kkJQGGhKTWAvdEhMqmc1wtI6M/CoKpixBrnQYaeW:8n3Nn7ByILdEODlcOnlpOuodL+8Y
- TLSH T140346D2036D4DA32E4E321B456BCE67519BEF4705B30C1C7A3941BEE9EA96C0AB34747
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Installer\{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA}\_756133834B381C2B267A80.exe
- Size 24KB
- SHA256 4d2b7456984f643ce10de64a94c33a284b08b332354c97971d27bb2a8413098a
- MD5 f7a7da276ab923c5bbf7bbdc1c479e99
- SHA1 5a4c70f4283183c49731042f37c900fff2f3aedd
- SHA512 8948926ec678e78c401810c6340ec372aa1e8c7bb46c0c69b38117f06d405108af84152c4b7f3857709f42fd8a96e62b199e29bd6bc6e9c3d48f1c92cb0b1729
- SSDEEP 384:4URa3dI2hfSMMQXb5J5PhzmZFImNEOqCC1KPC4Ay7:C3q2EMMQaFImNEOqCCp4Ay7
- TLSH T188B2F8E3B2804A77CC3441FA45D74467650AEC3696812E4BD2E1E72E053362B9D2F95F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59af22.msi
- Size 698KB
- SHA256 1f4bf89c8c3f2b41d95e0bb2dc3bf5923edfdbdfb0d73ff135ad8c79772fa4ee
- MD5 1fbec85b530f27cefc35ba5e4f30c4c5
- SHA1 049035bd43504ca5e1a41d99474f5f54d5953a72
- SHA512 1e0cb7ddb9de4d903ec2d90113f17b47a77c314e420a6b0b2833702f10a5764c7ed246f75c5fb44489203e172334d803aa54394f01db500b5a43c572669cd466
- SSDEEP 12288:hS9MMNI3Nn7ByIuyBlpOuq+8gMMNXpMMNKezwLvEA0tGS/ZE:hS9MMNI3Nn7BjlpOu37MMNXpMMNKezwn
- TLSH T1F8E4CF6232C68B33C49301B545AFA370167DFC305B708687A2907B9E5E727D16B35B9B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 17f63a16251473fd6e016fbc53ac4208bbc54e19c0fbda84e706b334ce876db0
- MD5 b70a7548241ab425ad2b668263a0ae1a
- SHA1 1a7ea8e4751de9aa271a2375263bf8bc12315498
- SHA512 88a51b5dd8dba498842e0c2660032266d4aac8d0fc7d434544615846b0bf509147819d350e316b6f13251674487555feb240315f28c1fc53eca165e820c882d9
- SSDEEP 24576:aFo3DMPNdoO/vvTL/yAjDilQP7eJY7Eg0+1xNudb1WtqJESTsIRmD6pin+3:OHU
- TLSH T15E57B31436F92200E7B79E3DB8F06A234D397D5BAC15DE8D45511B8E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61fa831-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{f372cea3-3987-4203-a0f0-8f1a45a2cf1b}_OnDiskSnapshotProp
- Size 6KB
- SHA256 50c3da5a06a67c5b6ca23ee197a53858d33137696fc0fdccfe08613af6bb5724
- MD5 38a64e771ebf757c0e3d420e7603fb95
- SHA1 f60f0310c4a8067a6f0478f21749a5b496225643
- SHA512 49528d571a468b5479cf16f79970e24fefc87fbfa456a74d6ce45f8574518b1c26dc528a7c483ad7750969b84de6f65e752200eae715e03fa453bc3156150964
- SSDEEP 96:FALIPbOuvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:wIyib++uVmN
- TLSH T109D178185AF54711E2B3AB3228F14557A877B911EF33CB8E0198238E6671A10F935F6F
- MD5 SHA1 SHA512 SSDEEP TLSH