Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
09/02/2026, 12:19
Behavioral task
behavioral1
Sample
835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe
- Size 163KB
- Sample260209-phk43sdz5e
- SHA256 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5
- MD5 a727362416834fa63672b87820ff7f27
- SHA1 4ec3c90846af6b79ee1a5188eefa3fd21f6d4cf6
- SHA512 57c10403889ed063bc6100038ba3e8ce68e753c0b2ca93b1e6b8232185aaba31c5a5c0ae2e41226690a65c896dc0954f6836ab9ea430df5d7caf604a2da2c500
- SSDEEP 3072:fT4SpKtaWp+id2jJgc43l4l2tgQyRUJWXBVDhDq2:r4SMtaz0l1fHyaoThDR
- TLSH T1C8F37C1275D08071D573067609F8AB355A7DBD620F629ACFB7C80B0D1AB41D1AB367A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 4 IoCs
pid Process 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found - Drops desktop.ini file(s) 30 IoCs
description ioc Process File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Users\Public\Videos\desktop.ini 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1383858298-2057492509-1726743289-1000\desktop.ini 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files (x86)\desktop.ini 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Users\Admin\Links\desktop.ini 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Users\Public\Music\desktop.ini 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\Downloaded Program Files\desktop.ini 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Users\Admin\Music\desktop.ini 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Users\Public\Documents\desktop.ini 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Users\Public\desktop.ini 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\desktop.ini 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\Fonts\desktop.ini 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe - Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\nl_FEMININE.pak 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ppd.xrm-ms 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libaes3_plugin.dll 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SmallTile.scale-100.png 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxCalendarMediumTile.scale-200.png 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-96_altform-lightunplated_contrast-white.png 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\sat_logo_2x.png 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarLargeTile.scale-400.png 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Primitives.resources.dll 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-80.png 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\en-US\msdaremr.dll.mui 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ppd.xrm-ms 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Configuration\config.xml 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOIDCLIL.DLL 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\AppxManifest.xml 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-96_altform-unplated_contrast-black.png 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.SqlServer.Types.dll 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MeetingJoinAxOC.dll 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\FeedbackHubAppList.scale-100.png 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateCore.exe 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ul-oob.xrm-ms 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013bw.dotx 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_10_p010_plugin.dll 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\customizations\Customizer.js 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\es-es\ui-strings.js 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Conversion.v3.5.resources.dll 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\index.html 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libvdr_plugin.dll 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\NewsAppList.targetsize-96_altform-unplated.png 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-30_altform-unplated_contrast-white.png 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\paintpicture.targetsize-128.png 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-40_altform-unplated.png 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\glib-lite.dll 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Win.Misc.v11.1.dll 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationProvider.resources.dll 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_11.2104.2.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SnipSketchAppList.scale-125.png 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\eml.scale-48.png 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreSmallTile.scale-200_altform-colorful_theme-light.png 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\Add-Numbers.ps1 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-150.png 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-36_altform-unplated_contrast-white.png 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIDE.dll 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\selection-actions.png 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldNotExist.snippets.ps1xml 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\Windows Photo Viewer\PhotoBase.dll 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\Assets\Icons\StickyNotesAppList.targetsize-256_altform-unplated.png 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\PhotosLogoExtensions.targetsize-40.png 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeSmallTile.scale-150.png 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Tentative.scale-400_contrast-black.png 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Specialized.dll 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\uk_FEMININE.pak 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\Images\splashscreen.scale-200_altform-colorful_theme-light.png 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\archives\data-1aa6d744f14b0274bfb2dd528b45b73676e640fa.archive 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Robmikh.CompositionSurfaceFactory.dll 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\Microsoft.PackageManagement.CoreProviders.resources.dll 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\selector.js 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\ca-ES\PAD.Console.Host.resources.dll 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_12008.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreStoreLogo.png 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-ae\ui-strings.js 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-black\NotepadAppList.targetsize-30.png 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_100_percent.pak 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\diagnostics\system\Power\uk-UA\RS_DisableScreensaver.psd1 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\Fonts\vga775.fon 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\logo.targetsize-256_altform-unplated.png 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\BIBUtils.dll 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\Fonts\dosapp.fon 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\INF\acpipagr.PNF 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\INF\c_pnpprinters.inf 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\INF\mbtr8897w81x64.inf 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ViewerPS.dll 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfkd.nlp 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S356e1ba0#\1c78231be6944e936e168f3d84cd68f6\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\Cursors\ibeam.svg 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\diagnostics\system\BITS\RC_BITSDLL.ps1 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\Help\mui\0407\msorcl32.chm 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\apppatch\ja-JP\AcRes.dll.mui 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\INF\vca.inf 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\diagnostics\system\Audio\RS_ChangeVolume.ps1 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\diagnostics\system\IESecurity\uk-UA\RS_Blockpopups.psd1 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\Fonts\palab.ttf 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\assembly\GAC_MSIL\mscorlib.Resources\2.0.0.0_ja_b77a5c561934e089\mscorlib.resources.dll 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\Fonts\DUBAI-REGULAR.TTF 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\Cursors\aero_move_xl.cur 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\INF\netip6.inf 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data.Resources\8.0.0.0_es_b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.resources.dll 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\Fonts\holomdl2.ttf 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\Fonts\msjh.ttc 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\wide.phone.png 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\INF\wsearchidxpi\0411\idxcntrs.ini 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.Security.Resources\2.0.0.0_es_b03f5f7f11d50a3a\System.Security.Resources.dll 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.Web.Routing.Resources\3.5.0.0_es_31bf3856ad364e35\System.Web.Routing.Resources.dll 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W708fc392#\98a7778c2b17d6ac957e5a4b10137c68\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll.aux 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\Presentatio5ae0f00f#\5246a1f386bed92b8c9877d6dd0cfbaa\PresentationFramework.ni.dll 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\INF\mdmpace.inf 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\ksc.nlp 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.Core.Resources\3.5.0.0_de_b77a5c561934e089\System.Core.Resources.dll 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\diagnostics\system\Power\ja-JP\RS_AdjustScreenBrightness.psd1 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.Web.Entity.Resources\3.5.0.0_fr_b77a5c561934e089\System.Web.Entity.Resources.dll 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\System\1a1b2c0d59576b0e7cc713a8229a5ff1\System.ni.dll 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\napcrypt\49c9b962951833c9f23b9ba383f252fa\napcrypt.ni.dll.aux 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\diagnostics\system\Audio\RS_SamplingRate.ps1 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\Fonts\vga850.fon 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\splashscreen.scale-400.png 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMDiagnostics.Resources\3.0.0.0_ja_b77a5c561934e089\SMDiagnostics.resources.dll 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\assembly\GAC_MSIL\UIAutomationProvider\3.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\th-TH_BitLockerToGo.exe.mui 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\diagnostics\system\Power\de-DE\Power_Troubleshooter.psd1 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\Help\mui\0407\msdasc.chm 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\E39B69A3F3677E14587CF1C3CC73FE72\48.108.8828\fileCoreHostExe 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_ja_31bf3856ad364e35\MMCEx.Resources.dll 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\diagnostics\system\Power\it-IT\RS_ResetIdleDiskTimeout.psd1 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\Help\mui\0C0A\mmc.CHM 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\logo.contrast-black_scale-400.png 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.Data.Services.Resources\3.5.0.0_fr_b77a5c561934e089\System.Data.Services.resources.dll 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.We9f24001#\6fce37222e24a071ccae099996be783c\Microsoft.WSMan.Management.Activities.ni.dll.aux 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\INF\c_camera.inf 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\INF\mdmsii64.inf 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\INF\qcwlan64.inf 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.Printing.Resources\3.0.0.0_es_31bf3856ad364e35\System.Printing.resources.dll 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\Cursors\busy_rm.cur 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\Globalization\Sorting\SortWindows62.nls 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\logo.targetsize-72_contrast-white.png 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe File opened for modification C:\Windows\INF\wvmic_timesync.inf 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe"C:\Users\Admin\AppData\Local\Temp\835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5.exe"1⤵
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4480
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\icudtl.dat
- Size 16B
- SHA256 0edfb6e8076ad04a76570166345a35cf2a67713cdc677f50ac2361a294fdcfe1
- MD5 1622a639750dce9da2e936d28c703235
- SHA1 ce645683d7511642dfaffc1e69eaec71b2fbe56b
- SHA512 04538ea7490951ca276bce76f99dca5ffbdd80de84d3b5a9469c91709a54d8e4fb13787953de8967a912ebaf236ed1590e8a2c00b30925944d66ca5b3f67bdb4
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Trust Protection Lists\Sigma\Fingerprinting
- Size 172B
- SHA256 6ebbee05af0d34323e4eee6e624860345616e1b31de260478e93d4bceae3563a
- MD5 498fe85be410f26e88b0dad2a6000ae1
- SHA1 674bcdbc2f9d81f5b5435869d986e90f9e012dd1
- SHA512 659e9f9849350bf73bf457d3b5a7a28734ace827e8d8ceb13b70d24af058858e36c4d7a692e1d1ce01e967704b628ef054e79b1f6e5000f124d8f5b24ac47b0d
- TLSH T1B1C08C0B1F23C6830E085CC7A311200C2C00AB7C0496DCF183D089A15850F8E80F0040
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll
- Size 18.4MB
- SHA256 e888a01f0f4436f9f83cc6fd4611dac75e5c1685cefd3903522e93c28b2a2f04
- MD5 bbc497a8970637ec3e8e947dc2c4c37f
- SHA1 44b19ea3379b85661482cdd16f85d50b2ee336a2
- SHA512 04fcf984578bed0e3a712789617dceea96f7f7632afdfa1b600b3b1091e9459e4d9e1393bd6173b2f5da004a9cbfc6fad5d4afc41ebe7e943c8277d6f4327301
- SSDEEP 393216:v2h8nWnrijhXm6HF80RRn5NsQ6/SapuM/6aM2Moj7L5Lh:QijhX/K0RRvsQsSawMJvL5Lh
- TLSH T1E817E04EE73351A5E80E8CF18379A962D0343D4E0362EEAF17D479315A727C4AA79F09
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Trust Protection Lists\Sigma\Entities
- Size 42KB
- SHA256 d5b0710d45843e0d6eab704c3e8972b064026696cabd457b9b5f59d9bf064c0b
- MD5 3ce8a69f25a2c3ad075c60ef1faf9196
- SHA1 ad756799946ad0ef6c95343f9a1419398e025439
- SHA512 0f50650b04961d8ec333c82ffedcaf2db7eb1a01d45d034205d2e737e221e58cda796d5881a6439dc5f1ba3a29699d12fd8685e539f1b0b705421b04fc9596fd
- SSDEEP 768:J4f1uAf8UY6709C/Ank/5WEhmacUGi01cGiEdwLXIZ6xcjfEDfNMREA165:mdXfrwn2AnTdw8YEY6NA
- TLSH T1C51383388F13C61618DB098B7259A98C51140FE93F92DDE4DBBFBD590203FA931BC56A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_proxy\win11\identity_helper.Sparse.Internal.msix
- Size 56KB
- SHA256 d0a79556fe4e5e4876d2615b90dea5c3a6cf17d19bc760d48e14a6ce17ea8670
- MD5 885b6a891e5ffce4309675782d21c96e
- SHA1 90da3605ccbd7d343efcae738b25572ba50251a3
- SHA512 de1362cc2a0e9489ab5c4cc1bbcee4cd5a51859fb8116bcefec928b7d4e90aeff921066604ed77f08f7c508c9cf6df27d38a83831d33b24b70016e5a4d6acfff
- SSDEEP 1536:v/KeT1Qyr5S73zAg0YgUKxMpf04MerZAymrdFAK:XK4XC57gUKxMpf04M4ZAyydSK
- TLSH T19243D06DAF77D723CA681CF39759790A1229A70D38D4CC7AAFC06C988660B4CD9F0658
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_bho.dll
- Size 438KB
- SHA256 79300f354bc691ff95d4ed043a370f13f2acdfd6869a0eb0386efa9a52f9423b
- MD5 d8a5a4acc1911631670ca812f23d7ac0
- SHA1 9cb0e2310882ae67c193ece386fb71d4df814ef3
- SHA512 d0bab0b0b48c5d308e8968a2b75976d6cbda2d916188bb416848c1454633363278ae04109bb8779ccdaa088b266982b4e68ee871fec948ca276dcfbb7c5b5b49
- SSDEEP 6144:KBJaiiFtH8jEMy/dvo4MA7i2yz3o2u+6HQ2ZKU/Fp9XHCDwdQeCAnvnE:KBpCtlMgNd2u+6HQ2ZXpM6
- TLSH T18B947C057AA3D173D41E28B317A4F3240A38BA264FA4CDDB97841DBA6FB13C0D93565B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\sl.pak.DATA
- Size 1.0MB
- SHA256 10a5fa7f6447ebdd66dcbcbb306022af5dd0a9beb5fce8c40e63541fc9c54d6c
- MD5 4b9ce2e1f2e0a34bf87d43898d52c8c4
- SHA1 aed1c3d718202f9a69d0141e644b8c6312fea611
- SHA512 75c364423a978688cac12f37dc444d83a4f379c7717551141e872aa277af3a4041814c1cc986b11516f761366889b1c8cbc3611fb072d163801cd428067d3192
- SSDEEP 24576:hztBcvu1Ki7zLVutMPdSwj3FZ7AeyqmkR32:hJBLflRAeyqmQ2
- TLSH T19D35093DEFBBCF0F0D5566C7AF911610769C468ED181CE71BE8E27296202BAC92F8154
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_wer.dll
- Size 126KB
- SHA256 96f98b6ce4ed56fbeab073221051324a4198ee8d5f703a5e5cc5e687e704b048
- MD5 28e798cb2e7ee78a7e1977c2d89955a6
- SHA1 d9a2089e4ab7f86f78b2f739779475a55a169d6a
- SHA512 c45ed3a5539e8140790008cf854ebd501a6231b177129674a31770af57dfb3c7947da3073e40f9526e7ac8be846f2a114f09af2400e8c9558804fba48f006cab
- SSDEEP 3072:SujUah9rFrsTqp5S2NQlxbk8TWxCyXvub1y5IBesy2:Srs95rOnbk8TWkMk
- TLSH T1C2C33A4E6BB74267E0664AF5C6536A01AB33B50907A0EFBF03E04A551F137C8ED79B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Locales\lo.pak
- Size 2.1MB
- SHA256 d145ca02384c682b37cd17a544c4233ca802f862954befb7276a2c6df3dddaa9
- MD5 2edcee1a5c465ffe77c392016727d830
- SHA1 a6699c5078ef41faa30f71e1c1aaf6f8c69f5efa
- SHA512 38d5dd419f9944937cd84cc0c99b91e348d9550215930c9424a930707cd461bfc4ef40bada30de1ba2a42e1c8aace41671089ceaaeb3b1c0f7b2bcb299854bfa
- SSDEEP 12288:+R67R9mTo/A17O2KYsIhTuTM2e5et6FFAHEwRfJ3qu6TgThNKiYmCySehaYPwcBn:+ReAVhOY2e5et6FF2X
- TLSH T114A52510A9AFA3F091F41783795362F653B58E38F0A7A8603B9E4D785EC1D34EC47668
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\fr-CA.pak.DATA
- Size 1.2MB
- SHA256 1e5676e61793adac9a730f9c5a1eb95be2f6717a8064a975d2195f4ef37a0c3c
- MD5 94a4493ff170c752af0087aed4f9e3bc
- SHA1 75a54ec934f95d8748377d62caf1c33beb99700d
- SHA512 8d34dcf9b0d1043b1e7b22f7989c6ad6a1cd92e6b7c1e94c700d21a382f451891323a5bec9e21da8e6b9a6bf6e64ecf90f69fa0a4e9ccdb8165671883c878c8c
- SSDEEP 12288:/Mi5RZI+gUF6s9yGswVTfHEH4lJf76swGrpJxPMy6S0gjiNliuNoPNrsceDv6iPx:kiXDxVTf3xWS0gjizXcPECOf
- TLSH T1BB45E75FEAD7A2C349C116E3BB029563A934C34DE141CB10AAEF4655138BAECD3EB1D4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\delegatedWebFeatures.sccd.DATA
- Size 17KB
- SHA256 d04e57135d01604c438bb35f9dc9749f86c5b415ef9dbae578648f012548bbf3
- MD5 7c7e5a322cd77e96ebbf505ff2faa266
- SHA1 b3356597c0f2bcb3693fab5890b0785678aea537
- SHA512 3cf31c04704b008aab195ffbae107ecb9758ad2ddd707182f323d9a6e5137d5abeab9f3062217802e5ac4cc0e49406c9d8af4f03a60c43c7b7144a39349e8fa9
- SSDEEP 384:wzOC+5bMCBDCbxaKpZ34KNMWoUSy6DZJ/2pMimfBupT89MHQob+ZIk1P4tzZRhDz:zZImCaKpZ34KNMWoUSVVJ/W3mJupT89w
- TLSH T109827CEB5F136F17944B9CD4D19D9E69A818571F49D1CEB867D03C22802BB68D2F34C1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\VisualElements\LogoCanary.png
- Size 29KB
- SHA256 760e61e331599cd3f62d7c0b177bcd71be813625d00b73dec578b8591f9984c4
- MD5 6cf78c22e5500c61415bd716f7ad4029
- SHA1 aa0cc0021d4bdcad7e50153ab51dbe4dec41d1b4
- SHA512 36810051bbba44d793192c544aef001b2ddf48c64d62f7fdd21783ade4b54f6efce100c5fc7f998b3a87844f21f560d900eddaa934aaea50c1707239e95733fd
- SSDEEP 768:IZGZzY/0qaI+xwT9G28If/mvyteiaxx0Ly:xY/0qaI/5hjeVxSG
- TLSH T159D2BEAC9F33EB87C8686CF327A63AE45624474D14D1CF346BD6AE54234830DD1FA299
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\learning_tools.dll
- Size 1.2MB
- SHA256 31aef00c027dcdfb120d29289ac317b82194dc1fbf228f2fa10381a0ac3d0fbb
- MD5 e5a829c58e8def67bf11168b3ea9cdca
- SHA1 de54dc30e903fdc960064c4d698b77bb4bb74c8f
- SHA512 2254e2073fa7fad41ca6ec61ce12826c31df352c07f0fbfff1476f5e9a3fc76b5bc601837048545b493750eb934574b19912bbb7f0ce20d1d253c3851eff835c
- SSDEEP 12288:1mHV2gRYZPoPp9/QIaLSWiHgkLcIGycaQjYgkLcIBcaQXgkLcImcx8YJ6aQzDtzD:1m24p9/TWigEYJ6aQzDtzpgnm
- TLSH T190455B1173179837C99A80F5E9326283F270788525168CFEB35C9DCE2A5EBC561FAB34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\libEGL.dll
- Size 483KB
- SHA256 a8a3cfe0c56cbb61ed0a5366bfa832c959eabcdb2b2efc7ba12b4b857465208a
- MD5 cdc13461eb4f33d323c4312aaedaf5fe
- SHA1 f6d73946f3c2cdcf0b77db9a02c9a801ba02af49
- SHA512 182940ac7e50be8785943204442fa2ea3909a88f4cf7b0e5290dc21bc5a0397448c2f5982d4b12088a63f25468776d56f63dfcea7167ff81a55a33a227dc0512
- SSDEEP 6144:safiEURY6N6W46IoRkL76dDOrjRCmmYjiK1EpDRTTTSIp6:saF6UWCoC6dDOrjImmYjiK12RTTTO
- TLSH T130B48D0977E78596D06A88F5CB439502D971784A0BA0EEEF03D0D6692F73BE89B7D310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\bg_NEUTER.pak
- Size 18B
- SHA256 e2769f0076f9670f37dfd36156092b19f24e8066d126c431cb37f1669c5c39b9
- MD5 489fbe64ea571626441f70546c6a5b9b
- SHA1 084a9f85a3655e014bb30d3f7f5224bd8059d314
- SHA512 8a32495be42a770dae34beaa50c19dc5cf7c70255d05a1a5ac36d39191123860d6cbf2f33e3e0b9ec72467a8a9500eaca37d94c4353d523f0eaef6e4f526b0d6
- MD5 SHA1 SHA512
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\bn_FEMININE.pak
- Size 18B
- SHA256 a0742c87e79775ecf54ff8748471f654bc08742e2d320b391d925c4ee421835d
- MD5 732f168d2a9700d31e1c299dd6cd305c
- SHA1 8a4bd203d6a4795c0feebd3c60384093371b16d5
- SHA512 1b6699258a90d8beeb0a4eddce2bb608cb71b308177c1d8ed2db85c03516e58585d0207305ba82f065be8bc7b4bdd3ea9bb0fc73f1a221c6cba9bb83bb3e2ebc
- MD5 SHA1 SHA512
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ca_FEMININE.pak
- Size 18B
- SHA256 3e0e0d517ee5a8cb3ba1a53dc9852a09f23fa95dc4bfd9418d6435e48df24257
- MD5 ecf66bb8d1d4ecf02fb95f729360a087
- SHA1 58ae658418eb2e022a7a98758c476f5f2b3d1d97
- SHA512 67b86e53e55f151d54bc5513d33b14076ed149a578e6301868543603b7d37b0e8f3417fa34711ae60156e21b55d0d40da98fc3f15395d8144e2f1b6bf23d05d5
- MD5 SHA1 SHA512
- Path C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
- Size 279KB
- SHA256 7a83319f41c626818556e406b5b664aa4c102cb851269e9becbe3041bde4368a
- MD5 7efcf0111eb7a22aec8410d6a427b328
- SHA1 d6828e7c4fb2789da55899e69c6197eaf4017b88
- SHA512 c1526e7bfe3c9f5d9ea9ab0f18d555e01f107ec56123ab83b8677ac24da57e206fb02a0148d2ae08ceba6ec4c10f42a46b0093e2324c0d723f09ec1fd4f43d97
- SSDEEP 3072:chODtLp34ulhWpOUpTEmqHWDA10fFT1u4qnHqneFIFryVKtANp8JPTl31e07CWvz:GsRCUwTEnkW+NyVIANpKJ1etWU77M
- TLSH T1285491C2FBE648E2EC52673C84BF462EAFF5F9300571C22F0DD091998DAB7484D2565A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 1.7MB
- SHA256 606390649012b31b5d83630f1186562e4b1ce4023d8870d8c29eb62e7e0769e0
- MD5 c606bd7c9c733dd27f74157c34e51742
- SHA1 aab92689723449fbc3e123fb614dd536a74b74d4
- SHA512 5f8fabe3d9753413d1aedcc76b9568c50dd25a5a6aeacd1ce88aecc28c0ba96dac80177679d380708213a0997946e49383bdaca7114c8c9526a24ed999194e38
- SSDEEP 24576:HcT4tSLLxH7lk1YzRJGEXF2xFFdVtFD/4AGyw5JxAfRrMDtWbtxrTHeN:HFAyE9XwfTTx+JSmDQxrT+N
- TLSH T19885272167FD5094F1BB863898BBA976FDBAB6411870F21F0520C16E1F36F20993D726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcp140.dll
- Size 613KB
- SHA256 99e3e25cda404283fbd96b25b7683a8d213e7954674adefa2279123a8d0701fd
- MD5 c1b066f9e3e2f3a6785161a8c7e0346a
- SHA1 8b3b943e79c40bc81fdac1e038a276d034bbe812
- SHA512 36f9e6c86afbd80375295238b67e4f472eb86fcb84a590d8dba928d4e7a502d4f903971827fdc331353e5b3d06616664450759432fdc8d304a56e7dacb84b728
- SSDEEP 12288:dO93oUW7jh6DN0RUhsduQjqDZ6X/t5mTOKGmJ7DseBiltBMQEKZm+jWodEEVoFt:s3oUW7jh6DN0RUhsduQjqDZ6X/t5mTOo
- TLSH T19DD40927AB5905B4E052E378A1C78711D7F1BC058322E3C782A6E27D2F673D5AB3B650
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\vcruntime140.dll
- Size 83KB
- SHA256 2b7602cc1521101d116995e3e2ddfe0943349806378a0d40add81ba64e359b6c
- MD5 1453290db80241683288f33e6dd5e80e
- SHA1 29fb9af50458df43ef40bfc8f0f516d0c0a106fd
- SHA512 4ea48a11e29ea7ac3957dcab1a7912f83fd1c922c43d7b7d78523178fe236b4418729455b78ac672bb5632ecd5400746179802c6a9690adb025270b0ade84e91
- SSDEEP 1536:U3qPWvVCMgfw2eeWqjOebgk0jIpePxd76LGYU8j6ecbolG8EB4h88ii0:U66dsFeeBGPj1L6LGY+ecboC/8ip
- TLSH T169837D4577E402BAE06BD074C0A29E47FB72B585873047DF036996AE0F53BE24E39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{0E4A7820-FDA4-4250-B7AC-E7A2F7B43B64}v64.60.31203\windowsdesktop-runtime-8.0.15-win-x64.msi
- Size 29.1MB
- SHA256 62bc41df5b6ededf34c7338176fc48243658720a94ee3bbe09bb4447dfbf86f5
- MD5 c6cccebce19614b5ffc16e3e1d028ee3
- SHA1 9b4d584d5253792f5d98851e6b8e40a069117cf9
- SHA512 6860b2a63b5dd95e3d12ac2cb1606db5d53ee241cebbfb85000297a7cbcc329ae53587a40d783add6b181f408a75d6165ff457ac1385eda03a47c2f348409572
- SSDEEP 786432:3s4VptJc/oebeo7X+qMIFfevn8ZBu+uDZP6ZioT:84jGdy7IVmn8Tu+YPii
- TLSH T1AF67110E3F37CB27C0AA0DF2833AB7516A2A1B2C56D4CD7657D42D4AD8A03DCD6B1592
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi
- Size 148KB
- SHA256 ba043cc4b58a984dc1abd6feae1d9ec94304b7b0fc5b55fa85fa22dc56345330
- MD5 44c76fbee47d69587cbea7e10299c3de
- SHA1 9ed0bd2eb44171240c3ea8ff5424a8fac7d4c971
- SHA512 d53fe339f153f8a540d9e4d638270b5da71cf2d11d63d35ae0fefc7a29e4af2e84173d859ba6fd0db019e292435350f52928f231b230fed757ff756880d7854c
- SSDEEP 3072:9AhnQr0kIFfXfvER9A5bJc3nOJ8/E4jrS21:9aquE9Aw+J8FS
- TLSH T16FE37D1ABF73C337C0414AF35629A7611B386E2C0AE18D6577D57A5C2E723C4A2B72D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi
- Size 180KB
- SHA256 5615c0b81b0ce330c85cf8cfe838c57d3cac4cb853207b4fa7032f99645de4ee
- MD5 229fa9448291bed293a61898e1126c25
- SHA1 4af33f32406633a31817f90924b057aebb394f9e
- SHA512 129b9cdddd9fbae2b0c451e85fc02c5e3d483986a7a776d74f5c9870181608e463885ddd2326baf4a4b32b4f5cd9d093054ef1a4387ad2272a77ce5373783ea9
- SSDEEP 3072:7PbOLtBgixM3tjCmjw52SxTM+BxWDqvTVI6:7PbGBvSJlUb/hVF
- TLSH T17F048D02BAA3C133C4AA1DF20778F2615F3C6FA49EA0CD6B239479581D717C0DE75A66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\dotnet-runtime-6.0.27-win-x64.msi
- Size 25.7MB
- SHA256 422e343165297e1f55f587faf988d8571ee0e9ea189d2974c2663ecbea8de124
- MD5 912beccbecfc54ead66c4fc218fc0e6a
- SHA1 105c4060f3881fabc1114507b844382d75bfea22
- SHA512 1a0c74fb4da0d478fb53a6b9dc313b321e79a07b09ef234a61e3bf2ca8aa5c11d32f86639ebb6cd46202d4e7634f1f8f673ad3759bfe81ffb13706010f66a308
- SSDEEP 786432:zXtEtmQczWGSX547ToFjMvF0qA08KfzG:Kt+zWGSXeIFjo+qz8s
- TLSH T1F747231B7FB78B27C5A11DF24339A7210A2A9B1812D0DCB653C46D48C8E17CCD6F5AE6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{8731E6E3-AF96-4515-ACEC-DBFB3DF55292}v64.60.31149\dotnet-runtime-8.0.15-win-x64.msi
- Size 26.3MB
- SHA256 8a356de0ad775997fcd27e50a7d453a87c3989a3ba6e554335eac9ce3d718d98
- MD5 a6eb7596fee269c1c5c0e2d0ef85c81d
- SHA1 6f22bd02a8ea837b52ceed55103b98dcf8ff9163
- SHA512 c74cd3cc97ef94257f7c3b66935804dbd7f0ee9f2e280d2f54791209b3b8fbac1641bf30f651244c9445b2958ea974f336d3e7691175a72f223e27ebc57aa89f
- SSDEEP 786432:x4nZAnBpmL8WR0SMqv8uvkqN8+mcDVpsrhT2:uZAnBMLZnMqv5McWh
- TLSH T18157111E7FA3C727D86A0DF35738A3615A299B1C09D0CC7663C06D19E9A13D8DAF22D1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\cab1.cab
- Size 790KB
- SHA256 b5f934c20bf28ffb0cabf5768368fe0b1037d5b5d08e910293506d36525b5220
- MD5 7b6be06673551e8d498c191ea64940cb
- SHA1 b2499125128ec0e3c8a3e106207a9a4eea841b8e
- SHA512 029d32954c817db03ff9a2cc1bac63406e55ae4743ffcbb139480d1499fb9dcd6e215706179a639979bd61cfc3f115581533d542859d52e3f6b19c0ead45a1d0
- SSDEEP 24576:iAalazmiJIWfZveYLrZYvBG1ESlEanGUa8H+e:iA+ayiJZZzpYv7SlZnJp
- TLSH T1DE05224D8F3BE71B58964CE343857A0A682163DE2CE0DE346BD60C66E1D1F5EE2F0664
- MD5 SHA1 SHA512 SSDEEP TLSH