Analysis
- max time kernel
132s - max time network
97s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
09/02/2026, 12:19
Behavioral task
behavioral1
Sample
60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe
- Size 163KB
- Sample260209-phl2dadz7a
- SHA256 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b
- MD5 75fec5afb2deebab6dd9c16d9de35032
- SHA1 86596a5c5b05a8bfbd14876de7404702f7d0d61b
- SHA512 2be0a6a4a0f86abc64ab1c4f229725e2676639681e3314a264ab106c20e86cf50c65d1d95ebbcf33790d77be2841ef1c39829f1247700798f1001aff5684ca19
- SSDEEP 1536:RI5x+cpS8+c48t3UjpGyAgGsu0X55l1tSsHGVIdWQe7AtaCxc2BGywukCbg+DjcX:R2Sz8tkNn9/Nc3mECxd8iD9yUS7vV8E
- TLSH T1FBF35A1276D0C071E573427609F8AB354A7EBD620F625ADBB7C80B4D0AB41D1AB367B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Drops desktop.ini file(s) 28 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\desktop.ini 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Users\Public\Music\desktop.ini 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\desktop.ini 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Users\Public\Videos\desktop.ini 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Users\Admin\Music\desktop.ini 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Users\Public\desktop.ini 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Users\Admin\Links\desktop.ini 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Users\Public\Documents\desktop.ini 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-600123060-2148212387-2211176695-1000\desktop.ini 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files (x86)\desktop.ini 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PaintAppList.targetsize-48.png 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-80_altform-lightunplated_contrast-white.png 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Theme_Illustration_Seasons_Summer_Center.png 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\sl.pak 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.dll 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-100.png 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sv-se\ui-strings.js 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\Images\AppExcel32x32.png 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\PowerAutomateSquare71x71Logo.scale-400.png 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeWideTile.scale-200.png 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Theme_Illustration_Seasons_Fall_Right.png 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppUpdate.svg 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\Color.js 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SyncFusion.Tools.Base.dll 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\Assets\Icons\StickyNotesAppList.targetsize-32_altform-lightunplated_contrast-white.png 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_sv.properties 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Times New Roman-Arial.xml 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-pl.xrm-ms 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr\msipc.dll.mui 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-400_contrast-white.png 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.50.24002.0_x64__8wekyb3d8bbwe\resources.pri 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\selector.js 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Web.HttpUtility.dll 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\LogoBeta.png 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-profile-l1-1-0.dll 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ul-oob.xrm-ms 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PaintAppList.targetsize-40.png 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-white\StoreLogo.scale-400_contrast-white.png 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\Wide310x150Logo.scale-400.png 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-conio-l1-1-0.dll 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IdentityModel.Resources.dll 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-amd\initializeComponentRef.js 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.DispatchProxy.dll 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_10.2.41172.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\TipsBadgeLogo.scale-125_contrast-black.png 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxA-Advanced-Dark.scale-200.png 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filterselected-dark-default_32.svg 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\pl-pl\ui-strings.js 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\msedgeupdateres_en.dll 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\coreclr.dll 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\callphone.png 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Square310x310Logo.scale-100.png 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-30_altform-unplated_contrast-white.png 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\Assets\contrast-white\CameraStoreLogo.scale-100.png 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-20_altform-lightunplated_contrast-black.png 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-80.png 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\WinMetadata\Microsoft.UI.Xaml.winmd 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_it.properties 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-warning.png 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-oob.xrm-ms 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msvcp120.dll 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_display_plugin.dll 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Microsoft.Photos.dll 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\id_NEUTER.pak 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-phn.xrm-ms 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PaintStoreLogo.scale-100.png 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-96_altform-unplated_contrast-white.png 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ru-ru\ui-strings.js 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe"C:\Users\Admin\AppData\Local\Temp\60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4128
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\icudtl.dat
- Size 16B
- SHA256 c588b1f8ff24c12b996bb4ff6c4e7dadc9743e86bde9bf19bd9643936b5f760c
- MD5 cb89f9cca93ed349b9394faa48472792
- SHA1 7646f78d091ff2c196630a95b0809bea84a134c2
- SHA512 c232d12480819dff50d680ab52d82099f4c1577289ddc54954cdfec8bcbb3835f3309d1eb200a5885e048ed8052c79d5f95af6e6fba336fb605091405a98a21b
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_proxy\win11\identity_helper.Sparse.Beta.msix
- Size 53KB
- SHA256 cd5cc8eb716a14d464fcca78c443adc0ba14f69e46ce4090bf61247a7ef5c898
- MD5 81112c7ee16ac5a06785b8ae9575acfd
- SHA1 12a3c0f65877044b9eb024949c7d48f06d102aea
- SHA512 ced9faeb84f2368b5801882b47d748357f5766c441241bfc0eac998eb193b0cf27b9939a363c69787caf794de9c7c26fe87bfc1e71eba71e19238a818bf7fa87
- SSDEEP 768:2HbUoelIpjlTUT8FJHFzqXPutk9NwJMnN5b26I/CJSpwD2D9tf0oJ:kYllIvTFrH2Kk9+6nnb06SfHfXJ
- TLSH T1D133CE99BC2CE64BDE527A74F2E70F5E7C6B011D42C7AD36723B28886C748151C2B85E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\libEGL.dll
- Size 475KB
- SHA256 11d2c15d0da03837a20f703895de42ab26af10555b6125763eb23ac491fa0b82
- MD5 896e4511028bde8329e5eaed02c76df8
- SHA1 595b77de00e4a8b79dc5ad16ec6d2e41f5b09842
- SHA512 21334cfe9b7a239d65dfd4f3bda7a60df3591e18390d69bad051b4cedb458e26d4334962d7ad8bb7ce0d7bf5ffecd8d2d950938b14a34078e257913319e2c0c3
- SSDEEP 6144:FMk0x4HqXW49txSCu0nAr+HyZOrbGe0mjMi10aTXxPFR7lyr:fiWqG49txXrHyZOrba8Mi10EXxPr7w
- TLSH T169A47D017A988456D4268834DAE34F46ED73744A0BA2FAEF22B592291F77FD45F3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\sr-Cyrl-BA.pak
- Size 1.6MB
- SHA256 615e06316c7a2be451e3216d227d707e2d62aa47692dc8985a18cd144e39be89
- MD5 9a576dec54a3227ba6fe7f973dffe913
- SHA1 f3209e46c2aeb16092c8f94025a8cbbe359f0c6f
- SHA512 7e33ab30ca1998cb8541c139d3357d03dac88d22d079c9018211e0fd87847fb345e58cfaeb46ac8f5899d14f9b82bebcbec8bfe2e9be4049a5d21fe390ecd320
- SSDEEP 12288:i02CS77G01c05Vz7QccUAVjSJYqU4vghPusWKYqBqpr59OxbyMQSEDxJvNmSA9Uu:W7o3jSJYqU4vgYBnzvNmSECjghLt
- TLSH T11F8579A19B9E64DB0501F41BD808BE493D9F41FF3FAB976221341DBD39E20B446AE24D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\mspdf.dll
- Size 18.3MB
- SHA256 1138a6e987ad8772599ab68c2183a6d6b71dc12b50c61dcd2d8cd76cc39b2677
- MD5 9933924b16aa3d04c71c9df3a65a69e4
- SHA1 420da082b899294798a66cc3352e30a04f2afc9e
- SHA512 f6723c2d51118a0d4e07dcb9c16b93cbfb92dc1ecf761a79f027d2e7d2e2436e7b0e56ec7dc581a10542380ff37b01e26a1cb8ef7850f54de8a81c257b404ad9
- SSDEEP 98304:Sy7qKJVP1aY856WPCUiurpbOX7baLhfcNJjs1bQQbCPCCCWZehVQyN8WRiUKuAr9:SYJVP1P856WPbiu5WbkfcN9svC4Agvkl
- TLSH T10C174D027A9A489DE44CC87093478956DE217CCB0BA6F5EF458972192F7BBF85F3E204
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\resources.pak
- Size 33.0MB
- SHA256 0815fa2eb2d5f3f93b4fbadd9902257a5793bc3c6a1f6b9c526d334979f8e5ff
- MD5 4daaf7338dc9e3fb53abf81e6b5dabc0
- SHA1 2a94a4505760650738fa3543f901fef543234a75
- SHA512 727266fa51bc652b875a615ce0b9db700d7f6b77cffb4ca39786a18303a5129a0632feea0e684383c28c1db9d1bcb81f8f8dc658b189e92171b0219922d07ee3
- SSDEEP 786432:Fsk02fI/PYXS7ykOiIhxN9z6lT50T4QJUqdzeh80S:FsSI/AC7yAIh9zEGT/UbhW
- TLSH T13F772201BB09912BEE165B7A31E14F2AFF3684082AC3A765357A53182C377E35F4F51A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\qu.pak.DATA
- Size 1.1MB
- SHA256 b2341bdfe0c49e308cc3e43a7123e129e9ed5246ce830c2a81db18d12d5f4509
- MD5 5a90aa788c6a08e84f768104a76d4f7f
- SHA1 367822b7c7806ca85d427744b444e641572cba6f
- SHA512 c1b4504460ed918d483c303c2d28c259dd10db66931c0212f49a4f8e52bbcd794c4325658787a8c143546e38582724e07f4ccc9bf73ffad45ab69b065b787c02
- SSDEEP 12288:WApT/rWfnJs10lW/RgFTb1BUcNSNfDN/WmULEcU:WAlifnJs7mb11k7//
- TLSH T1D83583442DDE4145BE1057C312F98D1638EAB27A2CA1ADE3B87D162C1F5ACCEF186F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Trust Protection Lists\Sigma\Cryptomining.DATA
- Size 32B
- SHA256 fcd8c0874f86366a7a903e9608dbbd1be314da135680426c8fc3f46e602eba39
- MD5 181c1af2e728ac1cb59d8f4a6f13bafa
- SHA1 3ab64fd6eab911b166a38509ac003cbf6a0582fd
- SHA512 fec1137ceff3f7d4590423c7c5e8254432765675c930be75908a8eea0c3b48a7a2870cd3282c02de1ad5bda480dc0593601661407a9f67b463641a57693b0a51
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\learning_tools.dll
- Size 1.2MB
- SHA256 4bbe0802c530dcc39aec90300ff4151e8908b9fbf9ff72a0065004d9172cfdd8
- MD5 1a57ad4b4a8c44c49bb0b22540ab02b0
- SHA1 09750a8825ce0aefdf64dd68252f2ae7ebd1296f
- SHA512 6cfb58a8bcb8a0d3aeefb19cc097834b7fec07b52a3748ffea1ce463598ac33b17afd1ec2626b5f8f479a87e6bd67773d3f061d2aa6b8651d0269f0b0111e545
- SSDEEP 12288:mgwb80GLH3hTAuXJYk15KQNwiyhgktcIXsclQOZ10sLcIrcaQ6wgALcIqcaQS9qq:mgwgpALQUtzrz9qKSO/7Q9u8eesB
- TLSH T10C454B11320AA837CE9980B4F8F24B46FE617445254758BE723E9DCE1E6FE8125AF734
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\resources.pak
- Size 26.1MB
- SHA256 2269166bb63f7900d8d6ab57b8104784fd1d042c4708599148e9feda21f859a3
- MD5 cf59fc604bf85b5052a564aa0db053e4
- SHA1 3fac39c5d32caf6fd72eb7b4ea23153ae508c073
- SHA512 e5b517a89888c55cf858cb2936db36df810640f8ceb162f7e25b04dc015e95e38b38e7ef8c44c2de6706dacb34751d49497a974e771436adde6dc1af8f049aa0
- SSDEEP 786432:cUhsfQhjFrGsy35VR+DmJBQF5LWG/p54HWkpyuaR4eTF:cUsUYP5VR+Dm7e5LTpilyuaR9p
- TLSH T1E95722567A18D067FE046E3238F9AF2DFE1B181D51C2BAA6317F14184CB79444F9F22A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Locales\am.pak
- Size 1.5MB
- SHA256 20f7db73968476393cde35dd4bcc19a7b9e0b1c74be86a4ee45e154f903a8d15
- MD5 38f0b72c740e04e6279c188fbfb8ceab
- SHA1 566ad897d9910cac0a0fea7008d6c6490af64f5d
- SHA512 13702e32f7d8ea2dab4a782fd9c19c4d1aad372105c28b41cea24ea1ed4b172b30d4dd67051a6a31760a157f1bfd893e0ed1affe316c2da3e5fb0bcf0be7fa3c
- SSDEEP 24576:63kIePUMMVbmDzvY7AyiGv/lcm0zBPn9hYYvPbXhfEgSHVTHsPaE504tk2lpxR3d:tI2yUb
- TLSH T14665BB147DF9F7170F8E4A15A4611E4E68999E4A92812C38E36B93FC2F2EF174CDE214
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\lt.pak.DATA
- Size 1.1MB
- SHA256 9fb2d2c5cdcec476f6bb22137feb5f484bc4fc85454ac9674d3e1c24d5d0e21e
- MD5 dbd352137604967065b80874bb37ea30
- SHA1 5370e8be8c3306c36a1e2bd0b221048feb06ec94
- SHA512 e2134ab80935edda135dec3a407525fa85d65f97aa8614cce1766f4c1d9748ffe35e38832c42359bef8738919bb3004ca9a051f1051df69562e21d441aada5c6
- SSDEEP 12288:2Z/3B/bnqawf4sUmW1JB8nIhF1WQAKmywfLMX51TXLj8u/ozl6adWx:43d8Ay6XhF1WQAXyw+GI
- TLSH T1AA453B00BE97D99B9F0027C660F08E65EDB91108A267BC30B87FC656DE3BFC52595B24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Trust Protection Lists\Mu\Entities.DATA
- Size 68KB
- SHA256 289b8613b40d08ab80a4c7a1264ba1b03a182c76edad268601c2b00591974f1f
- MD5 1881c21303174849655a88516185303a
- SHA1 f2afb1c3413452f8e04f7ad255b20eb2f986cd30
- SHA512 0d82933d470295a6b3e00885d706c8f643866cc24ba337979edff75c11de1048fd4629591118aae73813dc5850db6b71e2faf6cbd4657e08150a779d6f8ed23c
- SSDEEP 1536:6EDL0fWjtCOjajaPrUb+siljwJHoR+5tTt:DDgfWpCWU1OjMR
- TLSH T1AD630937BC544C3349F6844BB0E92E2D39249FD9C4DBFDE4ABB641621283984B49C6F6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\edge_game_assist\EdgeGameAssist.msix
- Size 996KB
- SHA256 32156d6c918cd0c6f941b1302d826885b4dfe49105728fa5b6a52838b6e38d52
- MD5 d24828224941169725bab62957144c79
- SHA1 3cf2e3fd7f89505febfebe395f9ba90cc6941df0
- SHA512 b7ddc4a89917a1dcb8dc3d6ea81031a15774ddf42e01eba602ba09a1912a04b5f10c7ebf54f5cfd1d806a2c3e92e76cfb6dd4d86638166a51bce5747ba768037
- SSDEEP 24576:FthtUxnHCZeKC/dtTjrQOf84ytQKQOxNu+6G2GumgcJM:FftUxnc63QOfNyRQ8u+j2GDgz
- TLSH T10325BC44B90DC963DF154831BAE40F9E3C27854E20DB7EB9347FA2642DB1E906D0FA99
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\bg_FEMININE.pak
- Size 18B
- SHA256 04ba096d08b60e028cbc1b40cb6196ba6faa50e3e7c9c0c406d6de768db751c0
- MD5 2644744f5a85256bfa8aa7e61a1d4989
- SHA1 bc222b8d925c27f47ac7fffcaa0cad2a3e0711fb
- SHA512 abbd592e119571fde7907e43213ee1ba5c8e581f63c19f946952e499f38b69bb3ac0425ddc8f1b392597a9af0309056077cfe18be523b64699e8a65db10c3c02
- MD5 SHA1 SHA512
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\bn_MASCULINE.pak
- Size 18B
- SHA256 e4ec9a978187a5254af006bd285076c0d9f0d5637d42b65e57a5ea7077d3da09
- MD5 1a685a0e9144c14b7abd170ec54488e1
- SHA1 6c3c02824c4fc8de22d3a3e724da4f0ec2f14bc7
- SHA512 7bd9a86725a8a29b48fa521e127bb37878d376fd16c4ffd9711f49b97904d2f53a2bf8a0519409ba4f5ac81942bfe96a656c019ea644260ba8deacadbcdc59f4
- MD5 SHA1 SHA512
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\cs_FEMININE.pak
- Size 18B
- SHA256 5813cecfb67a830bd2e00c26a44b427eff9d9c9696014480570052ac8d24b54f
- MD5 ce466374e3f09797943135fc0df5a047
- SHA1 762ec3f8f9b7b79f35b8df3f9f0101a10997fbe4
- SHA512 13d3d194d23c77cdacc8d558185481822303639d1109d16411895a129b49e522c369c98d732489f2895908cbde7414f1f72cca978e9d0df37a2006e2c7161c70
- MD5 SHA1 SHA512
- Path C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
- Size 279KB
- SHA256 7a83319f41c626818556e406b5b664aa4c102cb851269e9becbe3041bde4368a
- MD5 7efcf0111eb7a22aec8410d6a427b328
- SHA1 d6828e7c4fb2789da55899e69c6197eaf4017b88
- SHA512 c1526e7bfe3c9f5d9ea9ab0f18d555e01f107ec56123ab83b8677ac24da57e206fb02a0148d2ae08ceba6ec4c10f42a46b0093e2324c0d723f09ec1fd4f43d97
- SSDEEP 3072:chODtLp34ulhWpOUpTEmqHWDA10fFT1u4qnHqneFIFryVKtANp8JPTl31e07CWvz:GsRCUwTEnkW+NyVIANpKJ1etWU77M
- TLSH T1285491C2FBE648E2EC52673C84BF462EAFF5F9300571C22F0DD091998DAB7484D2565A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\msvcp140.dll
- Size 613KB
- SHA256 99e3e25cda404283fbd96b25b7683a8d213e7954674adefa2279123a8d0701fd
- MD5 c1b066f9e3e2f3a6785161a8c7e0346a
- SHA1 8b3b943e79c40bc81fdac1e038a276d034bbe812
- SHA512 36f9e6c86afbd80375295238b67e4f472eb86fcb84a590d8dba928d4e7a502d4f903971827fdc331353e5b3d06616664450759432fdc8d304a56e7dacb84b728
- SSDEEP 12288:dO93oUW7jh6DN0RUhsduQjqDZ6X/t5mTOKGmJ7DseBiltBMQEKZm+jWodEEVoFt:s3oUW7jh6DN0RUhsduQjqDZ6X/t5mTOo
- TLSH T19DD40927AB5905B4E052E378A1C78711D7F1BC058322E3C782A6E27D2F673D5AB3B650
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\vcruntime140.dll
- Size 83KB
- SHA256 2b7602cc1521101d116995e3e2ddfe0943349806378a0d40add81ba64e359b6c
- MD5 1453290db80241683288f33e6dd5e80e
- SHA1 29fb9af50458df43ef40bfc8f0f516d0c0a106fd
- SHA512 4ea48a11e29ea7ac3957dcab1a7912f83fd1c922c43d7b7d78523178fe236b4418729455b78ac672bb5632ecd5400746179802c6a9690adb025270b0ade84e91
- SSDEEP 1536:U3qPWvVCMgfw2eeWqjOebgk0jIpePxd76LGYU8j6ecbolG8EB4h88ii0:U66dsFeeBGPj1L6LGY+ecboC/8ip
- TLSH T169837D4577E402BAE06BD074C0A29E47FB72B585873047DF036996AE0F53BE24E39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 1.7MB
- SHA256 606390649012b31b5d83630f1186562e4b1ce4023d8870d8c29eb62e7e0769e0
- MD5 c606bd7c9c733dd27f74157c34e51742
- SHA1 aab92689723449fbc3e123fb614dd536a74b74d4
- SHA512 5f8fabe3d9753413d1aedcc76b9568c50dd25a5a6aeacd1ce88aecc28c0ba96dac80177679d380708213a0997946e49383bdaca7114c8c9526a24ed999194e38
- SSDEEP 24576:HcT4tSLLxH7lk1YzRJGEXF2xFFdVtFD/4AGyw5JxAfRrMDtWbtxrTHeN:HFAyE9XwfTTx+JSmDQxrT+N
- TLSH T19885272167FD5094F1BB863898BBA976FDBAB6411870F21F0520C16E1F36F20993D726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{0E4A7820-FDA4-4250-B7AC-E7A2F7B43B64}v64.60.31203\windowsdesktop-runtime-8.0.15-win-x64.msi
- Size 24.9MB
- SHA256 4e79762b3d95e2a97bc0bf20d28a157d83ec377d57c6d6947c1c8e4cd9a32ac2
- MD5 17f98dc285d6bf84ace9a70a8a6a8a49
- SHA1 94c02a8484f755fa4374589e5a9190d7fe58325a
- SHA512 cf1403317c18ef479326e8576eae5dbeb08951fe16d098c9bd5cf5ed95a1f160c6b68c8eede55565becefa35d3f0a8ceba6dcb35ec350d1874316fa86beadd2f
- SSDEEP 786432:DGDp6WPgmSNDQ+FGWiHAfI+dMd2J+VXFqek:i9I1vgAfHad2MVXPk
- TLSH T10F4722897C1EDA538FAA4D64B0FA4F4D7D27181C66C73E70B8BF2A82AD719681D0F011
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\cab1.cab
- Size 5.4MB
- SHA256 d0cdf441bb78100c0fec8cf5cb97fd03ab619501bf042fb4d20753d80081f02c
- MD5 28f68ac48776ba3c4b70dcb753e5c492
- SHA1 b60cd57c57aa497d0c80a3f7335bce566bba47d6
- SHA512 92a55926847bff415d5ef3150fb66e953c7d8d3b92698153e772e9129674737aa5d0e08a5f8f246e79c7ae68b7bfb8783f848b97970a3d9700cce32e13e4d82a
- SSDEEP 98304:DlPU8uDoR5K5NC9d9HIzegTYT29Y7IGKeCRHn5/Hl9t3J5Mm4vbD:VBR5KS9d9HIze/T2YvDCRH5/HZJ5MmWf
- TLSH T1CD46AAA57C1CE24B0E252C1A78F0AF1E7C5B661C99CBBD35397F80685DB0D82AD0F619
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\dotnet-runtime-6.0.27-win-x64.msi
- Size 23.5MB
- SHA256 a54204b8ec48d9b9cfad7498b3d4951f8083f65f23c4f6c4763265e136241eed
- MD5 29323416904677a78ed5f2a811c49f5e
- SHA1 f4f07d3af90e77db2670d115ae3e7e3f29e600ed
- SHA512 2aa1adba79081eb9760080cc27165bc913cf9da71854495354ae481b316bdf09f4741b8010109017610b804cd7a0739bc5ea824f07ff320ca74f21c3eb8847bf
- SSDEEP 393216:+krcLobh+DODY1mEO06fdOQy9G6olzxrXb4Qji4WwjGgVfbgXhwMutf4IeGa702w:/HMl1m309CxjwIGgVY6Ztf4Ija1WcA5
- TLSH T13B4722127E9E9A238F915EA471F98F2C3D23890C12C7BCB2707F69845C39D991D4FA19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{8731E6E3-AF96-4515-ACEC-DBFB3DF55292}v64.60.31149\dotnet-runtime-8.0.15-win-x64.msi
- Size 23.6MB
- SHA256 e0ec2adbe7623e6f2e15f580b475b722f5362b6b202a206329e61301145b7715
- MD5 83c9cdc1efab69795695309ecf10f22b
- SHA1 09a6dfc35f7ab6cf2e0d91fce96ba1d62c9052a8
- SHA512 158c1ca416a19be069688a5fc38d33b52c406ccdeebb04bff4b4b345e2eaa3e2b64e49a81538db86e649b0d6dd97dbed63b776c0998178bac47b93afb764fadb
- SSDEEP 393216:Ge+VXPgYn+6m5Bv2dvre0WwpzTGq2N+Ax9sr0+upS0QRcqki4zBOGCFpP0uE3ywR:IfgcA2s07Ho+AxXA0Q+qkR1QpPe3BKqh
- TLSH T16A4712507C8EC12B9F6A8E61B5E84F6D7D03892C58D33C7575BF62222D31E652E9F280
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi
- Size 148KB
- SHA256 196ee456abceacc0b9f9d132d153056c5752872f3cc203fefc678236609d18c0
- MD5 458648225c68cc91145287e2101ca8dd
- SHA1 2cfc54190980d5cb8b2acea497596dc8c31cda2f
- SHA512 ab24648e254f5f4aeec0a0a4fd07f02838594b8b0ffac700f7b358133069e7b567834c991366a826443b69f75907b2ad3c7097b1082d673fe016121f3c1025e3
- SSDEEP 3072:rNB58095VUpZV0z/Zx15p53nQ27CQLcmvu:r58HXIx19g2bc
- TLSH T1ECE35C12BA54C237CA41093175FA9FA92F3A5C2C0AD31965367F325D1E32AC06B7F2D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\cab1.cab
- Size 4.9MB
- SHA256 c6af92bef8199a01bc155aeeffd84c0b2e3ad66796fbaf09929cd940fd36800a
- MD5 1d614298ba55f0555903c3dd541bf0eb
- SHA1 678927288bfd8e3420bd7a766f4e28d9423645e7
- SHA512 20a9d662d32b69fc3fc26e49fa9ec67d9147f01e9c78670d78cc8de5e69e1076405f592235898bbfbbded97df06ce7953c2cf54ef7b62df67166f58fc55e0b3f
- SSDEEP 98304:cUn19azE9JERmH3odKIM2HhBx3pXwCDv6JflDzajHMSUJKck7TWXCloT+Pp:cUnnbJERwIM2HhBfgCiOsSf7qyS+Pp
- TLSH T16036DD847D1CDA1B6F412C11B0F08F5E3E9622AD84D3BCB0B9BF544A1D70D059E2F6AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{E634F316-BEB6-4FB3-A612-F7102F576165}v48.108.8836\windowsdesktop-runtime-6.0.27-win-x64.msi
- Size 28.5MB
- SHA256 6f20d219e26af34cd1063f65e9411214f5f3a61b75c457b57c8f27f68844ec0d
- MD5 85b9a45b781a3421f78bdc0789a9b96f
- SHA1 6747215ca82f17dfe8ce10ff1f6f5b390dcfdf0f
- SHA512 55a189ec91c36e155ea44e76136b30fc5ac5cecd828f91798b96fd5ca3304f7f84694238b2bbace068b4f040a7de2e8d9a0fcba4b92539c191019e79a5576638
- SSDEEP 786432:N2zHL0UvdQS8Xc6mp1c/6mabI9uDplRo+c7yCCMw4WwN2f1Qg/:N2s6dQz20ymdAplV49TWTyg/
- TLSH T13667231B7C89D823CE2A0C3174F99F187E2B591806C2BC72B17E6418DDF19D06E6E6D6
- MD5 SHA1 SHA512 SSDEEP TLSH