Resubmissions
14/07/2026, 19:57
260714-yprpwafs3y714/07/2026, 04:43
260714-fckfxsgx7t714/07/2026, 03:04
260714-dk5eyscz9p714/07/2026, 02:55
260714-dem9gse181714/07/2026, 02:51
260714-dce54acy5p714/07/2026, 02:33
260714-c2afgaey4t714/07/2026, 02:30
260714-czl2gscw3r714/07/2026, 02:27
260714-cxvwlscw2n714/07/2026, 02:21
260714-cs1w3aex8x714/07/2026, 02:00
260714-cfd7jacv5q8Analysis
- max time kernel
148s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 02:51
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
XZP-Tool-v2.0/Setup.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
XZP-Tool-v2.0/Setup.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral3
Sample
XZP-Tool-v2.0/XzpTool 2.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
XZP-Tool-v2.0/XzpTool 2.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target XZP-Tool-v2.0/Setup.msi
- Size 698KB
- Sample260714-dce54acy5p
- SHA256 1f4bf89c8c3f2b41d95e0bb2dc3bf5923edfdbdfb0d73ff135ad8c79772fa4ee
- MD5 1fbec85b530f27cefc35ba5e4f30c4c5
- SHA1 049035bd43504ca5e1a41d99474f5f54d5953a72
- SHA512 1e0cb7ddb9de4d903ec2d90113f17b47a77c314e420a6b0b2833702f10a5764c7ed246f75c5fb44489203e172334d803aa54394f01db500b5a43c572669cd466
- SSDEEP 12288:hS9MMNI3Nn7ByIuyBlpOuq+8gMMNXpMMNKezwLvEA0tGS/ZE:hS9MMNI3Nn7BjlpOu37MMNXpMMNKezwn
- TLSH T1F8E4CF6232C68B33C49301B545AFA370167DFC305B708687A2907B9E5E727D16B35B9B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 4 IoCs
pid Process 1660 MsiExec.exe 1660 MsiExec.exe 5648 MsiExec.exe 5648 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Xzp Tool\Xzp Tool.ico msiexec.exe File created C:\Program Files (x86)\Xzp Tool\XzpTool 2.exe msiexec.exe - Drops file in Windows directory 14 IoCs
description ioc Process File created C:\Windows\Installer\e5a0785.msi msiexec.exe File created C:\Windows\SystemTemp\~DF5AFF4191FD23FDC6.TMP msiexec.exe File created C:\Windows\Installer\e5a0783.msi msiexec.exe File opened for modification C:\Windows\Installer\e5a0783.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI967.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA} msiexec.exe File created C:\Windows\SystemTemp\~DFCFD9930FCDDF73D5.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIDCE.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF5D3E4585759AD94F.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSICF3.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF65D7D72E8325AC67.TMP msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4372 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.xzp msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Xzp\DefaultIcon msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Xzp\shell\open\command msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Xzp msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Xzp\shell\open msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Xzp\shell\ = "open" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.xzp\Xzp\ShellNew msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.xzp\Xzp msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.xzp\ = "Xzp" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Xzp\shell msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Xzp\shell\open\command\ = "\"C:\\Program Files (x86)\\Xzp Tool\\XzpTool 2.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Xzp\shell\open\ = "&Open" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Xzp\ = "Xzp Archive" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Xzp\DefaultIcon\ = "%APPDATA%\\Microsoft\\Installer\\{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA}\\_853F67D554F05449430E7E.exe,0" msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Xzp\shell\open\command\command = 210030005f003f007b00210030005f003f007b00210030005f003f007b0079005b002600620079003e004f0058002e002a0041006a0074004f00660079004a005200760073005500500021002500360033002000220025003100220000000000 msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5596 msiexec.exe 5596 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4372 msiexec.exe Token: SeIncreaseQuotaPrivilege 4372 msiexec.exe Token: SeSecurityPrivilege 5596 msiexec.exe Token: SeCreateTokenPrivilege 4372 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4372 msiexec.exe Token: SeLockMemoryPrivilege 4372 msiexec.exe Token: SeIncreaseQuotaPrivilege 4372 msiexec.exe Token: SeMachineAccountPrivilege 4372 msiexec.exe Token: SeTcbPrivilege 4372 msiexec.exe Token: SeSecurityPrivilege 4372 msiexec.exe Token: SeTakeOwnershipPrivilege 4372 msiexec.exe Token: SeLoadDriverPrivilege 4372 msiexec.exe Token: SeSystemProfilePrivilege 4372 msiexec.exe Token: SeSystemtimePrivilege 4372 msiexec.exe Token: SeProfSingleProcessPrivilege 4372 msiexec.exe Token: SeIncBasePriorityPrivilege 4372 msiexec.exe Token: SeCreatePagefilePrivilege 4372 msiexec.exe Token: SeCreatePermanentPrivilege 4372 msiexec.exe Token: SeBackupPrivilege 4372 msiexec.exe Token: SeRestorePrivilege 4372 msiexec.exe Token: SeShutdownPrivilege 4372 msiexec.exe Token: SeDebugPrivilege 4372 msiexec.exe Token: SeAuditPrivilege 4372 msiexec.exe Token: SeSystemEnvironmentPrivilege 4372 msiexec.exe Token: SeChangeNotifyPrivilege 4372 msiexec.exe Token: SeRemoteShutdownPrivilege 4372 msiexec.exe Token: SeUndockPrivilege 4372 msiexec.exe Token: SeSyncAgentPrivilege 4372 msiexec.exe Token: SeEnableDelegationPrivilege 4372 msiexec.exe Token: SeManageVolumePrivilege 4372 msiexec.exe Token: SeImpersonatePrivilege 4372 msiexec.exe Token: SeCreateGlobalPrivilege 4372 msiexec.exe Token: SeCreateTokenPrivilege 4372 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4372 msiexec.exe Token: SeLockMemoryPrivilege 4372 msiexec.exe Token: SeIncreaseQuotaPrivilege 4372 msiexec.exe Token: SeMachineAccountPrivilege 4372 msiexec.exe Token: SeTcbPrivilege 4372 msiexec.exe Token: SeSecurityPrivilege 4372 msiexec.exe Token: SeTakeOwnershipPrivilege 4372 msiexec.exe Token: SeLoadDriverPrivilege 4372 msiexec.exe Token: SeSystemProfilePrivilege 4372 msiexec.exe Token: SeSystemtimePrivilege 4372 msiexec.exe Token: SeProfSingleProcessPrivilege 4372 msiexec.exe Token: SeIncBasePriorityPrivilege 4372 msiexec.exe Token: SeCreatePagefilePrivilege 4372 msiexec.exe Token: SeCreatePermanentPrivilege 4372 msiexec.exe Token: SeBackupPrivilege 4372 msiexec.exe Token: SeRestorePrivilege 4372 msiexec.exe Token: SeShutdownPrivilege 4372 msiexec.exe Token: SeDebugPrivilege 4372 msiexec.exe Token: SeAuditPrivilege 4372 msiexec.exe Token: SeSystemEnvironmentPrivilege 4372 msiexec.exe Token: SeChangeNotifyPrivilege 4372 msiexec.exe Token: SeRemoteShutdownPrivilege 4372 msiexec.exe Token: SeUndockPrivilege 4372 msiexec.exe Token: SeSyncAgentPrivilege 4372 msiexec.exe Token: SeEnableDelegationPrivilege 4372 msiexec.exe Token: SeManageVolumePrivilege 4372 msiexec.exe Token: SeImpersonatePrivilege 4372 msiexec.exe Token: SeCreateGlobalPrivilege 4372 msiexec.exe Token: SeCreateTokenPrivilege 4372 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4372 msiexec.exe Token: SeLockMemoryPrivilege 4372 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4372 msiexec.exe 4372 msiexec.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4372 msiexec.exe 5596 msiexec.exe 1660 MsiExec.exe 5648 MsiExec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5596 wrote to memory of 1660 5596 msiexec.exe 89 PID 5596 wrote to memory of 1136 5596 msiexec.exe 95 PID 5596 wrote to memory of 5648 5596 msiexec.exe 97 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\XZP-Tool-v2.0\Setup.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4372
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9500A897E9A30D6389325FF5C0104E87 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1660
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1136
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 73C9633D968B46A7F1EEDDAC864206D42⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5648
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:1492
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5a0784.rbs
- Size 12KB
- SHA256 366e6162ea8d38193d53c0470b55b67055639ad24ca990aaf684e30e74c38bc6
- MD5 0566a331cd76ab34deef9d2f9c46ffe9
- SHA1 a03e00bdef0e1beae78c5c6d13a751116020e3c5
- SHA512 d9bf766362576729498054cd4b1aa964d6a9080b9f039a2ca1f95b68098297dda2349f0547f708a96dbbba918cacb11afc4f7f3de6c0b6305a3b719e3e1d1156
- SSDEEP 192:wXthxkfkhnDHAqA6OJyl9C0PDIpGhIxpGhvJ9V9ngz7+wlb+cMvpKUpghaNfgTs/:wipGEpGhmPW
- TLSH T1CB4230417200C1DAE9752B76C217172677B2D3EAF391633BC48F8435DE93FA89A4A4C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI6C0E.tmp
- Size 231KB
- SHA256 97a55524e0bf06419143b1b71778c0ec867716079ab477e8404a0f3125da7dc3
- MD5 0a2626fc9e4e0ca18386c029e9efffd9
- SHA1 ac5576497afac2456f485cdb14bf52d895769651
- SHA512 40b25e507e64b5634e13e83d4bc420196b1294d533e60b01dae8898a8eed939417aec8341b409f59a722d14fb63884c24c5a31985da63933b761f1fc3acb24da
- SSDEEP 3072:Z7PyQaeLAxV9EcU95qWCn7B1kkJQGGhKTWAvdEhMqmc1wtI6M/CoKpixBrnQYaeW:8n3Nn7ByILdEODlcOnlpOuodL+8Y
- TLSH T140346D2036D4DA32E4E321B456BCE67519BEF4705B30C1C7A3941BEE9EA96C0AB34747
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Installer\{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA}\_756133834B381C2B267A80.exe
- Size 24KB
- SHA256 4d2b7456984f643ce10de64a94c33a284b08b332354c97971d27bb2a8413098a
- MD5 f7a7da276ab923c5bbf7bbdc1c479e99
- SHA1 5a4c70f4283183c49731042f37c900fff2f3aedd
- SHA512 8948926ec678e78c401810c6340ec372aa1e8c7bb46c0c69b38117f06d405108af84152c4b7f3857709f42fd8a96e62b199e29bd6bc6e9c3d48f1c92cb0b1729
- SSDEEP 384:4URa3dI2hfSMMQXb5J5PhzmZFImNEOqCC1KPC4Ay7:C3q2EMMQaFImNEOqCCp4Ay7
- TLSH T188B2F8E3B2804A77CC3441FA45D74467650AEC3696812E4BD2E1E72E053362B9D2F95F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e5a0783.msi
- Size 698KB
- SHA256 1f4bf89c8c3f2b41d95e0bb2dc3bf5923edfdbdfb0d73ff135ad8c79772fa4ee
- MD5 1fbec85b530f27cefc35ba5e4f30c4c5
- SHA1 049035bd43504ca5e1a41d99474f5f54d5953a72
- SHA512 1e0cb7ddb9de4d903ec2d90113f17b47a77c314e420a6b0b2833702f10a5764c7ed246f75c5fb44489203e172334d803aa54394f01db500b5a43c572669cd466
- SSDEEP 12288:hS9MMNI3Nn7ByIuyBlpOuq+8gMMNXpMMNKezwLvEA0tGS/ZE:hS9MMNI3Nn7BjlpOu37MMNXpMMNKezwn
- TLSH T1F8E4CF6232C68B33C49301B545AFA370167DFC305B708687A2907B9E5E727D16B35B9B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 f6fe3b0d4d12030c336c1d960a0613de3c8228af59c2f9e5765db92878dca3ed
- MD5 7daf23839d074e8fc843dcbb0c012894
- SHA1 4305fba1e91f8dd5b0af411fd0cbb22ae3d1408d
- SHA512 eafbca233a676d6903dc92ed9cec64fc3c8e5ba37c66ddfccd97b3624fd035df9c783b21857e2ef85be1426a546c09e4499ed7f804a4a6a9b3d57ebed0a9008d
- SSDEEP 24576:vFo3DMPDdoO/vvTL/Sg88iFQvrumHb7P0BKudxSUKpyKpb9cMoRWclmd4+a:RHc
- TLSH T1C857B42436F92200E7F79E3DA8F06A234D397D5BAC15DE8D45511B4E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61f3bad-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{ccdf7c30-1446-4a07-880d-b8624a8e473f}_OnDiskSnapshotProp
- Size 6KB
- SHA256 7504fb7a323b46592412d393677d16bc4f83effbce0d3411dd473d6bc267de94
- MD5 194949c843866c6b4c4e9453722abb7d
- SHA1 90b3e81d8847b617a7e109c297e14d74b50c081b
- SHA512 6bb71cfb72394229067f7ed123cc24aa39d189b7b555fda03d3c3a7f9c5f240f2d8de4aa437f5e3e3f458255d09edc36fa8df0588125ee8a5de23d3291aed651
- SSDEEP 96:F+P7DCvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:Afeb++uVmN
- TLSH T134D178085AF54311E2B3AB3129F14557A877B911FF33CB8E0198238E6661A10F976F6B
- MD5 SHA1 SHA512 SSDEEP TLSH