hxxps://archive[.]org/download/alaamwas[.]com-marmoset-toolbag-4[.]0x-64

Resubmissions

14/07/2026, 02:03

260714-cg6ceaex4z7

14/07/2026, 01:46

260714-b7cmcaew417

Analysis

user interaction
yes
max time kernel
868s
max time network
831s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/07/2026, 01:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://archive.org/download/alaamwas.com-marmoset-toolbag-4.0x-64
Sample260714-b7cmcaew41

Score

7^/10

defense_evasion discovery installer ransomware spyware trojan

Malware Config

Signatures

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	Activation.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	Activation.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	toolbag.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	Activation.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	Activation.tmp

Executes dropped EXE 19 IoCs

pid	Process
3228	toolbag_install_400.exe
3840	toolbag_install_400.exe
4176	vcredist_x64.exe
652	vcredist_x64.exe
1028	viewer_install.exe
3876	toolbag.exe
1476	Activation.exe
312	Activation.tmp
3464	toolbag.exe
4108	patch_4064.exe
3852	toolbag.exe
3496	toolbag.exe
4316	Activation.exe
4512	Activation.tmp
1848	Activation.exe
3992	Activation.tmp
4836	toolbag.exe
3976	Activation.exe
3116	Activation.tmp

Loads dropped DLL 62 IoCs

pid	Process
652	vcredist_x64.exe
1028	viewer_install.exe
1028	viewer_install.exe
1028	viewer_install.exe
1028	viewer_install.exe
1028	viewer_install.exe
1028	viewer_install.exe
1028	viewer_install.exe
1028	viewer_install.exe
1028	viewer_install.exe
3840	toolbag_install_400.exe
3876	toolbag.exe
3876	toolbag.exe
3876	toolbag.exe
3876	toolbag.exe
3876	toolbag.exe
3464	toolbag.exe
3464	toolbag.exe
3464	toolbag.exe
3464	toolbag.exe
3464	toolbag.exe
4108	patch_4064.exe
4108	patch_4064.exe
4108	patch_4064.exe
4108	patch_4064.exe
3852	toolbag.exe
3852	toolbag.exe
3852	toolbag.exe
3852	toolbag.exe
3852	toolbag.exe
3852	toolbag.exe
3852	toolbag.exe
3852	toolbag.exe
3852	toolbag.exe
3852	toolbag.exe
3852	toolbag.exe
3852	toolbag.exe
3496	toolbag.exe
3496	toolbag.exe
3496	toolbag.exe
3496	toolbag.exe
3496	toolbag.exe
3496	toolbag.exe
3496	toolbag.exe
3496	toolbag.exe
3496	toolbag.exe
3496	toolbag.exe
3496	toolbag.exe
3496	toolbag.exe
4836	toolbag.exe
4836	toolbag.exe
4836	toolbag.exe
4836	toolbag.exe
4836	toolbag.exe
4836	toolbag.exe
4836	toolbag.exe
4836	toolbag.exe
4836	toolbag.exe
4836	toolbag.exe
4836	toolbag.exe
4836	toolbag.exe
4836	toolbag.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Marmoset\Toolbag 4\data\python\win\lib\shlex.pyc	toolbag_install_400.exe
File created	C:\Program Files\Marmoset\Toolbag 4\data\shader\paint\layer\effectcheckered.frag	toolbag_install_400.exe
File opened for modification	C:\Program Files\Marmoset\Toolbag 4\data\python\win\lib\multiprocessing\dummy\connection.pyc	patch_4064.exe
File created	C:\Program Files\Marmoset\Toolbag 4\data\python\win\lib\lib2to3\pgen2\tokenize.pyc	toolbag_install_400.exe
File created	C:\Program Files\Marmoset\Toolbag 4\data\shader\paint\selection\cull.frag	toolbag_install_400.exe
File opened for modification	C:\Program Files\Marmoset\Toolbag 4\data\shader\mat\reflection\anisoParams.frag	patch_4064.exe
File created	C:\Program Files\Marmoset\Toolbag 4\data\python\win\lib\pty.pyc	toolbag_install_400.exe
File created	C:\Program Files\Marmoset\Toolbag 4\data\python\win\lib\ctypes\test\test_array_in_pointer.pyc	patch_4064.exe
File created	C:\Program Files\Marmoset\Toolbag 4\data\usd\usdShade\resources\generatedSchema.usda	patch_4064.exe
File created	C:\Program Files\Marmoset\Toolbag 4\data\python\win\lib\multiprocessing\resource_sharer.pyc	toolbag_install_400.exe
File created	C:\Program Files\Marmoset\Toolbag 4\data\shader\scene\selection.frag	toolbag_install_400.exe
File opened for modification	C:\Program Files\Marmoset\Toolbag 4\data\python\win\lib\curses\has_key.pyc	patch_4064.exe
File created	C:\Program Files\Marmoset\Toolbag 4\data\python\win\lib\distutils\tests\test_sdist.pyc	patch_4064.exe
File opened for modification	C:\Program Files\Marmoset\Toolbag 4\data\python\win\lib\distutils\debug.pyc	patch_4064.exe
File created	C:\Program Files\Marmoset\Toolbag 4\data\shader\bake\matValues.frag	toolbag_install_400.exe
File created	C:\Program Files\Marmoset\Toolbag 4\data\shader\mat\microsurface\glossMap.frag	toolbag_install_400.exe
File created	C:\Program Files\Marmoset\Toolbag 4\data\shader\paint\paintscope.frag	toolbag_install_400.exe
File opened for modification	C:\Program Files\Marmoset\Toolbag 4\data\post\BW Low Contrast.tbpost	patch_4064.exe
File opened for modification	C:\Program Files\Marmoset\Toolbag 4\data\python\win\lib\runpy.pyc	patch_4064.exe
File created	C:\Program Files\Marmoset\Toolbag 4\data\python\win\lib\lib2to3\tests\data\py3_test_grammar.pyc	patch_4064.exe
File opened for modification	C:\Program Files\Marmoset\Toolbag 4\data\shader\mat\merge\shadowMapMerge.frag	patch_4064.exe
File created	C:\Program Files\Marmoset\Toolbag 4\data\usd\usdPhysics\resources\usdPhysics\schema.usda	patch_4064.exe
File opened for modification	C:\Program Files\Marmoset\Viewer\locales\am.pak	viewer_install.exe
File opened for modification	C:\Program Files\Marmoset\Toolbag 4\data\mat\Skin.tbmat	patch_4064.exe
File created	C:\Program Files\Marmoset\Toolbag 4\data\shader\mat\reflection\glintMap.frag	patch_4064.exe
File created	C:\Program Files\Marmoset\Viewer\locales\te.pak	viewer_install.exe
File created	C:\Program Files\Marmoset\Toolbag 4\data\python\win\lib\functools.pyc	toolbag_install_400.exe
File created	C:\Program Files\Marmoset\Toolbag 4\data\shader\mat\other\scatterUtil.sh	toolbag_install_400.exe
File opened for modification	C:\Program Files\Marmoset\Toolbag 4\data\python\win\lib\multiprocessing\managers.pyc	patch_4064.exe
File created	C:\Program Files\Marmoset\Toolbag 4\data\python\win\lib\_sitebuiltins.pyc	toolbag_install_400.exe
File created	C:\Program Files\Marmoset\Toolbag 4\data\python\win\lib\xml\__init__.pyc	toolbag_install_400.exe
File opened for modification	C:\Program Files\Marmoset\Toolbag 4\data\python\win\lib\markdown\treeprocessors.py	patch_4064.exe
File opened for modification	C:\Program Files\Marmoset\Toolbag 4\data\python\win\lib\multiprocessing\popen_fork.pyc	patch_4064.exe
File created	C:\Program Files\Marmoset\Toolbag 4\data\python\win\lib\sqlite3\test\hooks.pyc	patch_4064.exe
File created	C:\Program Files\Marmoset\Toolbag 4\data\python\win\lib\turtledemo\__init__.pyc	patch_4064.exe
File opened for modification	C:\Program Files\Marmoset\Toolbag 4\data\python\win\lib\xml\etree\__init__.pyc	patch_4064.exe
File created	C:\Program Files\Marmoset\Toolbag 4\data\gui\control\layernewprocedural.tga	toolbag_install_400.exe
File created	C:\Program Files\Marmoset\Toolbag 4\data\python\win\lib\colorsys.pyc	toolbag_install_400.exe
File opened for modification	C:\Program Files\Marmoset\Toolbag 4\data\gui\control\colorpickergamma.tga	patch_4064.exe
File opened for modification	C:\Program Files\Marmoset\Toolbag 4\data\python\win\lib\email\contentmanager.pyc	patch_4064.exe
File opened for modification	C:\Program Files\Marmoset\Toolbag 4\data\python\win\lib\encodings\euc_jis_2004.pyc	patch_4064.exe
File created	C:\Program Files\Marmoset\Toolbag 4\data\gui\control\materiallabelselectedsmall.tga	toolbag_install_400.exe
File created	C:\Program Files\Marmoset\Toolbag 4\data\python\win\lib\distutils\command\install_lib.pyc	toolbag_install_400.exe
File created	C:\Program Files\Marmoset\Toolbag 4\data\texture\blackTransparent.tga	toolbag_install_400.exe
File created	C:\Program Files\Marmoset\Toolbag 4\sl.common.dll	patch_4064.exe
File created	C:\Program Files\Marmoset\Toolbag 4\data\shader\post\llfFinalize.comp	patch_4064.exe
File opened for modification	C:\Program Files\Marmoset\Viewer\locales\da.pak	viewer_install.exe
File created	C:\Program Files\Marmoset\Toolbag 4\data\python\win\lib\posixpath.pyc	toolbag_install_400.exe
File created	C:\Program Files\Marmoset\Toolbag 4\data\texture\lensdirt.dds	toolbag_install_400.exe
File opened for modification	C:\Program Files\Marmoset\Toolbag 4\data\shader\bake\bakeAO.frag	patch_4064.exe
File created	C:\Program Files\Marmoset\Toolbag 4\data\shader\paint\averager.comp	patch_4064.exe
File opened for modification	C:\Program Files\Marmoset\Toolbag 4\data\gui\control\scenenewshadowcatcher.tga	patch_4064.exe
File opened for modification	C:\Program Files\Marmoset\Toolbag 4\data\gui\control\viewportprogressflash.tga	patch_4064.exe
File opened for modification	C:\Program Files\Marmoset\Toolbag 4\data\shader\paint\layer\effectHSVfilter.frag	patch_4064.exe
File opened for modification	C:\Program Files\Marmoset\Toolbag 4\data\shader\scene\backdrop.vert	patch_4064.exe
File created	C:\Program Files\Marmoset\Toolbag 4\data\shader\paint\layer\effectcellular.frag	toolbag_install_400.exe
File opened for modification	C:\Program Files\Marmoset\Toolbag 4\data\python\win\lib\calendar.pyc	patch_4064.exe
File created	C:\Program Files\Marmoset\Toolbag 4\data\shader\bake\bakeLight.frag	patch_4064.exe
File created	C:\Program Files\Marmoset\Toolbag 4\data\python\win\lib\asyncio\compat.pyc	toolbag_install_400.exe
File opened for modification	C:\Program Files\Marmoset\Toolbag 4\data\gui\control\curveeditortimestretchbackground.tga	patch_4064.exe
File opened for modification	C:\Program Files\Marmoset\Toolbag 4\data\gui\control\levelsgradient.tga	patch_4064.exe
File created	C:\Program Files\Marmoset\Toolbag 4\data\plugin\Examples\Set Keyframes.py	toolbag_install_400.exe
File created	C:\Program Files\Marmoset\Toolbag 4\data\python\win\lib\idlelib\idle_test\test_multicall.pyc	patch_4064.exe
File created	C:\Program Files\Marmoset\Toolbag 4\data\python\win\lib\idlelib\idle_test\test_pathbrowser.pyc	patch_4064.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	viewer_install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Activation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patch_4064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Activation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Activation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Activation.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Activation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	toolbag_install_400.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	toolbag_install_400.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Activation.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Activation.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Activation.tmp

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1580	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 10 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/1476-2722-0x0000000000400000-0x0000000000422000-memory.dmp	innosetup
behavioral1/memory/1476-2877-0x0000000000400000-0x0000000000422000-memory.dmp	innosetup
behavioral1/memory/1476-2889-0x0000000000400000-0x0000000000422000-memory.dmp	innosetup
behavioral1/memory/4316-5455-0x0000000000400000-0x0000000000422000-memory.dmp	innosetup
behavioral1/memory/4316-5460-0x0000000000400000-0x0000000000422000-memory.dmp	innosetup
behavioral1/memory/4316-5496-0x0000000000400000-0x0000000000422000-memory.dmp	innosetup
behavioral1/memory/1848-5497-0x0000000000400000-0x0000000000422000-memory.dmp	innosetup
behavioral1/memory/1848-5502-0x0000000000400000-0x0000000000422000-memory.dmp	innosetup
behavioral1/memory/3976-5543-0x0000000000400000-0x0000000000422000-memory.dmp	innosetup
behavioral1/memory/3976-5551-0x0000000000400000-0x0000000000422000-memory.dmp	innosetup

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x0007000000024c1c-2569.dat	nsis_installer_1
behavioral1/files/0x0007000000024c1c-2569.dat	nsis_installer_2

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
1632	taskkill.exe
5100	taskkill.exe
2240	taskkill.exe
5116	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134284672141250355"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Microsoft Speech HW Voice Activation - Spanish (Spain)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\Speech_OneCore\\Engines\\TTS\\fr-FR\\M1036Paul"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "L1040"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\ja-JP\\VoiceActivation_HW_ja-JP.dat"	SearchApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MarmosetToolbag.Scene\ = "Marmoset Toolbag Scene"	toolbag_install_400.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Female"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "11.0.2016.0129"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\Speech_OneCore\\Engines\\SR\\es-ES-N\\L3082"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\AI041040"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "È stata selezionata la voce predefinita %1."	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\Speech_OneCore\\Engines\\SR\\ja-JP-N\\lsr1041.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Microsoft Speech HW Voice Activation - Japanese (Japan)"	SearchApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mview\ = "Marmoset Viewer"	viewer_install.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "I 0069 Y 0079 IX 0268 YX 0289 UU 026F U 0075 IH 026A YH 028F UH 028A E 0065 EU 00F8 EX 0258 OX 0275 OU 0264 O 006F AX 0259 EH 025B OE 0153 ER 025C UR 025E AH 028C AO 0254 AE 00E6 AEX 0250 A 0061 AOE 0276 AA 0251 Q 0252 EI 006503610069 AU 00610361028A OI 025403610069 AI 006103610069 IYX 006903610259 UYX 007903610259 EHX 025B03610259 UWX 007503610259 OWX 006F03610259 AOX 025403610259 EN 00650303 AN 00610303 ON 006F0303 OEN 01530303 P 0070 B 0062 M 006D BB 0299 PH 0278 BH 03B2 MF 0271 F 0066 V 0076 VA 028B TH 03B8 DH 00F0 T 0074 D 0064 N 006E RR 0072 DX 027E S 0073 Z 007A LSH 026C LH 026E RA 0279 L 006C SH 0283 ZH 0292 TR 0288 DR 0256 NR 0273 DXR 027D SR 0282 ZR 0290 R 027B LR 026D CT 0063 JD 025F NJ 0272 C 00E7 CJ 029D J 006A LJ 028E W 0077 K 006B G 0067 NG 014B X 0078 GH 0263 GA 0270 GL 029F QT 0071 QD 0262 QN 0274 QQ 0280 QH 03C7 RH 0281 HH 0127 HG 0295 GT 0294 H 0068 WJ 0265 PF 007003610066 TS 007403610073 CH 007403610283 JH 006403610292 JJ 006A0361006A DZ 00640361007A CC 007403610255 JC 006403610291 TSR 007403610282 WH 028D ESH 029C EZH 02A2 ET 02A1 SC 0255 ZC 0291 LT 027A SHX 0267 HZ 0266 PCK 0298 TCK 01C0 NCK 0021 CCK 01C2 LCK 01C1 BIM 0253 DIM 0257 QIM 029B GIM 0260 JIM 0284 S1 02C8 S2 02CC . 002E _\| 007C _\|\| 2016 lng 02D0 hlg 02D1 xsh 02D8 _^ 203F _! 0001 _& 0002 _, 0003 _s 0004 _. 2198 _? 2197 T5 030B T4 0301 T3 0304 T2 0300 T1 030F T- 2193 T+ 2191 vls 030A vcd 032C bvd 0324 cvd 0330 asp 02B0 mrd 0339 lrd 031C adv 031F ret 0331 cen 0308 mcn 033D syl 0329 nsy 032F rho 02DE lla 033C lab 02B7 pal 02B2 vel 02E0 phr 02E4 vph 0334 rai 031D low 031E atr 0318 rtr 0319 den 032A api 033A lam 033B nas 0303 nsr 207F lar 02E1 nar 031A ejc 02BC + 0361 bva 02B1 G2 0261 rte 0320 vsl 0325 NCK3 0297 NCK2 01C3 LCK2 0296 TCK2 0287 JC2 02A5 CC2 02A8 LG 026B DZ2 02A3 TS2 02A6 JH2 02A4 CH2 02A7 SHC 0286 rhz 02B4 QOM 02A0 xst 0306 T= 2192 ERR 025D AXR 025A ZHJ 0293"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "11.0"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\lsr1033.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "spell=NativeSupported; cardinal=GlobalSupported; ordinal=NativeSupported; date=GlobalSupported; time=GlobalSupported; telephone=NativeSupported; currency=NativeSupported; net=NativeSupported; url=NativeSupported; address=NativeSupported; alphanumeric=NativeSupported; Name=NativeSupported; media=NativeSupported; message=NativeSupported; companyName=NativeSupported; computer=NativeSupported; math=NativeSupported; duration=NativeSupported"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "{31350404-77AC-4471-B33A-9020A2EDA1D1}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Microsoft Pablo"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\Speech_OneCore\\Engines\\SR\\fr-FR-N\\lsr1036.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Traditional Chinese Phone Converter"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "SR en-US Lts Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "SR fr-FR Lookup Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Microsoft Speech Recognition Engine - ja-JP Embedded DNN v11.1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mview\Marmoset Viewer_backup	viewer_install.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Microsoft Pablo - Spanish (Spain)"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "- 0001 ! 0002 & 0003 , 0004 . 0005 ? 0006 _ 0007 + 0008 * 0009 1 000A 2 000B 3 000C 4 000D 5 000E a 000F ai 0010 an 0011 ang 0012 ao 0013 ba 0014 bai 0015 ban 0016 bang 0017 bao 0018 bei 0019 ben 001A beng 001B bi 001C bian 001D biao 001E bie 001F bin 0020 bing 0021 bo 0022 bu 0023 ca 0024 cai 0025 can 0026 cang 0027 cao 0028 ce 0029 cen 002A ceng 002B cha 002C chai 002D chan 002E chang 002F chao 0030 che 0031 chen 0032 cheng 0033 chi 0034 chong 0035 chou 0036 chu 0037 chuai 0038 chuan 0039 chuang 003A chui 003B chun 003C chuo 003D ci 003E cong 003F cou 0040 cu 0041 cuan 0042 cui 0043 cun 0044 cuo 0045 da 0046 dai 0047 dan 0048 dang 0049 dao 004A de 004B dei 004C den 004D deng 004E di 004F dia 0050 dian 0051 diao 0052 die 0053 ding 0054 diu 0055 dong 0056 dou 0057 du 0058 duan 0059 dui 005A dun 005B duo 005C e 005D ei 005E en 005F er 0060 fa 0061 fan 0062 fang 0063 fei 0064 fen 0065 feng 0066 fo 0067 fou 0068 fu 0069 ga 006A gai 006B gan 006C gang 006D gao 006E ge 006F gei 0070 gen 0071 geng 0072 gong 0073 gou 0074 gu 0075 gua 0076 guai 0077 guan 0078 guang 0079 gui 007A gun 007B guo 007C ha 007D hai 007E han 007F hang 0080 hao 0081 he 0082 hei 0083 hen 0084 heng 0085 hong 0086 hou 0087 hu 0088 hua 0089 huai 008A huan 008B huang 008C hui 008D hun 008E huo 008F ji 0090 jia 0091 jian 0092 jiang 0093 jiao 0094 jie 0095 jin 0096 jing 0097 jiong 0098 jiu 0099 ju 009A juan 009B jue 009C jun 009D ka 009E kai 009F kan 00A0 kang 00A1 kao 00A2 ke 00A3 kei 00A4 ken 00A5 keng 00A6 kong 00A7 kou 00A8 ku 00A9 kua 00AA kuai 00AB kuan 00AC kuang 00AD kui 00AE kun 00AF kuo 00B0 la 00B1 lai 00B2 lan 00B3 lang 00B4 lao 00B5 le 00B6 lei 00B7 leng 00B8 li 00B9 lia 00BA lian 00BB liang 00BC liao 00BD lie 00BE lin 00BF ling 00C0 liu 00C1 lo 00C2 long 00C3 lou 00C4 lu 00C5 luan 00C6 lue 00C7 lun 00C8 luo 00C9 lv 00CA ma 00CB mai 00CC man 00CD mang 00CE mao 00CF me 00D0 mei 00D1 men 00D2 meng 00D3 mi 00D4 mian 00D5 miao 00D6 mie 00D7 min 00D8 ming 00D9 miu 00DA mo 00DB mou 00DC mu 00DD na 00DE nai 00DF nan 00E0 nang 00E1 nao 00E2 ne 00E3 nei 00E4 nen 00E5 neng 00E6 ni 00E7 nian 00E8 niang 00E9 niao 00EA nie 00EB nin 00EC ning 00ED niu 00EE nong 00EF nou 00F0 nu 00F1 nuan 00F2 nue 00F3 nuo 00F4 nv 00F5 o 00F6 ou 00F7 pa 00F8 pai 00F9 pan 00FA pang 00FB pao 00FC pei 00FD pen 00FE peng 00FF pi 0100 pian 0101 piao 0102 pie 0103 pin 0104 ping 0105 po 0106 pou 0107 pu 0108 qi 0109 qia 010A qian 010B qiang 010C qiao 010D qie 010E qin 010F qing 0110 qiong 0111 qiu 0112 qu 0113 quan 0114 que 0115 qun 0116 ran 0117 rang 0118 rao 0119 re 011A ren 011B reng 011C ri 011D rong 011E rou 011F ru 0120 ruan 0121 rui 0122 run 0123 ruo 0124 sa 0125 sai 0126 san 0127 sang 0128 sao 0129 se 012A sen 012B seng 012C sha 012D shai 012E shan 012F shang 0130 shao 0131 she 0132 shei 0133 shen 0134 sheng 0135 shi 0136 shou 0137 shu 0138 shua 0139 shuai 013A shuan 013B shuang 013C shui 013D shun 013E shuo 013F si 0140 song 0141 sou 0142 su 0143 suan 0144 sui 0145 sun 0146 suo 0147 ta 0148 tai 0149 tan 014A tang 014B tao 014C te 014D tei 014E teng 014F ti 0150 tian 0151 tiao 0152 tie 0153 ting 0154 tong 0155 tou 0156 tu 0157 tuan 0158 tui 0159 tun 015A tuo 015B wa 015C wai 015D wan 015E wang 015F wei 0160 wen 0161 weng 0162 wo 0163 wu 0164 xi 0165 xia 0166 xian 0167 xiang 0168 xiao 0169 xie 016A xin 016B xing 016C xiong 016D xiu 016E xu 016F xuan 0170 xue 0171 xun 0172 ya 0173 yan 0174 yang 0175 yao 0176 ye 0177 yi 0178 yin 0179 ying 017A yo 017B yong 017C you 017D yu 017E yuan 017F yue 0180 yun 0181 za 0182 zai 0183 zan 0184 zang 0185 zao 0186 ze 0187 zei 0188 zen 0189 zeng 018A zha 018B zhai 018C zhan 018D zhang 018E zhao 018F zhe 0190 zhei 0191 zhen 0192 zheng 0193 zhi 0194 zhong 0195 zhou 0196 zhu 0197 zhua 0198 zhuai 0199 zhuan 019A zhuang 019B zhui 019C zhun 019D zhuo 019E zi 019F zong 01A0 zou 01A1 zu 01A2 zuan 01A3 zui 01A4 zun 01A5 zuo 01A6"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Universal Phone Converter"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Microsoft Hortense - French (France)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "SR ja-JP Locale Handler"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "SR ja-JP Lookup Lexicon"	SearchApp.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MarmosetToolbag.Scene	toolbag_install_400.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\AudioInput\\TokenEnums\\MMAudioIn\\"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Japanese Phone Converter"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "SpeechUXPlugin"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Microsoft Speech SW Voice Activation - English (United States)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\Speech_OneCore\\Engines\\SR\\es-ES-N\\c3082.fe"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\es-ES\\sidubm.table"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Microsoft Julie"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "MS-1036-110-WINMO-DNN"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Microsoft Paul - French (France)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "SR it-IT Locale Handler"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "既定の音声として%1を選びました"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbscene\ = "MarmosetToolbag.Scene"	toolbag_install_400.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Adult"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "{6BFCACDC-A6A6-4343-9CF6-83A83727367B}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\Speech_OneCore\\Engines\\TTS\\en-US\\M1033Mark"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "SR ja-JP Lts Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "SR de-DE Lts Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\fr-FR\\VoiceActivation_HW_fr-FR.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "{A79020BC-1F7E-4D20-AC2A-51D73012DDD5}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\r1040sr.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Near"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Microsoft Laura - Spanish (Spain)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "- 0001 ! 0002 & 0003 , 0004 . 0005 ? 0006 _ 0007 1 0008 2 0009 a 000a e 000b i 000c o 000d u 000e t 000f d 0010 p 0011 b 0012 k 0013 g 0014 ch 0015 jj 0016 f 0017 s 0018 x 0019 m 001a n 001b nj 001c l 001d ll 001e r 001f rr 0020 j 0021 w 0022 th 0023"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "409;9"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "%windir%\\Speech_OneCore\\Engines\\TTS\\ja-JP\\M1041Ayumi"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Microsoft Speech HW Voice Activation - English (United States)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "Microsoft Speech SW Voice Activation - French (France)"	SearchApp.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	toolbag.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	toolbag.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	toolbag.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	toolbag.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c00000001000000040000000010000004000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	toolbag.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
3812	NOTEPAD.EXE
5012	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2948	msedge.exe
2948	msedge.exe
1028	viewer_install.exe
1028	viewer_install.exe
1028	viewer_install.exe
1028	viewer_install.exe
1028	viewer_install.exe
1028	viewer_install.exe
312	Activation.tmp
312	Activation.tmp
4108	patch_4064.exe
4108	patch_4064.exe
4512	Activation.tmp
4512	Activation.tmp
3992	Activation.tmp
3992	Activation.tmp
3116	Activation.tmp
3116	Activation.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeRestorePrivilege	5076	7zG.exe
Token: 35	5076	7zG.exe
Token: SeSecurityPrivilege	5076	7zG.exe
Token: SeSecurityPrivilege	5076	7zG.exe
Token: SeRestorePrivilege	4440	7zG.exe
Token: 35	4440	7zG.exe
Token: SeSecurityPrivilege	4440	7zG.exe
Token: SeSecurityPrivilege	4440	7zG.exe
Token: SeSecurityPrivilege	1028	viewer_install.exe
Token: 35	3876	toolbag.exe
Token: SeDebugPrivilege	1632	taskkill.exe
Token: 35	3464	toolbag.exe
Token: SeDebugPrivilege	5100	taskkill.exe
Token: SeDebugPrivilege	2240	taskkill.exe
Token: SeDebugPrivilege	5116	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
5076	7zG.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
3876	toolbag.exe
3876	toolbag.exe
3876	toolbag.exe
1780	SearchApp.exe
3464	toolbag.exe
3464	toolbag.exe
3852	toolbag.exe
3852	toolbag.exe
3852	toolbag.exe
3496	toolbag.exe
3496	toolbag.exe
3496	toolbag.exe
3496	toolbag.exe
4836	toolbag.exe
4836	toolbag.exe
4836	toolbag.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 3556	2172	msedge.exe	84
PID 2172 wrote to memory of 1580	2172	msedge.exe	86
PID 2172 wrote to memory of 5068	2172	msedge.exe	87
PID 2172 wrote to memory of 5068	2172	msedge.exe	87
PID 2172 wrote to memory of 5068	2172	msedge.exe	87
PID 2172 wrote to memory of 3312	2172	msedge.exe	88
PID 2172 wrote to memory of 3312	2172	msedge.exe	88
PID 2172 wrote to memory of 4308	2172	msedge.exe	89
PID 2172 wrote to memory of 4308	2172	msedge.exe	89
PID 2172 wrote to memory of 2072	2172	msedge.exe	90
PID 2172 wrote to memory of 4308	2172	msedge.exe	89
PID 2172 wrote to memory of 2072	2172	msedge.exe	90
PID 2172 wrote to memory of 2072	2172	msedge.exe	90
PID 2172 wrote to memory of 3116	2172	msedge.exe	91
PID 2172 wrote to memory of 3116	2172	msedge.exe	91
PID 2172 wrote to memory of 3116	2172	msedge.exe	91
PID 2172 wrote to memory of 4264	2172	msedge.exe	92
PID 2172 wrote to memory of 4264	2172	msedge.exe	92
PID 2172 wrote to memory of 4264	2172	msedge.exe	92
PID 2172 wrote to memory of 2732	2172	msedge.exe	97
PID 2172 wrote to memory of 2732	2172	msedge.exe	97
PID 2172 wrote to memory of 4080	2172	msedge.exe	98
PID 2172 wrote to memory of 4080	2172	msedge.exe	98
PID 2172 wrote to memory of 2624	2172	msedge.exe	100
PID 2172 wrote to memory of 4396	2172	msedge.exe	103
PID 2172 wrote to memory of 2384	2172	msedge.exe	104
PID 2172 wrote to memory of 4396	2172	msedge.exe	103
PID 2172 wrote to memory of 4396	2172	msedge.exe	103
PID 2172 wrote to memory of 2384	2172	msedge.exe	104
PID 2172 wrote to memory of 1048	2172	msedge.exe	107
PID 2172 wrote to memory of 2392	2172	msedge.exe	114
PID 2172 wrote to memory of 4352	2172	msedge.exe	115
PID 2172 wrote to memory of 4932	2172	msedge.exe	116
PID 2172 wrote to memory of 1392	2172	msedge.exe	127
PID 2172 wrote to memory of 1392	2172	msedge.exe	127
PID 2172 wrote to memory of 2948	2172	msedge.exe	131
PID 2172 wrote to memory of 2712	2172	msedge.exe	133
PID 2172 wrote to memory of 2712	2172	msedge.exe	133
PID 2172 wrote to memory of 4020	2172	msedge.exe	134
PID 2172 wrote to memory of 4020	2172	msedge.exe	134
PID 2172 wrote to memory of 5104	2172	msedge.exe	135
PID 2172 wrote to memory of 5104	2172	msedge.exe	135
PID 2172 wrote to memory of 2416	2172	msedge.exe	136
PID 2172 wrote to memory of 2416	2172	msedge.exe	136
PID 2172 wrote to memory of 3144	2172	msedge.exe	137
PID 2172 wrote to memory of 3144	2172	msedge.exe	137
PID 3840 wrote to memory of 4176	3840	toolbag_install_400.exe	144
PID 4176 wrote to memory of 652	4176	vcredist_x64.exe	145
PID 3840 wrote to memory of 1028	3840	toolbag_install_400.exe	146
PID 1476 wrote to memory of 312	1476	Activation.exe	158
PID 312 wrote to memory of 1632	312	Activation.tmp	162
PID 3464 wrote to memory of 4108	3464	toolbag.exe	168
PID 4316 wrote to memory of 4512	4316	Activation.exe	176
PID 2172 wrote to memory of 4468	2172	msedge.exe	177
PID 2172 wrote to memory of 4468	2172	msedge.exe	177
PID 4512 wrote to memory of 5100	4512	Activation.tmp	178
PID 1848 wrote to memory of 3992	1848	Activation.exe	187
PID 3992 wrote to memory of 2240	3992	Activation.tmp	188
PID 3976 wrote to memory of 3116	3976	Activation.exe	195
PID 3116 wrote to memory of 5116	3116	Activation.tmp	196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://archive.org/download/alaamwas.com-marmoset-toolbag-4.0x-64
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffe0009c188,0x7ffe0009c194,0x7ffe0009c1a0
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,16561414373414218764,17856267313377857550,524288 --field-trial-handle=2252,i,12842891724942625786,7487821670493287419,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,2174274405648507856,1946317634625422074,262144 --field-trial-handle=2252,i,12842891724942625786,7487821670493287419,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,9067906335222123215,14546160273377916441,524288 --field-trial-handle=2252,i,12842891724942625786,7487821670493287419,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,198130166492314455,7553021510683719784,2097152 --field-trial-handle=2252,i,12842891724942625786,7487821670493287419,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,7395597877852410930,6380169632194344548,2097152 --field-trial-handle=2252,i,12842891724942625786,7487821670493287419,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,8364161376400876720,4770470443059192942,2097152 --field-trial-handle=2252,i,12842891724942625786,7487821670493287419,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,17804636812780840657,4617182163857576751,2097152 --field-trial-handle=2252,i,12842891724942625786,7487821670493287419,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:2
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,750283428276662944,6011923052109405389,524288 --field-trial-handle=2252,i,12842891724942625786,7487821670493287419,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,11525487082251439310,15183504392164776941,524288 --field-trial-handle=2252,i,12842891724942625786,7487821670493287419,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3320,i,17623552473114675354,9871570381155865482,524288 --field-trial-handle=2252,i,12842891724942625786,7487821670493287419,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3320,i,17623552473114675354,9871570381155865482,524288 --field-trial-handle=2252,i,12842891724942625786,7487821670493287419,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6324,i,18170334467558666301,12550469573188265658,2097152 --field-trial-handle=2252,i,12842891724942625786,7487821670493287419,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,17743981444572656563,685967796924133334,524288 --field-trial-handle=2252,i,12842891724942625786,7487821670493287419,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,761281935380753061,8681639228395262587,524288 --field-trial-handle=2252,i,12842891724942625786,7487821670493287419,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,12908231868085675416,8691246138520428379,524288 --field-trial-handle=2252,i,12842891724942625786,7487821670493287419,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,9848395428453359610,6128506184738516828,524288 --field-trial-handle=2252,i,12842891724942625786,7487821670493287419,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,13863140005579936744,14427330104573698653,524288 --field-trial-handle=2252,i,12842891724942625786,7487821670493287419,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:8
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,11873835217113776512,17024358605520918225,524288 --field-trial-handle=2252,i,12842891724942625786,7487821670493287419,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:8
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6096,i,2001349828045571603,14367713923207470670,262144 --field-trial-handle=2252,i,12842891724942625786,7487821670493287419,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,2755703858505899607,2171902934698027638,524288 --field-trial-handle=2252,i,12842891724942625786,7487821670493287419,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,14928361388136251010,10982228813260049756,524288 --field-trial-handle=2252,i,12842891724942625786,7487821670493287419,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,4195105885143665550,15447179703711601156,524288 --field-trial-handle=2252,i,12842891724942625786,7487821670493287419,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,13597614305382010239,5699679115038846713,524288 --field-trial-handle=2252,i,12842891724942625786,7487821670493287419,262144 --variations-seed-version --mojo-platform-channel-handle=1312 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,14151549131995277574,4678140102131874843,524288 --field-trial-handle=2252,i,12842891724942625786,7487821670493287419,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,1168872022832055327,31479265731300839,524288 --field-trial-handle=2252,i,12842891724942625786,7487821670493287419,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  PID:4468

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3352

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2112

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap25351:136:7zEvent14373
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5076

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\_alaamwas.com_Marmoset_Toolbag_4.0x64\" -ad -an -ai#7zMap29750:136:7zEvent12527
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4440

C:\Users\Admin\Downloads\_alaamwas.com_Marmoset_Toolbag_4.0x64\toolbag_install_400.exe
"C:\Users\Admin\Downloads\_alaamwas.com_Marmoset_Toolbag_4.0x64\toolbag_install_400.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3228

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\_alaamwas.com_Marmoset_Toolbag_4.0x64\Readme.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5012

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\_alaamwas.com_Marmoset_Toolbag_4.0x64\_alaamwas.com_Marmoset_Toolbag_4.0x64\Readme.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3812

C:\Users\Admin\Downloads\_alaamwas.com_Marmoset_Toolbag_4.0x64\toolbag_install_400.exe
"C:\Users\Admin\Downloads\_alaamwas.com_Marmoset_Toolbag_4.0x64\toolbag_install_400.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Program Files\Marmoset\Toolbag 4\vcredist_x64.exe
  "C:\Program Files\Marmoset\Toolbag 4\vcredist_x64.exe" /q /norestart
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Windows\Temp\{1BD0550C-5390-4E1C-A317-D2C2AEFC4300}\.cr\vcredist_x64.exe
    "C:\Windows\Temp\{1BD0550C-5390-4E1C-A317-D2C2AEFC4300}\.cr\vcredist_x64.exe" -burn.clean.room="C:\Program Files\Marmoset\Toolbag 4\vcredist_x64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548 /q /norestart
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:652
- C:\Program Files\Marmoset\Toolbag 4\viewer_install.exe
  "C:\Program Files\Marmoset\Toolbag 4\viewer_install.exe" /S
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1028

C:\Program Files\Marmoset\Toolbag 4\toolbag.exe
"C:\Program Files\Marmoset\Toolbag 4\toolbag.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3876

C:\Windows\system32\werfault.exe
werfault.exe /hc /shared Global\445bc3fa226c453fa3e268f5e996e706 /t 3968 /p 3860
1⤵
PID:2704

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1780

C:\Users\Admin\Downloads\_alaamwas.com_Marmoset_Toolbag_4.0x64\Crack\Activation.exe
"C:\Users\Admin\Downloads\_alaamwas.com_Marmoset_Toolbag_4.0x64\Crack\Activation.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Users\Admin\AppData\Local\Temp\is-4FTU1.tmp\Activation.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-4FTU1.tmp\Activation.tmp" /SL5="$40094,111168,111104,C:\Users\Admin\Downloads\_alaamwas.com_Marmoset_Toolbag_4.0x64\Crack\Activation.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:312
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /F /IM toolbag.exe /T
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1632

C:\Program Files\Marmoset\Toolbag 4\toolbag.exe
"C:\Program Files\Marmoset\Toolbag 4\toolbag.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3464
- C:\ProgramData\Canopy\toolbag4\patch_4064.exe
  "C:\ProgramData\Canopy\toolbag4\patch_4064.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4108

C:\Program Files\Marmoset\Toolbag 4\toolbag.exe
"C:\Program Files\Marmoset\Toolbag 4\toolbag.exe" e
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:3852

C:\Program Files\Marmoset\Toolbag 4\toolbag.exe
"C:\Program Files\Marmoset\Toolbag 4\toolbag.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3496

C:\Users\Admin\Downloads\_alaamwas.com_Marmoset_Toolbag_4.0x64\Crack\Activation.exe
"C:\Users\Admin\Downloads\_alaamwas.com_Marmoset_Toolbag_4.0x64\Crack\Activation.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Users\Admin\AppData\Local\Temp\is-NMF1N.tmp\Activation.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-NMF1N.tmp\Activation.tmp" /SL5="$A01E2,111168,111104,C:\Users\Admin\Downloads\_alaamwas.com_Marmoset_Toolbag_4.0x64\Crack\Activation.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /F /IM toolbag.exe /T
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5100

C:\Users\Admin\Downloads\_alaamwas.com_Marmoset_Toolbag_4.0x64\Crack\Activation.exe
"C:\Users\Admin\Downloads\_alaamwas.com_Marmoset_Toolbag_4.0x64\Crack\Activation.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Users\Admin\AppData\Local\Temp\is-BP8CM.tmp\Activation.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-BP8CM.tmp\Activation.tmp" /SL5="$C01E2,111168,111104,C:\Users\Admin\Downloads\_alaamwas.com_Marmoset_Toolbag_4.0x64\Crack\Activation.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3992
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /F /IM toolbag.exe /T
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2240

C:\Program Files\Marmoset\Toolbag 4\toolbag.exe
"C:\Program Files\Marmoset\Toolbag 4\toolbag.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4836

C:\Users\Admin\Downloads\_alaamwas.com_Marmoset_Toolbag_4.0x64\Crack\Activation.exe
"C:\Users\Admin\Downloads\_alaamwas.com_Marmoset_Toolbag_4.0x64\Crack\Activation.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Users\Admin\AppData\Local\Temp\is-RVOAQ.tmp\Activation.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-RVOAQ.tmp\Activation.tmp" /SL5="$A03FE,111168,111104,C:\Users\Admin\Downloads\_alaamwas.com_Marmoset_Toolbag_4.0x64\Crack\Activation.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3116
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /F /IM toolbag.exe /T
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OpenImageDenoise.dll

Path C:\Program Files\Marmoset\Toolbag 4\OpenImageDenoise.dll
Size 40.6MB
SHA256 0f5cf67819ddf763a347b1c7066307b37b55f6613b6baba47c9fa6f33e79d21e
MD5 427d14350fa8d098627cda3cabe4ee6d
SHA1 5efca650ee3db8e0ddd4ec74b1c8395332f5f6de
SHA512 5cddaacdf47b53da8d95e3bb330509d9c86f07cc33df51b59939e7fb2201fb494da273432fd74bc05b5cfb3752d4199a81e56cbd299cbc08c48521228300c1c8
SSDEEP 786432:HiKC42S/wIF+y6adgcstYMTt5Vcw00aid86gbmya+mgmYm89OjFA0EkU94od1Guf:HiKASYIFWajshVj00aid8jbCgo8cq0lk
TLSH
T1A1973393E33956C5D97EC07981175203FBB1B09A0B3A46D7574299583E3BAE8EEBC700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Program Files\Marmoset\Toolbag 4\d3dcompiler_47.dll
Size 4.3MB
SHA256 29bebe2cb2dd788fc4c9522da872902cf2c324273b638db74e3465dd85d66347
MD5 23d9f1c6fe08178d09dcfc9cebfe201e
SHA1 5ba356258b9034f15ec08ee3095e7981fe93bcf1
SHA512 183347994380a5ca7c5801455be79a4ce900d1778db0a0dc0a359cada90ad4cb987bf21bedeef95534f66a9a0d44eaffa9cba2ac28f96e87061a266ecfc54dc4
SSDEEP 49152:cTMG5Z2OLpwf24Q6QnCF29Yhlua+V16Ar2EclBTz9pjUj8PJKhuQw6sRAy3Gk6d6:35+nQWao6ycl9rGzd5sh
TLSH
T177266C47B7A400E9C2ABC13886479717EBB1781403345BEF55A0C665EF73BE26A3B724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

assetpropertiesblank.tga

Path C:\Program Files\Marmoset\Toolbag 4\data\gui\control\assetpropertiesblank.tga
Size 60B
SHA256 91988312da4b5a8e22423fec7411f0e7f2ff75229274f3654eb3cbd1ce9c1ebf
MD5 92892780f31c08f68521fd3da5f9b92d
SHA1 2911b198996bed68b87439c173634a90a29948ac
SHA512 17d11f4c8cc4b112d3552e1d552d3e55af01fa0f44aa27360fc9b38d4987ee70e67cfa84aa0a28702f6c59bb86156b70b92441c91aa7c6083a704155b6170aa5
TLSH
T1FDA0040001130137DD4CF7F50057C0415734D4713F43014C54C00375001514111D3050
MD5 SHA1 SHA512 TLSH

Submit Download

dockseparator.tga

Path C:\Program Files\Marmoset\Toolbag 4\data\gui\control\dockseparator.tga
Size 80B
SHA256 453b802b464da5fed2e7107737d26c5fffec4a576a3b7c6a4f50c2fcde3ad498
MD5 e54fbb80f2853933fd799ea52a1302ab
SHA1 f9c59d1d6c97c0403f63795a695c476f96febc4e
SHA512 2a51157083764dd546bbc367be286f4397309c2df42faa4d979b54454a61689389832dd59d6e3a08586e8f51399aa7f116536de34d3d530bb3f3de38d9078e0d
TLSH
T125A00400034C0D15C74C7D753055D0555417DC301443C34C5441047D04350C573D30D0
MD5 SHA1 SHA512 TLSH

Submit Download

frameborder.tga

Path C:\Program Files\Marmoset\Toolbag 4\data\gui\control\frameborder.tga
Size 80B
SHA256 8a2c62c5b267a25fe95c743e9c284a088957955d5e50ac041d425abc562ddf06
MD5 bb2a9111e67fbbb40432a58387b834df
SHA1 248b058d404981a2ed357e672b6818c3e8e4baec
SHA512 2e57bca42295e63fce54231f0002b437d0d87d49340831540a59321add26cb845dc646885692e68409916e2a581bc6df0178fd70c8da965d90fc5f4b5ea890a2
TLSH
T116A0040001530D37DD44F5F50057D0515434D4701D40C34C54C0037D00154C113D30D0
MD5 SHA1 SHA512 TLSH

Submit Download

guirootbg.tga

Path C:\Program Files\Marmoset\Toolbag 4\data\gui\control\guirootbg.tga
Size 48B
SHA256 700c2b30b5cec45f6ccea891d97a8c15ecbb5dba674b7972b4840f3c99cc9da6
MD5 06c6206f1b060e15067e21fcf8073623
SHA1 3c7511e8699713672380908244ebaa1de9e3090b
SHA512 102df7c104df2dcdd5a0820affb361afb46d2d6579aefcf2bbc2b95db7b43d1a31f1d26cc5736a388d901f965b63ab42d64baae37eed2284bc2ec84969885a49
MD5 SHA1 SHA512

Submit Download

guirootedge.tga

Path C:\Program Files\Marmoset\Toolbag 4\data\gui\control\guirootedge.tga
Size 48B
SHA256 d77b4ed3a0bac8dfc6b13f5e18e59817ae10328cb64946072caafe9bebc93606
MD5 5b43b6639bb8ad5acdb122e7ac966916
SHA1 f27c95af456600c35f43b133fc38a66bf1453b64
SHA512 26964cdb92e606a012dd32301514f1328dea91c8da15c975d4f5f691828ca6a1ec35edb01d8e9f5e3a6d7f132ab0736bbd487da71abf6d8b399ebf3cdbb4dbcd
MD5 SHA1 SHA512

Submit Download

materiallabelsmall.tga

Path C:\Program Files\Marmoset\Toolbag 4\data\gui\control\materiallabelsmall.tga
Size 556B
SHA256 c95b65f37694f901e8b3762fa2c4fbca54a3f6f6f458bc04125ef182069db0f3
MD5 dd28249556c5fcac1f650ff6503db4be
SHA1 d9558d4c58d60fd5ac0e0e4de899a2076ad977c1
SHA512 82ea11ca9f1798e404886c0b989b9b60774a02d787cfddf3bc28f60bd22919fb14b1838a9f8a5ac1ad2da45dc8af54ee77acc7b0d641b39e3c7320ecc3aa584d
TLSH
T106F002300301012EC44425F55455C3615CD4C7205C40C1C854F0F1F4087604132A40D0
MD5 SHA1 SHA512 TLSH

Submit Download

tabselectorbg.tga

Path C:\Program Files\Marmoset\Toolbag 4\data\gui\control\tabselectorbg.tga
Size 2KB
SHA256 af4027fac74306c3aac3c95fd1bccd2cc8598a691b84950ea1a956fd75bd2d4b
MD5 67130fa34efd1c6655229669d0955490
SHA1 74834ca8e225232454e331cd3ab8ae888454b6dd
SHA512 ab46a63778906fa12ef1e19353f929d8ce20e61fbdf95cb7e11ff54ef6e579dfca992d2f19b518827c4784eaddf8d916da1fa09236b5a1ea518f0666ea1af0a9
TLSH
T17841021183500315D54865750077538354D4C72C3C55C18CA930447C01D544111A08B0
MD5 SHA1 SHA512 TLSH

Submit Download

textureboxreload.tga

Path C:\Program Files\Marmoset\Toolbag 4\data\gui\control\textureboxreload.tga
Size 1KB
SHA256 a0e18aa9345df778756087be485ac9e52966cf439e2a3d3ef55ed8ce6d178b02
MD5 d3e1d99aa477bc347dfde6b0aaff29e9
SHA1 39177c85b1c62bc4636ae40016dc779037b8f2b3
SHA512 0641e9c04fa166e2f33a361f1719b10327c0492cd2854ef815aa50205e23b9811e235dd01bc7250d6663779e19963c5afcbcb4fe7236997b2a314823ed48e57e
TLSH
T11B111A707601D016FF8C20BCCEB4A5444946BDE5DAD9B395BBA1B35914F210E0960F24
MD5 SHA1 SHA512 TLSH

Submit Download

segoeUI16.tga

Path C:\Program Files\Marmoset\Toolbag 4\data\gui\font\segoeUI16.tga
Size 1.0MB
SHA256 059984942c4069b84665b03d4d940bc6d513662a981454c2e26c1564287e6fe9
MD5 99d70e8b8dfbfb440f51cf84b6d58893
SHA1 05f44823675b937f9465592c20b6607c1e7bb69a
SHA512 0b4befd7b52220d68012057170d7122180db98fb6d639a7a06dc20d69b1348057f463232427d03bd3b307278194e1d7862cb7a282469845399d69cf50f7f3439
SSDEEP 48:jPTbvmyVnfPHbXz/LzLPrRg0NDHF7B2GbnryWPH/PXXqbariCr//HXnvD7hhMyBn:yW7XLj2DG3jMXFoQ7777
TLSH
T1BD25D64D793EC893D8F5007C5D6684F8306D2D41EE8A7C13B1AAF72FA5B0690F285A99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

segoeUI9.ini

Path C:\Program Files\Marmoset\Toolbag 4\data\gui\font\segoeUI9.ini
Size 1KB
SHA256 3e7b9cf366a5927a1ac5a58b713f11e169cc5c42ab23fd49422e87cfca1f49c6
MD5 74ce9501e4bbc025eca5552fd6848e1f
SHA1 4cb2b339cad6f793739916ef9dbfec0c69ef809d
SHA512 3732c339c60b1d763fe1d262a06e79de4846b168995aee38ff6f32b4dd7b7a97899d005e8e91353dd6bb8e5371f93da14bdd0b4fd4bf9d88ea89513dbddafaf2
TLSH
T11431E64BC28C2C9556C7FAD1227B9506ADFFE351D2FF60C56EBB22868B405630538531
MD5 SHA1 SHA512 TLSH

Submit Download

segoeUI9.tga

Path C:\Program Files\Marmoset\Toolbag 4\data\gui\font\segoeUI9.tga
Size 256KB
SHA256 75c3b4f06bda8bb56edbe6fc8d8c413606a8125e77687e4e89f90750540e3b27
MD5 a719dee709a53c1de3db48bd29832a32
SHA1 7d61f1389397b36d6f22d119416742f726cc84ba
SHA512 9182eb2369c0ec80fafd64d424fee307a6203b0fa883fc09212b0e2f585ead87541595f8b51f339c88713acd5509a851fa2d51caf1e94b786efabfe6fdea36ef
SSDEEP 96:zD0vHHHHzDXHHHHz/4xJizzzzI5vvvvZKXHEb9nKeUKb1Hsn7Pv3vTzTjPAYAo3/:lx3vvvv1bgeUKbdB5VDR/rCV
TLSH
T1FA44F7F7B5B4EA44DA0388BC6EC2D5D5054B7C15CCCC48AB76E937EE0239A252C15A8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

line.tga

Path C:\Program Files\Marmoset\Toolbag 4\data\gui\viewport\line.tga
Size 16KB
SHA256 0f83478a32d38d0a3b2119a3c7d7c26f0170aba9a10f684915adb68a6b59b045
MD5 d4c120e5a1c6adc06b63ad869275e6df
SHA1 ef6b2fd5f8f81bb4af3f7f417e14104264e0280d
SHA512 543436453aeb5edb8a58abfdd4c953583699cb855569449aa2a81689b0195f2e1785b56a012a371e83c9daa229a981695b95108b6d896952b848d82851f15089
SSDEEP 3:HlSvllnR5//5capOl:8x5XCapK
TLSH
T1097204403100C111C44435750C55C0C554547C305D50054F7440337D003704145D0050
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Grammar3.6.0.candidate.2.pickle

Path C:\Program Files\Marmoset\Toolbag 4\data\python\win\lib\lib2to3\Grammar3.6.0.candidate.2.pickle
Size 31KB
SHA256 28fe24eb8dd20fe8230a81ccea5db8abea3b74fbabf067885f90485a5a7aaac6
MD5 a58798a9e7ea57ad816b1c4496606d79
SHA1 5a1cde957b7a6e7fd0f0bd0f6606ef957a9422ad
SHA512 ce498c8a303c3bb2f9d7d1e14b5dd16be4bf2a23c6912ae6e88e5f6f06bd9a5b39c0ce4af3527a225f5fdb559923ee097d304579406bb7d3f7e6f5045b279187
SSDEEP 768:GUyW3qCUOhZjLN2jDCK21mrqJKYyCz//j54:JJaQDN2jt21EqeCzq
TLSH
T1FBE23308BEA1710E9D5DC7630E6BAB9A4E39D9D076033C43546B9EB9A7080AF1ED1D07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PatternGrammar3.6.0.candidate.2.pickle

Path C:\Program Files\Marmoset\Toolbag 4\data\python\win\lib\lib2to3\PatternGrammar3.6.0.candidate.2.pickle
Size 2KB
SHA256 edb7f84f6a386161434bf3cdb64db03b29b80717cedd1c492789578454bc3d05
MD5 986c4ca9c0d20c0d8ee01455d087dbd0
SHA1 5ed5a3815307c8ae0939b2e4b47c7b41205b95ba
SHA512 f8d65229ea26b08d1ba827653e6e8db33bdcd4972305aa28baa08eb5021b07c3917906ce478de916da39990e37522b140c90e8a954b8aae650213b065d921499
TLSH
T108415120CD7B01AEE08D430C13D6A16D5EB2FDA443692423D707E906350AA47D3CE90F
MD5 SHA1 SHA512 TLSH

Submit Download

layerrenderpreview.vert

Path C:\Program Files\Marmoset\Toolbag 4\data\shader\paint\layer\layerrenderpreview.vert
Size 348B
SHA256 e49de0bd748ab9f2317a0e34eca06b5169ed7b8669a389bf976d8f838fb14d87
MD5 a479f97a8f5a10c6292b80c025090fe6
SHA1 15cdb68582295078e0587526c8286b0968332088
SHA512 6df93ae6e6173d37da9ebd6e2eb5844b9953cb428b269691da3289a8efe351ca12a6fda5e11b709e761f9b72baba6dc4de399802152cce5600de53145728f9de
TLSH
T191E0684858F25F112F282B2F69728E4B865DC8B1189C3627F1858EB240104F58D0AF17
MD5 SHA1 SHA512 TLSH

Submit Download

english.txt

Path C:\Program Files\Marmoset\Toolbag 4\data\text\english.txt
Size 120KB
SHA256 727243c18e0c8770f7902d0a95a548e2e0b5f2e82816bfaba0447f7dc765e86c
MD5 8952378461cb02b7facdb0054590dedc
SHA1 1c5a5bd9c6b366a9fb412f52156800302529f55e
SHA512 6b2d1b2da58041e49fc3c6c642dc4523214cb30014aeb8ef04833b1729636c9be7009068219962436e6a102312fe437059579b2797763f8fb181cd87e5c7c537
SSDEEP 3072:luWo2aR3JhBTCkuo0lc/w0o32BGuKnQ1SD7K2rD3:ro2aR3JhtYc/w9GJLSD+2v
TLSH
T1E5C3C6277A05633B499302D1620ED6C3973A806D45739AA166EDC02C65CFDB0A37F7EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python36.dll

Path C:\Program Files\Marmoset\Toolbag 4\python36.dll
Size 3.4MB
SHA256 dd4bba32bf57165371822f5966617f475198764a91f39dc6ef86552457ac795d
MD5 7e5ad98ee1fef48d50c2cb641f464181
SHA1 ba424106c46ab11be33f4954195d10382791677d
SHA512 7633730cc9672bc558f8f3391534f9a0f3627a98c5c9f5acefbfc2356eeb14cd10581dceceec2e2d20ed666bc121b28d2af63bd61ead48d34cbcec5861f8ef82
SSDEEP 49152:h4PFJ4H0KKK62SHkRzpwFM32Hc7VOO0JwGLDsKuPkwETUI5ZaHi6MInQPvU/9vsB:hF284x5EH1MI06vad
TLSH
T1EDF58D72A3AB0155DEB3C477C912860ADBB1BC552F1DF70A41A8B6D52B73CA306EE701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tbb.dll

Path C:\Program Files\Marmoset\Toolbag 4\tbb.dll
Size 391KB
SHA256 57742065adfbac614a7e2cca7c11c293830bfabdb188e06e5a02f50506439f52
MD5 2bf5be47eba60d8e5620a42854fb6525
SHA1 719b943464f8b937995dcda8bc8b472ab0bef2d9
SHA512 48de73e271f78f510bb886f85caeec1a731116f953ec61fe9a896223e86c1abb1e165c1f9884c38cfc885c2e00f3ee3996a7da3471b1923785bb0726b52a3494
SSDEEP 12288:s26TInx7iuCnIhWWTeceIkSAr31Wj2y29XFwg563T:szuQBr3Qj2y2hF2
TLSH
T1F5847C27F6D96C59D546C23486634B5037F2B4440726E75B22A9CB393FB3F50AE2CBA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

toolbag.exe

Path C:\Program Files\Marmoset\Toolbag 4\toolbag.exe
Size 26.1MB
SHA256 0bbedf6fa92ddf3de256b1725e36931f0196d0f3d425b2f2c52c43fd0d93c4ed
MD5 2eb817896dbb03386c30b9114859b817
SHA1 5de5b5da16d5aea2e7160af5a1abcd57727e37c6
SHA512 55a09d5706897679c4ad7059fea7609067540e515e016bf5646280673189c91eaa8e3d01c8949f0faf4b9856b8cf9ecbf3728c3a6a0a05550c20d2c5ed6e4450
SSDEEP 393216:DKAaWTRw9qWDB3hlvqIDT974k5drQ5lamns:jux133dDus
TLSH
T1EF578C95333854E9F0B3D07C87D66E0BE7B274290734ABEF969145991F2BAE0193B720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.exe

Path C:\Program Files\Marmoset\Toolbag 4\uninstall.exe
Size 85KB
SHA256 53b8d72ff792df01ae4a27b4bc3150876fd079464513246271c7df31479e16a2
MD5 6e34fbb967f03acdf67f36ff0017164f
SHA1 28489cf35f422017261d72d08a0481d5c8248ebf
SHA512 53caa8aa5567f3cd61ec97bf3f639860770651c96cbadf55478efb8d3733b2fe7312d95570adacf0666a97643fb4ac1ff5cf4c5d7c2401a137ad005dabd5e43a
SSDEEP 1536:uBWx2gmwLOuYL12EawcKocVLWJhdXc2tDfiXQtprBu5F:uBynOpL12riocVLAddtDfiAtNI5F
TLSH
T1ED835A3423DFD877C48FAA70966A56FEA3319E0001209AF717EF7E9A39202D7D574192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x64.exe

Path C:\Program Files\Marmoset\Toolbag 4\vcredist_x64.exe
Size 14.3MB
SHA256 b6c82087a2c443db859fdbeaae7f46244d06c3f2a7f71c35e50358066253de52
MD5 f0248d477e74687c5619ae16498b13d4
SHA1 9ed4b091148c9b53f66b3f2c69be7e60e74c486a
SHA512 0c373b06ffe84f3e803831e90f22d7d73304e47a47839db614f63399ff1b7fcf33153bf3d23998877c96d2a75e316291a219fdd12358ca48928526284b802591
SSDEEP 393216:q5lptVYmfr7yBG/4WoI+j6LTinXKSf0fzTDv8:q7pttD7yBG/uljIinXj0fQ
TLSH
T1AFE63332A598402BDBF20473EA94F9242E3DD119735589BBE2DCDD0E1F7818217FBA16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

viewer_install.exe

Path C:\Program Files\Marmoset\Toolbag 4\viewer_install.exe
Size 35.5MB
SHA256 a1a1c2fa7a2ef869ab01d0bdc84e47631caf180af7ebcd5b3262874781e7790c
MD5 bb8d1522c00a0bd59a4d5b679ebccd1a
SHA1 9d361042e6253b2b23e0721c466ad0013a1c1cd3
SHA512 e67539f78db1475cd60ea1317535285ee6514478d26d66917787d29d56c0955916608eaadb7b0b81cdd858957b1f26fd1d63897dbf0fdeaaa577977168db82e1
SSDEEP 786432:Rqxzpnw4BbC1g789zf2MhYNbM/CqItCIQeO65DWWupmaBcFNSCjMM8mE7QF80pHX:Rqzw9SARYhNtC5p6TWh1CGYbpHX
TLSH
T15D87335B6F6ECBA6EB49F9FA36A0D0FFE959FC41A4F48B91036472093470345467C882
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-LUBD3.tmp

Path C:\Users\Admin\AppData\Local\Canopy\toolbag4\is-LUBD3.tmp
Size 16B
SHA256 8df9f58e0f75cd35207778a08e5de29f07773c68f955ad33eb0b9e1aba0d35f7
MD5 fe94547f2eef4dc6d385f141dabce92e
SHA1 61dd5f02406e1c90c56771fc4921275d14dfafc4
SHA512 2845e9223bc884c7e1e866ba2add9a507a39794e9e8e4d5f887b561d7456e115317243f224e74352aaa1155e1439ce9e52b1be80f7ada93d06b2bd7d1a5ad57c
MD5 SHA1 SHA512

Submit Download

is-OT7M7.tmp

Path C:\Users\Admin\AppData\Local\Canopy\toolbag4\is-OT7M7.tmp
Size 14B
SHA256 4d4b79fd8089e58d343e5c57538eb8572cb531f5f681238d474ed8b6ed03ec98
MD5 4967522725b9a0faaebecf5981b5fde0
SHA1 3299d6763725828e4261f720737d6bafddbba85c
SHA512 6d487c2e9aaf3da6ab33dabdb79b73150b5cbde2813ed114fbaa77fa806075b4c3beb7d3ca06ddde3f90eff7a8b562aee5ed35b47a524acb5660a24e14dfe33b
MD5 SHA1 SHA512

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 5daf72c9a12bd87c5b123890e859b95d09a6d27791f6fec67aa27567a1e41c37
MD5 dc1f4a83ead52f95efd673579eb259a4
SHA1 2d41d7b7d5315e89ece4c27249eba70baff95d97
SHA512 4a6222fc02c5832341438b26d42baf02dc533aa523972eaebb24d3b8cd895774c6e3b55ee3497bd731c498a79df225165582b3be51fe20086cacbe3791c06d84
TLSH
T1D4E086DC06C9CA6EB248AB4B826F471C86D0B78FE6C86A5A274CC4A87145544E3926A5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 70a6376cde017826017514e12d717c7ad82c3e6357537d74f799befc6369b527
MD5 fdebf6cdb03c7e78cca13d830d7881e3
SHA1 1eaa8368bc28399d633460b8b68d26119fefe4e3
SHA512 75591311795763a7b9dd654d6239c9b377ef8a5397dd0ef5eb1f3d20a43d6ca57885142ff5a0e79195a096188779eaa9c5f678462b102dfa567c9b3fc71ec91a
TLSH
T11FE06F7D17CCCDA0064893C2A08A4A1C8890B0AFAACCC7EE32CEB0BC2460002C304A88
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 249358b1eab901f0b034023569e7f01b1f94c9179591789d99d6f279761d6e1c
MD5 e3fe72c0f542fbb29d9eb8933eefb382
SHA1 fce9a5a6bf89b76d58b4c0f0c691531330ab3b3e
SHA512 f71315278d44c74df19833e56e16d62705ddd45cc9bbabd13be55f51927a3d7464736846a1c4bcda6770c5b8c0720e1defbfbddb5206de648079efb1a9250340
TLSH
T17EC080D9BD4D845FD385187E5716F00007906511942796171650FDC032419A01E29220
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8f75248c6ab531bbd5c13f43cc0a9159fb967b026e77823bea24d4e1aa02771c
MD5 38e221a73012db71ee383f02d0a0f768
SHA1 02465ed18854da134b19d0633b598e95cf760e63
SHA512 b6d5a56e494d0f6e8c8f57bf674d1a45aea7cbc9f6ba2de2d85ed582f9c921bd83a347d9e8985e344be9c8d195ecbaded50e2d24a3ffbcb47bbbfcedb0c188f1
TLSH
T17B716EBB07E2A87CE3D04872A0D65540743DC1F9F807EEA6F7D084B95E1272686F8174
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bc85.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bc85.TMP
Size 3KB
SHA256 6bfba015bc739de4194ecdf2384c50f98de93dca7366e95c73f1f2774a820af2
MD5 3b754fd997ed835913fcef58f427970a
SHA1 f32ab9d044ee312c7324a14dc65f63d36f4fcef8
SHA512 51151fb9b754b4acedd245f82e2c4efa062cff1d4cf83de725f9ad9cc8b1720ef02e8267245e3a68f6652caf6f1a70ae1edf3d74096271a405cf5bee43fbb400
TLSH
T1A8714CBB07F2A8B8E3D04872A0E25645743DC2F9F807EE9AF6D085791E0172582F8174
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a6b496d46bd3bd33f2d307e22c4bd8ab167d1987efab6119073bee2322af07c9
MD5 d35f22385bc7433e889a3ad49f27a744
SHA1 285154c3b39f6c8416380fb4e41c9803bf65fe56
SHA512 17bb8d95f7722b400fbd944a8f7401b94a7a9b54477130b36ae26787e5a3be8e951e32e85888847941d8a6afebdf7ac8b25dfd2d41b4bc32b0f70acfce058faf
TLSH
T129317BF787B4856EEA1151F4EA19AF1FCE5C0421436C7C6586E0AE17A3E24B0E101A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b28e99b1eebe26b71a9a2c4ebee3a090cd4d59b62cdce46578f0aa71cf639cc0
MD5 a71a30f24051da3bc1e289598bc1430c
SHA1 27d3bbe3e4dc3a118b6fb8eda12e81e9a4911ec6
SHA512 d3dc4b8b61e14626126e538e7d04d02b9d886e728a365711b58ba80f78c109e21caec67fa89a072a4a9b298cd68f2b029ae9c946cbd50b92dceeae3fd9dd8824
TLSH
T1112170F783B4856EDA1195F4EB09AF1FCE1C0522475C7C75C6E0AE17A3E24B4E001A4B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 dbcd1b305f3c7b2c3c78e2f58740c9511825069043d4bd35c9869d43530eaf23
MD5 f8af7dfc01007dbe163efb5332f11b83
SHA1 f8e9e394fa8e3d3cd55a731e0a6c9a6a797037fd
SHA512 0b6cf7ab25bec2d0e25dfb57796a28c5c5c73140744c40b1a5bc8c7545db187449c7a3da6233e2fcdd7b85b8f4abeffe548867c00d614d85c5eb4819c012eba2
TLSH
T125217BF387B4856EDA1192F4EB099F1FCE1C0522475C7C75C6D0AE1BA3E28B4E10168B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9b9dad2c4d9bc245b5151a121d4c3d5ecd8083f249bc8198f6b28cbbd0717d84
MD5 faf5201e6ca07dea40677510a635d8cd
SHA1 c840ddd80229f7b641b71ecaf635ef14d93083ac
SHA512 830020f0989045ae536368c327a77ae506bac37de842be521357138851197d4326107f78b4b4e872ceee0fbe82af5af79a4dd7ea48dcc9708f0d2e5ca87b0a12
SSDEEP 192:sxZIdRiYyM/jK1Ml8UQEjI/frsSqAfwVeIdpPcHW6+WNavk/YvIK9koIg5YJ:sxZIdjq8I/frsSqgk0Hb1/q3m
TLSH
T1C052D812AA345977CCDBD60DF951BF93D6F50472A2900E48AAFCCA0C05E6AED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4d752cfdd9a02e373290d5ecb1cdccf3893dc3c6a902a9f8ddfd8eec698173f0
MD5 78a8518eb959d0b21bf27e3e14b845ae
SHA1 047350b37030894fe99dd0fa5c72c9fd995c3c5a
SHA512 790c09af83dfcf6ef134cfed1554336ac1db3f6ae279bad9960e4a68dcde8a89a01fa877a92ec65a0dd2b5da0f63d2a75dc31c655cf38424fd712fdbfc903a55
SSDEEP 192:sxZIdRiYyM/jK1Ml8M9I/frsdqJwVeIdp1cHW6+WNavk/Yvq13koIgrJ:sxZIdj1I/frsdqJkmHb1/J39
TLSH
T10852D8126A346977CCDBD609F955BF93D6F9147292900E58AAFCCA0C04E6AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 28KB
SHA256 41f431bec82238577c9e18cea6bb66228daf05e674471e03adac4d3dafaa9a24
MD5 003f5254d25dd5884b7695ce0dd73017
SHA1 3dd3afaf470822e58a2a84b7dad65b30e7972880
SHA512 d6835bd7633932bf90e5acc9b0d4d9892ac376065413ac8dc5e5911ea37cb781e47e3577ed71286e667286d0964050324c6317e74b8d04a71371ccc94395698d
SSDEEP 384:sxZIdWq8I/frsSqj66s8qMpRiYnazAW8pZS15posJWeT+4k0Hb1/q8m:sQd58I/fBq4Mnc7WeT+4NHbJqj
TLSH
T1E0D20806A924C877DEC35D19B43D7E73D9EC40526285CEDA1AECCA0C01AD5FDAB4782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 41eb186f2169d920e0a45d00f8da18001bd97ec1cd0479b4177bb47ac8810c4c
MD5 ce2f4d0207e4f7eee3404eaf45d69ace
SHA1 e36fb1d5f0e5be443b0e4b6848cad93c622d650d
SHA512 db467cc17a8b725776edfd115087ee0144874de088ba218e29f249a8f6609319b5d10f2f104595456f7a842c7c04b0f25dc1d2ec08627aeac245c2b556ae4a65
SSDEEP 192:sxZIdRiYyM/jK1Ml8MjI/frsSqJwVeIdp1cHW6+WNavk/Yvqn3koIg5yJ:sxZIdjbI/frsSqJkmHb1/T3s
TLSH
T10252E912AA34597BCCDBD20DF951BF93D6F90472A2900E549AFCCA0C04E6AED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 945744c4dbf14758ced26d0f7318221853c7ec8128dc3a326f828894e4721e43
MD5 af18f01b568bea804e0df905ae6cb561
SHA1 1498911d6b2ff92d70e06ad0bd7d33e64c25bb6d
SHA512 05f410672763133a1047ecb2dbbb32348e919449284759674f3d18b8fa90f6dd5f43ba5444e231778929379dedd8077d10c43dab10ab0bc82f12b563554e3ef5
SSDEEP 768:IeseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppDrowAXR:IeseJ3xWvhfynu1jaVcL88pwPh
TLSH
T165D20B2B280CCB7E4F844E5CEC266F966EE801CB67984D5487FA884C02C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 2KB
SHA256 68f480a4ad79fbf43a638345438ed1b5a9f256d9db8fb98dcbb22f8d7d805129
MD5 ac2327b36e4c59ce8ca7c37a06f31b26
SHA1 540a31f7a151233a7379efba84d3c31941ed100a
SHA512 7ac7319abdb231fd99dff1c5771d41d6697dcb768a544513365d57c8ee2f58fb1fd5e4e1ebfbe2ba2d41011b269c8b0ac537526d70c33cbf90cd347d369cae77
TLSH
T1FC41E60E4E60856FD8A884B315B224E837F0D8DC1B61A2274CFC163D7C173AA1C4B2A8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d00ce.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe5d00ce.TMP
Size 2KB
SHA256 0f981949893c03ac4cdeac595c745b44ca1c3575d41c6933859a194565da63d7
MD5 94f9464037ae70f9dea32d99ea382c86
SHA1 6144744ff413f4a05bc96aacc6fb283fdd333b85
SHA512 56c6a21db835b6a40b0259bc8a3ef365d42b235b6a6bfbb8be833c2cd4c71b61a4e629f278d84b9da56ae543161319c4817fb92a642f82df3a4c2ba25fea5e14
TLSH
T16441868A4E41861FD8D044730A93B4A83339D94097127B57A4BC563AB8B57BD2D5E1D8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 754386eba168bc4318c2cc0e4dda46646df0aae6acd9f9fbc8ab2b5e0674bada
MD5 5d6309f01744b17a0885af89f02057e7
SHA1 f6440941ddce31dc1d7ebaa41af0a338bc780eb6
SHA512 301fb873b7c8e749f459ff31dcb0ef1f1b2adab6e6c424067a63c0478604c1bac2bd30df9fcbcdce98e243cccbaf4116f343208f223623068828f040ec35e7ef
TLSH
T120E0C6BA2DD72850BEAFC3D224308090060A78ADE945FC0EA42BF6C310B231530DBC36
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2e377e9286b5f9a6ed49c04fef7640ed636ef9c6b060d83c116d8374b7013501
MD5 6c4aee7ad18d45ecc1e85b8c606ff377
SHA1 cb047dbda58b43f312028d4e8dc48f273ecb5468
SHA512 03daa39b641635766e863312e0ea6503535c03602da1025c6fa359c7cbe66355a68e4c97ed4deb3b93fa4e67d7e77889089e1cd03cce50eff45c8d77779d90c7
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1EI:KYHIhKggkXyi0InKxmUTyNrIlKksw/
TLSH
T14DA1820A343A06123CBD299CB29296361F4631AB3528646F7F7C00530E6FD566EFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cface769-1dfd-4043-977d-f7d069a85e85.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\cface769-1dfd-4043-977d-f7d069a85e85.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 6287d23dadf7513a8506336e7c79e8d87c5310434339597063057193daec97a9
MD5 b2a04d725dea5e7b3c3cfaf637cc721c
SHA1 1c484525f389801ce5244542a45965b9f5a92dd7
SHA512 c8e2d940d52efbc2b2bfa9fa7d290044948648a215fa76d82aebeab8e98fb116b816c7ba38a1fd2a8f0ee7142522c4daa75d32363ec3f5d84bf0eb3f20a34424
SSDEEP 384:ttNn/s3n9SbsNoYe6V/7rJC6QdExMdU8rv+rc:tj+9856V/cxLU8rmrc
TLSH
T1F8624C326C38AC276DE2A989F44B37475FF4516796C42F94E6ED6F0C01DA2AC130BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 2e42e864b33efb6de979a61762251efa4f74bc225b05060e633075ae9808b1d2
MD5 450dbf546aa09d462bd681fc165230c2
SHA1 03a8e0eaa4e946ee2786fae1ffea2c538c4e0b47
SHA512 b51f9ddf098e4785f33ee3b51a46a1f129907a94080f2361a65ee237689e122db80928b2c8af3bbddf65cb3daec06443fac9c126d1a62888779a9070c1c02726
SSDEEP 384:FtNn/s3n9SfsNoke6V/7rJC6QdExMdU8rv+rc:Fj+9Ut6V/cxLU8rmrc
TLSH
T156625C3268386C27ADE2A989F44B37475FF4516796C43F94E6ED6F0C01DA2AC0307D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 48fc2ee990850bfbf90135683e7373800f6f637dc9d772147105de5a9c62d929
MD5 5662ed414ebc0d08de161217eaba96db
SHA1 1e52f12e02e53974136331ca14538ce625f3b339
SHA512 0e28ed3dcf7305f6a0eee24000a19ed0379d50b06572874ba6439ff64a9d529da85c9fce7ccad72b45b0c7988a31909db2a6eb1bfb7db08c36b2d25df4a52c62
SSDEEP 384:aiFdtNn/s3n9SwvsNY8TUNTUlIlBe6V/7rJC6QdExMdU85v+rc:RFdj+9zhwgm6V/QxLU85mrc
TLSH
T1C2B209F258D79837E9AE5B87F73E2E024EBCC057B5806950B3985A0CCC961BFC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 acc945c5547efae7d820b355bc2fe716bab0d2da51f12613a363ce46aedf134b
MD5 1fb098b597b83d9f7d49eada767d160f
SHA1 855f151fd3f673887724b681ca0d91fe2466a2ec
SHA512 ad27a275bdfa7265ba51e272a2fb9d5af7092025fc257ed87edd52ae2012c3c57835fd72f585b3c454227916c13a45db8ee324b6dd0ae8abd170bb7303d98de8
SSDEEP 192:lONw6vMtPQmiUyB0ThTQv+FdLYx5847/7U/u:lONw6UtRJT3dExBzU/u
TLSH
T127020835AC786C7BEAB3AD46F08A37171FF4516BA6D05B54EAE82F1C00D764C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 551234c87e83b846b65138a1b1c93becc4299122f7716d748227150e2d4e6090
MD5 45b1749b325972d0640482239e58aa50
SHA1 2d23843198a8b3c9acbcbd26a4b49c5750a3c8e8
SHA512 1f7a97629e15ba5f15a7cb7d88d54a46bae9080591fa1bf8f5c66d16a55f72aa1337948bce63e97bccf0b8ef152f4ab798c447dbd4b6542bdf8d7467c23e7b18
SSDEEP 192:KON56vMDPQmiUyI0mhTQv+FdLYxTkFd3E8S80IvDqNU/u:KON56UDROm3dExMdU8bv+U/u
TLSH
T18E121B31A8749C276DA3B986F08B36535FF1916BDAC46B50F6ED2F1C01DE66C130AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 09bb8b4cd0b99725f878a1b3b7a5924e0d23f1d869427eedfcf63e536f918c9c
MD5 5a2b575640c7fe9f6e58833117c848e5
SHA1 73dbdfeabb7c36508bb01fff387b3de24502bbe6
SHA512 c4517576442e1af5d178aa0a309f9bf6d3e34117f3efd02e8013d61771c99c70d19965591991ea62fac5c29262ac6fcc8e555cd2e948177842922473efcf9744
SSDEEP 384:HtNn/s3n9SbsNoBe6V/7rJC6QdExMdU8rv+rc:Hj+98M6V/cxLU8rmrc
TLSH
T1B1625B326838AC276DE2A989F54B37475FF4516796C42F94E6ED6F0C01DA2AC030BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eedfdf33-9336-4321-87f5-0632b922399d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\eedfdf33-9336-4321-87f5-0632b922399d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d73165bf5b9276e399411bf60127bbff3b21a7d30756032f577d6dc3651995e7
MD5 9a8f97cd1b28a5f72c480d8432840552
SHA1 3095b79325e3418cb5a4251e9b1d163856188869
SHA512 33f9255b5e9ea1ebee3bfd63d3b87bbfd60c3a37d06cf4452748881bf30d7913851af470eb7ee826417b56ebca55ec02f6edb19a49f2e69a989d398914d4e6c3
TLSH
T15F413868A6FA1158B3B37E5A9BF7A86D487AB8732F07D55E00010D4F0A23B40D972737
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Office_SETLANG_EXE_15

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15
Size 36KB
SHA256 0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36
MD5 0e2a09c8b94747fa78ec836b5711c0c0
SHA1 92495421ad887f27f53784c470884802797025ad
SHA512 61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409
SSDEEP 768:XmmmmmmmmmmmmmmmmmmmmmmViU6PZmc4sax+ksfEY4q55ZYVfhykWSsk6pa7fD9j:uCd
TLSH
T1C0F26850FA21A3CCFF890830D95598B994C03C350DE4F469F6EFB31E4233E665A5BA69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Explorer

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer
Size 36KB
SHA256 20a108577209b2499cfdba77645477dd0d9771a77d42a53c6315156761efcfbb
MD5 ab0262f72142aab53d5402e6d0cb5d24
SHA1 eaf95bb31ae1d4c0010f50e789bdc8b8e3116116
SHA512 bf9580f3e5d1102cf758503e18a2cf98c799c4a252eedf9344f7c5626da3a1cf141353f01601a3b549234cc3f2978ad31f928068395b56f9f0885c07dbe81da1
SSDEEP 768:Jyur5+Elx/VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV:Jyur/x/VVVVVVVVVVVVVVVVVVVVVVVV7
TLSH
T1F4F2690665B22636DFA6D4B745D284B9CD3B6F22033E98BC9D52FD3174D0B087989E70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Activation.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-BP8CM.tmp\Activation.tmp
Size 749KB
SHA256 ce58c94531faedbca16e1cb6beff233b5506276a86ab00effbe7a73fd3ae3e86
MD5 bf2f40b3ef26293972ae05a112c2f15c
SHA1 84656cc88b61450fefa1ca3589af916285ecd0fb
SHA512 87f65ecede50253d48b58a740c86b13b00f4410f76294b5b0ded47e47daea4cd9611d2691d0f56881b153b99668bcb6bea9260b8a9ba9ec7dd9ffba30b7a11f3
SSDEEP 12288:+sMLIMoi3rPR37dzHRA6nX0D9OKWbO7SERb5rNUK1bce0jXyx9V/:5McMoi3rPR37dzHRA6G7WbuSEmK50jXK
TLSH
T13DF47D32F2A08837D1B32E789D1B82955936BD103E35B5A776F91F0C4F792817A272D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq7917.tmp\StdUtils.dll
Size 101KB
SHA256 72d38ef115e71fc73dc5978987c583fc8c6b50ff12e4a5d30649a4d164a8b6ae
MD5 33b4e69e7835e18b9437623367dd1787
SHA1 53afa03edaf931abdc2d828e5a2c89ad573d926c
SHA512 ca890e785d1a0a7e0b4a748416fba417826ae66b46e600f407d4e795b444612a8b830f579f2cf5b6e051bea800604f34f8801cc3daf05c8d29ad05bcda454a77
SSDEEP 1536:Ayy+wx2YAlWrU5OX9crt5c4DBqiC7hk333kbQk:ry+wojIwgNcr1a7WH0b
TLSH
T189A31A527174349EE1F5077C176E2373847E1B38AB28A8DB03A249CEC3761E1A0F5B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq7917.tmp\System.dll
Size 11KB
SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
MD5 17ed1c86bd67e78ade4712be48a7d2bd
SHA1 1cc9fe86d6d6030b4dae45ecddce5907991c01a0
SHA512 0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
SSDEEP 192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
TLSH
T1E3325C12135081F3E4918138C86B3A276B6A15029BF98E57DFD39546BE31BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinShell.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq7917.tmp\WinShell.dll
Size 3KB
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
TLSH
T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
MD5 SHA1 SHA512 TLSH

Submit Download

nsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq7917.tmp\nsProcess.dll
Size 4KB
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
TLSH
T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq7917.tmp\nsis7z.dll
Size 391KB
SHA256 66ac8bd1f273a73e17a3f31d6add739d3cb0330a6417faeda11a9cae00b62d8b
MD5 c6a070b3e68b292bb0efc9b26e85e9cc
SHA1 5a922b96eda6595a68fd0a9051236162ff2e2ada
SHA512 8eff8fc16f5bb574bd9483e3b217b67a8986e31497368c06fdaa3a1e93a40aee94a5b31729d01905157b0ae1e556a402f43cd29a4d30a0587e1ec334458a44e8
SSDEEP 6144:KI4T3K6gRPI8G1W3ODli+GIuuu8M1CkJagSdJFCAvgw7nv0Yy6ptK:KBK6gU1YsI+GIuEbgagS7FCyp7cD6po
TLSH
T1D0848E12BA90C036C66F1231BD18F7A621FE76B0692CD65BB39C5B5F1FB04C1A718A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AccessControl.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw1284.tmp\AccessControl.dll
Size 15KB
SHA256 5fd5d8aec97cffaad9b7df6371b348d436cf1401e86fab614dc4cb8575428e52
MD5 d74bb4447af48da081c7d9b499f3a023
SHA1 dadf6e140e6fd8e49a1851cc144bb022e0adb185
SHA512 9a15de5c6b08914f5e5bbc1c318fb0e84da28a316cf51ccddca8dfb64cd67b7ad06acac307b41d5086a0740055d327007ff890807d6853bb2e767179a3b3d758
SSDEEP 192:0hdGZ2E0hm+Gc7ROMzCPvXWROt086dXHGrEKcDDi0b5ZsgMgiCXyo1Fp01eLLuIt:0hdGZ2E0YWV2908oj21ILud8
TLSH
T1B362A6124FF90BFEF1F16B352AB5553303A2B50124B1C21D5B91CE9A2831B9B5D74327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FindProcDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw1284.tmp\FindProcDLL.dll
Size 31KB
SHA256 a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294
MD5 83cd62eab980e3d64c131799608c8371
SHA1 5b57a6842a154997e31fab573c5754b358f5dd1c
SHA512 91cfbcc125600ec341f5571dcf1e4a814cf7673f82cf42f32155bd54791bbf32619f2bb14ae871d7996e9ddecdfcc5db40caa0979d6dfba3e73cfe8e69c163c9
SSDEEP 384:1NWlNdqdAnhTKMLE2oIM05fnqCiWg3Yy9kflIinokN:1NWtqdihTKCldkYwkdpnoy
TLSH
T140E25A2128D144F7C68F4134A4E44F178A7E69752AE614D3DF65A9CA2E229F2F23B307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShellExecAsUser.dll

Path C:\Users\Admin\AppData\Local\Temp\nsxCAE0.tmp\ShellExecAsUser.dll
Size 7KB
SHA256 27d61cacd2995f498ba971b3b2c53330bc0e9900c9d23e57b2927aadfdee8115
MD5 86a81b9ab7de83aa01024593a03d1872
SHA1 8fd7c645e6e2cb1f1bcb97b3b5f85ce1660b66be
SHA512 cc37bd5d74d185077bdf6c4a974fb29922e3177e2c5971c664f46c057aad1236e6f3f856c5d82f1d677c29896f0e3e71283ef04f886db58abae151cb27c827ac
SSDEEP 96:GFZf6PnleKYcBVGKLyhkrw0qyz/sRXQVgKXohw8FFtkqCp:Gnf6IKTAKLyGOCqQomItQ
TLSH
T167E1097A56D288A1E11E07746A975E7B13AD6A1203B00431CB471FCE2DF5456F42FA4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Readme.txt

Path C:\Users\Admin\Downloads\_alaamwas.com_Marmoset_Toolbag_4.0x64\Readme.txt
Size 325B
SHA256 378a4223d0204ad97aaa5a223bab18495d3dceeeba9f9d888bacaa3512758904
MD5 9d1412fbe89b4c2daa1db8d7b8188570
SHA1 045da84ee109a264291a9490cbb65c7929c897d5
SHA512 3b7d7f5a233bb53abd9d7271b05b85cb5ea9a258d4eee1ded67ee96fe033cac6790ea03ad0ca695eb83201fdbf2153f5e26896196eaccc00d8fd629511eb9e76
TLSH
T129E0864926935A5906A757F310D01700D028CC83A119C445B34EE6A557977FAC77665F
MD5 SHA1 SHA512 TLSH

Submit Download

vcredist_x64.exe

Path C:\Windows\Temp\{1BD0550C-5390-4E1C-A317-D2C2AEFC4300}\.cr\vcredist_x64.exe
Size 632KB
SHA256 82c3e3423e48bafcdd726624eb7fd3e00674e50e4b6acdcac408fe8fae43b022
MD5 843288fd72a1152b50b4e4b7344bb592
SHA1 648416c53721a85666abaf71c6682fcc1da70b48
SHA512 04b61bb0a6e748ab78b1037db68bc9ec1745bb3efaca0b8fb6d99e01abbe08a67168cbf3f714b72daf00da26084ec6f6f707c3cd08fa8243023e6924719a4e41
SSDEEP 12288:SnMwHskY7gjcjhVIEhqgM7bWvcsi6aVj7Iy41wXK4Qzh+jMlWCEht:cMysZgjS1hqgSC/izvf0wiz0wyt
TLSH
T1FCD49E3291614036E6F206B3B958E2307E3CD2186714C9AEE3E8ED5D7EA848177F7257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{7A4B9D9E-1518-4092-A7DA-790F3A8E3992}\.ba\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{7A4B9D9E-1518-4092-A7DA-790F3A8E3992}\.ba\wixstdba.dll
Size 191KB
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
TLSH
T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/312-2888-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/312-2880-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/312-2878-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/1476-2877-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/1476-2889-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/1476-2722-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/1780-2732-0x0000028E2F4A0000-0x0000028E2F4C0000-memory.dmp

Download

memory/1780-2727-0x000002862DAC0000-0x000002862DBC0000-memory.dmp

Download

memory/1780-2749-0x0000028E2F460000-0x0000028E2F480000-memory.dmp

Download

memory/1780-2763-0x0000028E2F870000-0x0000028E2F890000-memory.dmp

Download

memory/1848-5497-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/1848-5502-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/3116-5557-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3116-5562-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3116-5566-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3116-5570-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3116-5574-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3116-5552-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3496-5352-0x00007FFE189E0000-0x00007FFE18AD4000-memory.dmp

Download

memory/3496-5353-0x00007FFE189E0000-0x00007FFE18AD4000-memory.dmp

Download

memory/3496-5354-0x00007FFE189E0000-0x00007FFE18AD4000-memory.dmp

Download

memory/3496-5351-0x00007FFE189E0000-0x00007FFE18AD4000-memory.dmp

Download

memory/3852-5281-0x000001A11E1D0000-0x000001A11E1D1000-memory.dmp

Download

memory/3852-5280-0x000001A11E1D0000-0x000001A11E1D1000-memory.dmp

Download

memory/3852-5278-0x00007FFE189E0000-0x00007FFE18AD4000-memory.dmp

Download

memory/3852-5282-0x000001A11E1D0000-0x000001A11E1D1000-memory.dmp

Download

memory/3852-5276-0x00007FFE189E0000-0x00007FFE18AD4000-memory.dmp

Download

memory/3852-5279-0x00007FFE189E0000-0x00007FFE18AD4000-memory.dmp

Download

memory/3852-5277-0x00007FFE189E0000-0x00007FFE18AD4000-memory.dmp

Download

memory/3976-5551-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/3976-5543-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/3992-5511-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3992-5505-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3992-5507-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3992-5509-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3992-5503-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3992-5515-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3992-5517-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3992-5564-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3992-5525-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4316-5496-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/4316-5460-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/4316-5455-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/4512-5482-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4512-5495-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4512-5494-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4512-5488-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4512-5486-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4512-5480-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4512-5461-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4836-5529-0x00007FFE189E0000-0x00007FFE18AD4000-memory.dmp

Download

memory/4836-5537-0x0000021A09540000-0x0000021A099AC000-memory.dmp

Download

memory/4836-5530-0x00007FFE189E0000-0x00007FFE18AD4000-memory.dmp

Download

memory/4836-5531-0x00007FFE189E0000-0x00007FFE18AD4000-memory.dmp

Download

memory/4836-5528-0x00007FFE189E0000-0x00007FFE18AD4000-memory.dmp

Download