Overview
overview
7Static
static
3dvorak-key...64.msi
windows10-2004-x64
7dvorak-key...64.msi
windows11-ltsc_2024-x64
7dvorak-key...86.msi
windows10-2004-x64
6dvorak-key...86.msi
windows11-ltsc_2024-x64
6dvorak-key...64.msi
windows10-2004-x64
6dvorak-key...64.msi
windows11-ltsc_2024-x64
6dvorak-key...ak.dll
windows10-2004-x64
1dvorak-key...ak.dll
windows11-ltsc_2024-x64
1dvorak-key...ak.dll
windows10-2004-x64
3dvorak-key...ak.dll
windows11-ltsc_2024-x64
3dvorak-key...ak.dll
windows10-2004-x64
1dvorak-key...ak.dll
windows11-ltsc_2024-x64
1dvorak-key...up.exe
windows10-2004-x64
7dvorak-key...up.exe
windows11-ltsc_2024-x64
7dvorak-key...ak.dll
windows10-2004-x64
3dvorak-key...ak.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
148s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 22:06
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
dvorak-keyboard/dvorak/Dvorak_amd64.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
dvorak-keyboard/dvorak/Dvorak_amd64.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral3
Sample
dvorak-keyboard/dvorak/Dvorak_i386.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
dvorak-keyboard/dvorak/Dvorak_i386.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
dvorak-keyboard/dvorak/Dvorak_ia64.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
dvorak-keyboard/dvorak/Dvorak_ia64.msi
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral7
Sample
dvorak-keyboard/dvorak/amd64/Dvorak.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
dvorak-keyboard/dvorak/amd64/Dvorak.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
dvorak-keyboard/dvorak/i386/Dvorak.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
dvorak-keyboard/dvorak/i386/Dvorak.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
dvorak-keyboard/dvorak/ia64/Dvorak.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
dvorak-keyboard/dvorak/ia64/Dvorak.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
dvorak-keyboard/dvorak/setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral14
Sample
dvorak-keyboard/dvorak/setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
Behavioral task
behavioral15
Sample
dvorak-keyboard/dvorak/wow64/Dvorak.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
dvorak-keyboard/dvorak/wow64/Dvorak.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target dvorak-keyboard/dvorak/Dvorak_amd64.msi
- Size 112KB
- Sample260718-11ekssd15l
- SHA256 ca601b31fc0df9e1dc67634e685e85620022373d58f3a8c577d7ea1fe1520869
- MD5 5a8ab341342070beb0a21ce6aaa85867
- SHA1 a4e45adaaee43d0148cf91a43cd5af5ad1788336
- SHA512 c10e7ab580f75dfcef7bdb7af3f9c8bec37833895c109ad623796b82df15c83961ba4c1ca832b49a5dc37d681d481f0e0a13cf43f6e4a8a7fb6e202384ca0865
- SSDEEP 1536:Wx8fEfvIjLgv/A+VXJ3lIMW10i2AinCNvy/Fae7p1:ojXIngv/ACPIMViRy/Ec7
- TLSH T1D9B35D0777048333D5C20232852FD7E19F799CA84B724513A19EB2AD2CB2BD8E6B75D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 4 IoCs
pid Process 5608 MsiExec.exe 5608 MsiExec.exe 5608 MsiExec.exe 5608 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe - Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\Dvorak.dll msiexec.exe File created C:\Windows\SysWOW64\Dvorak.dll msiexec.exe File opened for modification C:\Windows\system32\Dvorak.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\Dvorak.dll msiexec.exe - Drops file in Windows directory 14 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF19B0BD1AD5525A9D.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI5FCC.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFCAF7A0EA4653A63C.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFE20B792C5E1ECCD6.TMP msiexec.exe File created C:\Windows\Installer\e595857.msi msiexec.exe File opened for modification C:\Windows\Installer\e595857.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{A56E1AA9-28B3-4108-9092-661113C6C712} msiexec.exe File created C:\Windows\SystemTemp\~DF9CD488E29CBFB79B.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI5D78.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5EB1.tmp msiexec.exe File created C:\Windows\Installer\e595859.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4708 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ffbf1fc65d8bbf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ffbf1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ffbf1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ffbf1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ffbf1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\International\AcceptLanguage = "en-US,en;q=0.8,de-DE;q=0.5,de;q=0.2" MsiExec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3012 msiexec.exe 3012 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4708 msiexec.exe Token: SeIncreaseQuotaPrivilege 4708 msiexec.exe Token: SeSecurityPrivilege 3012 msiexec.exe Token: SeCreateTokenPrivilege 4708 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4708 msiexec.exe Token: SeLockMemoryPrivilege 4708 msiexec.exe Token: SeIncreaseQuotaPrivilege 4708 msiexec.exe Token: SeMachineAccountPrivilege 4708 msiexec.exe Token: SeTcbPrivilege 4708 msiexec.exe Token: SeSecurityPrivilege 4708 msiexec.exe Token: SeTakeOwnershipPrivilege 4708 msiexec.exe Token: SeLoadDriverPrivilege 4708 msiexec.exe Token: SeSystemProfilePrivilege 4708 msiexec.exe Token: SeSystemtimePrivilege 4708 msiexec.exe Token: SeProfSingleProcessPrivilege 4708 msiexec.exe Token: SeIncBasePriorityPrivilege 4708 msiexec.exe Token: SeCreatePagefilePrivilege 4708 msiexec.exe Token: SeCreatePermanentPrivilege 4708 msiexec.exe Token: SeBackupPrivilege 4708 msiexec.exe Token: SeRestorePrivilege 4708 msiexec.exe Token: SeShutdownPrivilege 4708 msiexec.exe Token: SeDebugPrivilege 4708 msiexec.exe Token: SeAuditPrivilege 4708 msiexec.exe Token: SeSystemEnvironmentPrivilege 4708 msiexec.exe Token: SeChangeNotifyPrivilege 4708 msiexec.exe Token: SeRemoteShutdownPrivilege 4708 msiexec.exe Token: SeUndockPrivilege 4708 msiexec.exe Token: SeSyncAgentPrivilege 4708 msiexec.exe Token: SeEnableDelegationPrivilege 4708 msiexec.exe Token: SeManageVolumePrivilege 4708 msiexec.exe Token: SeImpersonatePrivilege 4708 msiexec.exe Token: SeCreateGlobalPrivilege 4708 msiexec.exe Token: SeBackupPrivilege 4992 vssvc.exe Token: SeRestorePrivilege 4992 vssvc.exe Token: SeAuditPrivilege 4992 vssvc.exe Token: SeBackupPrivilege 3012 msiexec.exe Token: SeRestorePrivilege 3012 msiexec.exe Token: SeRestorePrivilege 3012 msiexec.exe Token: SeTakeOwnershipPrivilege 3012 msiexec.exe Token: SeRestorePrivilege 3012 msiexec.exe Token: SeTakeOwnershipPrivilege 3012 msiexec.exe Token: SeRestorePrivilege 3012 msiexec.exe Token: SeTakeOwnershipPrivilege 3012 msiexec.exe Token: SeRestorePrivilege 3012 msiexec.exe Token: SeTakeOwnershipPrivilege 3012 msiexec.exe Token: SeRestorePrivilege 3012 msiexec.exe Token: SeTakeOwnershipPrivilege 3012 msiexec.exe Token: SeRestorePrivilege 3012 msiexec.exe Token: SeTakeOwnershipPrivilege 3012 msiexec.exe Token: SeRestorePrivilege 3012 msiexec.exe Token: SeTakeOwnershipPrivilege 3012 msiexec.exe Token: SeRestorePrivilege 3012 msiexec.exe Token: SeTakeOwnershipPrivilege 3012 msiexec.exe Token: SeRestorePrivilege 3012 msiexec.exe Token: SeTakeOwnershipPrivilege 3012 msiexec.exe Token: SeRestorePrivilege 3012 msiexec.exe Token: SeTakeOwnershipPrivilege 3012 msiexec.exe Token: SeRestorePrivilege 3012 msiexec.exe Token: SeTakeOwnershipPrivilege 3012 msiexec.exe Token: SeRestorePrivilege 3012 msiexec.exe Token: SeTakeOwnershipPrivilege 3012 msiexec.exe Token: SeRestorePrivilege 3012 msiexec.exe Token: SeTakeOwnershipPrivilege 3012 msiexec.exe Token: SeRestorePrivilege 3012 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4708 msiexec.exe 4708 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4708 msiexec.exe 3012 msiexec.exe 5608 MsiExec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3012 wrote to memory of 5168 3012 msiexec.exe 94 PID 3012 wrote to memory of 5608 3012 msiexec.exe 96 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\dvorak-keyboard\dvorak\Dvorak_amd64.msi1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4708
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:5168
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 072EA9515023ED6A992291CF6B8AECC82⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5608
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4992
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e595858.rbs
- Size 11KB
- SHA256 b8eaeb8d41182d6e003617cceb16dce10f90e999372c821e6bf075e8cf1ae3ac
- MD5 772452d3461f60c15e3e2240f41cc472
- SHA1 3b76eeb20b6b2d91e54020ed25d87d5ce854f2ca
- SHA512 35e98d66c6884c54b2289b1f98b248c1562971d31c58017fb590f0ed993974828cbd5fb8bdacf98fb08069a7af2bd15053ced09e6adb1d93eaec09eecf72ddac
- SSDEEP 192:4kvtCFa3IYTYmwdYQ1+FdYQ1lYsYdc6YCZYTYYuYaYjYdMHEp6DjwjzjH2jKjzim:4Ys/ssV2Vbrb6NZyYVZI8MbDUHj2Ofim
- TLSH T1CF3211A0B684C6E3E8A21735D92717187772F3D9CA55738F40CCC0A84E42BD98E6E797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI5EB1.tmp
- Size 55KB
- SHA256 51ecd80a8d868820fec1e9a939be55723434c3b0f8d54e66bb78512a7298e4c0
- MD5 9bc979bcb75e3dd95644f8e075c9e5cd
- SHA1 a5f98b6d961924335342e81e1b104f2449cae25d
- SHA512 081c974c278807207ee469674d2325f58c11f754325f5a0654fe942ece4be31f6a1c600b964691201aa92f37eea36cbd4444dce1c57a1558cbc9a9b33088c172
- SSDEEP 768:h+VX3KRO3SgvI8uMW10++cPuGbBinCi6vy/jRae:h+VXJ3lIMW10i2AinCNvy/Fae
- TLSH T13E437D02B758D052F8E61C71817EDAE2797DFEB14B21C94BE255B5AE2C363C2EA30705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Dvorak.dll
- Size 6KB
- SHA256 98763086c0fd7e56624e16b372e55c7096e03deb88650bc586cfeefd062c1b6a
- MD5 39c7392f72703ec37d4d11b4d1a14571
- SHA1 6ddc447ff386652db0183532158ca109a89dd659
- SHA512 b9a47c4955d3b99c241003e7d1f8dd8c580afcf34b9e07b57b84d12a56ec26bd0a49927123b07e49c396023b18b05c51d5f42b2afcc2fca6df92eb632a9319dc
- SSDEEP 48:qwg9Iw+AAgynkYIoarJMVcEjFzuyLT7N8a+q7moWhJUn6Wcu1rDE082Actqsx7Si:Uu1aKcEuyHJ8xnoW86WjVEmrd1ee
- TLSH T179D11F80DFF5813DF2FFCB3814B6662678257D2294F3CA6D1191064B58AF6409F19B39
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Dvorak.dll
- Size 7KB
- SHA256 9d31fbd02defd401e5d20c4bb17ab372dfaa2712e00feb5501d822aa8dd232f6
- MD5 8dd1e39e4795c0c0f7614bd329d0820f
- SHA1 47a3f40c53597943b90d1517ab3512eac5038801
- SHA512 7ed1dbbb14de1805f1c8f63c18c78d7f6cd42afc5c0f8a75d8b35ffbab19e52efbd4bd565808f63433a2bbe32a26e61f941276591565ea2a8ed85588d2177643
- SSDEEP 96:koDt6x1gjrYcEuyHEGA9QF7zufcl0Ghd1e+vP:kUt6jg4cZh2efGw2
- TLSH T1D0E11E40EFF4801DF1BFCA3848B71E6A6926F9224033CB6E1595024E5CAF7455F5AB39
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 b4d6f1314cb70eb417d0aebb120fa42a57be4f3611dde19b7053e24e905a3e7d
- MD5 e6b03dd284babcd4fb6fff26c44d6087
- SHA1 07175340ac2e8fcdfc4b11c3180bd091ab9f2dd1
- SHA512 5b367fb8f4ea7304d70f5010604e7f528ba187123b1b82a2400c3a67ce4241cd05644640f1eefb5a87e73dc045f92e81bab3708920b09d00e829ee44249588fc
- SSDEEP 24576:QFo3DMPVdoO/vvTL/yAsMilQPrOWX7rf0R6e9BCE65iqpLNMMoR2s12NoeG:wH4
- TLSH T19057B51436F92100E7F79E3CA8F06A234D397D5BAC19DE8D45511B8E0922F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61fbfff-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{8bee4bfd-fd3f-4a4e-9baa-0f274813c76f}_OnDiskSnapshotProp
- Size 6KB
- SHA256 f14c0ea1c24b16bdce07873a45e1b2dfe5f742d8a2f365579e6fbaef448a203e
- MD5 708609d747eac5e1c1afd2366c559d0b
- SHA1 47e5c61d6f501d5188babc4f7eb1190cbb175780
- SHA512 0411e108f85bae7440b4d1f5b143da0ea3c22675c91ef503571d8fcdebf244b98c6cd9b073a25a72aa9000db0d1332365f60b4db1c52b406f53dc7c93789275f
- SSDEEP 96:FLEPW5m7lDvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:u2+l/b++uVm
- TLSH T199D1880C1AE54711E2F3AB3129F18557A837B911EF33CB8E0198678E6630910F875F6B
- MD5 SHA1 SHA512 SSDEEP TLSH