Overview

overview

7

Static

static

3

OfficeSetup.exe

windows11-21h2-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    227s
  • max time network
    232s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    27/04/2026, 05:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    OfficeSetup.exe
  • Size 7.0MB
  • Sample260427-geavyact6v
  • SHA256 75597a98eac497bdf1aed75949d3c059ba8c9e20dd65599490ce28cd29700e1d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistencephishingprivilege_escalation

Malware Config

Signatures

  • A potential corporate email address has been identified in the URL: [email protected]
    phishing
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 31 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks system information in the registry 2 TTPs 8 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 7 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Event Triggered Execution: Accessibility Features 1 TTPs

    Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 3 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 9 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 18 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 56 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 41 IoCs
  • Suspicious use of FindShellTrayWindow 41 IoCs
  • Suspicious use of SendNotifyMessage 19 IoCs
  • Suspicious use of SetWindowsHookEx 38 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\OfficeSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\OfficeSetup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3104
    • C:\Users\Admin\AppData\Local\Temp\OfficeSetup.exe
      OfficeSetup.exe RELAUNCHED
      2⤵
      • Checks system information in the registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5188
      • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
        OfficeClickToRun.exe platform=x64 culture=en-us productstoadd=O365HomePremRetail.16_en-us_x-none cdnbaseurl=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 baseurl=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 version=16.0.19929.20090 mediatype=CDN sourcetype=CDN O365HomePremRetail.excludedapps=groove updatesenabled=False bitnessmigration=False deliverymechanism=492350f6-3a01-4f97-b9c0-c7c6ddf67d60 flt.useoutlookshareaddon=unknown flt.useofficehelperaddon=unknown uninstallcentennial=True scenario=CLIENTUPDATE
        3⤵
        • Drops file in Program Files directory
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious use of SetWindowsHookEx
        PID:3328
      • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
        OfficeClickToRun.exe platform=x64 culture=en-us productstoadd=O365HomePremRetail.16_en-us_x-none cdnbaseurl.16=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 baseurl.16=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 version.16=16.0.19929.20090 mediatype.16=CDN sourcetype.16=CDN O365HomePremRetail.excludedapps.16=groove updatesenabled.16=False bitnessmigration=False deliverymechanism=492350f6-3a01-4f97-b9c0-c7c6ddf67d60 flt.useoutlookshareaddon=unknown flt.useofficehelperaddon=unknown uninstallcentennial=True
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks system information in the registry
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:7124
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
    1⤵
      PID:1376
    • C:\Windows\System32\oobe\UserOOBEBroker.exe
      C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
      1⤵
      • Drops file in Windows directory
      PID:2572
    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
      C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
      1⤵
      • System Location Discovery: System Language Discovery
      PID:6000
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
      1⤵
        PID:4312
      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
        C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
        1⤵
        • System Location Discovery: System Language Discovery
        PID:5684
      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
        C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
        1⤵
        • System Location Discovery: System Language Discovery
        PID:4632
      • C:\Windows\system32\wwahost.exe
        "C:\Windows\system32\wwahost.exe" -ServerName:App.wwa
        1⤵
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:4368
      • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
        "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks system information in the registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Checks processor information in registry
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:5500
      • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe
        "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /progressandlaunch AppTargets="root\office16\excel.exe|root\office16\msaccess.exe|root\office16\mspub.exe|root\office16\onenote.exe|root\office16\outlook.exe|root\office16\powerpnt.exe|root\office16\winword.exe" ManualUpgrade=False ScenarioToTrack="Scenario:{477E0208-58BD-4F33-978A-09BCC9AA9EB1}@INSTALL"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks system information in the registry
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        PID:5564
      • C:\Windows\system32\osk.exe
        "C:\Windows\system32\osk.exe"
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:5148
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004CC
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:6540
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        1⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:6824
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c098c728,0x7ff9c098c734,0x7ff9c098c740
          2⤵
            PID:6812
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1796,i,2177773808499870167,7938552316435368459,262144 --field-trial-handle=2004,i,9331386170185451520,7520685708119527487,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1984 /prefetch:2
            2⤵
              PID:3872
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2260,i,608001199239546511,1167312754522229980,524288 --field-trial-handle=2004,i,9331386170185451520,7520685708119527487,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2148 /prefetch:11
              2⤵
              • System Time Discovery
              PID:4908
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,16377877472947799053,3941983002834687882,524288 --field-trial-handle=2004,i,9331386170185451520,7520685708119527487,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2404 /prefetch:13
              2⤵
                PID:4068
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3292,i,16007898811223526809,8725375724892155184,2097152 --field-trial-handle=2004,i,9331386170185451520,7520685708119527487,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3308 /prefetch:1
                2⤵
                  PID:2440
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3580,i,171171595210944841,10553379496446783860,2097152 --field-trial-handle=2004,i,9331386170185451520,7520685708119527487,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3592 /prefetch:1
                  2⤵
                    PID:5492
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4552,i,10856286950677981957,12018752128519269073,2097152 --field-trial-handle=2004,i,9331386170185451520,7520685708119527487,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4608 /prefetch:9
                    2⤵
                      PID:5464
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4584,i,14526601392243099350,13879614181005696331,2097152 --field-trial-handle=2004,i,9331386170185451520,7520685708119527487,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4720 /prefetch:1
                      2⤵
                        PID:6888
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5484,i,15951863113088271457,4425699068299168308,524288 --field-trial-handle=2004,i,9331386170185451520,7520685708119527487,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5488 /prefetch:14
                        2⤵
                          PID:1052
                      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                        1⤵
                          PID:6908
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                          1⤵
                            PID:2016
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                            1⤵
                            • Drops file in Windows directory
                            • Enumerates system info in registry
                            • Modifies data under HKEY_USERS
                            • Modifies registry class
                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of WriteProcessMemory
                            PID:4736
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x2f4,0x7ff9c118c188,0x7ff9c118c194,0x7ff9c118c1a0
                              2⤵
                                PID:6892
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1852,i,14918646889395096964,6851144315238690513,262144 --field-trial-handle=2028,i,4139193927153493696,9768090927162151743,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:2
                                2⤵
                                  PID:6164
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,4466965278361586296,2260789412466812754,524288 --field-trial-handle=2028,i,4139193927153493696,9768090927162151743,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:11
                                  2⤵
                                  • System Time Discovery
                                  PID:2024
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,3246057344578054732,15028197927492977995,524288 --field-trial-handle=2028,i,4139193927153493696,9768090927162151743,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:13
                                  2⤵
                                    PID:4112
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,9506935728881663353,943803848690267710,2097152 --field-trial-handle=2028,i,4139193927153493696,9768090927162151743,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
                                    2⤵
                                      PID:3276
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,736597878623729843,6421896987125237840,2097152 --field-trial-handle=2028,i,4139193927153493696,9768090927162151743,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
                                      2⤵
                                        PID:5388
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,5178869138960432086,7247450445461766830,2097152 --field-trial-handle=2028,i,4139193927153493696,9768090927162151743,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:1
                                        2⤵
                                          PID:6888
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5080,i,11958600972103166159,12958675780896807410,2097152 --field-trial-handle=2028,i,4139193927153493696,9768090927162151743,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
                                          2⤵
                                            PID:1444
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,15496275901154345214,12843564461651168729,524288 --field-trial-handle=2028,i,4139193927153493696,9768090927162151743,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
                                            2⤵
                                              PID:3712
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,691760800959874889,6036519425676636861,524288 --field-trial-handle=2028,i,4139193927153493696,9768090927162151743,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
                                              2⤵
                                                PID:6720
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,3762416744719861158,9394326445103880408,524288 --field-trial-handle=2028,i,4139193927153493696,9768090927162151743,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
                                                2⤵
                                                  PID:1056
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,3762416744719861158,9394326445103880408,524288 --field-trial-handle=2028,i,4139193927153493696,9768090927162151743,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
                                                  2⤵
                                                    PID:1688
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,14863272784588917575,83815187702927377,524288 --field-trial-handle=2028,i,4139193927153493696,9768090927162151743,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
                                                    2⤵
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4724
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                                      cookie_exporter.exe --cookie-json=1128
                                                      3⤵
                                                        PID:6344
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5256,i,3140303784520728076,7722834967618199726,2097152 --field-trial-handle=2028,i,4139193927153493696,9768090927162151743,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:1
                                                      2⤵
                                                        PID:4628
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                                                        2⤵
                                                        • Drops file in Windows directory
                                                        • Enumerates system info in registry
                                                        • Modifies data under HKEY_USERS
                                                        • Modifies registry class
                                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:3056
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x280,0x7ff9c118c188,0x7ff9c118c194,0x7ff9c118c1a0
                                                          3⤵
                                                            PID:6524
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1744,i,15893241359591499719,10212794424583773943,524288 --field-trial-handle=2528,i,10306868763138593801,13267694488434850596,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:11
                                                            3⤵
                                                            • System Time Discovery
                                                            PID:6100
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,5236606698667748843,6330700206528654289,262144 --field-trial-handle=2528,i,10306868763138593801,13267694488434850596,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:2
                                                            3⤵
                                                              PID:6052
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2056,i,6535604708770029582,11193730197853814511,524288 --field-trial-handle=2528,i,10306868763138593801,13267694488434850596,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:13
                                                              3⤵
                                                                PID:424
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,752965645510851120,9457245315262677495,524288 --field-trial-handle=2528,i,10306868763138593801,13267694488434850596,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:14
                                                                3⤵
                                                                  PID:2560
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,752965645510851120,9457245315262677495,524288 --field-trial-handle=2528,i,10306868763138593801,13267694488434850596,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:14
                                                                  3⤵
                                                                    PID:72
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,17418746907065234238,4745940603464677204,524288 --field-trial-handle=2528,i,10306868763138593801,13267694488434850596,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:14
                                                                    3⤵
                                                                      PID:4296
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,7664996946917503633,11542109656255649118,524288 --field-trial-handle=2528,i,10306868763138593801,13267694488434850596,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
                                                                      3⤵
                                                                        PID:4560
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4804,i,59231281758391771,2838884439540994192,2097152 --field-trial-handle=2528,i,10306868763138593801,13267694488434850596,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
                                                                        3⤵
                                                                          PID:1620
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5492,i,12491787053734948612,16285178178068325353,2097152 --field-trial-handle=2528,i,10306868763138593801,13267694488434850596,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
                                                                          3⤵
                                                                            PID:5484
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                        1⤵
                                                                          PID:6040
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                          1⤵
                                                                            PID:2272
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                            1⤵
                                                                              PID:4080

                                                                            Network

                                                                                  MITRE ATT&CK Enterprise v16

                                                                                  Replay Monitor

                                                                                  Loading Replay Monitor...

                                                                                  Downloads

                                                                                  APPVFILESYSTEMMETADATA.dll
                                                                                  • Path C:\Program Files\Common Files\Microsoft Shared\ClickToRun\APPVFILESYSTEMMETADATA.dll
                                                                                  • Size 248KB
                                                                                  • SHA256 778dae214fe699059c62a7c8902d607b9b1b8dc2ba38cf11c43d3b54f999647b
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  APPVPOLICY.dll
                                                                                  • Path C:\Program Files\Common Files\Microsoft Shared\ClickToRun\APPVPOLICY.dll
                                                                                  • Size 945KB
                                                                                  • SHA256 7323f8d45a0637ab0bf5d0631159bf351bcb5181952625c1a3f04ae8b9c7d63c
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  AppVIsvSubsystemController.dll
                                                                                  • Path C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVIsvSubsystemController.dll
                                                                                  • Size 915KB
                                                                                  • SHA256 b4f6148f6c7eaef9cab6215bfbac8c6267a177fe7dded9b9e7c8bba281c7144b
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  IntegratedOffice.exe
                                                                                  • Path C:\Program Files\Common Files\Microsoft Shared\ClickToRun\IntegratedOffice.exe
                                                                                  • Size 4.4MB
                                                                                  • SHA256 3c510216f5ffb549ef29f069bf496b6e8142eea56f92c81b1599ad034faf7c0a
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  MSIX.dll
                                                                                  • Path C:\Program Files\Common Files\Microsoft Shared\ClickToRun\MSIX.dll
                                                                                  • Size 657KB
                                                                                  • SHA256 836113527a20594215804f75987b51198f011a7188b71eefaf3e2ae35f15f433
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  MSVCP140.dll
                                                                                  • Path C:\Program Files\Common Files\Microsoft Shared\ClickToRun\MSVCP140.dll
                                                                                  • Size 555KB
                                                                                  • SHA256 b30327d49edc035869ce340ee60680d2bbd0684cc359bf5771695fca9aafbb42
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  appvisvsubsystems32.dll
                                                                                  • Path C:\Program Files\Common Files\Microsoft Shared\ClickToRun\appvisvsubsystems32.dll
                                                                                  • Size 1.0MB
                                                                                  • SHA256 d6f83954f57ec0ec67e21ccc00b8fa30a0ab3169a7cfa8dcc6fc8ee661eb7451
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  repoman.dll
                                                                                  • Path C:\Program Files\Common Files\Microsoft Shared\ClickToRun\repoman.dll
                                                                                  • Size 2.4MB
                                                                                  • SHA256 e63b38f66e7f39726c6cd0c84da950fea62d707e1e79dbe37f1b46fda2651dd6
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  ApiClient.dll
                                                                                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll
                                                                                  • Size 131KB
                                                                                  • SHA256 03bcafd43e1e9b04f2b08b2ea20d14536a804d972b9a3ce3ff9dd2626e026429
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  AppVCatalog.dll
                                                                                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll
                                                                                  • Size 513KB
                                                                                  • SHA256 975649d77f1c2216f08778a1ee0300e18d3e65ed56ff46473add6327d8eb814a
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  AppVIntegration.dll
                                                                                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll
                                                                                  • Size 1.5MB
                                                                                  • SHA256 56f758247d6afbb279f16f5bb8bc9d7c8a71845e0c54f1a009cfebb400cafb55
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  AppVIsvApi.dll
                                                                                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll
                                                                                  • Size 363KB
                                                                                  • SHA256 6f83175707ddd50bf15257b16c7a48d8b9a7fe12201fa02ec83e02fcdb3969b4
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  AppVIsvStreamingManager.dll
                                                                                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll
                                                                                  • Size 183KB
                                                                                  • SHA256 7a1c9af997b3f5847ba538cc3130cc00bd18014afa966807d3ba20f7ed4abdf1
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  AppVIsvVirtualization.dll
                                                                                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll
                                                                                  • Size 465KB
                                                                                  • SHA256 f71de411c50524e41d185d56270c7661e02626b090cc329b9dc4af50846ce606
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  AppVManifest.dll
                                                                                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll
                                                                                  • Size 859KB
                                                                                  • SHA256 a1edd71e12b6a994ea2410c3088e178cdf116036344d9519d75e0c32b6c25c46
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  AppVOrchestration.dll
                                                                                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll
                                                                                  • Size 745KB
                                                                                  • SHA256 199f91c9ddb6e82fea506615ee21c0101ff06ace99c9bfc07fd27d671bb2d8a1
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  C2RINTL.en-us.dll
                                                                                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll
                                                                                  • Size 51KB
                                                                                  • SHA256 4ae89325ab576fa5ef0e69b3a69c3e34ccd3127def3204c508c6d228eb38602c
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  C2RUI.dll
                                                                                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll
                                                                                  • Size 2.9MB
                                                                                  • SHA256 ced4253c4eecac1c2e424bb952be53230f6b6c9553b21fab5bd3986aafa66fa9
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  OfficeC2RClient.exe
                                                                                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
                                                                                  • Size 27.2MB
                                                                                  • SHA256 5e915340b567f05666894f8d7b59a7cc650399cac6fb236961ebb39607767e61
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  OfficeClickToRun.exe
                                                                                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
                                                                                  • Size 12.7MB
                                                                                  • SHA256 bc2a66275318024d39a976915e9e590812cd4625d9650e4df94f5f926190750c
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  i640.hash
                                                                                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\Updates\16.0.19929.20090\i640.hash
                                                                                  • Size 106B
                                                                                  • SHA256 929f74312379c3be9e4b6bcec3949e4749477c2971456fc96b7e75eb7f54d22b
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  i640.cab.cat
                                                                                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat
                                                                                  • Size 32KB
                                                                                  • SHA256 b645b38c2681c4871314c6dc4c3a3a0b5db8de1b4550c80a71cd53812ac9e3ef
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  vcruntime140.dll
                                                                                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll
                                                                                  • Size 132KB
                                                                                  • SHA256 b573edb6f63037c8ca94cbb333b48111b5679b59dbf081c8ba5d62053111ea3e
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  vcruntime140_1.dll
                                                                                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140_1.dll
                                                                                  • Size 59KB
                                                                                  • SHA256 4d7f36ff507edb8b712129500b2b2c405db44818a5ceeaf82f6f46d73639a071
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  MasterDescriptor.en-us.xml
                                                                                  • Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\3F17732A-001B-4DDC-A34F-B1C0207645C1\en-us.16\MasterDescriptor.en-us.xml
                                                                                  • Size 40KB
                                                                                  • SHA256 9e5ee34e6bd1f7d6fa4db9ec2c3ab95d6aeded381573798c7a19184e766d5b1e
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  stream.x64.en-us.dat.cat
                                                                                  • Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\3F17732A-001B-4DDC-A34F-B1C0207645C1\en-us.16\stream.x64.en-us.dat.cat
                                                                                  • Size 79KB
                                                                                  • SHA256 9eaeeb113e41780368e7c546f3a3e411fce404cbd252727de2706a0a32eb9983
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  MasterDescriptor.x-none.xml
                                                                                  • Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\3F17732A-001B-4DDC-A34F-B1C0207645C1\sd640.delta02.cab_extractOfficeC2R668803AE-0FD5-410C-970B-2D2BA94B7838\MasterDescriptor.x-none.xml
                                                                                  • Size 35KB
                                                                                  • SHA256 d68492fc365fe214904afc7070f2f534df1773a5d58bfa7bcf92bda03fe36b79
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  stream.x64.x-none.delta03.hash
                                                                                  • Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\3F17732A-001B-4DDC-A34F-B1C0207645C1\sd640.delta03.cab_extractOfficeC2R3E002F77-AA53-4273-B357-E3724241C8A8\stream.x64.x-none.delta03.hash
                                                                                  • Size 128B
                                                                                  • SHA256 97fc8425f7a938f26edda977ee9cf5809d3a9223d1458cd4ed24717ac5ac3a24
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  stream.x64.x-none.delta03.man.dat
                                                                                  • Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\3F17732A-001B-4DDC-A34F-B1C0207645C1\sd640.delta03.cab_extractOfficeC2R3E002F77-AA53-4273-B357-E3724241C8A8\stream.x64.x-none.delta03.man.dat
                                                                                  • Size 22KB
                                                                                  • SHA256 c7f59d53d258e83582280b661061a350c435b8354c8ed13f89076b296e20c2bb
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  stream.x64.en-us.delta03.hash
                                                                                  • Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\3F17732A-001B-4DDC-A34F-B1C0207645C1\sd641033.delta03.cab_extractOfficeC2RBB5548F7-5B67-4C88-8FCB-A17503A0347D\stream.x64.en-us.delta03.hash
                                                                                  • Size 128B
                                                                                  • SHA256 661ea1ad5de8179e78fc8b5bc4adeb0bb4b26cb20ed5b48ed3d5f93cd7d7d907
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  stream.x64.en-us.delta03.man.dat
                                                                                  • Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\3F17732A-001B-4DDC-A34F-B1C0207645C1\sd641033.delta03.cab_extractOfficeC2RBB5548F7-5B67-4C88-8FCB-A17503A0347D\stream.x64.en-us.delta03.man.dat
                                                                                  • Size 15KB
                                                                                  • SHA256 ce7a6722065cde915be3aa21f8e85b72e4baa3b4fa6b98363a604124de9d47de
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  MasterDescriptor.x-none.xml
                                                                                  • Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\3F17732A-001B-4DDC-A34F-B1C0207645C1\x-none.16\MasterDescriptor.x-none.xml
                                                                                  • Size 40KB
                                                                                  • SHA256 73bbfb241453ae96da618fab6d99b950b8f6ea0a78d175489e23b2d1eab3df21
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  stream.x64.x-none.dat.cat
                                                                                  • Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\3F17732A-001B-4DDC-A34F-B1C0207645C1\x-none.16\stream.x64.x-none.dat.cat
                                                                                  • Size 1008KB
                                                                                  • SHA256 9d1656d3a1edff40fea34a3d9e8a61b158de537e4c337275f81ec9d0d0d0e805
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  BookmarkMergedSurfaceOrdering
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                  • Size 6B
                                                                                  • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  BrowsingTopicsState
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                  • Size 414B
                                                                                  • SHA256 1383ec69633fd50033e87cbc91be7f0377fa972206227cde3bb7da5489942818
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  Network Persistent State
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                  • Size 2KB
                                                                                  • SHA256 a56620c846407411f5de5b98178f15416feee483315c1eee91b9f7d619a86691
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  SCT Auditing Pending Reports
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                  • Size 2B
                                                                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  TransportSecurity
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                  • Size 523B
                                                                                  • SHA256 49d67b10487498ef185d49faf38d4987ebde73e9fdf035a4a6f75bd958a39e5f
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  Preferences
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                  • Size 12KB
                                                                                  • SHA256 a2395d9fd405b56c4dc8fec5529979473b4de73ff1310080ef2004f7cb3f7b33
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Preferences
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                  • Size 12KB
                                                                                  • SHA256 23d15a1d83f2d6c58532c52b97f5b124056588d04483b560bfc16c9b7b426404
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Secure Preferences
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                  • Size 17KB
                                                                                  • SHA256 82f19bdaa200c3a3056c6486f8d9171c832143077338572b10c4c0ee03580c4b
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  temp-index
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
                                                                                  • Size 120B
                                                                                  • SHA256 a8894d71a4cd758198579913cb8fc8cce36340cadb48c7a7be0487972116b971
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  the-real-index~RFe5a8d5d.TMP
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a8d5d.TMP
                                                                                  • Size 96B
                                                                                  • SHA256 24f6cba1bb9792997acf105e78d3a8fc14d0f741d18ff39f6b5bdc947c95bc10
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  Local State
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                  • Size 196KB
                                                                                  • SHA256 6c744054923f4256fd2248d1b23bf952c03cdda623026f16b02ad457d98e5aa0
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Local State
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                  • Size 90KB
                                                                                  • SHA256 2da8a69551a68c45a00e4a6acb9070977410747dc2c9f9fce3bcb2e17879ab51
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Local State
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                  • Size 196KB
                                                                                  • SHA256 f97a7ea84c384357fb15fc54cd33cbe6da04b3f3fcac723a4523dd75afee4afe
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  data_1
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
                                                                                  • Size 264KB
                                                                                  • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                  Submit Download

                                                                                  settings.dat
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                  • Size 280B
                                                                                  • SHA256 1eac715bceeccb15cc45a13a9b914a80ac00eeb9f178f8c94511c17b32720b1a
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  settings.dat
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                  • Size 280B
                                                                                  • SHA256 2172811336537a33607e0aadb9c5ba8cadf28b2a4fcb84d32213c685b1c34544
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  settings.dat
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                  • Size 280B
                                                                                  • SHA256 a9f4fecd4e8f8d72ef057367e2946882ee6bc1449adca096e722663d2e3c4180
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  settings.dat
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                  • Size 280B
                                                                                  • SHA256 0ab1babc0a4cd0a782bce4be09c374850c07bbcc0c1af8a5ce4d99c5b507bbf5
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  settings.dat
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                  • Size 280B
                                                                                  • SHA256 0b1cc26b6f44e0e25bba0fa7b74f7acfe7bf7838e4b8caf791d040fbfed38852
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  BrowsingTopicsState
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
                                                                                  • Size 414B
                                                                                  • SHA256 53556f9d45684cb353244102bba8c7c959442a5a485725dc0bdfbbd85bf1fc90
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  the-real-index
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                  • Size 5KB
                                                                                  • SHA256 81466297161c067936fb895b006c7e35840488b1e0a6a6676d6b85e41bb65f5d
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  the-real-index~RFe5b248c.TMP
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5b248c.TMP
                                                                                  • Size 3KB
                                                                                  • SHA256 3f8753d85a316c8d22a6a48bf056f12fef1cf154ec5ea47d0285d36cb8fb4573
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  SiteList-Enterprise.json
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                  • Size 2B
                                                                                  • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  HubApps
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                                  • Size 106KB
                                                                                  • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Network Persistent State
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                  • Size 4KB
                                                                                  • SHA256 9e6abf006b6a4a0ee6456dbefd1d1c57349d682c241afa03ffb517118aaeac3e
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Sdch Dictionaries
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                  • Size 40B
                                                                                  • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  Preferences
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                  • Size 18KB
                                                                                  • SHA256 90343248b04ea279ef3874b96caa72efe54544037560084fa8c7d65ab4ceb493
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Preferences
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                  • Size 17KB
                                                                                  • SHA256 bc69bcc2137f21a8024d5f9b0427efe32727407ae6b4566424f36a24071a405a
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Secure Preferences
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                  • Size 36KB
                                                                                  • SHA256 71448e84d00c168b5ff86221afe4173f251b0d80d42ff32326b36e3660598931
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  the-real-index
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0fb5ef40-558d-48c2-a3a3-30db6f2b1f3e\index-dir\the-real-index
                                                                                  • Size 2KB
                                                                                  • SHA256 0e349dc473ef50c1015d251182986dc1cc265bac437a29c6024a4e09d48b2c1e
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  the-real-index~RFe5b247c.TMP
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0fb5ef40-558d-48c2-a3a3-30db6f2b1f3e\index-dir\the-real-index~RFe5b247c.TMP
                                                                                  • Size 2KB
                                                                                  • SHA256 76a0714cf93c09f173676ea8e8e5b118e8b07748259e049ff0ea2c8928e95df4
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  the-real-index
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8a367834-68d9-4a2f-8d23-8a5bf77e73ac\index-dir\the-real-index
                                                                                  • Size 72B
                                                                                  • SHA256 81d7fadfb9aaa01fe0720fce8acede65fb86266e20bdc0333e0fa4bffc53c7f8
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  the-real-index~RFe5b247c.TMP
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8a367834-68d9-4a2f-8d23-8a5bf77e73ac\index-dir\the-real-index~RFe5b247c.TMP
                                                                                  • Size 72B
                                                                                  • SHA256 46b7183aa8649017a71388d651bdc4079629d676c8b8440498470ea1381e13c3
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  index.txt
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                  • Size 474B
                                                                                  • SHA256 e813ed5bfdfdd328c6f27ebfc826f518660dcdf5c796c34dc3e3a25a4aa6f44d
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  the-real-index
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                  • Size 72B
                                                                                  • SHA256 696b2f9f36ae3a2957b3e96305850a09b5e2a1aabeed86ac387f939d0909f963
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  the-real-index~RFe5b246d.TMP
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b246d.TMP
                                                                                  • Size 72B
                                                                                  • SHA256 2ed19e103813ab716fd605e9c2c7287bb15d71e21b5b9ffa0314e51a134f3883
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  sync_diagnostic.log
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                  • Size 25KB
                                                                                  • SHA256 53c4ba1170ae7c4cb1723e9f4a3f2df7f47a0120625942c4a512be1598f43628
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  CURRENT
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
                                                                                  • Size 16B
                                                                                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  MANIFEST-000001
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
                                                                                  • Size 41B
                                                                                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  Local State
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                  • Size 34KB
                                                                                  • SHA256 4c245098680bfaf5791304feaae6e0b7956d03f2c05a986d0d3086934d3b3fbf
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Local State
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                  • Size 26KB
                                                                                  • SHA256 9efcc190fd500e171f3f1b5d446cb8d96ec3a43082fdf8c4fb66d0a419985735
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Local State
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                  • Size 27KB
                                                                                  • SHA256 0e2ac21fc62d30ef11cc9cc2eb1badb7ef9899fa6db209d042121418088a2e08
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Local State
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                  • Size 27KB
                                                                                  • SHA256 dabe0df23c8b1b61200af268fa7f8204f23881c48d6b5da39525b31580565ed2
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  B4389D5A-52C6-46FE-B0F5-0447CE36166C
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\B4389D5A-52C6-46FE-B0F5-0447CE36166C
                                                                                  • Size 188KB
                                                                                  • SHA256 167d537e3ec3ad0c2fb199d0b0068110dc3ded15cb42b896698285a725b26456
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  officeclicktorun.exe.db
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db
                                                                                  • Size 24KB
                                                                                  • SHA256 b5cbae5c48721295a51896f05abd4c9566be7941cda7b8c2aecb762e6e94425f
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  FileCoAuth-2026-4-27.543.5684.1.odl
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2026-4-27.543.5684.1.odl
                                                                                  • Size 706B
                                                                                  • SHA256 9dca061d5458fe39c4af943361f8c956053bde18ded6b26054a69fc60cdaeff2
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  FileCoAuth-2026-4-27.543.6000.1.odl
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2026-4-27.543.6000.1.odl
                                                                                  • Size 706B
                                                                                  • SHA256 8912210674191ba541482ee6a724ea9be2a9725ec801e15233b29296850d1452
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  login.live[1].xml
                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\OAWBMSSF\login.live[1].xml
                                                                                  • Size 13B
                                                                                  • SHA256 b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  _sessionState.json
                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\LocalState\_sessionState.json
                                                                                  • Size 115B
                                                                                  • SHA256 89e4e79a21e5bfff3794d477d0997c976a66eca9ad91276bb08c77efb9953cf1
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  i640.cab
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\OFFICE~1\i640.cab
                                                                                  • Size 31.5MB
                                                                                  • SHA256 2ebbe1f504c004d5d29a85a2eca26998ce69e4272ad0a540511f0847ac0e166f
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  VersionDescriptor.xml
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\OfficeC2RDF86EE0D-7F1F-4D71-83A5-03CD2F312095\VersionDescriptor.xml
                                                                                  • Size 25KB
                                                                                  • SHA256 7867f66bcbaf2b8f641978191861c3f4b0532a8f781ecc856b89ca76d5070860
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  default.dic
                                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                                                  • Size 2B
                                                                                  • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  d640.cab
                                                                                  • Path C:\Windows\Temp\OFFICE~1\d640.cab
                                                                                  • Size 10KB
                                                                                  • SHA256 4dff510e4dac153252f21dc2f7216100b23bcb5942b84df0a423469eddea2266
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  d641033.cab
                                                                                  • Path C:\Windows\Temp\OFFICE~1\d641033.cab
                                                                                  • Size 10KB
                                                                                  • SHA256 6786616c653c106c9c1af8e29bc658d08817428d16ef10f8f9f5a6bef636d83a
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  s640.cab
                                                                                  • Path C:\Windows\Temp\OFFICE~1\s640.cab
                                                                                  • Size 3.5MB
                                                                                  • SHA256 26cb73345979c05328d84bc69c70cd5d96a4d1f9b5e13c1c53ed57787d1f1756
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  s641033.cab
                                                                                  • Path C:\Windows\Temp\OFFICE~1\s641033.cab
                                                                                  • Size 519KB
                                                                                  • SHA256 9047ec86b6684a7babe09ef00b4a715b34a21043ab6d0450ae9581acaf54d59d
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  sd640.delta00.cab
                                                                                  • Path C:\Windows\Temp\OFFICE~1\sd640.delta00.cab
                                                                                  • Size 2.0MB
                                                                                  • SHA256 354fdf327c3547d63015c68ec808b2f97fc568b5741ea44526a30398a0384b32
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  sd640.delta01.cab
                                                                                  • Path C:\Windows\Temp\OFFICE~1\sd640.delta01.cab
                                                                                  • Size 36KB
                                                                                  • SHA256 2c6027b7b563d41c016bb5b6aef5fbc86a242b5e063da61ba8a20bce3a2574b2
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  sd640.delta02.cab
                                                                                  • Path C:\Windows\Temp\OFFICE~1\sd640.delta02.cab
                                                                                  • Size 36KB
                                                                                  • SHA256 46d3695079ae185d4101b26d14fbe17d4680dff4dcd019e14a7b39ce0eb11517
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  sd640.delta03.cab
                                                                                  • Path C:\Windows\Temp\OFFICE~1\sd640.delta03.cab
                                                                                  • Size 36KB
                                                                                  • SHA256 5e1acf4b0b42c3873a28c3f019a64433963ae0871d95a8cd19da5926733da397
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  sd641033.delta00.cab
                                                                                  • Path C:\Windows\Temp\OFFICE~1\sd641033.delta00.cab
                                                                                  • Size 270KB
                                                                                  • SHA256 824af4204528f512ec189055060d781f2e81cbb8be23b83ed503f48f3a1a74fa
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  sd641033.delta01.cab
                                                                                  • Path C:\Windows\Temp\OFFICE~1\sd641033.delta01.cab
                                                                                  • Size 31KB
                                                                                  • SHA256 dd6d73ecebae69e10066856f103b63089476223bbeac6a2f0124d650b99bc8c1
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  sd641033.delta02.cab
                                                                                  • Path C:\Windows\Temp\OFFICE~1\sd641033.delta02.cab
                                                                                  • Size 31KB
                                                                                  • SHA256 50248175500b5b38f0723b9e3194f16d37423502989671323f6377353efba97f
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  sd641033.delta03.cab
                                                                                  • Path C:\Windows\Temp\OFFICE~1\sd641033.delta03.cab
                                                                                  • Size 31KB
                                                                                  • SHA256 2cbb428dad37f6da315c451199442ed99d7778d1627c63ba5ddd0dfc6240e5cc
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  memory/3104-0-0x0000000001590000-0x000000000166F000-memory.dmp
                                                                                  Download

                                                                                  memory/3328-1513-0x00007FF7E24F0000-0x00007FF7E2F89000-memory.dmp
                                                                                  Download

                                                                                  memory/3328-1514-0x00007FF9D90B0000-0x00007FF9D914B000-memory.dmp
                                                                                  Download

                                                                                  memory/3328-1516-0x00007FF9D9070000-0x00007FF9D90AA000-memory.dmp
                                                                                  Download

                                                                                  memory/3328-1515-0x00007FF9DF7B0000-0x00007FF9DF7C5000-memory.dmp
                                                                                  Download

                                                                                  memory/4368-347-0x0000014D3B400000-0x0000014D3B420000-memory.dmp
                                                                                  Download

                                                                                  memory/4368-345-0x0000014D4BDD0000-0x0000014D4BDF0000-memory.dmp
                                                                                  Download

                                                                                  memory/4368-511-0x0000014D4BC10000-0x0000014D4BC30000-memory.dmp
                                                                                  Download

                                                                                  memory/4368-1044-0x0000014D4CBA0000-0x0000014D4CCA0000-memory.dmp
                                                                                  Download

                                                                                  memory/4368-2345-0x0000014D4D1E0000-0x0000014D4D200000-memory.dmp
                                                                                  Download

                                                                                  memory/4368-236-0x0000014D38C40000-0x0000014D38C60000-memory.dmp
                                                                                  Download

                                                                                  memory/4368-455-0x0000014D4CAA0000-0x0000014D4CBA0000-memory.dmp
                                                                                  Download

                                                                                  memory/4368-355-0x0000014D3B420000-0x0000014D3B440000-memory.dmp
                                                                                  Download

                                                                                  memory/4368-1340-0x0000014D39880000-0x0000014D39892000-memory.dmp
                                                                                  Download

                                                                                  memory/4632-32-0x00000000010E0000-0x00000000011BF000-memory.dmp
                                                                                  Download

                                                                                  memory/5188-1-0x00000000015C0000-0x000000000169F000-memory.dmp
                                                                                  Download

                                                                                  memory/5500-2010-0x00000284D8FC0000-0x00000284D8FCC000-memory.dmp
                                                                                  Download

                                                                                  memory/5500-2012-0x00000284DA3F0000-0x00000284DA432000-memory.dmp
                                                                                  Download

                                                                                  memory/5500-2011-0x00000284D9060000-0x00000284D9072000-memory.dmp
                                                                                  Download

                                                                                  memory/5564-2243-0x000002AFAAE60000-0x000002AFAAEA2000-memory.dmp
                                                                                  Download

                                                                                  memory/5564-2242-0x000002AFAAD00000-0x000002AFAAD0C000-memory.dmp
                                                                                  Download

                                                                                  memory/5564-2241-0x000002AFB04E0000-0x000002AFB04F2000-memory.dmp
                                                                                  Download

                                                                                  memory/5684-23-0x0000000000BD0000-0x0000000000CAF000-memory.dmp
                                                                                  Download

                                                                                  memory/6000-5-0x00000000017D0000-0x00000000018AF000-memory.dmp
                                                                                  Download

                                                                                  memory/7124-2061-0x00000227522A0000-0x00000227522AC000-memory.dmp
                                                                                  Download

                                                                                  memory/7124-2062-0x00000227522C0000-0x0000022752302000-memory.dmp
                                                                                  Download