64904d8e03c984096077175b872d00866d4d1d450388b7d9f9a2ca164952c8b9

Analysis

user interaction
yes
max time kernel
50s
max time network
31s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 18:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xpran.exe
Size 174KB
Sample260910-wn234seq8z
SHA256 64904d8e03c984096077175b872d00866d4d1d450388b7d9f9a2ca164952c8b9
MD5 25fafb261c4f06a390e93a03ce194e94
SHA1 88a16946db25adc1bcc1a7d5dc72e0a3141bc4b4
SHA512 7ca825082d3e6141425c91b71eb526c2bb5e5b5219209aa40c70fd9d918c1287ec5510b145b4a17a7041e13c204ca6a729e16d28a869906ee61f94360f85c09d
SSDEEP 3072:SyfkbMj7Vrp09Ddbk+Vy3KJT5j3jQsrLXWNzX4Ug8pb10:SyfdT09xjVprkaL9x+h0
TLSH
T137046C16B7A511FAE0778178C9A20705F776B8250770ABEF03A04376AF276D09D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion evasion execution impact persistence ransomware spyware stealer

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1856	bcdedit.exe
6116	bcdedit.exe

Renames multiple (2974) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\XPRan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xpran.exe"	xpran.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\XPRan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xpran.exe"	xpran.exe

Drops desktop.ini file(s) 27 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\desktop.ini	xpran.exe
File created	C:\Users\Admin\Desktop\desktop.ini	xpran.exe
File created	C:\Users\Admin\Downloads\desktop.ini	xpran.exe
File created	C:\Users\Admin\OneDrive\desktop.ini	xpran.exe
File created	C:\Users\Admin\Videos\desktop.ini	xpran.exe
File created	C:\Users\Public\Documents\desktop.ini	xpran.exe
File created	C:\Users\Public\Libraries\desktop.ini	xpran.exe
File created	C:\Users\Public\Music\desktop.ini	xpran.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	xpran.exe
File created	C:\Users\Admin\Links\desktop.ini	xpran.exe
File created	C:\Users\Admin\Music\desktop.ini	xpran.exe
File created	C:\Users\Public\AccountPictures\desktop.ini	xpran.exe
File created	C:\Users\Public\desktop.ini	xpran.exe
File created	C:\Users\Public\Downloads\desktop.ini	xpran.exe
File created	C:\Users\Public\Pictures\desktop.ini	xpran.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	xpran.exe
File created	C:\Users\Admin\Favorites\Links\desktop.ini	xpran.exe
File created	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	xpran.exe
File created	C:\Users\Public\Videos\desktop.ini	xpran.exe
File created	C:\Users\Admin\Saved Games\desktop.ini	xpran.exe
File created	C:\Program Files\desktop.ini	xpran.exe
File created	C:\Users\Admin\Contacts\desktop.ini	xpran.exe
File created	C:\Users\Admin\Documents\desktop.ini	xpran.exe
File created	C:\Users\Admin\Favorites\desktop.ini	xpran.exe
File created	C:\Users\Admin\Pictures\desktop.ini	xpran.exe
File created	C:\Users\Admin\Searches\desktop.ini	xpran.exe
File created	C:\Users\Public\Desktop\desktop.ini	xpran.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\nl-nl\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\version.js	xpran.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\NL.ROGERS.COM.XML	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ca-es\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sl-si\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sl-si\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffffff_256x240.png	xpran.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.xml	xpran.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-80.png	xpran.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml	xpran.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\go-mobile.png	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\OutlookTaskNaiveBayesCommandRanker.txt	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\images\example_icons.png	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\js\plugin.js	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png	xpran.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	xpran.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\Client.xml	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\sat_logo_2x.png	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\SearchEmail.png	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ko-kr\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-si\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png	xpran.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\vk_swiftshader_icd.json	xpran.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.runtimeconfig.json	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-cn\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	xpran.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-80.png	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\nb-no\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-cn\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\README_en_GB.txt	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\core_icons_retina.png	xpran.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL087.XML	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\cstm_brand_preview2x.png	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-fr\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\plugin.js	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ca-es\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\hscroll-thumb.png	xpran.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-100.png	xpran.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.COM.BR.XML	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-si\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\s_close_h.png	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\hr-hr\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml	xpran.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Median.xml	xpran.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-80.png	xpran.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\PRODIGY.NET.XML	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\warning_2x.png	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\convertpdf-selector.js	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\CompleteCheckmark2x.png	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\selector.js	xpran.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OutlookLogoSmall.scale-80.png	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\eu-es\ui-strings.js	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\rhp\editpdf-tool-view.js	xpran.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml	xpran.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EXPEDITN\THMBNAIL.PNG	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png	xpran.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\illustrations.png	xpran.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
6104	vssadmin.exe
5496	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
4168	xpran.exe
4168	xpran.exe
4168	xpran.exe
4168	xpran.exe
4168	xpran.exe
4168	xpran.exe
4168	xpran.exe
4168	xpran.exe
4168	xpran.exe
4168	xpran.exe
4168	xpran.exe
4168	xpran.exe
4168	xpran.exe
4168	xpran.exe
5628	xpran.exe
5628	xpran.exe
5628	xpran.exe
5628	xpran.exe
5628	xpran.exe
5628	xpran.exe
5628	xpran.exe
5628	xpran.exe
5628	xpran.exe
5628	xpran.exe
5628	xpran.exe
5628	xpran.exe
5628	xpran.exe
5628	xpran.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	4612	vssvc.exe
Token: SeRestorePrivilege	4612	vssvc.exe
Token: SeAuditPrivilege	4612	vssvc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 5496	4168	xpran.exe	91
PID 4168 wrote to memory of 1856	4168	xpran.exe	92
PID 5628 wrote to memory of 6104	5628	xpran.exe	99
PID 5628 wrote to memory of 6116	5628	xpran.exe	100

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\xpran.exe
"C:\Users\Admin\AppData\Local\Temp\xpran.exe"
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:5496
- C:\Windows\System32\bcdedit.exe
  "C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1856

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4612

C:\Users\Admin\AppData\Local\Temp\xpran.exe
C:\Users\Admin\AppData\Local\Temp\xpran.exe
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5628
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:6104
- C:\Windows\System32\bcdedit.exe
  "C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:6116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

HACKED_BY_MR_M.txt

Path C:\HACKED_BY_MR_M.txt
Size 105B
SHA256 04dd15032fe4e47c5ec58c05ab7846932d831ff0c14428a15752e1d8f5541341
MD5 2c90780e0ed25d965fc9a0b7e358193e
SHA1 72ce83e9055dced88f159c9bc2b9f4a0f76295cb
SHA512 02458ecb2321c996f794e17d88f6b6ac3405c7319190c1b9bf6266cb966be07de66999cc9e9b6def0d36acd13f7ab708267b24225417c8c2c8a02467f79b0b42
TLSH
T102B012F73C461954001004D1BDA584394F2F4A5C9C500995250044880C25A0DB587033
MD5 SHA1 SHA512 TLSH

Submit Download

ui-strings.js

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ca-es\ui-strings.js
Size 1KB
SHA256 9e83554895403f0e048fb43991612735ed7036fcf26ea66e2719cf4a4e9a5401
MD5 73ac585286735622119814431c44abec
SHA1 812f926a82fee4be535ae7c65b3176b7f9e26d28
SHA512 f97f89d468ed832455e6d5588de3faeb4b565603e179fa0f09196e7eb1dac1521886cbb11c483377d3174e32670df97260a3a40d890064fe5ecaa53cf2083210
TLSH
T10121442255E52C14041F07711B2ACD2DD3018A3D7E0BFD4970FCC76633DA8ACC2A4850
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\AdSelectionAttestationsPreloaded\manifest.json
Size 144B
SHA256 5c4351d44583a74365b348721c47799a899a1e99bd3796ccfc42e1d6bbb2cbe1
MD5 1009b1003eab66bdf8950afd7b5f2788
SHA1 5e45a77dc4b9b3249f21c78abc89559aefb5c583
SHA512 67ac21eb6d15a6ee292720a13bff511279c591800463e5e6a9c29329246e414d928069f073200f32cb99ee7393f703bbaeaa315b7425d0c0a564adc095d32ad1
TLSH
T1ABC02BC417CF3ABF606F44033B911188213910CE9F009A8353013C3891138846831C49
MD5 SHA1 SHA512 TLSH

Submit Download

external_extensions.json

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Extensions\external_extensions.json
Size 115B
SHA256 7dde344dd0e3f63999ca887f7f15dd38e97d460b8cfde1ece121f104af35953d
MD5 858c18afc2c28a7aa2633a5d5c1ff504
SHA1 efe7f5dbb40e469d5d411343d8761184f47f3bea
SHA512 177c31798d9eee189496bdff675870367f13e78ee3203f3fd35948fd0a9fb587ca563fa5a896de46044dc673eaec4a5038e99daeb9c155687092fcb136d09343
TLSH
T14AB02B8150436008977C5C000B7944AB0A90090C97443365000055C406B70101200062
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\MEIPreload\manifest.json
Size 254B
SHA256 89d7f4f9b087f0493debec1a86fa64c86e565a9b1839b3bc640536cffe805dbc
MD5 23901f27c4958201c018867ee3e05a4c
SHA1 579d33df68dc067f62c2dbd022e02277f2c2ff86
SHA512 c6608769a570f623639204090c3a6017506f3b62e6a1f7b5661417b3bf3cc5480baddba782be2f957ddeeb4231eabc16961320bc72cfa598587f6fbcce6cd234
TLSH
T102D097A03AACB1CE8C17ECDA4238861E03AD2E4ACE90801C252022A072F8E81896D813
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Trust Protection Lists\manifest.json
Size 148B
SHA256 cb254b3551db3ece68c2dcedf4ffe4d92d12c481d8a2245648f785221528246d
MD5 6b074aa659beda2b6ee4d2acc1bf08d2
SHA1 6a40ef63a8bd7a7398c58b92ae5dcb4947f9ae3c
SHA512 18dd2091875be05cfec1f333df94d912462de058ed4024ae6fb4c98e571ec4bcead86c24d4ab6048dfbd885d8265d45716a09a951a04a467be9a4a0c47925ba6
TLSH
T11DC08C651B9A16228053626A69A6EB933898359091E128A8A6BE29BB2255DC0200E204
MD5 SHA1 SHA512 TLSH

Submit Download

Logo.png

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\VisualElements\Logo.png
Size 31KB
SHA256 b382e71665e6a51720f6d84e34f37fce8ef13ebf3e1df94c7bafeb9be9f7797b
MD5 1c4ff7b6c9be47c57d867309b81f44c9
SHA1 e480c1d802b1506a8de33364286fd16a39ef20a4
SHA512 68a5222500416d019dfdfa559b1dfa7d4123a85a6c9f47cd2398974e3241d39fd0e100a36bd85dc80fe9b040c4e56719b281bdf73c28d2806107b80ded2e065e
SSDEEP 768:C9Wvk0GuX6IyJKCferWfPMdhXlfVUoebX:Dvk0GuX6IyJKCfHMdVltiX
TLSH
T1F1E27C714CF57392FCA095EDA0617F9034BF69AB87BD71EED8C063440997CE22982587
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogoBeta.png

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\VisualElements\LogoBeta.png
Size 29KB
SHA256 d7ef6e1ce589957399fa1fab6eb9afc009dc3213f572ecd04bc4dd91a845403f
MD5 abd227febc91ae9490bec8485a124f70
SHA1 00be92ba909a67418d9ecdda3868b050833bcf44
SHA512 b0764b2dd86331dd5e806d374b5aa22dd4d460d1b1514d9c5f1e02da8bad47e5d70cb73456c81daf515f314553b1b9ba8be63e6e4147d1381b77894691a9d65f
SSDEEP 768:OLUyqL/HgkoJEntgrBvQyL/4qH7uqKDBojg:OLUyqL/Hglin2vD/4M7VKDuU
TLSH
T10ED2BD93470DEA05EB980E263E7C4C097C5B4462B5C56297E7A4770F9623CAD08F4AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogoCanary.png

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\VisualElements\LogoCanary.png
Size 29KB
SHA256 90910c9893b5357c77b113c28fceca1b7f033bd2cf974195135e9f2fd4e37a58
MD5 503d537c26d3ae7e09b13c25381849b1
SHA1 f606a6f0e5c66ab7f5f028a96d92241fc13c2872
SHA512 a234c1141b03d75728e2e31ed3fedbc3672d56739ccd4876c2026fd8fc4889adbfeec8567ffcd2e9438dbd7be6d05293276d9c9420e6bf9404b39de57bbd684d
SSDEEP 768:/TbUIS6BXngejqp418eHqZ7xnEgCmOPf1:/T/jVnm5eHutCmOX1
TLSH
T1ECD2ADEFDCB0A89F914E018C389C875C5BB524E17B25580119F9267EBA606EC4E8D4EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogoDev.png

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\VisualElements\LogoDev.png
Size 29KB
SHA256 0792fb03165e8fb0a138d30dbc2d32cfc775b4cec569e343c6471839b8b308cd
MD5 00ad670844e185a06f570038ce4381dd
SHA1 66f619185ee6cec96b06e963dd0650aac5fa1667
SHA512 d69786b66400f607494772eebfa3513e2aafbd71b37ff92f70c3501c6435f8c6e056098b44e3cefcbc1b51434bd5a5da297110be7d55f9194df0c4b18b87d7f9
SSDEEP 768:GuFec+kHL5vsmN30Cs5kfobINfBYLIMWOEj3gZsMnDvO4fFcrv:wCL5vsS0CHwcNfWLIEmpQDvOEcz
TLSH
T1C0D2BEC9102DF353293B4D66A17827EB5AD85D1B8FD18A92FED8201E3F29B05B4DBC14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SmallLogo.png

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\VisualElements\SmallLogo.png
Size 15KB
SHA256 c4d1cfb08a6751238dc86154f2e52f6933ea4f4692886bcf483bc4e9d08a0252
MD5 0e3b2853cd63f70af3c64803ee842382
SHA1 c32d10d76bd0afccb8a24a7915f8d0219de31462
SHA512 20f930095b1c1e93c4077de0c1f5c8dabf8ac898877ef4037aaea9f328d74de43085de1e62bd9135e47d042c5801e62c12e465806f544dd13d7d33ae48f676c5
SSDEEP 384:C1PXykdGja0jKfvcYn8DytISP2jO+rsuv4yC39DG:C1PXykdfTP8+tISP6drXK9q
TLSH
T1D962D1D05E04F58D0877F61CEE7C9A6D50E03497F80398EA192B61A8F8AE3936175EF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SmallLogoBeta.png

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\VisualElements\SmallLogoBeta.png
Size 14KB
SHA256 4cf38bfbb7cdc1457476c83e3b8030cdc6f2889b8f19f55af3ab98f618372500
MD5 823ce95fadea6fe24afeea4360dd1a91
SHA1 a42deab82fa5f26ab265bd88496f94aae70be5ef
SHA512 1104700cb3f20e0efd75b51be5a6428d4ad4520fd20317a90876efeebca6cb4d7dd89a0a236831c7707445801dfd69a060d22b1e61a2ece4c09c7196fd9e7eb7
SSDEEP 384:83my3lXKuuqsByfs5SuVe+oTkD8WCcIu7byQYCZbT4CIrgyY:83m2XrMy0tgbTvyuTQYgyY
TLSH
T16062C0F815E24D0B6C11CB4B7F2A159046C8CEFA5A45D19BB1D8835B884BC7A6774073
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SmallLogoCanary.png

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\VisualElements\SmallLogoCanary.png
Size 14KB
SHA256 45e779f10eb70e3672fed1df885bf4baa2c24291171aa3cba11907d0aca039a5
MD5 0c61c9007c8d7066e8e3069a727087a9
SHA1 41e987471ef59f98e6c4d5d7cd616e6e599bd44c
SHA512 8583ae3001fa05938b2fb4327834f20bd3ff086b04d0379193288967dae51df622a8cd7f2eda063fc7e5b7874a7606b096775538ba5bebc01e69f6c4579db343
SSDEEP 384:hUm/7qyzhTaiUMbSlU03pPi3IQJoW2VMTWJsT/:ioqgPOFmR2VAWWT/
TLSH
T1D962D08ADCA933D67F3788F7101DA4404DE62DB4BDAF8660D1BB5E879048582ECD3948
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SmallLogoDev.png

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\VisualElements\SmallLogoDev.png
Size 14KB
SHA256 bcfea1a67ea8302ac24c2fc898288a8ea73ba3f3a23d350d956d7759a049c70a
MD5 78a268899ffde39db6f0b024b471c2b0
SHA1 041bac712e449cb5cc5f18d917de98aa81144154
SHA512 22fd176bddd0d997e26136e43a7b8405a53a864345739d7cd60a869d13496723cc9a192d0d374850ca054f8ab9afe1fb624d15ed4d5878702f4ad4b794baada4
SSDEEP 384:Dh89YYty92HSvn64+wwcsdQuXWxUw5OI71JPFXnWcYGAFY8:FYg9CSCNcsOFUwsq1NFXbCj
TLSH
T19C62D1C19E72AC572087E94184CB403BBE4F87CC4975F91CF5054B297A5153B1E8F57A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\WidevineCdm\manifest.json
Size 1019B
SHA256 4692aca020adf3093fdcfe29d9d0f71ec6a10bc08f7c09956366968b7c1b3c83
MD5 f860c07e6c5f923a1059dd3e7cde61cc
SHA1 ec99aaa26572a7404cf60c806227c5886ca882af
SHA512 c4cfd01f78edcfb3da242efaefa73791268ac023e44f31b61dbe1913bf3d057d00377370c7c20dee103d42f975f77fd81faa89afd6ec418a1b7dd64843af08ec
TLSH
T19911A5DE869A15E465F34ECBEFA647026C8622DE6B6FF4C84C6940C17016007976422E
MD5 SHA1 SHA512 TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\vk_swiftshader_icd.json
Size 122B
SHA256 1dbb76ae930b6d25bfeacaa7b654bfc61592c3648376a42480e528ef7201ef7c
MD5 ac98e60a45e315771641af0de1b4490e
SHA1 0e3195500d82c97b2e2c44377024f7fbf27f4e0e
SHA512 36119b411e719451e02f952a582d2017111186efd42b06e76c7fb892f8c2b465edffa87dba39b5028efa888ec112a3b7f49c11d46b8f4ecbcb4c3dab637af093
TLSH
T1C5B02B430022910B9608031E91434538081A0745E206E6C2D9238C381290013D1400B7
MD5 SHA1 SHA512 TLSH

Submit Download

external_extensions.json

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Extensions\external_extensions.json
Size 115B
SHA256 4413e7b5ba4383d89c6764fcb8ca509d6944b6c9b2006ce1231d2fba2d2dcd62
MD5 5df39341cea958149fcf4c59ef3edc48
SHA1 cbaeb9349467bedcf21d78cff83a6ea57bc4d94d
SHA512 ef8434d8c270cc9b7f806bcc162e1e62a6b2730109f1b255d5adb25f59c9d2055d67543a60d2d65984a618afb44199092825c398534cd009a29eed5cbac5af4f
TLSH
T1E7B092589208BBE8CB644E297618A62873AD2547F6B01B8088A8DE02622C9A6216490B
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\MEIPreload\manifest.json
Size 254B
SHA256 2bf4272df3241cad01777847fc33c64c590b03e18c7e86beccc7d2c925378a1a
MD5 7a879bf49f8323ef84d7ae016f1fbba8
SHA1 a7cfc0e0abc0f31257dad3ea70db190b9de9f8de
SHA512 953a6368de040d80c8ee50caf76b1ec35a8761c3f1b11be8c6a2915a337001a7510228d8dba9ded27c06d0ae344723d5f63595b7eff3f0205a75a46d882a88f9
TLSH
T1B5D02B2D80D348749A90E561119263754693D15D4DAEA915869403049FE2CE71E5A013
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Trust Protection Lists\manifest.json
Size 148B
SHA256 dec731a2f3764d5567f4514ca02c3cf7ffccd3029d38aa380620fe7e703aa953
MD5 aa7d262c0f7acc65a067e6234e6c68a7
SHA1 13d8b88a6d190391d688a763fa1762adeb61e0f2
SHA512 365ea351e7e91b12ffd95ff6cff631b75ed42e4c93c8019eeb199622e9c996b076c3aa6ae9d39d67d03a192f64d61be190622a3612d409a3a4e72f04cddf36fb
TLSH
T1B9C08C3293564B8BE5023604ABED1BBD6916400805C5208143F41F16C8AC5781C8B901
MD5 SHA1 SHA512 TLSH

Submit Download

Logo.png.xpr

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\VisualElements\Logo.png.xpr
Size 31KB
SHA256 8cbabb9ce581b062ae23eb1ba0f03fbbfedf6b2ad349eaee0432989ae7af7fb3
MD5 a8328741283f9a9c4eb23bfb9acf3613
SHA1 bff461a664e3d9be05ae68a533c85c36cf4c972c
SHA512 d9149f2afa18a80292ba88c69ec20fa13dfd510bb33cf28118e3683fffcfa4a5aa8ccfd8845a3be7c0a78f1b0810ecb1ea402c97491429f197d970fe767917c0
SSDEEP 768:jWpwlvzlplUjBvx2YK0kwk1UEKkS8wJ4WwlLzcNXhw:KulfGpxm714BFJ4dlLzSK
TLSH
T1CDE29B809B2390A095F209AED884F1FC4A2043AA13FFC1E68D92C5775DC58677277BCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogoBeta.png.xpr

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\VisualElements\LogoBeta.png.xpr
Size 29KB
SHA256 cb7f757a050671657eb06c22fe2c6abfad41b568339ef73dbcc830cee43939f4
MD5 dc78c6299e7871612f5dd52ac8fa2f5d
SHA1 fbb64e6f0049f9177128db5d2ce9348494e372f5
SHA512 e3daf22f84b44a5c444c4ecf060b71eac71165dce03ac13928204907edf298c506df4e24702e5357485e532e493f8b9d0bd6bff9058668c29e0a83a043425fdd
SSDEEP 768:eD9nYbrLlnddQqDPa+9wWkHgarTmLROCny6zwUo:WYbHld6qDPd+gar6lOCny6wUo
TLSH
T147D2AE5008D7E7F222F7B78D1324F2B6EE3E781A7061052E24688D6918EF79355D77A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogoCanary.png.xpr

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\VisualElements\LogoCanary.png.xpr
Size 29KB
SHA256 a5d5d240c098f1b8f5aae9dcf7e2de31f5befc93e18acff13c2405edba9b124d
MD5 796f032efad1464254efe5c57c4296e0
SHA1 170e60c48dee8a34f511180ae19a6bc386033129
SHA512 00c62602fdfa7d50f97a75833ae1d9ad9df022cfb91e29d2ac7679d9e2442ddda239a0d07d63ea88d786cabccb4684f7c3f1013b3c7db0550287a4d6d7c049dd
SSDEEP 384:F1lTd8CufigTs4lw7zoObm+VF39z68XfgL82VGWbU1y9boxVPR/XqNNSX+jtgCrn:FdYTAzoObPVtBF4aZQ9boXpfqNbtgyn
TLSH
T14FD2AED5979DC603CF249D2CC08D05082A6D4294D6A2362C3B46FB36F44D4A7A3FEE7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogoDev.png.xpr

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\VisualElements\LogoDev.png.xpr
Size 29KB
SHA256 c13080e0b809ec43ee5c2a734835879bc7020008c423ee644ad9412c7c9fd182
MD5 424d07d52abc99a5fb283184cffa75ac
SHA1 b6230c9ebc74b87ad0d77f4f7269dcc10e3acdf5
SHA512 8f09a6053747da2562c4f012e80f37f5de71cbe1dc7deeb7c2b8b745f5899ee5d79210ca8b54a92ff5647a2c40732a1c1741a943545632bc7557e9fe46f670d2
SSDEEP 768:vPuAmE9/aiCgkfU9GAzxAue4NIqnllxfm4HBGp0G6XtFi9mpX:kPUUAz6S2gllFmm4F6XrHX
TLSH
T105D2AE2EFDC2F9218126D51E52F356A3BE5315A2D88BE9389E1BB8000CF57F603E6165
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SmallLogo.png.xpr

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\VisualElements\SmallLogo.png.xpr
Size 15KB
SHA256 f952ebe6f094ba2a14c653cc21c167755a9d3851338ad70b219d5842a39d8278
MD5 3b5a1f44ab5854e13eb3f0d1e8f5e87f
SHA1 34e8cabe6142bc4f7b202f0e9a75fcfffdea4408
SHA512 b01bc93ccd86f40a1ee3ffee62bec24f702499ea2ba5dd190c12c28d35134b20ed2fd7990de87e1cbb8d275f954442e489bae8cb1c9739939e38afe13963d620
SSDEEP 384:XuYnLbpyWIicpqwTi/jE2A2TmXKTH1JUIutJS7QemvNG4BHDdU8rrbg:X/VdwTcE2A2TiKTHsSHm9BHJU8r3g
TLSH
T16B62D08B8982E119BB09546A082485F1D3CE63598514B40F9D1F6F292D1DFFEFCFA361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SmallLogoBeta.png.xpr

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\VisualElements\SmallLogoBeta.png.xpr
Size 14KB
SHA256 947a24b44d50048b586f70aefe6f8922cc9da283a2dc1dc5e24e2dd6896bd800
MD5 1a53b6e5568007cf6f7ce2dc99303ffb
SHA1 67f968da697abcbf8a0402b810bdfbf1bc81e0d6
SHA512 dca3243124f731bd15a05b4c41d906711470e713f0d7444f790d91b76e6283c9b1f202c621b93d80acf455190c0c0dbb59837b4424408db8bfab87844e7d1e05
SSDEEP 384:tqNtoYOlADAFZCf6t53JhaqW+blL5dg9DOjIkgCsMKPNkQeZ:kQjFZEy55MYghOjIFWKPNkQI
TLSH
T1A062D0636E041DDBFD159EE11E90C1707C94BB4844F16FA436DA4FB8B823699D26418B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SmallLogoCanary.png.xpr

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\VisualElements\SmallLogoCanary.png.xpr
Size 14KB
SHA256 5c08ed7b862dd0bd96c385e992a28339a1b30188670bfe56ab23dceeb0e0c443
MD5 8f8da2aa9ad453c30f89c5e628916482
SHA1 21cadd2e18d7f1f1ecdeeceded71684b9622ef0c
SHA512 de2f97f85ca775e11bf87165782893cd2660799b7687f0477d7fd14d5845b82d977facb3f72377599c21129e83eedaa9a8fe851833436de0471962490e273fa9
SSDEEP 384:AFTJhyzSOHbqmOfZtJkwDKc5i4wcev/axVnuO6:AZyzSOvwtJkuQfvixl6
TLSH
T1D462C051C44FADB96484EE80D762D88EE46B860FD7811D32205831594590D5F7ECD3FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SmallLogoDev.png.xpr

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\VisualElements\SmallLogoDev.png.xpr
Size 14KB
SHA256 314cbc669c20f253703f79597080b773f1623908668651e1c3347ff3976a919a
MD5 dd0b99704ce5f69054b1dea68735ceb6
SHA1 94c8ba1c89bddf31966288a717f9d237edd4d28c
SHA512 2996ec7ec20966c2c6bc47971e05e1041c6be1a94be38f1891ac3fe157367918b3e407ab7928cb11fd169a36f256be2d6b5a5d91f13a916f8c4a163299450130
SSDEEP 192:yKVVNUjlwsXZIozmoR/5mG/93Yh6OjOppaQlrkIsH9tqVHBYZM78ptQvaMcccQ3R:fpUjasXPzl93Ya7lrfsTqVHBYZ/QcCR
TLSH
T16862C0441DAE2D12E022F6C7A7C0D75B8BF10B551746C1D6EDFCB5B86D42A570211CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json.xpr

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\WidevineCdm\manifest.json.xpr
Size 1017B
SHA256 097307e30133b07b5c4f86e14fdf65fc4ba192124d4109f76a78a06f25b79fbe
MD5 bd67bdbd44f97daa16f92828ce92e557
SHA1 375633ab2142df3b5451ee58e074059835c468d7
SHA512 5a8cb3f1b14120a539ea9ce3cb661d8c251ee85a57c720c6494c9fb87d868c8f4d2861533a0e299c3c5027cabee3d9737869cf90b4867158235f60341e08c2f1
TLSH
T19F11126A0EA26F12DA05894C4F525CD5A6931903E1978A893D62A5C5A46C71B073EC33
MD5 SHA1 SHA512 TLSH

Submit Download

vk_swiftshader_icd.json.xpr

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\vk_swiftshader_icd.json.xpr
Size 122B
SHA256 9ce1af79b5600774f4c20ff164b988d553b85958c311d2e11b5db16689783f5b
MD5 04a7467c32fbbb77959467e65fc07ffd
SHA1 3064acd4af8300e940b121d340cf033548f1b9f9
SHA512 afb5fa6e16135494f3b7eb7623fc6c2441723c9764edc8f09dc48c23096817bc3342751484188d22ab793e22b758a32cf7fc99b8eb90de5c7871bf3ad0242e6d
TLSH
T15FB092BC4F96E8EB9AC1247B6A2E32202950268E14100AB2A8224B0984A11E2A138067
MD5 SHA1 SHA512 TLSH

Submit Download

AppXManifest.xml.xpr

Path C:\Program Files\Microsoft Office\AppXManifest.xml.xpr
Size 4.3MB
SHA256 7043ddeedaf03e7eaff6a5491d997a4b72ce373d0e5c735a0d4833fea1b86abf
MD5 f6973b934670eed97f2eb3c56763b1df
SHA1 db4dcd892595ab359d8f9668b48ce9b80c7c08dd
SHA512 03265c3cd8c57d546e74adab514ab295dcb4c7115b828c7e7cbae63531100074c99671c6a971b60cbac9934e70ee7b846549823ff69fad5921de1ef92859280b
SSDEEP 98304:8MKWoTXxbsX7yXQX9XeXLqVXqXR59mdte6XEXwt8XXXRXeu9ZJSeL3XAX3XSXqTF:8MKWoTXxbsX7yXQX9XeXLqVXqXcXEXwV
TLSH
T1FC26B82E09C5E2B11B2F4FE3CBA5C9B071CAD3EB7488AE564508BC7C91013F6156769E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YAHOO.COM.XML

Path C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.COM.XML
Size 814B
SHA256 5d0381457af2af894401973674cb625c90fd4c110e1297447bb5f5c7df763c71
MD5 9f612afa637af3d1c03824372389993c
SHA1 43f49393232d4912c94d99b6520f4bba864ada88
SHA512 6e152117d92f2da5375eddc37f911bb9bcc8aeb9387067964adf094026da4c70b193b68cceb65eaf6a1c241c210d85af3f3c62b38afeae0990ae9f92dc41eae5
TLSH
T15501416E16BEEA584BE933F00585026325AD21A903D24CA7F760A983EC3811CCF07E41
MD5 SHA1 SHA512 TLSH

Submit Download

PGLBL002.XML

Path C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL002.XML
Size 1.4MB
SHA256 99fc5877709c4c694acd79d5beebbb4a536ddafe9a490c336d93a2a0c50b6739
MD5 0963a566a09c81d5403453214a9726e3
SHA1 f42c716866214be312bada556ffad726211d66dc
SHA512 2a74d2e270d706332d3467ff0c286346118c1b6a65c619fb07d76cdf7febc654b902df8a1eb040b51e95c3ee8c73c6e48a0bea3cbe267d5c42e166e7e825e621
SSDEEP 6144:xZxe8WwK1hPIh1phN+eGNUq1uDWYvu3zFc1L0Ar6oW0kqaeD+uK9P:FwXI7N+eGADWYv4i1L0ABW0kxuKB
TLSH
T1F765D13D4A6D87360B87C1AF1A6F035A88690D605F9E7D353BB9418B64B1EF274313B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PGLBL048.XML

Path C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL048.XML
Size 1.1MB
SHA256 3f14789adae5152c75c8fb8a3e7be5252d44dc79e4db5fb011cb60632146d7e7
MD5 269a19ed1732e8daee493225c28bdfe3
SHA1 5031dfc984b69fb22926547e8ef813915c56ca0f
SHA512 bf02b76f2e17e016e7c72f215a214dfd23c8ecd4f2103e95a3dbb0fd5df2e29b6f0ef49e2d87cf4054b63aeadf9c59c374b6715e6fbcae78f20b467b5cb8b081
SSDEEP 3072:BFUuJYsbYoQ2ANOuOpYwmzufgkN3RvbwaOxWH48vgG8NdfcsroqkS/wWSgmwgDXn:BawDnjfzbwhWT18/uegjw2uqTsa+mr
TLSH
T18535006560B9257B029E2A77C33664FEFD93E41ACBE964147583CF4CA5FCB2026EC640
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PGLBL083.XML

Path C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL083.XML
Size 35KB
SHA256 341dd9158f5c9ff4d541063bd276c4e9d35b7d887eb946b681b92559c60890e7
MD5 05b45e6b689ecf02ca161bdd3ee216c0
SHA1 6564aec5e95b18ac0c3462cee39648c4e59fc2aa
SHA512 b3f3175a81ff2a06e554843a6e06248015520524c2a5b90a9ec70f26bb4451da09b228b76867e61ac70e22e377059c9e6149571f428103b8bfc22ed3ce61ce76
SSDEEP 384:sl4DFzDMKitMhuYxHX1khOCWaLg/jBykGYIA4GLyMrkEBh68t:Q4RD9+AxHXo6a+lykflLykLBt
TLSH
T172F20E2E6950860D6384FF3C93D2C8DF8DB849502554833B687A17A29F45339BB39DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PGLBL104.XML

Path C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL104.XML
Size 384KB
SHA256 11dd1387196af5d23015746532240da3bc212cfc82b204977a67bceddaa1b58b
MD5 7a487a4d67391d61cde67a08a451a6f4
SHA1 099acdba781ef8a7e33038df2d7e346aa6e02aa7
SHA512 18942c32cd6a59e92adf7478b98d4d0ae3909ea0cfa86d06bb7e310527b1d1031b85705181352c9525be4a5c2cc5a443a9965161efb7caa649e72920ab3b5a75
SSDEEP 12288:TyUvak+Q7+s5LKtAwti+j/jkUvsP4Pnw7qQq3r8bCb6jPDxmFNjjUZE5WLZRhrZG:/a8u0pe0CqVEIBviJz7NKCX2IOb0
TLSH
T10484B87C3D27499F3B458E3D859BA6E5F4401A12C99C543A38B324ED9ED82BB503F278
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PGLBL107.XML

Path C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL107.XML
Size 117KB
SHA256 108f7f07176686eabc77ee402dbea5266cb665c87ced62117ada0817d85b0b89
MD5 b64a02d8b9fb248b55fb4b2d0df2d1b5
SHA1 5f29f55c04137a4b2f91d9689eabdc950463c4fa
SHA512 64cf57e07266277045ca04222081a11ad9060bc5ab98546ff0a8558324afe9d9a35ba87aab02e5a42cc273965162068974e2919f4b5e43b1e0c2014caf3a31f9
SSDEEP 768:X9lhww61bpv2LOJ7J2x5fsfD59Ehv8zquCrRsp2AF5BHhahFI8xb9/zQ5N9e9fL+:lcOaefgVFHJdNouTzaRuj
TLSH
T1EBC3EDF68BD89068FA1CC2ED8DADA6B5BC0C15D3FEF12FDE060D2552CA3C846D095259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PGLBL108.XML

Path C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL108.XML
Size 182KB
SHA256 1b1fa9040294f19d98959a01fff954d1ddca3bbb4703b990c701fe5d784ecdfb
MD5 eea1131db025a2029c952160d305f56f
SHA1 e2a7d0e6bba46b7739e08e36eec215ec501381e8
SHA512 a0619e9f349f4a17cf759fecff48cb4200bf021afee2684d8498cd5743e3808586c7326149dde8cfb38b01a426f65107ab36a716918a1dc8d1e31c48593fa43d
SSDEEP 3072:GpPu50dGn0PhtV1LoihQvbiBTRVWRoWbdWIoJaQ:GpPu50dGn0PhtV1LoihQvbiBTRVWRoWY
TLSH
T175041E7D6954BE39D3D9D25C80204378B4554AE02478183928B7F89A753327FEBB2DF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PGMN110.XML

Path C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN110.XML
Size 50KB
SHA256 991830af0b63da518b92223d4723942436c7d0906f7743699cd7c9d56500320e
MD5 7d5221f705a7fbefdc309316d9480450
SHA1 d52d8ac7f8f2d1f03cbddf06836b81baf4baabdc
SHA512 bb9e14f731f4ff12962c5c8935ab2294076ae29a5e742dd4b7e23572719990f2d3bbe43bdba56c09f37f4bc56aa6a7d57875e8cbd049de3641e430c04d8feb7c
SSDEEP 384:LMGxzIi8RnJMtxq8wy28c3VIvWihDtLLJa0pwLWNg/yy2HPAvvhhD7i8:/xzIXRnJM/x28ruixLLxwLOi2HK5RH
TLSH
T1E533A37CCDE145BD0367D5EC647773A5E0ADCA25DAF1903928B294806E21BFE8170EB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cardview-addtotable.png

Path C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-addtotable.png
Size 247B
SHA256 6e27120a079a59c020a559973898a4a6d9784d3f76a80e3c6e73741630f5c0af
MD5 3e62f9d0cc7775979a658bf7228dcf67
SHA1 fb068d860e3c1f668be9271047d7b75d22051d86
SHA512 dae554b394b13d72c4b5e3bf72ee87c1ec350752f985e25abeb7698df43e59ba0dc2ff10530260e28c33c2b963c8db1f39662cfc0d5d0a36d4ae9b345388bad6
TLSH
T166D02BA61AED0CBAEF6DD5592B008721C1D454011142859C19604A48280FE063496987
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Size 233B
SHA256 8cf66d27df031e4d0112c890f515f7437aa5c639459cdd0790dc0cafedbd6a25
MD5 47e88e8c377a14cfa0b7e4500a5ad9dd
SHA1 ad9be0a69c0b05908059048dda71d95598d398ed
SHA512 fec69fdec85a4aa65129819923565a6d2236c88bb3f4bbffbf0c6ba818215ce0d3fff4ca3b8cb82b9861596f44456792c7fe345dcbdd53c1c48e690f14eeb97b
TLSH
T136D09734827F38230E7C2C8FB222EA2661F91300CC180063ABAB30486280DE28082008
MD5 SHA1 SHA512 TLSH

Submit Download