Analysis
- max time kernel
148s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 18:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ZeroLauncherInstaller-2.40.1-prerelease.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
ZeroLauncherInstaller-2.40.1-prerelease.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target ZeroLauncherInstaller-2.40.1-prerelease.msi
- Size 11.3MB
- Sample260930-w6fmtstybz
- SHA256 7c4dd2f4acaa6c0fe1b833fd8fc6110889fbfcdd465743cafe817e78afffa524
- MD5 74e8831754ff6a3e83c1ce03df63305f
- SHA1 ccf2555c7f954c5c12aabf139f7b534668301775
- SHA512 e757e4b4890fca4e35e53e5e2fc7854037e1ecefe5c3e5ef6ec8f40246fe9cc8c06a5ff27094e47aaa626e54ed89e968d9670d64bc57f60243ce3556ad878f68
- SSDEEP 196608:nKRDowT2V+QAVljINhlDjelspn+RzH57l8ivB+IeaM0pZIsSPer9V/R:Vw0RwjINhlDVnMzBl8wB+JoWM
- TLSH T1CEC6122166CBC636D95D02F2E53CEE4F1539AEBB076000D7B3E53D9A54708C2A37AA47
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 10 IoCs
pid Process 4952 MsiExec.exe 4952 MsiExec.exe 4952 MsiExec.exe 4952 MsiExec.exe 4952 MsiExec.exe 4952 MsiExec.exe 4952 MsiExec.exe 1208 MsiExec.exe 1208 MsiExec.exe 1208 MsiExec.exe - Enumerates connected drives 3 TTPs 47 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe \??\F:\ msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\X: msiexec.exe - Drops file in Windows directory 15 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e58dc13.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIDDDA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE0AA.tmp msiexec.exe File opened for modification C:\Windows\Installer\{70D35D48-2C7E-4968-8F59-83EC48BC224E}\Zero.exe msiexec.exe File created C:\Windows\Installer\e58dc13.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\{70D35D48-2C7E-4968-8F59-83EC48BC224E}\ZeroLauncher.exe msiexec.exe File created C:\Windows\Installer\e58dc15.msi msiexec.exe File opened for modification C:\Windows\Installer\{70D35D48-2C7E-4968-8F59-83EC48BC224E}\ZeroLauncher.exe msiexec.exe File created C:\Windows\Installer\{70D35D48-2C7E-4968-8F59-83EC48BC224E}\Zero.exe msiexec.exe File opened for modification C:\Windows\Installer\MSIDC90.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDD9A.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{70D35D48-2C7E-4968-8F59-83EC48BC224E} msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1184 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000c7fddbefb65c088a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000c7fddbef0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900c7fddbef000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ac7fddbef000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dc7fddbef000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe - Modifies registry class 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\84D53D07E7C28694F89538CE84CB22E4\MainFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84D53D07E7C28694F89538CE84CB22E4\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84D53D07E7C28694F89538CE84CB22E4\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84D53D07E7C28694F89538CE84CB22E4\SourceList\PackageName = "ZeroLauncherInstaller-2.40.1-prerelease.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84D53D07E7C28694F89538CE84CB22E4\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84D53D07E7C28694F89538CE84CB22E4\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84D53D07E7C28694F89538CE84CB22E4\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84D53D07E7C28694F89538CE84CB22E4\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\84D53D07E7C28694F89538CE84CB22E4 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84D53D07E7C28694F89538CE84CB22E4 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84D53D07E7C28694F89538CE84CB22E4\ProductName = "Zero Launcher" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84D53D07E7C28694F89538CE84CB22E4\Version = "36175873" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84D53D07E7C28694F89538CE84CB22E4\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84D53D07E7C28694F89538CE84CB22E4\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84D53D07E7C28694F89538CE84CB22E4\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84D53D07E7C28694F89538CE84CB22E4\SourceList\Media msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84D53D07E7C28694F89538CE84CB22E4\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4BBEA544847D5884CBEDA369D58402B4 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84D53D07E7C28694F89538CE84CB22E4\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84D53D07E7C28694F89538CE84CB22E4\PackageCode = "3E5707AB2FF546547B3BA834322FA137" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84D53D07E7C28694F89538CE84CB22E4\Language = "2057" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84D53D07E7C28694F89538CE84CB22E4\ProductIcon = "C:\\Windows\\Installer\\{70D35D48-2C7E-4968-8F59-83EC48BC224E}\\Zero.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4BBEA544847D5884CBEDA369D58402B4\84D53D07E7C28694F89538CE84CB22E4 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84D53D07E7C28694F89538CE84CB22E4\SourceList\Net msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4260 msiexec.exe 4260 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1184 msiexec.exe Token: SeIncreaseQuotaPrivilege 1184 msiexec.exe Token: SeSecurityPrivilege 4260 msiexec.exe Token: SeCreateTokenPrivilege 1184 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1184 msiexec.exe Token: SeLockMemoryPrivilege 1184 msiexec.exe Token: SeIncreaseQuotaPrivilege 1184 msiexec.exe Token: SeMachineAccountPrivilege 1184 msiexec.exe Token: SeTcbPrivilege 1184 msiexec.exe Token: SeSecurityPrivilege 1184 msiexec.exe Token: SeTakeOwnershipPrivilege 1184 msiexec.exe Token: SeLoadDriverPrivilege 1184 msiexec.exe Token: SeSystemProfilePrivilege 1184 msiexec.exe Token: SeSystemtimePrivilege 1184 msiexec.exe Token: SeProfSingleProcessPrivilege 1184 msiexec.exe Token: SeIncBasePriorityPrivilege 1184 msiexec.exe Token: SeCreatePagefilePrivilege 1184 msiexec.exe Token: SeCreatePermanentPrivilege 1184 msiexec.exe Token: SeBackupPrivilege 1184 msiexec.exe Token: SeRestorePrivilege 1184 msiexec.exe Token: SeShutdownPrivilege 1184 msiexec.exe Token: SeDebugPrivilege 1184 msiexec.exe Token: SeAuditPrivilege 1184 msiexec.exe Token: SeSystemEnvironmentPrivilege 1184 msiexec.exe Token: SeChangeNotifyPrivilege 1184 msiexec.exe Token: SeRemoteShutdownPrivilege 1184 msiexec.exe Token: SeUndockPrivilege 1184 msiexec.exe Token: SeSyncAgentPrivilege 1184 msiexec.exe Token: SeEnableDelegationPrivilege 1184 msiexec.exe Token: SeManageVolumePrivilege 1184 msiexec.exe Token: SeImpersonatePrivilege 1184 msiexec.exe Token: SeCreateGlobalPrivilege 1184 msiexec.exe Token: SeCreateTokenPrivilege 1184 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1184 msiexec.exe Token: SeLockMemoryPrivilege 1184 msiexec.exe Token: SeIncreaseQuotaPrivilege 1184 msiexec.exe Token: SeMachineAccountPrivilege 1184 msiexec.exe Token: SeTcbPrivilege 1184 msiexec.exe Token: SeSecurityPrivilege 1184 msiexec.exe Token: SeTakeOwnershipPrivilege 1184 msiexec.exe Token: SeLoadDriverPrivilege 1184 msiexec.exe Token: SeSystemProfilePrivilege 1184 msiexec.exe Token: SeSystemtimePrivilege 1184 msiexec.exe Token: SeProfSingleProcessPrivilege 1184 msiexec.exe Token: SeIncBasePriorityPrivilege 1184 msiexec.exe Token: SeCreatePagefilePrivilege 1184 msiexec.exe Token: SeCreatePermanentPrivilege 1184 msiexec.exe Token: SeBackupPrivilege 1184 msiexec.exe Token: SeRestorePrivilege 1184 msiexec.exe Token: SeShutdownPrivilege 1184 msiexec.exe Token: SeDebugPrivilege 1184 msiexec.exe Token: SeAuditPrivilege 1184 msiexec.exe Token: SeSystemEnvironmentPrivilege 1184 msiexec.exe Token: SeChangeNotifyPrivilege 1184 msiexec.exe Token: SeRemoteShutdownPrivilege 1184 msiexec.exe Token: SeUndockPrivilege 1184 msiexec.exe Token: SeSyncAgentPrivilege 1184 msiexec.exe Token: SeEnableDelegationPrivilege 1184 msiexec.exe Token: SeManageVolumePrivilege 1184 msiexec.exe Token: SeImpersonatePrivilege 1184 msiexec.exe Token: SeCreateGlobalPrivilege 1184 msiexec.exe Token: SeCreateTokenPrivilege 1184 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1184 msiexec.exe Token: SeLockMemoryPrivilege 1184 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1184 msiexec.exe 1184 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4260 wrote to memory of 4952 4260 msiexec.exe 89 PID 4260 wrote to memory of 3308 4260 msiexec.exe 107 PID 4260 wrote to memory of 1208 4260 msiexec.exe 109 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ZeroLauncherInstaller-2.40.1-prerelease.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1184
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DE4E382E35645ED696B551BFDE310DB9 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4952
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3308
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4ACACD91AF87396FED235A0D26D5D1872⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1208
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4468
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58dc14.rbs
- Size 12KB
- SHA256 b5a8180e9c188dbcfbd935665cf8c8904135d8cc93a725b56d7dbc912191f332
- MD5 b3cd63f2ee162edfba878e6f79784cd8
- SHA1 a7c72437f9d2f920c80dc04dc8791d5b130c097f
- SHA512 0f76f9801934a9a24d977012e417afe45dfcc3525978cdbcce7df6c73e2afac21a80f1cd34cdae996fedefb162ba9c5610c01b829b7df939372bde4843dcd9ff
- SSDEEP 192:phw63XA3+yipy1BWNpUl3iEWuRmndXBv3mWLBbpqFelElM0BRJ1MlM0BRr1m8sbP:pmEWo/5NELYLNsb08
- TLSH T1B842B443214482D3FC950339832F977D77EB9278A3146F0B926A44AD0E9F64C2EFA6D1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI4C08.tmp
- Size 1.3MB
- SHA256 2e1f01cf245231b35a9b961bc7830a08e68bed9863d7d8daacc0fe5d298faa14
- MD5 7cc81c8339b718bf89372f743946b7c4
- SHA1 d1782e81d58589bcac8cacbd908656d6e1cca526
- SHA512 514f67715ee68f3e776f5991014678b0ae592bc1a978be9bee8b024970f9b537d6cd5cbeeaece6fd76ef4a3021d1888e64244f76cd20bdc98f1ca939a67db3b8
- SSDEEP 24576:ZaOLcT3RlUSuBRgsvoQr/h0lhSMXlaBRSXR2z5C:ZaMcT34SuBysvoQr+0RSh2z5C
- TLSH T13F557C31368AC136DA6E02F16A7CDA9B512E7DB90B7104CBB3D46D6A54308C3A736F17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\ZeroLauncher\app\ZeroLauncher.exe
- Size 155KB
- SHA256 16d287d254cbfa65cae559cf03ed7de0d98fb590c5bb85e129953a7774501e3e
- MD5 4672e614e986327ce00bf37b808dd70d
- SHA1 69a243166e7a4f9db6108326d657ff547f249223
- SHA512 5360e42b94cfa0ad13391169042004f486689718c975d1fa73e014303165eee83e2d7cd0f1c767528a570764baa4dee138c5da3d2e9b27915a6b95c1c8a3b303
- SSDEEP 3072:UqeXA/4yIbHkNPN+6H6xCYOigUE265IJtSe78Y:UvdHkNFdaxmMEoJz8
- TLSH T110F34B17A2A950BDF1B3C639C9928941FBB2781D4B71A6CF17504DB60FB27D0AE79302
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e58dc13.msi
- Size 11.3MB
- SHA256 7c4dd2f4acaa6c0fe1b833fd8fc6110889fbfcdd465743cafe817e78afffa524
- MD5 74e8831754ff6a3e83c1ce03df63305f
- SHA1 ccf2555c7f954c5c12aabf139f7b534668301775
- SHA512 e757e4b4890fca4e35e53e5e2fc7854037e1ecefe5c3e5ef6ec8f40246fe9cc8c06a5ff27094e47aaa626e54ed89e968d9670d64bc57f60243ce3556ad878f68
- SSDEEP 196608:nKRDowT2V+QAVljINhlDjelspn+RzH57l8ivB+IeaM0pZIsSPer9V/R:Vw0RwjINhlDVnMzBl8wB+JoWM
- TLSH T1CEC6122166CBC636D95D02F2E53CEE4F1539AEBB076000D7B3E53D9A54708C2A37AA47
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 d5d3a36ae3e1b78dadfc2163ebf44de597e89952a3b8acd11f778fda8c40ed5f
- MD5 3f5f87bc4362c0432438ae4f7766d5bc
- SHA1 9c4c393923e53a8d1b88718e597de6114f995bd4
- SHA512 39a40491dd5f5cf3dc1ca8b943a845fa8ea854d2653e14ccaeb5fbe7abfc40b61f5f875bd2c0b93616b65b0424e4bf4c0cf9b576b885f802a399c75dd2bd1a95
- SSDEEP 24576:/u8m+1z6doO/vvTLL2G+DWKSXfEzulGSKQmNkZnVe0KHehPbYPF/egthj:e
- TLSH T15B47B42536FD2200E7F79E3C68F06A274D3A7D5BAC159E8D45411B8E0921FB0E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{efdbfdc7-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{332b3b3f-f4dc-4474-b487-61569ecd91f2}_OnDiskSnapshotProp
- Size 6KB
- SHA256 c86ad81158122af55ccfd72e91740783c0f2d0965a671c7f780e2d2d111a4c48
- MD5 2928e3054018faad9d47110e8f81eeec
- SHA1 b9dc086e44c7b37bf164f5bf2a001f956088544b
- SHA512 a036809577f631f13321f49295ae08c13cb40a6ccf4c1e90f8a0c5f6dbf39be8a1dfeb33c9209459dd1c78f5fe91daa9432955c4c2ca260135fdbe7dd42576dc
- SSDEEP 96:FIBmg6vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:mcb++ZVmN
- TLSH T1E7D178085AE54711E2B3AB3229F14557A877B911EF33CB8E0298638E6670A10F935F5F
- MD5 SHA1 SHA512 SSDEEP TLSH