64904d8e03c984096077175b872d00866d4d1d450388b7d9f9a2ca164952c8b9

Analysis

user interaction
yes
max time kernel
30s
max time network
27s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 18:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xpran.exe
Size 174KB
Sample260910-wn234seq8z
SHA256 64904d8e03c984096077175b872d00866d4d1d450388b7d9f9a2ca164952c8b9
MD5 25fafb261c4f06a390e93a03ce194e94
SHA1 88a16946db25adc1bcc1a7d5dc72e0a3141bc4b4
SHA512 7ca825082d3e6141425c91b71eb526c2bb5e5b5219209aa40c70fd9d918c1287ec5510b145b4a17a7041e13c204ca6a729e16d28a869906ee61f94360f85c09d
SSDEEP 3072:SyfkbMj7Vrp09Ddbk+Vy3KJT5j3jQsrLXWNzX4Ug8pb10:SyfdT09xjVprkaL9x+h0
TLSH
T137046C16B7A511FAE0778178C9A20705F776B8250770ABEF03A04376AF276D09D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion evasion execution impact persistence ransomware spyware stealer

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1692	bcdedit.exe
2396	bcdedit.exe

Renames multiple (3113) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	xpran.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	xpran.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XPRan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xpran.exe"	xpran.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XPRan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xpran.exe"	xpran.exe

Drops desktop.ini file(s) 31 IoCs

description	ioc	Process
File created	C:\Users\Admin\Desktop\desktop.ini	xpran.exe
File created	C:\Users\Admin\Favorites\Links\desktop.ini	xpran.exe
File created	C:\Users\Admin\Music\desktop.ini	xpran.exe
File created	C:\Users\Public\Libraries\desktop.ini	xpran.exe
File created	C:\Users\Public\Music\desktop.ini	xpran.exe
File created	C:\Users\Admin\Links\desktop.ini	xpran.exe
File created	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	xpran.exe
File created	C:\Program Files (x86)\desktop.ini	xpran.exe
File created	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	xpran.exe
File created	C:\Users\Admin\Saved Games\desktop.ini	xpran.exe
File created	C:\Users\Admin\Searches\desktop.ini	xpran.exe
File created	C:\Users\Public\Desktop\desktop.ini	xpran.exe
File created	C:\Users\Public\Videos\desktop.ini	xpran.exe
File created	C:\Users\Admin\Contacts\desktop.ini	xpran.exe
File created	C:\Users\Admin\Pictures\desktop.ini	xpran.exe
File created	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	xpran.exe
File created	C:\Users\Public\AccountPictures\desktop.ini	xpran.exe
File created	C:\Users\Admin\Documents\desktop.ini	xpran.exe
File created	C:\Users\Admin\Favorites\desktop.ini	xpran.exe
File created	C:\Users\Admin\Videos\desktop.ini	xpran.exe
File created	C:\Users\Public\Documents\desktop.ini	xpran.exe
File created	C:\Users\Public\Downloads\desktop.ini	xpran.exe
File created	C:\Program Files\desktop.ini	xpran.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	xpran.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	xpran.exe
File created	C:\Users\Public\Pictures\desktop.ini	xpran.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	xpran.exe
File created	C:\Users\Admin\Downloads\desktop.ini	xpran.exe
File created	C:\Users\Admin\OneDrive\desktop.ini	xpran.exe
File created	C:\Users\Public\desktop.ini	xpran.exe
File created	C:\Users\Admin\3D Objects\desktop.ini	xpran.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Trust Protection Lists\manifest.json	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\root\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\manifest.xml	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\root\ui-strings.js	xpran.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\cs-cz\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\hr-hr\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\amd64\jvm.cfg	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_retina_thumb_highContrast_wob.png	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ca-es\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_20_666666_40x40.png	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ca-es\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\illustrations_retina.png	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ko-kr\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.SE.XML	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\example_icons.png	xpran.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\EXITEM.CFG	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sk-sk\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL\THMBNAIL.PNG	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\lpklegal.txt	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\cs-cz\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sl-si\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected]	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-il\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\bg_pattern_RHP.png	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hr-hr\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml	xpran.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-140.png	xpran.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_WHATSNEW.XML	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\sv-se\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\jquery.ui.touch-punch.js	xpran.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	xpran.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2.16.GrayF.png	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon.png	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\selector.js	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN075.XML	xpran.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\Office.Runtime.js	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\Info2x.png	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\eula.ini	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\root\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\it-it\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\OutlookMeetingReqSendNaiveBayesCommandRanker.txt	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\root\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	xpran.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\tr-tr\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\pt-br\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files\Mozilla Firefox\defaults\pref\autoconfig.js	xpran.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_75_ffe45c_1x100.png	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ro-ro\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\VisualElements\SmallLogoBeta.png	xpran.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\OOFTMPL.CFG	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\plugin.js	xpran.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-180.png	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\it-it\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-sl\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\de-de\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pl-pl\ui-strings.js	xpran.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\cross.png	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\AddressBook2x.png	xpran.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2700	vssadmin.exe
3760	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
3436	xpran.exe
3436	xpran.exe
3436	xpran.exe
3436	xpran.exe
3436	xpran.exe
3436	xpran.exe
3436	xpran.exe
3436	xpran.exe
3436	xpran.exe
3436	xpran.exe
3436	xpran.exe
3436	xpran.exe
3436	xpran.exe
3436	xpran.exe
3236	xpran.exe
3236	xpran.exe
3236	xpran.exe
3236	xpran.exe
3236	xpran.exe
3236	xpran.exe
3236	xpran.exe
3236	xpran.exe
3236	xpran.exe
3236	xpran.exe
3236	xpran.exe
3236	xpran.exe
3236	xpran.exe
3236	xpran.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeBackupPrivilege	4000	vssvc.exe
Token: SeRestorePrivilege	4000	vssvc.exe
Token: SeAuditPrivilege	4000	vssvc.exe
Token: SeDebugPrivilege	18832	taskmgr.exe
Token: SeSystemProfilePrivilege	18832	taskmgr.exe
Token: SeCreateGlobalPrivilege	18832	taskmgr.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe

Suspicious use of SendNotifyMessage 31 IoCs

pid	Process
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe
18832	taskmgr.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 2700	3436	xpran.exe	84
PID 3436 wrote to memory of 1692	3436	xpran.exe	86
PID 3236 wrote to memory of 3760	3236	xpran.exe	92
PID 3236 wrote to memory of 2396	3236	xpran.exe	94

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\xpran.exe
"C:\Users\Admin\AppData\Local\Temp\xpran.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:2700
- C:\Windows\System32\bcdedit.exe
  "C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1692

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4000

C:\Users\Admin\AppData\Local\Temp\xpran.exe
C:\Users\Admin\AppData\Local\Temp\xpran.exe
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:3760
- C:\Windows\System32\bcdedit.exe
  "C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2396

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:18832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json.xpr

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\AdSelectionAttestationsPreloaded\manifest.json.xpr
Size 144B
SHA256 4d6ca6bb4eb1e9823ea0b0a9a34b13fe01b76926139d6ae853d9d4c7fc811ca6
MD5 50759b631e629dcdf901f7960e323b3e
SHA1 3164d73fbfecf6336650b862fdc430fd739bd6f9
SHA512 26a83f1b63b43ea44034b39d8e3e83c5fe689e5dc4212cc826405a79562c27b5772ee9b24e5235a314910dcdc510491dbb143cee29d6ef53bc19537eeb0e05a6
TLSH
T159C02B1F653C420080B0F10583189F7B075369440DF4142306AC23C38822D78E564647
MD5 SHA1 SHA512 TLSH

Submit Download

external_extensions.json.xpr

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Extensions\external_extensions.json.xpr
Size 115B
SHA256 44d6b792df2bd3d3fce64371cafdcabf0110b4dbc40f8a79841d0ba9e3c0d5e4
MD5 aaa8d92988166aa560c87bd161cca034
SHA1 67de44fd0db75b1a7a7fdd8d7dc707f30974bf3e
SHA512 c679ef7349293a8e1da6977c22bd709619b0591f04802eaa2098a52d5fbcb9eb74cd6dba2a8276cf7591247494daedf4933eea4ddd52c1c2c2c42098962bbe3f
TLSH
T1EDB0923A46E664B9201606591298DB2EEA96A2CB5892542825E2109CB0615BA4B1617A
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json.xpr

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\MEIPreload\manifest.json.xpr
Size 254B
SHA256 b8de02e18556a895eb087b6f2d3e9ad544cf018b29d4d9638bc80498dff1f7b9
MD5 e5196b6f22e46bce7ef8465bd56c1bc2
SHA1 355288af549c2a9cf361bc14742f516d49545a8d
SHA512 e54a091d04b0d316983b43065cae140bd10d724cbfc4cc00fd925be63219fc67fff9fa5f27388f28de7a46d2170c7d4abd6907740e2dc1bc6af94d5876b8482c
TLSH
T101D02BE149E2BD584C23711572A65027B4452B8A613FC5C80C12257644169615BD10CA
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json.xpr

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Trust Protection Lists\manifest.json.xpr
Size 148B
SHA256 caabd9923ffb0676283da40327bbddda4bd78cc52cee7bb3a9460f73410a914a
MD5 602c4076105c61937bb93605b34dc218
SHA1 9f930a782e01b8eb1bf564a9f13b6d951f49b1c4
SHA512 0e2d261d5f120ee798c35941c509045d55a472e609b0a1d66d3df856326098f4ed5c55712cbdd3bd90f29dd7e1d369c6f36014b07b6e97b08718f797514acb4f
TLSH
T114C02BB2E402C4E0355E20C32C305A6127F3B8442734ABD030B442274BFD1F915A5252
MD5 SHA1 SHA512 TLSH

Submit Download

Logo.png.xpr

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\VisualElements\Logo.png.xpr
Size 31KB
SHA256 6a41660b9424a0a8e4a7531fb7266a553d9359425ed303a967c00c312caa7f67
MD5 fe38afa6d87483cc31b70757545bdf6d
SHA1 c560402d9efd539d56a72016b8eb3dd4d3087558
SHA512 4b203d13995cbbe8c3bbe13436ae760f52dabf4ed854b745b8b7948cbd01eb956223aaacfa2e140c58613db883169f251575c552964ec5501ec82a5903162b62
SSDEEP 768:9t6u8lCwAUcjkaIrXez1wTmLMKeVXAnZymqZ7bSoQfb9B:D+odLVimLMKeQnZym0brsB
TLSH
T1A5E29D0D987528B0F3ACA5094B6991CFF5083193E280530E9A8E677B6E9DE94FD5CC87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogoBeta.png.xpr

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\VisualElements\LogoBeta.png.xpr
Size 29KB
SHA256 e7f4c488152a1df472ceb49f3a644b57f38899bc14257e8112cb2f7f52f64d81
MD5 afbfe43c4a9134d5062f54a19caad756
SHA1 4872469683114d38f443427ae3736528f861d5b6
SHA512 49ddec2c5aabfdd2c28aaaf8cede17573ad8a2db9316090e76445630a3e22aaae5b119a8ed59469a9d94b98f43583bc9d8d2ea962f4820e5d6ea9a61382933e4
SSDEEP 768:pwegYRF6A0pYN3KbeqeW1TUPhsQDbLJ3yRoKFTxipx:pwegt7e4IuQDbL0oqxO
TLSH
T19AD2BF2D0A7B82780A1EBD5F5160305D32C8613F991A0FAF51998EE8793E9541F8773F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogoCanary.png.xpr

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\VisualElements\LogoCanary.png.xpr
Size 29KB
SHA256 24ca5cc22f3f5e8f736afee3db087622982e554f40c5d75c11db1d5b7dac5cbc
MD5 ed44180719f8ef068265747c7e573dc9
SHA1 2cbcb6f3473667e35e3214245f06125652479915
SHA512 7e6bce6412cfdbe34a276d6f2317755121cb7b9232fb3a81b635c70d61507c41648fc80da074d2931bebaae031100a8ce721fb90a5e4ece1a2a5fe5197122b6a
SSDEEP 768:qbGiAEJjLvMZMV5Ljg9VoaVC6jwouokAOP/QvHb:gPAWXNwoawMwwkAT7
TLSH
T185D2CFDE27EF622F6217464F36B3001CC2717A1BFE2974496DCAA18C4D5E145B7CA81E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogoDev.png.xpr

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\VisualElements\LogoDev.png.xpr
Size 29KB
SHA256 f66ddd7fdfb6db1a05a763322d9d0ca63a08d88877395466a74ad93a5d4636d7
MD5 2ad7d83482ddc644b5d571be6de447d6
SHA1 d7343128a42ea278cb31c00a7022d95539ad64b5
SHA512 4456edc69e4c4ee1d6de2c27e4d5833586ebf567b31cb1d01cc5e12e2d4b2c3f6a0671cc0b9b81fb2a70d3b460439e0e32354c6e295ce84f9876c085684408b0
SSDEEP 384:tZiqoAZ+Ip61BKL+ISCiSfFXl1TMbEOAAyf7ggjJpUZ5SA9Jxb12UNs/L+:gF1Ba+ISCxjGbEl7f7hkkAfxp2umi
TLSH
T182D2AE97002F0F114FFB1352F1A2AB7E985B904190ACE6DC5AB64292052DFADB1DF5AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SmallLogo.png.xpr

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\VisualElements\SmallLogo.png.xpr
Size 15KB
SHA256 097d4c813bde1dd73be93f05c59883b2126c43fb18d1d772126a087efee88db8
MD5 729aa25f6ff3a27272f0a9a1f40f6c4a
SHA1 4c105c649f39c37b9396a743bfc8f79605a95a8d
SHA512 3c635ac6f2d0aac1b55eb3f47c0370f8b030bfed4fda52d87c7a380496db17d83c56e55c43442bfb1a0c13bb554abccb20a844634f8d9e4e870ca0c555942313
SSDEEP 384:60DLnaReR7YGjXj2OXLgJcAv4SjL57fJpUyOYCJIAYh/V:60faROYGjhcc6JjdOY55V
TLSH
T1F462E0764ABB6A7D08FE14562780A4F727F90FD37995686AC8C0D4201D5038FFE81829
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SmallLogoBeta.png.xpr

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\VisualElements\SmallLogoBeta.png.xpr
Size 14KB
SHA256 828cad913d6f52cdb47eaa125622898011d5ce589ecdcf34a6f58b57b40bd8ff
MD5 d3004c1827287a95ecf5ec087bb2e23d
SHA1 f4682d05f64fbf62732e56999cde62232c089a7d
SHA512 1216823da3fed8bdaffcddae8f70a15ccb93315b66be4cfa45cd80f74bc9270569ed8a2c12b53c6e4e55c1925572cdd41000eb23766b16373d3c48452902d476
SSDEEP 384:tr1FT1NPj84vzk5g2aqyJQ76iQfGWD0pvQxoOuxEiqZc:hfT1dtzqg2aqUQlQfGQ+QxoOuYc
TLSH
T1A562D0B0A766250C1DCBF1AF8B4125856D9C7C8AA0A42BDF4123BF6540D0EBED991F1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SmallLogoCanary.png.xpr

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\VisualElements\SmallLogoCanary.png.xpr
Size 14KB
SHA256 843f3012435532bc5afb4303373ea9bba8afee88c99b7d4ce0d62a88feb6d066
MD5 e2425c19a754849bfb28e36e2ad7f26d
SHA1 3206e16959501cf999b630927fb3141e9e6dc895
SHA512 882bb9012bfc28bf10ff92afc0ebce5a4c4ff32ff8a9a389856806b13f8b2907bc922b28e51ef478299ca93018bea20ad70d3dbfc68da6a532206d9ac077dd6f
SSDEEP 384:47pIyXw+UfXVwLzcJ+XkafvLMEfYJxdmyMI:49/g+KlwLwJ+XZn2dmyMI
TLSH
T14762C0FCDDE69E48ABD3B7E9C86DAAEB109420657092FCC5C9219D1A311EEC8C411C9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SmallLogoDev.png.xpr

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\VisualElements\SmallLogoDev.png.xpr
Size 14KB
SHA256 3c82a7187d881c24508ba7d42feeb07a8f139b177bc0c08f90e6cc052aedf3a1
MD5 d47d0cadc85a9e6c876b18410d2c499b
SHA1 9211e9c0f0054573822895dd14daa74f75c85d34
SHA512 6da2cddd97ddd1e2419ed0c584258dd970216e87c80318ed14680077dfe624a48c5111db800c0eb228cef194229d2d105aef47d924498a223174a1ceb2318a98
SSDEEP 384:oeTRoZromMqQG35sN3DWGryF0E1AR0jT8lSvj5LLhWP:oeVwh4G3KZsr1AR68l0tL4
TLSH
T17E62D1AC499048E86EE8445FA2CF8176F668E4401BD2A5E8AC4DB96C120D2DD4FCE642
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json.xpr

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\WidevineCdm\manifest.json.xpr
Size 1019B
SHA256 4e54395574c31cf50f17bf3ed111305b5e2a574e9364951129c4e61ed9f51b64
MD5 6dc612ce298b81c50012bc70930e263e
SHA1 69caf99aac9417591489e43a2bbdf48e650d27e4
SHA512 f62d7ac379ccb55a7c207b7d5b19691d7fdfaa4e0fb9922d2776cb961d651eb048a3f5f00e756027b0740bc3829b9d6682cc8c3e86deb79421b6995c98e0c7c4
TLSH
T14A116805F8060B890801804DA7B451A273C45D0A9E68A7B1496A976BB5CF234BA2F549
MD5 SHA1 SHA512 TLSH

Submit Download

vk_swiftshader_icd.json.xpr

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\vk_swiftshader_icd.json.xpr
Size 122B
SHA256 8702f46a8b8f689fb84b0b1fd62f1e778d13946d14881f9234f20804b60dce1f
MD5 2ca479dd3372b6d5a4dcb30d8a4dfda1
SHA1 41a951a0e70b443da37ea52d9204c72dee1882f9
SHA512 bb35fd94eb92f29d16d738792be35bfc8d3f2d33a6c94adc059ec94dac3961766b760c5698b8f8de39c1e51f281a9673931ab035db5a1a8076ad20fc4c2dd67c
TLSH
T19DB092B640B46801EE865D0EA3674120A064F22A8645AA8D039BA1D887A679A9D4C09E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json.xpr

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\AdSelectionAttestationsPreloaded\manifest.json.xpr
Size 144B
SHA256 b85279620d49b2f03065e18e6a0d389e80b5d1ffcf1de686b975ca3bd8de21a5
MD5 041c4b036fa8c63377f2f7255b0cc5aa
SHA1 3b4550c8e53f02c8a60fd379ecb6d584921a20a7
SHA512 778d3a3a31fb17c9ec0a2ba104217e8f664db6c211428f58310a845226c6075d50fedeb6b448a82ad688c16ce30e576bf161ff437e5ba846fbddee6a8754fb85
TLSH
T1A4C08CAE03219110AE6DD41104888A0978E5AAA469048900F23AF250510D308A1D41A0
MD5 SHA1 SHA512 TLSH

Submit Download

external_extensions.json.xpr

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Extensions\external_extensions.json.xpr
Size 115B
SHA256 88018bd2cc1d52d7a18813d2f926f4333a17c08b93ebc89cae09c2ac43798602
MD5 115b68db81dfb062a665250ca2daa46c
SHA1 f8a7ae57ec577014406f5f3ce246c84a91c979ac
SHA512 093016ac2063ca366e2e938af0b71d50097923fdebcfbed79bb93474dafb35de21fc911ac1445743a96705a898086ec2db0bb4c17073fcf05145a21a3802712b
TLSH
T1BDB092489402140E6A720A4E606C58A62C025236886561479A8AAA8658B9404C42C7FF
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json.xpr

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\MEIPreload\manifest.json.xpr
Size 254B
SHA256 ad8014da1426454b1c72a4c16887f1e68f5041b6d6baf7825ab7d83d686dbbce
MD5 0ad068876db79a50ae29a34ca39d510c
SHA1 668705296151418947593b408e0da8d41754c736
SHA512 9c50f682b701c6f3d73e02f5bf8ff80ae4d767f7047405532c2ee2d0d098929908232128ee772baeaaab091fdeb726dfff19d1b81e695fea747f2b4afcea0119
TLSH
T172D02B5A2D7D855A7157446D5419C6DC1617A7013361640854192840C457794DB024A5
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json.xpr

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\manifest.json.xpr
Size 148B
SHA256 460406e7d97f4cc101d103bf7975bb2e10f3de53424620b96470e651875edda7
MD5 026391827831732f75327ee8dda852ed
SHA1 4da91bcfe7751bbd222ff8b4fcd889903dac97eb
SHA512 155fbf93c507cc1effa34a7140f20e7578c2d1f40fe6617e726a4f671b01fb18f508c0002e9977caa83f9e2e12474bd3cdaa320334245ec23ed8ca787202b469
TLSH
T104C02B452344A3430EC93044FC3BB60C2FF604B64022C6B4424415F7F0E48000AE16AE
MD5 SHA1 SHA512 TLSH

Submit Download

Logo.png.xpr

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\VisualElements\Logo.png.xpr
Size 31KB
SHA256 282fe62bb3ed30b9b631ce2c5054f7e24f3890b07ff7656cf688d05913a6d0fe
MD5 e9e5b3267503b273b118a519c174f4cf
SHA1 0abba150db046e37b49369907736df58cebd9645
SHA512 a2d7dcaba1a2a044cc2f8d3a204f7c05716679b989d0d517206bc197a637e1a274e46aa31ab634e53ece8cb61a6f26e6bc5007dd803d8b69f0cd21966bff9ee5
SSDEEP 768:C9FOCaoQigNm9TVg3GsjhCABzWX+N1zgV1h:CrOCaoQigNm1VnsjhDBzok1zgV1h
TLSH
T169E28C00627366519F071B3FF52A49D43E996B3A3BDC91E15C94AB284B183F503F78BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogoBeta.png.xpr

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\VisualElements\LogoBeta.png.xpr
Size 29KB
SHA256 59e0bc1c1b5b90b433a94b8cb0634632150319a6977ec63fa6094fad999c498b
MD5 d39aa5c064df8f453d70aaf716ef960c
SHA1 d1185051d5fba2ab822bc86fc93786448fb39fb0
SHA512 77bfeb0086dd5177c727dadfbab5d30d129bad298015b243dafe5381c554bcee376405670129f744bff48aa37df731f1156ea8e2e532025d2415a72c0227963d
SSDEEP 768:D59koh8beJqwsVnhUPzC5+wIRkl+kvNG0con:D5+oh705uPzs+Fk/NRcon
TLSH
T1E7D2CFD9BC3EFFF888080AD844200CDF52E9AFB5DE751483C9EE052B27158A5E275E25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogoCanary.png.xpr

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\VisualElements\LogoCanary.png.xpr
Size 29KB
SHA256 2575fbf8eb845bbbead7487f21924e760269c86f01fdf22552f67c058286e68a
MD5 26a4b73e0d0471de1e3c1de9b3e72807
SHA1 18c48f7c723cef79ab7f76710984994dc59750ba
SHA512 c2cfff45982324d140437d4c2c467d8e8d0edb68eb24f3ab2ca4a303c7c57109456fb7bd0d4f15be6d07f2fea6b9ffeb97c3aed6de5046b9b06181cfb7963841
SSDEEP 768:yuYnOffP4xBR1VX583wzhFEg6JUBURbWYCAgyLh2w:P9fMDVXu3wDxlSRKXQ2w
TLSH
T13CD2AEF004DBB0984249CEE5A140E7FD92D69DA3FE4E0E64C31BD7D2B22AC689667034
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogoDev.png.xpr

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\VisualElements\LogoDev.png.xpr
Size 29KB
SHA256 229be0b7b234aa173e36a3ceebacf0d6545c9b442631c38d5ab651f43d8115fc
MD5 0e0f1d7aa0f2ab11ca454f5abc6bd17e
SHA1 a9bf9aea4ff37e581b49d3ff5220b21bdeadf3ae
SHA512 81e467567abf717d3e038c0d04f1bc19c15f3b450a4557497098458fc7efe0a2693717568154998576669f604a0b06128b401fbd544567262cdf06078a7f6de6
SSDEEP 768:MLfKE7k1nxo67nLi5TwUZaAXkmc/zdRxJdRWPsHU:lE7yHktaY+dRWPsHU
TLSH
T1F8D2BE88D54693082A5C83AF40D7DBD78B32CD756486E358C5A8DFB325F189F30AAE0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SmallLogo.png.xpr

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\VisualElements\SmallLogo.png.xpr
Size 15KB
SHA256 55e94266ee213a0d0e41ded6cfd3091123de6ef23928b7fca60e4df70a454c09
MD5 507704cbf353b3efb3416be212efbfcf
SHA1 7eb4263ce80aa36da38ba79af29d2a36ffd8ea6b
SHA512 45aab40bc547672e59b684f1777714e0bf15266a7d7bf8c2c253f5be69140e85d12b92bb888fcbdf906b582ad0448d460e0ede0bf52d8884571027ae1b6ff4d1
SSDEEP 384:FZGtdQydc6X9qYkARNLLGOglKDpYivmM5oZfrApE+oUibk98:G7QCc6X9NRlCO1Oi+M5OTApE+oUibw8
TLSH
T10F62D02576CE564C5E65A848DF44482D7BF9722D202C587BF4EF39688D7C8E187F500B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SmallLogoBeta.png.xpr

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\VisualElements\SmallLogoBeta.png.xpr
Size 14KB
SHA256 563f95f72ceee6b3f23202b42183565af084452d54a59102e1df13ed709f4476
MD5 82235c863b0ddd92e972fe173b8f815f
SHA1 d16cd61364b3865f51320164937289a24e62cbf1
SHA512 d0da4c7b9c41311866df82f4697772fdc45252b03b01acc373db8873b18e103853203edd9c5e08238025c52cfc924967fe0ef82ce3ff3ca64a0f15118738d280
SSDEEP 384:yyx+0zQRcpQx8oCsngWb6MnbRRYw7cDRZR5h6aSnfoSE0n:/Z0RQpoCygWb6MnbRUDHhBMfo4
TLSH
T1B162E108016B373F53D48692AC0E5D9F73829C24DAB7589DF8D483FA776CA740623650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SmallLogoCanary.png.xpr

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\VisualElements\SmallLogoCanary.png.xpr
Size 14KB
SHA256 c5c70975f4191030b5ec1a119e6cd7c20651c30920f70d5b5beea93aa5ac5c99
MD5 edbbd697041fdbd75c905938193e53da
SHA1 dc4c56a716c221c3530a364c63b3def2a3e7bb8c
SHA512 701ea2284e6cd778e880f894dba4be23c138882bdace99da253901bb0f292e93c8f49b0c14651d47f3fd3143e6518a59656f77d2d778317089b3ec030833398d
SSDEEP 384:3hJUgf+WpTHGof9DnPhyguaQrX3aRz4/st:3hJ1f+kzGofVALXKGC
TLSH
T1FE62C0EFA22AD086F0BB550D6E707ED6366848DA9619353174634FDE37C24E103BA329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SmallLogoDev.png.xpr

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\VisualElements\SmallLogoDev.png.xpr
Size 14KB
SHA256 7ee001b7586df267c48964971b8889ab40536d9c7282f634b0b249a24c939205
MD5 5760594e8018aeddfd8ae2b1db8941cf
SHA1 76ca59a3fb40651dba484cb14e6876d24ceb065d
SHA512 90599453222c34a38116d6157bd441214ad97b1bc5603a604e60ee685c5ff8a8d78d796b6e2171d512c37ff215f4265f466b5fc7b0fc33b42b05c8b5316dc2d7
SSDEEP 384:11XIRWQJfYA7VntmV7Pi5Gois6sjcBeNZiloKwa4C:TYDfLFkxmDZiSKAC
TLSH
T12262C10FCC528343153A0D1E6B753D165AD7C5D975BDBA88128F92C9A74C324BE217C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json.xpr

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\WidevineCdm\manifest.json.xpr
Size 1017B
SHA256 70190c1950c6398e6e47311e1a4c014c33da42cace9009badd4a4e3a6fdedb7e
MD5 3361a6fc802323519ec1f8f07e9bfe63
SHA1 c9728f90f975c700fa5ad8f3b330fd476c874967
SHA512 2f29200eafa0cd429e2e86e700f3e2e2298eca9cdba4801cd1fe03b6979b9634e3f91a18250dcfa11d0d31805c1b207031293b21523606c46ad10262735ced08
TLSH
T1EB11B57D06060AC049C47AAF849AC6A879B3EE10D103FE01AA0C81475DF93AC7202B62
MD5 SHA1 SHA512 TLSH

Submit Download

vk_swiftshader_icd.json.xpr

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\vk_swiftshader_icd.json.xpr
Size 122B
SHA256 4bd0c037a80bc94f02320967f9ea1432ca5c0ac4127eea374331a8419d4eb8fc
MD5 5586b671a3fc7368ae4de1ec2fba398a
SHA1 aa2acc0ab16ef1c6efaafee7aac8a8eb6c6f573c
SHA512 0a4eceb290781e32a01bd6d027df8fb164baa4b3085838eeb618856731038680af2f5f1b8a6e2f132a210d5af76541cfc962944fbdb37ea259f010ada4264db2
TLSH
T166B02B6781802BE60D15119D680BD41D2806C05295148B005101F0D614D886B00C8A10
MD5 SHA1 SHA512 TLSH

Submit Download

Manifest.xml

Path C:\Users\All Users\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\Manifest.xml
Size 4.3MB
SHA256 16419b081da0ed62c6da52e9bdd9242756445f7882ac7306d8dcc4bff401fd4d
MD5 f0badb1d0d333f9fc0b8b9554e95f260
SHA1 3c1e1ebab6feecad9b47a7210f37f04a0e6788e3
SHA512 46043bee9f3f3c8a0ed7ccdd2d553b70050d51ca3609366ae82b6d295d06714b89f0a61c44ba86af312f477d9414d774e337a73af0179559ad3122b4a2246455
SSDEEP 24576:DgrqyIF72ZiylTlnl5lylbl9llltlclxltlml1lHlz24PSkeck6o8B5+pJtB1X8x:PkY1
TLSH
T18926C59DB0E899BC63C3C9C0E6AE465B46ED6E77807201A27217591FB79A73353C12F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HACKED_BY_MR_M.txt

Path F:\HACKED_BY_MR_M.txt
Size 105B
SHA256 04dd15032fe4e47c5ec58c05ab7846932d831ff0c14428a15752e1d8f5541341
MD5 2c90780e0ed25d965fc9a0b7e358193e
SHA1 72ce83e9055dced88f159c9bc2b9f4a0f76295cb
SHA512 02458ecb2321c996f794e17d88f6b6ac3405c7319190c1b9bf6266cb966be07de66999cc9e9b6def0d36acd13f7ab708267b24225417c8c2c8a02467f79b0b42
TLSH
T102B012F73C461954001004D1BDA584394F2F4A5C9C500995250044880C25A0DB587033
MD5 SHA1 SHA512 TLSH

Submit Download

memory/18832-6331-0x0000024435D50000-0x0000024435D51000-memory.dmp

Download

memory/18832-6333-0x0000024435D50000-0x0000024435D51000-memory.dmp

Download

memory/18832-6332-0x0000024435D50000-0x0000024435D51000-memory.dmp

Download

memory/18832-6343-0x0000024435D50000-0x0000024435D51000-memory.dmp

Download

memory/18832-6342-0x0000024435D50000-0x0000024435D51000-memory.dmp

Download

memory/18832-6341-0x0000024435D50000-0x0000024435D51000-memory.dmp

Download

memory/18832-6340-0x0000024435D50000-0x0000024435D51000-memory.dmp

Download

memory/18832-6339-0x0000024435D50000-0x0000024435D51000-memory.dmp

Download

memory/18832-6338-0x0000024435D50000-0x0000024435D51000-memory.dmp

Download

memory/18832-6337-0x0000024435D50000-0x0000024435D51000-memory.dmp

Download