fe8b22013edc78d36d4718a0a02af080d553c31358e6fc0f7449e703d5dbe1e4

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 01:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 160KB
Sample260813-bvr69shm3x
SHA256 fe8b22013edc78d36d4718a0a02af080d553c31358e6fc0f7449e703d5dbe1e4
MD5 358f658509bd504355956b3b103c62bf
SHA1 355d101cdb5636b499eb1547706e66ccf0d2aa47
SHA512 9f028c422a30a858489a6c2c7e74cb0597606516da6da4254c0660d07f68b76f0b903dfa17075a3883c71c657928db69b110e76b093780451bf553dcdbbb68cb
SSDEEP 3072:TGD2Kh981MM446KtP45ENVvGDGZuqPapy2RH7RDbZTC:Sq745eCoskuqcFDd
TLSH
T1C7F37C57B7E520F8E5779239C8520616E772787213349B6F03A4077A6F233A09E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Active Setup\Installed Components	Explorer.EXE

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 55 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1079202589-886135813-2527035092-1000\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1079202589-886135813-2527035092-1000\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	Explorer.EXE
File opened (read-only)	\??\F:	Explorer.EXE

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	Explorer.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main	Explorer.EXE

Modifies registry class 43 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "0"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{63A04F47-E88F-4D77-8A65-354EF968C6BC}	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "0"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "0"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\NotificationData	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{E3C89AAA-C2F8-4121-8E8C-72538D3B42F7}	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1056	Explorer.EXE
1056	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1056	Explorer.EXE
Token: SeCreatePagefilePrivilege	1056	Explorer.EXE
Token: SeShutdownPrivilege	1056	Explorer.EXE
Token: SeCreatePagefilePrivilege	1056	Explorer.EXE
Token: SeShutdownPrivilege	1056	Explorer.EXE
Token: SeCreatePagefilePrivilege	1056	Explorer.EXE
Token: SeShutdownPrivilege	1056	Explorer.EXE
Token: SeCreatePagefilePrivilege	1056	Explorer.EXE
Token: SeShutdownPrivilege	1056	Explorer.EXE
Token: SeCreatePagefilePrivilege	1056	Explorer.EXE
Token: SeShutdownPrivilege	1056	Explorer.EXE
Token: SeCreatePagefilePrivilege	1056	Explorer.EXE
Token: SeShutdownPrivilege	1056	Explorer.EXE
Token: SeCreatePagefilePrivilege	1056	Explorer.EXE
Token: SeShutdownPrivilege	1056	Explorer.EXE
Token: SeCreatePagefilePrivilege	1056	Explorer.EXE
Token: SeShutdownPrivilege	1056	Explorer.EXE
Token: SeCreatePagefilePrivilege	1056	Explorer.EXE
Token: SeShutdownPrivilege	1056	Explorer.EXE
Token: SeCreatePagefilePrivilege	1056	Explorer.EXE
Token: SeShutdownPrivilege	1056	Explorer.EXE
Token: SeCreatePagefilePrivilege	1056	Explorer.EXE
Token: SeShutdownPrivilege	1056	Explorer.EXE
Token: SeCreatePagefilePrivilege	1056	Explorer.EXE
Token: SeShutdownPrivilege	1056	Explorer.EXE
Token: SeCreatePagefilePrivilege	1056	Explorer.EXE
Token: SeShutdownPrivilege	1056	Explorer.EXE
Token: SeCreatePagefilePrivilege	1056	Explorer.EXE

Suspicious use of FindShellTrayWindow 58 IoCs

pid	Process
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE
1056	Explorer.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1168	StartMenuExperienceHost.exe
3856	SearchHost.exe
1056	Explorer.EXE

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 1056	1748	userinit.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_358f658509bd504355956b3b103c62bf_catb_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Creates a file in the Startup directory
- Drops desktop.ini file(s)
PID:2324

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1056

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1168

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

stream.x64.en-us.hash

Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\41BAB06F-BBA7-4E8F-9DB6-266E324CD6A5\en-us.16\stream.x64.en-us.hash
Size 20KB
SHA256 0a440149a8e8a8d940f7fd9aaad717f52d1a0494b93045c7a897e22b9f40a889
MD5 5831eb7e78e05da0aae3923f716be83f
SHA1 15a586df86da09a4290f0d69cc308f912068a72f
SHA512 f90c0e471a1aa4c53b792356e3923e73942f4de8963b7f6bb03ccd661e302dee3c3654b502a0eede3a44b3f7acb2bf67696b01353170864f095b3ba36dc56659
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEOUTSDypY:J++OJ38hJU09QTSD4Y
TLSH
T1F9922189BE8D0890CA7712B177645D03EE13E264961C094227A5980E3261F3CAAA2ADC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7096db7aeb75c0d3497ecd56d355a695_dbb21806-baa1-4fee-bd71-4bba0b9aeeac

Path C:\ProgramData\Microsoft\Crypto\SystemKeys\7096db7aeb75c0d3497ecd56d355a695_dbb21806-baa1-4fee-bd71-4bba0b9aeeac
Size 20KB
SHA256 e243a43fb554635e7437314f1fe4c128880bfdaa3b87b1797734702baa8ae633
MD5 9d5ee6ba3bf432f06a49671ebb3e8275
SHA1 44fc08dc8eaffcdc3fc97e46b0784c7cbaaa853e
SHA512 bd8f303ea399ce9da94b4784e2a63d8ad553ce47d343b9dbb4064526a3afc9b33261767a598afb6718abd7b5dbd423ba98ca874e6d51e34d329dbd31ae89a240
SSDEEP 48:J++OJ38hJU09oUHWreRzmnm78goltxLZRW:7q38nUCxHWytmm78gKtxdo
TLSH
T1ABA229D4BF8A4D85D47706F327405A03BE5B8A00EB2A1C51C86D491E3306B396A23BCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

telemetry.ASM-WindowsDefault.json

Path C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json
Size 21KB
SHA256 957fee2a637c48ccaede2da305537b04ff4ea75ce8f3a93f62165acffbe5e9f8
MD5 a2154e0189a0d98499fbb16117e42de9
SHA1 92c7e905d0451c05d1dabf1d7db8b23d3e20ae05
SHA512 d3301ec748b4cb3e9348260ab8928d9e86008903fc575ee967126f1580e3cedc65b7a65d83bbbf47a7d40feca0977e4b320a377f3d8d23fd5dd42a6a4ed18f41
SSDEEP 48:J++OJ38hJU09yFpKbV6QLvuF+N8tLOCHWebUynVOOTrf0OTqT:7q38nUCyFpKbV6QLvuF+Prl4OOTrcOmT
TLSH
T1D6A22A5DBD8D09D5C45637F0AFACD973984B7798962C849330058C2531A463C60A2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qmgr.jfm

Path C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm
Size 36KB
SHA256 f25520ac31ec4183a32317a73d183d63b6f8c143b0ad4aba55852245bd62c42f
MD5 29e568c22c94124eeb5a43dffe2e52ec
SHA1 fadcda6cfa993d69ec9081e60a22767b783239f5
SHA512 ae477f9096171407c869bcd008fd4a6410206801de63faff1ff2027900df8c0f201467f8b10b849b1c4c7383bf6fdb4e50b512c6f3a06adb438c132850336c5b
SSDEEP 384:7dnuVpnZdHSs/TR2GzOSzvpZ34tpszlZXjt+8+5fUadbXd2m:BqnZNLR5v7owXjM8WfU+rQm
TLSH
T1D2F2D082A49FE098C40DB27ED7B624A184023FDC9831D5454F4E59E51BCE2351729BF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

user-192.png

Path C:\ProgramData\Microsoft\User Account Pictures\user-192.png
Size 20KB
SHA256 a490cf6d220bf59b59df0a907745dc35720f8f86d5c1dd9eb5d43b61eeff2afb
MD5 d0fee32198ff871211ad1f3c36b367f3
SHA1 500dc5205238389e584977cab4aad56ae3d51f15
SHA512 3777440a15e11d574a38b358b135b24008c2721eb6030211f8d90fa468f55a3df4a843176be11b0d0361e3dace4ce124a788c5595a8d7df1d2684b3f437c38f5
SSDEEP 48:J++OJ38hJU09EMyLb1HQCLwvUwryC4GNl6zzM:7q38nUCDeQCLwiuiz4
TLSH
T1C9A21A057B491988CF3316B37764A9037E03D590B60B1D0156717F293316E2C0AF79CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

user-40.png

Path C:\ProgramData\Microsoft\User Account Pictures\user-40.png
Size 20KB
SHA256 79da811c9c3ff72988034d17001af9e48382d4ab414348144541dbe83cd49948
MD5 00fc7ab673ad7f6a073874610a431585
SHA1 b7dd2feb1ab7f44ccd8dcb303fb16d13f03c0406
SHA512 30514be8510314dd5f467c0b4042097ae04f60246b9b1827871a0012bf3e989116aa614485eeb8e9e03d414a329667325c07e60b40576e13016835b67e620311
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiELE/c1kCln:J++OJ38hJU09mEskmn
TLSH
T1809246997F4D44A4CA7213F227544D03ED07F254532D095225754E0D3355F3CA6B16DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db

Path C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db
Size 659KB
SHA256 45b5995c05575e9ebb344eb67f31fe3051ab855a712464e87cfe9cf05c7e85ab
MD5 a7072f3816cf7ca174a546c28163ea17
SHA1 223e05c1e8b9b61584e19b5e66f1631b8d3b6048
SHA512 f7f70b2db9b54d0c3caeb8c002fb6df2bcc3aad838ed8ea14e7396b832840462f0af1f6e1104e966d4eb1969c0a9f88b272092f33f7be835ad51b5a0b718a7ca
SSDEEP 3072:5p+aTDCJ8/R/eZT6QchrQcoNs/r45u6hrv4xZXC3pF8Fe2Cnh0nMF:OaTDCJ/fcC0Uu6h0P8pce/h0nE
TLSH
T1B9E41504B7E49B52F1710F30BDB6DA950A7FBC11EE06875B3361739E1C31648A926F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7-Zip File Manager.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip File Manager.lnk
Size 20KB
SHA256 89498699519ea24245d9dc10d7e8f8bcd3aa7a3371a6ec43cefa834174a0013b
MD5 43ea97e2c24f12630967b747f6772bd4
SHA1 1c6517ff4b775a6638ee943f1ab030d082b53489
SHA512 41ba6546d4fa54933c20dff8dbae5ec858e861d2bb5659ec54e44d2886f6a501509074219c1a5a94c2f5fd38d89bf4c1a3a59ea56c60594d9d8219cde6efc2da
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEY/+39ur+adnrJgJ2liKOxWKtgcKaQb:J++OJ38hJU09slyrJqfwBbPHf
TLSH
T18DA2EA0AFF0D4944D67B277237555C039F03D748E22948672A64841E366AF3A06B75DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7-Zip Help.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip Help.lnk
Size 20KB
SHA256 0745a50b9cdb510ec295b1fb52e98ff6ee2f3a1db73b50fb3238687d5af2fcc0
MD5 f3bf87c2a1f2f24e960080526091e197
SHA1 eb22c83c5027149c35d2d4050309841ee4be6a3b
SHA512 31701512add97162ecce87f4bb8d67578d818426e9e9ad03876b47a96807afaac929ab46f8d2f2f33487496e8de6b6aa5d77f52745c5b8082a99941f92eac811
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEzYn1wbrBod8/tclKtSxL3avG/uXI53:J++OJ38hJU09lwbrKM7tSAv6oI5yI
TLSH
T1D5A2EC497F8D1A05C97215B327D40A035F87A640835F0481E778092F2312E3CAD73DDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Remote Desktop Connection.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Remote Desktop Connection.lnk
Size 21KB
SHA256 2b3f9d200719de97f93e6e97ea818afd252ac9ee6e673af5dc6b0479310e1137
MD5 a766a2229ea8367e29454bae2a36c93c
SHA1 e21a5104bd17c332faa864a067bbcd8f4c9ec245
SHA512 3804a379d2893901b5c72bb5e687d72b04ce34746256790e182971c4afdadbd4495b076497bcaa28ab9fa083fb2d2f695dc71477205e2397e36c5472e7c8ab62
SSDEEP 48:J++OJ38hJU09mbyH5rqono5IRsf+uNLS6dRf:7q38nUCjHN27
TLSH
T1F4A2184ABE149494EBA782F227649613AD4BEB00828D8E13F486061C239573D563ABEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Steps Recorder.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Steps Recorder.lnk
Size 21KB
SHA256 b36274409940ee3878ec5ccd646faf742e2617c2ea144238a463a83852a47e9d
MD5 27c053e62213114a79484487ca4b67f6
SHA1 e9dc330d4a5ca98675c1f5e115496b2d369a127c
SHA512 d69ffc978e7a8d0faa9a140b555fb86027623be8dac067e03cddffbeda0eeba92733cf1b80c33c0addabd8fe55a84799463ad3131a88216a352a3a93c24ac6d7
SSDEEP 48:J++OJ38hJU09p3kLANby93WcMXF1/KG9p1oIS8FF:7q38nUCpJbYWc+//Kep1DSgF
TLSH
T188A2EAD5EECA1D11CF6B12F217911503ED4F315CAA3C1E89619648143210A3663D7AED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Character Map.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Character Map.lnk
Size 21KB
SHA256 7dcd3a9b9c0d6b47e8906fe04cbc0bb8942724296a454d7a7b0861aec76b4c15
MD5 4fb43fee9d1a98a5f6379e42db7fd7f1
SHA1 87a0ab5da5dd3f50ed34b5146f025b3702c477cc
SHA512 968201b4d3fa64de5ed9c39d54023d78c697bf04a348d96dd6cff47914e4d6ee11fc8ddf9d57d089efa89f053f7e237888d74fc7622db5f8c04e00cd2b716504
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiETWv3EK32oEGrcz94DxWLMck/ljwEPe:J++OJ38hJU09p34r4DxWLMP/lPDdT4
TLSH
T124A20C4DADC71BA1C76612F137605D03FD0723D4CA1E4692319859AD3120F3A5A5E5EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini
Size 20KB
SHA256 1eb2e2dee81f3b01fd4b9d16ed0d161d216310af08139bb2e5ed0a1629fd4ead
MD5 fea4f8b82d409231a5259570a8ea4437
SHA1 825a5e25fac5673c75c1613d8e7cc4d99bb13942
SHA512 7be2f3c2b082d86099682dd6962eb2fe5d9fd6ed0b541f2d589733c338dd9e6382e7c0e1da1446bfd661b6e27b4d72c9e15187461b3c22d91edd23ffffb8b44f
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEsedRm:J++OJ38hJU091kE
TLSH
T18C924485BE8919D4C67717F227605D03FE17F314961C095339694C1E3224F3D6AA3ADE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows Media Player Legacy.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Media Player Legacy.lnk
Size 21KB
SHA256 63602a5cc174e54aefd8b62f2b6dfaebb8e7424a9dce8c204bcd861e017fcea8
MD5 75b978c869a036950f2c9eb2dc4a1312
SHA1 2750d0accfb2cf28d04f933f2ffef41218f10444
SHA512 7f3c78710897f8a6d47eae3eb71f1d607a08fe00a968320647c3bf4d40b5da5021430d866a83c0d93f06be0094c91985c012d69d4e59a9457b0733225d5a7e40
SSDEEP 48:J++OJ38hJU096ZF89ROF8lQrHEaEnh9nHVwd7DH0eLX+:7q38nUC6v82FaLTnuPH0D
TLSH
T1C4A20942BE892597CAB6D9F518600C33BE136B2445173D13720C4C292255F3CABF1AE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini
Size 20KB
SHA256 f9ca3ea253beacabfb06d84ff63fdcee3051e0cf7a2afbb90877eaa3fe4a34b2
MD5 d097dd9ed67b392b27da324fef447d6d
SHA1 2c162c946de709188f58b89c7f83dca567262661
SHA512 20e66805c6badc0c3c27a4319feea104e3be2ababef3c0fcdc9b1e7065891b3db826d458b6d2fdc23ec5468df140df1385ace1021b7a23188d5557faa804fcbd
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEudQZ4KMyOX6+oIx4c4DqwFQHa81cQz:J++OJ38hJU09l0MPdp4DbFQ6Dy
TLSH
T15692C7CDBE461586C76742703B219E03EE13B768652506C22DAFA50D2321F3AA5A3DDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Acrobat Reader DC.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
Size 22KB
SHA256 b762b997821bb5ba041f2a89942c6a0b66cd4eb8dc2d4d4554a7a946f5ba26ec
MD5 f0e71d209e2d608a884c163c63010ce7
SHA1 8a928e6c8012f147e4a81c053c849ad0c9cf04a3
SHA512 c2f892a4166e11602179ade7a042c6ffa783987743b1424599c71242981d9bead01eed3d548a4daefbd0c6fb56bcfeda7a0f8e27000a2d21637a2db3ebbc0474
SSDEEP 96:7q38nUChcKGxKjD63GoqFdFnioDpQjuANn:7qEU8cKMW1NVEn
TLSH
T140A24CB2BE0D052CCD3625B657B19B02F91302409B6E9F8E2B29580A2213F795E636DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Component Services.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Component Services.lnk
Size 21KB
SHA256 d2d0b00f3b3118443b2a4f1ef61ecb1ebbc034d18c7ef3bb1b124aee41edf876
MD5 1c983f6e876dcb5f83dac718d096ae04
SHA1 83d900e42e479121fb24d7f9c0f5b321078bcfa3
SHA512 82e41db53dad4a2ac8d2b04451d10352f963d7409b8e03ca6e3a3161b3517731a67053cb19817e3201d35a5f03f5fdf4d1a0e6bb02162c5a721de14a398a9ccd
SSDEEP 48:J++OJ38hJU09p3qcuWyEacrYb1c63ZVfxGGxXOR:7q38nUCpS3Tb263ZVpx+R
TLSH
T181A20CC4B94B2ED8C27355F123904C03FE4175186B1A19A175395D68735173E9AF3DEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Computer Management.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Computer Management.lnk
Size 21KB
SHA256 143fc14af3e0e4e87a8989cd008f9bfb288aea563554a1e98350ddb45094cf75
MD5 1df4d586e5211af54fbfcfe27eafc4e1
SHA1 6a7c644efac3f443414e6a56b1e020c866471e43
SHA512 32513acb382d0767c62a291cfd8416ebaccb0fae96f0f02c997e54d2a83335ba6792345fb15176886ff55dd98f63207d02c51ac978fa10b54418dc4bea37ad87
SSDEEP 48:J++OJ38hJU09jZMDXal7ql2trNCAc9hB8m0JVFG:7q38nUCjqDal7Q2trNCF9hBp0Je
TLSH
T13BA20A89BD4C0F90C92B1DF3AB254B02AA078B18760E44837D69851BA215F3566B75D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Disk Cleanup.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Disk Cleanup.lnk
Size 21KB
SHA256 5b151f4ced67923eaff69bf504c57769b06d351147ac094865b4e78136bdb34f
MD5 88dc6322c69fbca04dce98f9972432bb
SHA1 4a6069be608ebbe244ca988ac720d63aa08200dc
SHA512 2c7428096db58f01b4d5b1532383d6d06545c20fe0e61840c5c4c12729d0a9470ffe505708911589d5f21e41e28858e28554569102f834fdc517e8a8d2c62994
SSDEEP 48:J++OJ38hJU09p3zXYR3hGoDqQlNeAP44Ey2:7q38nUCpjEhGoDQs44Ey2
TLSH
T1CBA2E8C3EF842490C67B11F127A42C02FC0F72A4B6491C23389AA9183156F319B67FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Event Viewer.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Event Viewer.lnk
Size 21KB
SHA256 4034dc99a0c8915a66feb32b3034d510dba9f6c09d4383ce131bc005423b10d4
MD5 1e21a35d5656165f1b43929076ebda7f
SHA1 399589db8a946078e707fdcfe0de7bfd8ce6153e
SHA512 328314f9e43a74c23d4994dcb653055b92ba4318f6045a691f5ee213398d7a5c9aa80b8e00378a85a4bdb95cb72aa85e52372e6a8e16f1f09f308a8e0f7bdcf5
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEZafBPjrCLkTuqEtu1zAVXQLtvpP4/v:J++OJ38hJU09RZaLGeAWVXm9pOwpVqb
TLSH
T168A20A1DEE0A9B80C76753F32A201D22BD03BE9846191E613995441A7109B3C2FF27D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Memory Diagnostics Tool.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Memory Diagnostics Tool.lnk
Size 21KB
SHA256 f563d3b5f8eb2af111964297fb49ebc37f0c59aae369e029f4b0493959882f92
MD5 0ab05a2c5cecda54442c1a8ce6913a14
SHA1 68d258b3dc9b96f4f1008c36d97814fe84d20632
SHA512 2256af801b3095f739c63b1b9773ffd2970a8a32df3dd521b677521cf8aa60c72d8abd426444b57bb7a66c27fe48ac603b986ae4431782e421dd66932d004adf
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiESob9coXPvQNdp2JWfF/1iCBJIdrjVT:J++OJ38hJU09UbhfEdIWfvihkED+N01
TLSH
T1B3A2EC463E8C1D70DB7322F35A149516BD03E944E2AF08E236964905316063C65869DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RecoveryDrive.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\RecoveryDrive.lnk
Size 21KB
SHA256 17666fd2fdddd7c48d7c6f8e4fbff33b9a0f4e41f0e6aef4a049c2327adb0e05
MD5 8751678858e5a69dd6a51714321fc60f
SHA1 c65eec1b14ffa8fd0072a2a6a21818845c603a89
SHA512 c39f9a885dd51ecefc91901d5e9ea84e050a6dbb90ec0d48b70e72b3685e26c9fa32caf27592bed9479c24fa25d3210e6f4102e69312fb8a00b1a8975d11b3d1
SSDEEP 48:J++OJ38hJU09GqQ+xLVoF2990j3Mq8U176toY:7q38nUCGGD2Pvli
TLSH
T1D2A2C88AABCE0E90CFAA63F221680D01BE07436D9A7E1B407759491E6160B35DF67DD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Registry Editor.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Registry Editor.lnk
Size 21KB
SHA256 d0abcf0e56e5c0840d1a7dcc2a6b85e4e4dd78474b72bedd7165d825abd9f719
MD5 1c31fe054e12a0a0f8ea9b1aa0b5535c
SHA1 4d4009f5e179a07ae0ba7c5fa4bd5eba8bbb461e
SHA512 a20613f1fe23ec2d5afe9cddb059ea6f470b40ea8d26d045db72dc0bec6ed2cdf615aab98c58915ad7cf954ec11600ae0beecf9e591ba97dcdf03cb225a31970
SSDEEP 48:J++OJ38hJU09gYn/aYdD4hIz/5dugKyRMhk9u4oD:7q38nUCzuhoahtj/
TLSH
T176A2EA4EEC9809E8C97B05F3278C49039D0B6B5CC62D0B914A2C996E676063E75E36D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini
Size 22KB
SHA256 c576ef7deabd14e5a648db8bf48fea4ec135eb438958668e0721c2d411ca571e
MD5 bad36844a6e5d81f496cc70a5889407f
SHA1 eec62663f9c11ff5e3ed0ba976ace25dba98add7
SHA512 9de0eb3f37b0ebfe4c8191ec62f487d52b03649157905a08228848193314f7f910f26b98b5d72a1d3246a52a93cff00ea2d23cfa925cf7d016596fefed90ba88
SSDEEP 96:7q38nUCgfygjxCFy2WFOJscf+zn7/TZItd3lkdZiFm9:7qEUsglCF/WZcW77ZItId
TLSH
T146A23BC9FD4C68F5CA7781F01B417921FA1332401ABECD269F2BA63F7154F19A6824C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dfrgui.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\dfrgui.lnk
Size 21KB
SHA256 e640f7eb90a10640f95f6a2da1cc44511e506ec75e70806892c878943248e203
MD5 292f8c5719f37350f631cdbc9c4b7241
SHA1 daa7a18a0c601fe3b299287913503eb87feb394a
SHA512 2e8298767dd4eb3de188a47bf7e7520e9a1c5cd1647848b302430a4d6ce71bf4b44c8bed09c220ff1e77044e1505bd7e4bceb08a93528627c869e21c2f58f4a7
SSDEEP 48:J++OJ38hJU09XbRaks1Gk12VVZ/uE0BW2X0yH8xDhi:7q38nUC9aB1AbduHW2Bc50
TLSH
T1FBA2D6DAFFCF1AC0D63B52F2A3A8DD33ED0B9298061D0A2278660439753193814099DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iSCSI Initiator.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\iSCSI Initiator.lnk
Size 21KB
SHA256 87dcf9142b4ea7b69c1f8bb8da3a80b702573793e4af0beeb23fce3bbc96f35a
MD5 10c8a911334972cbef8b10de9b46f4b9
SHA1 c107334df11715a1ed89b3dc6f3c5f8bf5c1d225
SHA512 4d141bcb1d073167e2bab7a6397f03ef622048a34014994b2dbea424e07f3ca871f7feb3d50789d5a8fb9bcef3ba8dfb01c31e1a58cdb2e56e17223a9947a325
SSDEEP 48:J++OJ38hJU09Uwbzy//SxM4DdVJoqc5v8UJ1equ:7q38nUCxHwSxMgJoqEv8UC5
TLSH
T127A20898FEA810E5D7E305B76B705813EE2FB658961854503858080D3229F3EA8F29D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Calculator.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Calculator.lnk
Size 21KB
SHA256 05492130ca2607dfe80bc1c7c568d6c5eed1592cd239b288a679782e84864d60
MD5 bf1fc35ff818783f8dbe4c961f7bb4d0
SHA1 094776da99b97822cd3a53fdd2bb4da23eb90153
SHA512 69e79ed62e908a5a32b33f0d1ced70e6813199ec6fd44ed16d6db2f64a7b2a0078d48795d7a624884f506264d28f688731af79ed1e5ec9d386d0c82b793f7193
SSDEEP 48:J++OJ38hJU09p3g9myYnrSjqZrp3YNX8NksXWJzPV:7q38nUCpQ1wrSjqb3YNKkYcTV
TLSH
T11AA2C88CEF9C8459CAF621B137413903BE0392A4CB3556D32155DA282601F3D8AF6EFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Excel.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel.lnk
Size 22KB
SHA256 9e435a194530fe93d8c43bb46a32b055b85a05c1d04ec59ad750c035731cf79a
MD5 743abb1a74926cb7231789338f76d5c8
SHA1 b9c9d38df48fbc4f3102b2b3bb91d05d3a84d99a
SHA512 bdb9fa4973242affa61602ce8329d2cb2192e26926c6c2f8168f17d11df1a47395e95f1f5555753e7b64468b2aa3a284b01b095eee357a370a20d6ee75adc30c
SSDEEP 96:7q38nUCsyebkq0pKJZAyuNIISD4DJ26cF7XosL:7qEUmIJ2yxISDIJ26cF7XfL
TLSH
T1F6A24CC6BF444B08C4772BF015B98C07E70781A99F4A6BA03A548D8C3A15B3DE546DDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Firefox Private Browsing.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox Private Browsing.lnk
Size 22KB
SHA256 96a6ee4f836eb24e97a221b63fb8bcd3644358115017012d1a1225e1d949c424
MD5 2c54bb68ec2856a14558202178098198
SHA1 8b30e48ba637d92cfa1c3b1b304f97c330d6096e
SHA512 b236b90918a47cfae976e76051c98649492a09c15a4d1972682913aa3d321740c132cdf55f8d5b91fc90af5ab13abab74b8d6bc85d1f3b772a1dcc2df7192e16
SSDEEP 48:J++OJ38hJU093BRLjoW6O8fF2nTKwvug31JWk6ogUyf8F44xGE:7q38nUC3PLjoqCo/XuM
TLSH
T174A21A44BFCE5855C27502B33FC09F1329237618A468058131A5681E3621A3A56B29EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Firefox.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
Size 21KB
SHA256 7d7f6c3e1e11cd5ce03dab3dcd3566c3628dced063ff33ebb1fb828103ac56e2
MD5 a910e6075edf69b70338920d522822a1
SHA1 d62b8693e11fa16a05e209b84e297901d74202ff
SHA512 af70d6952319e22b8acb384a8968d5a0f011e8b9a44d0d93202d1552ebd49416ff1f007493324a3d20a081ccf65b2eb9c243e9125185bf2a6d003a842cbd3a3f
SSDEEP 48:J++OJ38hJU09W/+7RdE7Bm+E+iQmf8IxiA:7q38nUCW/+nE1K+id88L
TLSH
T131A2EA99BD9580CCD47F25F1211419137E0BE70C533A4A43675D611F7635A3DACB2ACD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Google Chrome.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
Size 22KB
SHA256 c275e4455d3d9a10cb13666c6ab34088a9582856f2842f182249bc84918bb839
MD5 4f51ea7d1d5a3aaf26abeb47a5b12509
SHA1 2f7d6a124ad61154f13f1e44e578a31e58bd4d24
SHA512 3e930a9c832d28140452a044c5804af8159d402549fca2c7fb86b4d06d5ee8679d528ca9b08f774eb0c710377eb2b9f3eeba0bb1b99da41f4eba4549ca8239bb
SSDEEP 48:J++OJ38hJU09ZIdxQOYkKKYMA3TaMl+zYFfNvzaOzXIMRpx3A3p1UWl:7q38nUCZIdxQeBADnl+zYF1IyRIHUWl
TLSH
T1E8A24B21BA4A4DA4DDB317FB074024079C57A6899A6105B3F86E4C695340E6C12AA6FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reference Documentation.url

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit\Reference Documentation.url
Size 20KB
SHA256 f412d60cbbf4de09b42a6a912ef202befd906d36809e46673c5e5ec7df04b09c
MD5 afa93711bceb538f76c4862bb1f41063
SHA1 e984508772ae1eda0755fbc3e8d7f8f4c12684c3
SHA512 afc56e7c321a7abba7206e0d2a6e8751c7089f96686c64203970cef9bbdb2b9f010e85b22a6b705fad0275cd8e33a3ec1c92114c469ba4eb7b4dbcc5e08d9f69
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEAztKEd:J++OJ38hJU091X
TLSH
T17092A85D7E891A90C67302F13F705D03AE03E3A4962E15416A7D481E7214F3DD5B3ADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Configure Java.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Configure Java.lnk
Size 22KB
SHA256 c3a7369c3d93d0d3dd0c7cbebcd523a17048773cc03146ff1a5b7e99a00596f6
MD5 57737b425c3a4d35a1c5d6871c5141fa
SHA1 83f431cd5b2993c1a41662a8530e2fe4e9f18bb1
SHA512 de43100a44aa952d09b87a4de32efaba287f8ec0e002375a4b91c1d145625ef98570fbc0cd3c03467a944cc6c3b66375943bdb411b224ad426265113f0de42ac
SSDEEP 48:J++OJ38hJU09MvU0MhzAUj/2OR8qWXvJeH4QptWf1XWv6PLwkWMfpcZiJNLAD:7q38nUCMM0MxNRWXIH4QptWNG30cIjAD
TLSH
T12DA24D48F9059C64C7A04AF527542962657363182F7EB797F01C4A2E2B39A3FD1B1AC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft Edge.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
Size 22KB
SHA256 5a41314c09e45c407f7df3b411f86db3a080bb84b778963905849759a7ff7e91
MD5 ebac2ac0bd19c0c81530828bf8398aa5
SHA1 9f38863e925c75abf96b507f572a40ff06a9c398
SHA512 fa566f4b0b43f63c8d6b56b341bf7298f5ffb5fd3572d273ebb7634d4259f0e22f55c92b578a4a4694c6ec47a7501a48bf984f3337ae40333c86f0532c18c134
SSDEEP 48:J++OJ38hJU09xgOoVeIQ8HJCc0LeO62TS1ZX/AxxShJTng:7q38nUCl8g7eiSY0hJk
TLSH
T185A24B84BD4858DCC96740F22FA29940AC020048763A4673AB4F623A3236F39D667FCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Notepad.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad.lnk
Size 21KB
SHA256 d62408a8c1c2e85ad65075f51ee95d8924ac3ea0f2c698f2c7032739056f1824
MD5 c331914a63d99e5fe81ae0ce820fba7b
SHA1 e8a3e7c2297a8280de31640fbb1aeb8bbf8325b8
SHA512 5249abd8b971ffb3a94e1e9b60358dfb9119135d564f61ff90498835805bde7390afd5c901d0396d3dc38ea8b2163f3be2337e6b5b711bd0c7e4294ff0e8dc15
SSDEEP 48:J++OJ38hJU09tb/8DJ0eB2wYkSdh+UM3NlNkFTJ:7q38nUChq0eB2w3yIUQWF1
TLSH
T165A2F8DBFE9EEF80CA560AF52A592E007D87F1B061090E007A65050F3208F38F9865EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneNote 2016.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneNote 2016.lnk
Size 22KB
SHA256 133886e62dc8f3641813dcfc8a37f24724d043ead9cf5af6d22bc38d85dc300c
MD5 e94d9b34fecdbd626bea753e34893dfa
SHA1 11e3e9622624bd6da3803b8961c9cd606af280fa
SHA512 27f970284356a7264411262e373cd0c39727147d3aa8992775a721a2962d48b5d1ea101747d3b7c23b94d861dc5cd343be7a28d76685f7c9ac7539aff0da1762
SSDEEP 48:J++OJ38hJU09OJpZkIbWmP1IfTC2IDA/HvDatNCdds9kCOrXTJSBmut:7q38nUC09WfTCfDAfvutNUsQBKmM
TLSH
T149A24D40FE9D12E4CD7712F62EF49D437F02F220532E6A5724DA15022AB627A6993FD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Outlook.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook.lnk
Size 22KB
SHA256 44a03e28bde8d8178b2305da8b6fad3615fd8fa19439a465a404b78fd894696e
MD5 88f02f747d7542badd8c1859f2e26e8f
SHA1 5be08fd0e1a47ef62e2b8b803ad9d162b4d902e7
SHA512 2197e443bdad1dff554acb4528fcf260038e39c04bdbe836474a2c9225d5b8a38f8ab5085b5ae480e08202b55f88d016d10fa4ece0d174af03147b01e6af87a6
SSDEEP 96:7q38nUC/qUEbFduGFMFr0ut2co7MOqASHFoU:7qEUSibFd1FMFrX2oOqASHFoU
TLSH
T132A26C0CB2CA5DD8C37775B0730C9917AF879A1052790700255CE016231A639E9B0EEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Paint.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Paint.lnk
Size 21KB
SHA256 b13edbe9541e43b5da36036857ddf59853b77ae8a8f485ce974035ac8bdb4393
MD5 0d558904a03c76d1323207945f30623b
SHA1 536f42e03d08b5f52e58bf30406fe9e58e115a32
SHA512 fe164edb4dee5d93d090dd50828b8ce496becbfc2496f1250834c4609ec2cc3cbe24f7ae47ace429d11cfe36c425417c0dbc832de700b76a0ea593e58dc3f7cb
SSDEEP 48:J++OJ38hJU09G3g9qrshakT/Ee3tZI6uvkkfL:7q38nUCGQ5hj/EubI63kfL
TLSH
T1FDA22A4D7D8D0EC1CB7B36F12FA80803BE479E44A97E0A492949451E324DA3D2661EF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PowerPoint.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerPoint.lnk
Size 22KB
SHA256 822d3e66befc0a368d74b98595e64762f1735202da59acce838e629816c283f1
MD5 d73c7a546e020ec65fdffdf34b5c3be2
SHA1 c111edc29e4b141352d9f0348c42bc8a5d600140
SHA512 6746d59c8eb73e00c2aee7592cecf483b0a8f897cf097a0e499423d7436d8ac866d55d855b954c6791994c19bdeb65ff2ca8a5950b6494ea609c27a2c424df4f
SSDEEP 48:J++OJ38hJU09oT/8WBwBOHOzkwNn7F3oll3/ULrt/N8af2yo/mUQhsxyBcnRwtSr:7q38nUCoYWBOOQmlqNxu5QSyBcPh
TLSH
T1C5A25DE6BFC91CB6D9F14AB2E59548133D41DBC495144513221E021A2B03F3155F76DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Snipping Tool.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Snipping Tool.lnk
Size 21KB
SHA256 e3bbc4fa04bbd96056a31eaa29e31ca03d5d624fa02ba9dc891cb11290dc5522
MD5 b75a9a5fe04e15c180c026da2d7abdb0
SHA1 6008d7531ecee98d40c2bd94063297b19ef43dd9
SHA512 2fb0915b8c7f8479f7c56527d5ad94444a8511009c6c3ba7679fa035cf74801d6878cb88c1b7af2d16b4bc364a546bf6e3bc17bf7667ab3d7fab85b5bf77c277
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiESWv3EoEkqfk++/y3QLas1qm1IQDM07:J++OJ38hJU09k3zqjm11z3gdMZO4zp9
TLSH
T17EA2EAC6FA953955CBBA04F32BA05102AD0B9158811847667C4A1C1F7235E3DA1B39CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
Size 20KB
SHA256 373c7d5d3105e0b70bc1bc0bf54db2bea14282ae5e0ef0e9476b4160f05c651f
MD5 bc2472d0760d084c72a3a261dd2e8050
SHA1 101db2db5bea30dff5b378a5b90542fdbfb4c1fa
SHA512 90a7da06b2226b35d2b9ce95370be2cbb7519f244d6cf453b11a97200aec1e89ebb7762c278159334531c35d489391b4418d557e30060a3d5ede57adb3a9a030
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEQIL7fI7n5aJB:J++OJ38hJU09NcfIbgB
TLSH
T18F92A589BE4D09E1CA7312F137549C03ED03E2009A3D09527769581D3320F3C96B2ADC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini
Size 20KB
SHA256 4571750c0735837bfce3d7a2269acb777cbb18036e076d1b09b0831bbe5db053
MD5 c03c36ab74b4247559183b761c02e537
SHA1 25ff0ebc35d5ea9b19b6a6cc104780d3589be9fb
SHA512 36e555c83f995fb674308e93bbc7825e684c1eb2556507cd5bb7ae5386af5615c80c5a1b8de5acac0d72c062ea12214e0a41e5f922b23769b6d74653780dea21
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiE4dQZ4KMyeaA0vcZrf:J++OJ38hJU09b0MYRvY
TLSH
T1B79274857F4A5960CA7B0BB12A505D03DE07A368D2681D533DBA480F7225E3C91629CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows PowerShell ISE.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell ISE.lnk
Size 21KB
SHA256 922ae8aac4318693e1c849183cddee9597bc5357f27d083e736f84f7d8dc0f66
MD5 e16c1212701712c83bd28eda0f9bb437
SHA1 c58c637d30aae73ea3639f8a510708f9081a78e5
SHA512 f6265626b2cd23c695e0ea490a48349c1aa426f9bd151d71050cac6efe37fb7122733465370022a13daa8174143644b02dc39052bd7c8faa65909bf3bb010eae
SSDEEP 48:J++OJ38hJU09/b3mHbWwZx7ZaLHPE/KB/3yW:7q38nUCCHiwZxVaDE/m/3yW
TLSH
T10BA2B76BBF4B0888CAEB5AB61F54CD11ED071234D3280E526A555E09754AF28B8B26D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini
Size 20KB
SHA256 28d46e77a6cfe15ca56690e22c4674e58e1017004e16f87e730933f80c5a724f
MD5 3915311eeac07ef843831c92a3f23d38
SHA1 08a25051413acf8a704a71d6280d8d91e3ce2ba0
SHA512 583720315908e16ea1c30912e7ed115c184312398a423636749d5f5bae4b18ea1031ecd12e6740730f3353ab2e2bca1c7e097827ec9f523c248ccee3f138dca5
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEx5rDprkV:J++OJ38hJU09krDGV
TLSH
T1E19286493E4D0DC4C67716F22B645D13ED0B9344972809512938480D3368B3C56B3DCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Word.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Word.lnk
Size 22KB
SHA256 df82e47c290c729eca46520a2a1e8b47c13c5f346a99fbadd7a219018b926f5b
MD5 65842655fc89342d853cdef114ef63ce
SHA1 22e3aa163f28aee577dd637f7d036b91eed0ed31
SHA512 4c80a4ad62a0573d4aec6d9346d4eb557f0453894815bf6c87471174b34650e54df758e0bbf596d642e2209bd64b6da824d58f19a8eb36e3da1f7dbc4b524a14
SSDEEP 48:J++OJ38hJU095Uk9sIvU2d1Aqir1yILBSp2tZ9zoVI0GXDqCL:7q38nUC5UjIM2fLiQI02tZN30GXmCL
TLSH
T1ECA23C29FF0B11D4C2FB06F2FA981533796E19E9AA5C1401F99594179300F1896A0FCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini
Size 20KB
SHA256 50625c5d1406c0806388256a73114b0a717905716856679f6a49accff8741df3
MD5 5cb8d2e503b07c2747b015cb71b15202
SHA1 52e0005b7ac5a203d3f53a8741d4343b5e455cd4
SHA512 204558b1f42be8c3375938dad8b65199ea6e9f12528ec46e278a63ff088483dd7be25320ff37afd847c54603a5b5faa2deffbacfe20f7a8f403c6c103f22cc50
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiE/L7fI7n5aJAHTkKynKwmNTKApoTHPT:J++OJ38hJU096fIbgAzkZxmNTjeTHPU2
TLSH
T19992D74F7E8DC6E0C7A709B11A504917FE0BE410EA7D080AB62E390DB225B3996727D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\state.rsm
Size 20KB
SHA256 64dca3be579769f988bd164dffe39971011174912638717e11dccc6ecaec3c24
MD5 d326c56ba020f93a0f69165a52bca93e
SHA1 2b72b2e4f322f2eb809ac1a96f5aa82bca9edfd7
SHA512 db9c73bb0d76823f29dcad791671545ecba5dd3bda21bfdb089831ca279e14761c4423be2339ddfc03f6cdc69d09b475140cdd3e076f504c821a7918bfc17538
SSDEEP 48:J++OJ38hJU09ZIyCRpLayn0vNWCMofgVA:7q38nUC0pLj+ACkA
TLSH
T1C0A208C5390D18E8C5FB43F767A49A036C1BC344457E0D1172A8042AB318E385BF6AED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\state.rsm
Size 20KB
SHA256 1c9f367db8355f99f8ef95f9720fa61c9f62328a5a15ff4844ea65566bbacc2b
MD5 49b9f55e5003b3457d7510e8c80f3f1d
SHA1 e78112cb12bc62434bc0d5e62d04f35ef02f76c8
SHA512 ff9be81273a7f1a193f5e1c4d15a78ad605bd842f8f4c1de170751dd2e9141c462452951ebf00c3010bbc2ebd468df0e3adaaa17fd85c7cf6f342c9ee4085684
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiE6GKzrqAXumT+osj8bdKXPGrLvAInGy:J++OJ38hJU09CA+mT+o9ZKurLvAlWJ
TLSH
T18092A9C8BF4C5484CFB705F166585903ED1BEB045A2D08563A5E591E366873C5DF32DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6DA548C7E5915679F87E910D6581DEF1_2A5D23B773C3F24BBAFFA9EFA8F1404A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6DA548C7E5915679F87E910D6581DEF1_2A5D23B773C3F24BBAFFA9EFA8F1404A
Size 20KB
SHA256 0992b06cc20f57d5825f8ccd6e024a18048cb91309b4bb39f4dd9d76ba7d5516
MD5 d29df3e6c7bbac0f81bd849d09e8d6c6
SHA1 6481034df4b519f7740822b854a16fb546cc1f15
SHA512 5e1b6d79a5668de5d39bf03fa97e721f55624a28fc396dfb445ee8f02bfec8bd7be0494ad22ceb146a60e7b9e52762c49358111db0e0e60a79206cbab817b825
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEuUvNqgUcxPbnwQbt:J++OJ38hJU09iNqgUcxPbnL
TLSH
T10A92869C7E8908E0C9B701F11B644C036E57E358862C5D96696D490E3115F3C95A29DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D
Size 21KB
SHA256 80449b17f6b07a0a73bed12e2cafa9ad9997a392febd8ed776e71ee2d3b1f504
MD5 d059580c91028af70b51406eed42697c
SHA1 e768f68ef62a0193a6b579ffa071b6c23ab97d82
SHA512 cfc5adb640aeade6cf6c5ba7abf5b97b9b916cbd9a9f33fd7ca70eb5af4b1b0c44fed24a7812b147f848b17e6161a6821ef2aa2e1336cce8b5146715d945e72c
SSDEEP 48:J++OJ38hJU09r16MQIa5Fha8AaOSHNHhcD+/aaf9P3oVy:7q38nUCZFd83a8AaOSHQ0Vf9AM
TLSH
T1EEA229F27E1F49ECC8B215B022049803D9078B58C5550E82B25E98AD3338A37566B9FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26C212D9399727259664BDFCA073966E_912C3CA51DE6018A7BE4CA7BC64AAFCD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_912C3CA51DE6018A7BE4CA7BC64AAFCD
Size 20KB
SHA256 6c9c4dff72151e3437fbed09a3df0a0a0276a231aa338b8f1cfdc22ffc332753
MD5 0e364aff8df8204826b07487db8e876e
SHA1 70374ee0ec31af8c58734815791e80bb4e2c81f4
SHA512 0c11d3af7a661a01d3de6439cb7bf2ca7f11d1379240cde8599c14ec54808fdbac6e3e486680db2a3b110a2f73f74fbd7e3e015ce06bdf435a04d7418e6bd5e2
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEpOEpU7PBs9iiCFw0U6V:J++OJ38hJU09XEp46A12L6V
TLSH
T17992655ABE4F06D0C67316F63771AD03AF07A36056140E52B57A845B3221F3CA6A2ADC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

892580777767344DCAEF580FFA143EA6_06AA6C92E12381CACC311949FAA50FF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\892580777767344DCAEF580FFA143EA6_06AA6C92E12381CACC311949FAA50FF1
Size 20KB
SHA256 7391ce610db01487e18f6f118a373612b9c39552ed74d1d5af9cb05c43cedbb2
MD5 8bf8d80ddf01f008f1242aff24654c14
SHA1 5d26d2d0593ff0b4c86ac8c677c60e92340b5a5c
SHA512 8b29a29ddcdc2ca9d6db37bc9e3a55681aa910a9a6f25bbe9cf4df6192fb43eaf0e862d32099cd026b3afa679e41b8735bddd754fb9e9afb4bceee72c036fec1
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEsnXFV2b8e5FTn3LD9po5RRGyFGPW5:J++OJ38hJU091T2wer7LDwGkF
TLSH
T12292959DBF8A19D0D7770AF276645A03AD13A214DE2859922468C40A7220A3C69A76DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D
Size 20KB
SHA256 66edb0ebb58a02b1368b81be1860e2cbe5f4bada9e96dce216a626ad62d2711f
MD5 99317865baf2f6451ebdd0af2bdc3516
SHA1 99ac1403fdec71dd542f0abfa3fecfa9e20a6c6f
SHA512 2f292dd75f9d922153d51ab29466e510a5431b7567ff6c053d616370fe5617c9110ec513e3c4695e4c276cdc7ea04458ec1b1f223461e658b6a7cffc621fda70
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEtbt/aBNm1yo:J++OJ38hJU09Wbt/a21yo
TLSH
T14292B794FE050C94CA7612F27B605903ED17E640961D0E9116264D063765E3CC6F3BEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ActivitiesCache.db

Path C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db
Size 1.0MB
SHA256 b6df3e7c1109786c96775b1fd62a492554e00992563df0b0dacc3bd152a2071f
MD5 06d0e4d1b6c2961fa96ef8a5c9210c6e
SHA1 ea314559acd7dbd42f87fd916360f1253a57c507
SHA512 f0222664d342af60afc8d25fee769f20da0b7ef21774a5856c00e017921ff3cb3fbc887624a83b8a478296649968fbac4e4e8402f664d513cc6d679a2ac9fc36
SSDEEP 768:BeVrJs0qFDVZHPIrJFMkwBLQy+cIXEpSYl4C+yGtxjtVNtaHR+CvI:YVrJs0qFDbHArUdLQtlXZZCrGBsHEb
TLSH
T1DB35FBC5F00CA229FEB35B731CC28CB2DAB52BA5CA9558369E6D1044E75F5895323E0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_2
Size 28KB
SHA256 5e39871de86e769a62ead2a7a0d0a950ca3b4299b2bdb6cc523f6d03bf375d1d
MD5 b2b029fea35c8e6ec03e73ec6fd316f6
SHA1 cb32a8f081775e111fcd9520672052d453be8486
SHA512 eec334cc70fef553d550868a473f42d9df442f1d4c5f2ee9f556556a331f017b14c590e44446f5332cf01eb8c829947e6feb02d79f7f2f5763abdaf574acd4a4
SSDEEP 192:7qEUaMgwwMklfC86OhWO+V5LA94rZf2cF/5g+wX:7dXywMkM86OoO+7LAUf225g+wX
TLSH
T17CD2BF9B160406B2CF9F04B2AEF5CD23F5FF75A603882322689D99292194A3C11491CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\CURRENT
Size 20KB
SHA256 4a9e8814bf8579ff822499e00c95bf26f7653ba42b36785794448ac079761132
MD5 08e3b99f0c38ef18239891496448e746
SHA1 9a24f21b02c91ad7d2fa532e75cd148b335878f5
SHA512 9cfdcfaaf00d670b237469a8801fb1d9a2b1550173aa537faa0e194c4d9119eb1bee4d7e4e1fcbe1523613ec4a5a326660ecc15b1c5625302c184f1973b90a52
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiET9:J++OJ38hJU092
TLSH
T1F8922349BE8D0894C6B716F237605D03AD07B754962D095225694C0E3224F3C56A3ADC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001
Size 20KB
SHA256 446c135906c22df202067b902ab857c4f0ec4a72ba44f4f5d01001e7d62e57ff
MD5 ff6c5066946b8c876d3b43d5cfd6b5d6
SHA1 8195cafa688a8d210fc6885d6579c9e86772acdd
SHA512 bb0aba6d5405adf19d0bb689688a2383bc4cf30066e25a4c9e82b1ac99eab68a09e32464a8e1cfe19642fc1a3b1f8bdcaed55989653bd2102e8585c7ab6327bb
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEe8:J++OJ38hJU09O
TLSH
T1EB926349BE8D09D0CA7703F227645D03AD07A358972C09536969480E3315F3C9AB3AEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 20KB
SHA256 a8c0a5197e57b4a0d7b13a3cf68c9abc72d91c9880420690b9d4ede7e2d0849c
MD5 03c90aa38cc02ca37d159332a810e316
SHA1 130bb552d31985357769d583141ad90906d48d49
SHA512 205932858eaa86d653b4042a28aa0c5893769fd5a9e99b8e6e39efe6c76df163c520fdbe168926b7ac3b42494f939caee3b67cb3e6dfd81e535048e0c74daf12
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiESZ0dVZAtxZIDaU:J++OJ38hJU09x0dW2DaU
TLSH
T19592A756BE8909A0C9B726F237740903DE03D304432C0E9165294D0E3261F38A573FEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old
Size 20KB
SHA256 850ead3bf91ae15181a4241b2e60c9093d916dc054dfe4179b61cae375a4c08e
MD5 5f8345612c33eefdd5a76c9fe14a700d
SHA1 229565ade2c576923dcc397c95467c7a97d4c1db
SHA512 101544a9789d4ed1181b1826e1d048dee09c938d4717c2a1e6f206f10b4addbf285fd6b077ce2dc338ebc2f338ffd9ab13ea3133ee124d5dfecfd90776993ca4
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiETlcQu/osRPjYaxJ:J++OJ38hJU09ccQu/HJ
TLSH
T184929689BD4D18C0CFB712F227605803AE43EB9492294E1135698C0A3324F3CA6E3ADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\extensions_crx_cache\metadata.json
Size 20KB
SHA256 00edfc47b678570b12e48a3041b903f801d3a126c75986bb8d0e7cdbf185947e
MD5 ef901cd155e01f4135294b307bd99cf7
SHA1 7941471a42052d6c7cf5b6da0c71111270954e10
SHA512 0acc849cf8ebea251ea6ffdc17e7d48cec646928dd6a8a4d96678f01b26268edf22486a84d9d9e04a4d507f2fb51f3a39b64b9319b3a00d211cf5ebd5b1edecd
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEz3:J++OJ38hJU09o3
TLSH
T1A6922349BE4D09D0C67702F237605D03AE07A354562C0A522669480E3324F3C56A3ADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

02d96292d9c03cb2_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\02d96292d9c03cb2_0
Size 20KB
SHA256 b9f3d103f3ec3f8461c4466d47407177bd6ac921ddfa61a04ea4add83d8663d4
MD5 fa139ea7b013821787ed3a1258f0b912
SHA1 a36bbda9fd277cf08b4b0200daa45a602e749c87
SHA512 f0334503a8d3cf0896c1cc9b1083ff033f27d9c57d75a5f2a59ddeb3621d12e876489f2cfc4003f620f09124d1825116e13aff3ef99a2956996c0c318f7adbeb
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEM6AsDxDE42Rg:J++OJ38hJU09aDxzmg
TLSH
T15D92668ABEC91990C6B312F337944913ED079748972E8912786D191D3315F3CA6A3AED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2d40b10c0f33dd4e_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2d40b10c0f33dd4e_0
Size 20KB
SHA256 d17a42b86bd9ef3408928bd8f07d9c14f88b1f9c17ee36ceff37437b0be81f89
MD5 dd3875cd9624a06ee231ae710846eeb2
SHA1 a396d419ead54d1396c6184f1ab0af5dc688eab1
SHA512 234223525c04ae319378abbc4d987c166e802071645ed221e739426314ad35d47dcbe93df10ae98f5b65d23293b692954a6ea7b0a7e16450191ef7f233a03822
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEV1GrKQY5:J++OJ38hJU09aGr1Y5
TLSH
T14292A7497E8A2AD4C6B916F63B500903DD13E358873C49022559481F7359F3855F3EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b4e9595507c3ec1e_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b4e9595507c3ec1e_0
Size 20KB
SHA256 1a2f6c8f1dc979a8932b9943432702bac225536c2f6618b2698ab5961919b459
MD5 9bff078a4a0c8133e53f75e0f9715b5f
SHA1 4bc36446ff889235e62360f3480426ef015eb780
SHA512 3b4adb6b9be144cc32c291c2ad497cbd9a5234c4872bc10cfed20a7644957a3312945d76311ffbaf174f2c02fff35f2b51bd9f46d5b4cb5f7fb48547ab2be143
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEFIRMQUp63wVRZx7mNTv:J++OJ38hJU098XLp63wDZxo
TLSH
T19692B7897D8AA9C8CBB742B117645903BD57E774563C0A933E184C0D3125E3C9A63ECC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_locales\id\messages.json
Size 20KB
SHA256 3301d889a777c6521dfc7369400e8bcd4830a6f870a617a3aa40281ea5ad3db2
MD5 63490d5900946431ca7706b0e8fd0e9e
SHA1 abd3b29bde958acc3b103ff41e9aa8df5bfe879d
SHA512 f24a14cfcb12e8b2137665cec3f08f9f9dd5077628a291f625777105e1de455e7009489e9738eff0556c9a603d5fe8dafea854a27a6b8f1a96c5acc84e0ab349
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEotZCRg+s3fqSW5haPHI7c/Scn28meC:J++OJ38hJU09B6RgHc5h0TbmpuhJS
TLSH
T173A29486BE0909F0C77E06F327949D13BD83B39C6B2D0603B9759A093264F392952EDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_locales\pl\messages.json
Size 20KB
SHA256 3b6f873183566e1293f17aa2fd2f8069521c383db50553e303e159cbe4eff5ea
MD5 25c8d1c011918a62243481919274d133
SHA1 8bcae76de1d9e5bbbea9ce0fb8596838697d555d
SHA512 7faa121722366e04c6174c92a78c64bea2c751fd1835ea35795afa2902edc16fad36c240ac2176f54c219cf86a19c44bc59058e7abd7fddc08cae250cf968d66
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEKg6nNyMrG3aC/I79NGPQHUz2OO9sIQ:J++OJ38hJU09TgzMrGqGInGP52eIcR
TLSH
T1BDA2EB09BD4500CACEA30BF336209A03BD82DE54433D5E53599D4D057314B39F9236CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_locales\ro\messages.json
Size 20KB
SHA256 fb6121d0ca7df39d4e867e6180c800156bb487971e80f1b12efd41fc8c55deed
MD5 da6e6c0ea837cfa0ac913126e9600388
SHA1 3f12ee06ce24b1f9bdd93f0e6f4f030e185b9837
SHA512 ee4d99cc6948add755bb809e68ecd5dea23c94109aa3f13c99d78ba0c25bb51003bbaf44b5b3a466755bd2cac6c34cc4fbe6f7b2d13e8ae1466b4437f98d8a31
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEDiRIq+umayleLnZpO03SACQCYf+Cn:J++OJ38hJU09uOIruBGebZg0oPYt
TLSH
T19FA2C7A8BD8708A0C726137263A58913EE57D7941B5C4D12392E585E3204A3A2A77FD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_locales\sl\messages.json
Size 20KB
SHA256 f352bb81cf34c0ecc57e0785d7cc8cf93cf055029f1305eab3a5b70f18f54ed0
MD5 0511eead9f1dc0c3aec5949067d4bad2
SHA1 08a77962b7ed6df037cdf8e38839d9c44cb17aa4
SHA512 56b07b72feb43f23be21e3c5565c3a0bd01456fa841af3464fcd0851e9dc9b5d9b6d3852210ef8cce3ca17590433c7ff90a2481520972bd76998be9abf10b156
SSDEEP 48:J++OJ38hJU09NdwhC7TtZHEUi65s6sUq00jueGz:7q38nUC8hCzdi65s6so0jueGz
TLSH
T127A2EB5DBD0D0F84C7B216F72720CE02BE06E754995B195258DFAC197128B7EDE41ACC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6abbb797-8ad7-4cf3-b413-ea1484380fe7\index-dir\the-real-index
Size 20KB
SHA256 7607db9483d10fb7d88b9b94c8f8236d5dc405c2b966e551426253925e50608f
MD5 465977c29ee2857e829b32cb6f577d94
SHA1 a3e07cbe52a9c16f3ec7351817944cbb788211d2
SHA512 6471fecf9309b5bffc3e91b4c61a58f727c2d443f1b2570c5f12d665bfbbc1458582d897b61efcdc209e5c53f05365aa7d9d0f8b02f71d5e46e3c1a97921e0b1
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEUBlRmsR:J++OJ38hJU09Nx
TLSH
T1F8924089BE8909D4CA7712F237605D03BE03E348562C0A423A6D4C0E3354F3C56A2ADC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 20KB
SHA256 a2742fbc7b57479379ecbbc7827d6d2ff6ec56ae3f58aac365f8d5adbfe28f22
MD5 78e58491b90ea4cb07fa8411f710a3cb
SHA1 e1fede6ca563d67ead95269b10ec8bebdb54954f
SHA512 c2c1979044991e338ffa9f9452c016ae2a1f42d6331a2ce41d18bb4111d1c8ba17b8ed8fc169160dc5782f4ba12968c87aa4dd03bb2551682f3983bbd16c35ad
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEm9QaAhYedsFGdwhNHpI:J++OJ38hJU093yPhYeYJI
TLSH
T1BB92D705FE856990C5BB01B277E50C03AD4BA61852190E833CAE4C1FB324F3C95B79CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

09_Music_played_the_most.wpl

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00008C13\09_Music_played_the_most.wpl
Size 21KB
SHA256 44faaf67b3375e7b97633a21957ccfc45a7cba05584331ce6a58c73a0adf1f60
MD5 7f9a9665df1c1d70cf2584d86132606f
SHA1 8441e9d7fd2c22bcac018db79d03fbe9da8cc44e
SHA512 f4f446bea0e55e0bd1831ea7957ce34d21c8608c97ece6df74d958af65c2276932cb3c9164035be5ecb952f0a68a75667e86059861ae29cb57b6eb23d623c7c8
SSDEEP 48:J++OJ38hJU09U/5LFp4oESIvx610sCM1Yn/kiTmGC:7q38nUCU/Fo9vxC1aNTmGC
TLSH
T106A2B78D6EDACCE4C97215B3B7501503EF4757A4657C1843663C080AA62AE3D2267BC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

outlook.exe.db

Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\outlook.exe.db
Size 24KB
SHA256 6744a2777eadc9bc1b8155ab77df0a5265e6f59f561d9fa3c4a66822a50d6145
MD5 65422fd63f66a08fea6e4cb8fff531cb
SHA1 03847ae8d228de15821aa3210b13ea8a569f21b5
SHA512 f0f5bf06837636bf9f3fc55a4b017604fd249baf3162135d12f08c4274748b5b451083280c429a4efb01dcdb291c4f0075059f173105ce2a31db53489804fe47
SSDEEP 96:7q38nUCTn9e9z6tknLcuuPY4QSL/k9rFTKjH7P4Mx1pGx9vPAOZfD9Ccr1:7qEUen9RtkuPJQSTk9ralLYAOZPZ
TLSH
T1BCB27F80FE6AAA44E6BB13F553D51317DF13DB9680B44ED015388D1DA62AD2C87D1ACC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-file-l2-1-0.dll
Size 37KB
SHA256 6130ead9c5c0e889635effc304d04641741ccd1c0429a9a263102ac41a1d3c82
MD5 7f4ea301cfe08ec6d26735de859df97b
SHA1 e9101dee790eb16e6650f61c1b459367c0df304d
SHA512 ac94ac5f156b119eba5b8b5d3a3b1592fb3e8327b4512c16873871b66c095a1be5c321b8e22058faad101296f9d4741665e440d0725ec71662c7ac24d1d3c426
SSDEEP 384:7dY46HNflC5n/Zl1WLyUMIWquuCDLOutDGyDpmz2NKNLeI91qQ1k2M:BY/M/JsWRNLhxDpmCNk1qQ3M
TLSH
T18303E1B39D4987A8EC7016B45C88453A9F1D62AA6AF1977325E234C54D78C212FEC3CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-synch-l1-2-0.dll
Size 38KB
SHA256 2335adb23a16e9d8005aa3222cb7d77ab4bf0aaaaa78ae419b7145b76ffc2242
MD5 34f56e7d42e671ac092fd2704ec2043d
SHA1 5e87c00c794f55c863aab9cc3a528b108a0887c2
SHA512 d81fc94f906fa513f93ba4d57f5ea7b6310c151fe35ed15cd89bca5e4f8cdfb3de0085f84bed198b7fe0824ca0eefa56864a05bbf18dff7040749f5a75263cfc
SSDEEP 384:7dZ9STu9gZJQJZSHKh4tAmoKS0SvNuuVMrrEucp0/Aow:BvucLWqmlS3vNuumrwTEAJ
TLSH
T13403E1B9BE998AADC9DF4633E5401F06C445EFF17489FA0046D8BD8F7D0072A25625D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-heap-l1-1-0.dll
Size 38KB
SHA256 f0c608194993e30365e789922ac407e4225b7aff8afe08328a0402b6d1efcbd9
MD5 5883ac810d8fa2bd6f63e2060cac8906
SHA1 c4b0ffaee5a8857cf615d501baa90bbee7f5fade
SHA512 797f8e04ec11dc1f30da045b3fb48da462f2613c1db92332063d0bc79f9cc90c4315ee837ca56540bb9a508eb242d9f8d4363408f1cab2615ffb500f10639aa7
SSDEEP 384:7dh+BNFN9UZ1KDl73eSbydvQx5cmLsM+fqJ1hV4QimxEw0lU0oLyxPCeoAfK5S:BYv22BSJ05cmLsryJlfEjUbreLfv
TLSH
T13703E130FFADEAA4DF1FACFE25439157790197D10278C92DA8456C8EFFD062613A4168
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qmldir

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Window.2\qmldir
Size 20KB
SHA256 1d6222d12d7f988f63ff34ce89432024a26af7d64d94b8e71c57cc635559a753
MD5 d91dc24e714bb3d7e767f4d9f197e11e
SHA1 bf57277077daf9d28ddae55343e4a839cdb7f155
SHA512 651e1868711294991fd851a1cdf953c97417469f8ec7898f4b98fe4aab5628092871573687843a5bd27259a5ceadc6e97993fc45d1083917b195fafbc13c263e
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEfUVIsO:J++OJ38hJU091O
TLSH
T116928889BE4C29D4C6BB13F237905903BD07A7549A2C0D526969480E3315F3C59F39DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveMedTile.contrast-white_scale-125.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-125.png
Size 20KB
SHA256 92be6f46ae4c0c048b4056332443ad4a960117615a81a04c4c65f00ebff5b851
MD5 a0838d3d5eec39a79de22b9d94170764
SHA1 2fb7514ad6428a7b91a6a70eae7d3f57b65e68fb
SHA512 44f1cffe81ac7468da77473ec7ce961bf2d2f29c879692ed469c3a8d626b224283cf36143df017a3c6b139d8b059a93218d8b737ee608afa10a71749c0463cfd
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEuuWnBxVElnEYc8I+Rh950xFPIiKcfR:J++OJ38hJU09rbInEl+Rh9GxlpMLUB
TLSH
T163A2D8943F4E49E8CBB117F0139069038D179388E62A4C71AC7C4D1E3510B38D6A1ECD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSmallTile.contrast-white_scale-200.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-200.png
Size 20KB
SHA256 901c58fc5101ba31cd4bab440b688ed6431e68fd6bee4077e2490d73a0243f16
MD5 7c2ab3ee574b680d4d196f05f7a08b57
SHA1 af739c532c92991005d2de9e223ee4f31321c489
SHA512 9b109565bc36edba35390bcbdbe5b25a121fde815b167516caa1610f4ae9645c6457391863fc43d55db2cc3748b87e9c0ba53680d9fd75a1eae8f7f117364e15
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEcUHBFPnlcdUS7mYiADR753IUKu2oQT:J++OJ38hJU09GhlnydUS7oA/3i4UJ
TLSH
T1F1A2D88BEA685E58C57BA9B513E44C03AE0BDB007F542991606D88293264A3D56F24C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install-PerUser-2026-7-9.1435.2220.1.odl

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\setup\Install-PerUser-2026-7-9.1435.2220.1.odl
Size 20KB
SHA256 7a11c3c4672efc4d548f41c7a12042f0a9bdb57a654af5bd992e6b0fd5965a3d
MD5 a15ffb498688c297782acb0746b2686b
SHA1 c838f60dbe5b32f00db24f57a30a890d772ee48f
SHA512 cfd90bb26f056796f1e14995b083c37998b5f4875928bbdab81d0775eec8b7d776b7ef02fcd1831b6c0476a4d0178b1e3d60ffd4d8b894547b703f0254d7ede8
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEb0rld/DEKPNRig:J++OJ38hJU09205tEKf
TLSH
T1F59296897D4D04D0CB7303F17B905E03AD0BA31463294A9262598D0D3315B385BF29EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00000055.bin

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000055.bin
Size 32KB
SHA256 eb78d7e2e087443e015706358d30d2cb0a868bbe938d10eda1fa644f53ba64d3
MD5 a295604099c9bf514aa40d2a45e3e6d1
SHA1 c2738d2843c2348d814d63ae996c80b869181006
SHA512 4c87647b8d591a12d2c2433d72823569e7a843fd7e7fcd94f692fd02e68948e61a760623046895a8b180372c63c5865e762991bf0ad9c5f03aad3193413e156c
SSDEEP 384:7d/gipmy9oMNgv0QjWd3zsWz8vq5OQHkD:B/gWgMyrjWZzsmmSxkD
TLSH
T1B1E2C05832D68464D2A297B1B730CC524C3807D59E27D0627DF6A4322B1EAB8BDD2ED6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

header

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\header
Size 20KB
SHA256 bea4b6486364131dbfa4b3f900117450c7afdfa3359efa69f8e57d0cbf8548ec
MD5 2ee80141b311bb0b2567b5496780d4e1
SHA1 06286a5e0bcad90c8ee38e889c8e0f7275a10e4b
SHA512 d291ca850efa125b56f20d7e746a410e92d8016adc83d25b61e0c9803811119774ab31fbf4d813af89bd7c499c250db19145ca48e701f74dff5c6a53ebc39a55
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEvwVvYa:J++OJ38hJU09vAa
TLSH
T12792048ABE8D0591CA7712F22BA05E03EE07A354562D095265794C0E3365F385BA7ADC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cversions.1.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\cversions.1.db
Size 36KB
SHA256 16541e633d6870edb6484c1a3957d77ecee8cb259c1adedf3e047020330d9a4d
MD5 2d8d84f385d80f8f998f40b806f7aed9
SHA1 725300728981b82a957595f3875def1ffcd624de
SHA512 79dac1ee0024f317d1e2a73d8eaa7c46889257719dd8880a15958b809b6c594bb0240c54aed1668adbb6a39ee481d13a15c9e1f9035a96712381ff97fdff116b
SSDEEP 384:7dUq/dSKyAJX6/rMXz6EYumzzO8CRUGMOCUV9gJNwhEKnJnoCgOcrU:Br1ILMXuELbRvx9MBK5gTo
TLSH
T11CF2D058D4084878DFBC617C1462EB9F1E9A87890958ABF36921C12EB413E31AC75ECF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_16.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db
Size 1024KB
SHA256 7c7da3981db804e408f932c1e2c2bca23a2a7c8e62a32060a1d4834c5453e57d
MD5 c84f5f96af1542bcea20b1e7cdbce645
SHA1 56aa92dc0884e64e83f54405aa49fe0a0e4afd1e
SHA512 699a9098af09cef5b0fa6b7740a75c7763c8e286072352e0ea8a868c8b87ec9597c14c7fbc88adb2377d4a48ec26296a87df922abcf7ae5c180444ab0cbcd81e
SSDEEP 96:EEvd8l3eCJ3ddD0U5bFLb937RfOOOVPWI8Pmg1:EEvd8U03ddDdbvHOOOVPWI8Pm8
TLSH
T14925C95D6650543BCE54A8708068FF4A58267DFE3A92CF3774D97E03BA827C610E383A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_32.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db
Size 1024KB
SHA256 4b9d98b146fb4f30b58ac70172c92f005ea435fd31dab85eea187693849adbf9
MD5 55f2acf51409c0f82db5e2d7f35f73fb
SHA1 0e61d1e5dd0bdb7766e140d382866d0c7cbd203d
SHA512 6ce04fcc902a9202a4115a1dbecb6250aba5d5571be0918b2d9c147a8b53c318acadc9bec36ba5c7c943759fdffd69611c9e7e9e4626277dc8e6b3e494a4746b
SSDEEP 384:QLokcdNd4ImKgmqhxJz8m3O1CCCCCCCwaFSDrQTWGNNU:QvcZ+zhjzBO1CCCCCCCwaFsQTWiU
TLSH
T11D25A34B4A46C13BE470677090AF9BB291A21DBE766BDD7278E83C43B6B3381C113526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_48.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
Size 1024KB
SHA256 994506f76ad4f86c142e1fbf7661c82de4b5003888c61381520f235b0d60397d
MD5 b28fafa83381a330a0ad532eab0643f7
SHA1 9767147c83425558b360d70cda65d181a541bc4c
SHA512 46b52eb79fecaa5b5c15072c60d502478e43b711304c8ef04b6fcf47bf29d73e5cdb0ead4e5f366c6ef1ba6e08ee4f8f075ff9b85468a8fb65c796d2c21b852b
SSDEEP 192:eLgVU1Bud//K1uwuyYaIlmaLwvLvfWoYkG4rFyD4:Agm1Bud//KeQvTfWorx
TLSH
T175258B2677F22E78F9DCD9BA7B82D1761A137C7206C2011622DE775705608F86AF162C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_48.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
Size 1024KB
SHA256 880e17b29a1f673a46c20973c9eba2ed21c54bda760e91107aa0d884381d0982
MD5 fe9fe7df959bbdaa7f855233d701bd37
SHA1 fbbfb06ea1df23c1dbaddbdcc1aa93834412a60a
SHA512 e3553e9a9c3cceb45ef7817f55b35c4044b5fa92a10f11df522d52c60cdc93d962d921d101fda69ae75ab071de06ce8c512d1a7144cef2748b8c7833bfa564e0
SSDEEP 3072:1sMfpsugEA3FBg+nKVY37wOlJWMYwSUoYsUYYUYUYUYQxIro:1QAAc
TLSH
T151250D59F779DC39F5CCE47A61828130550BEDA4A1E5857A308CB812E3B3AD116FAC2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 7KB
SHA256 f5c43da8e03ce1cf52b390e3b367cc32265583b05d598176bce177abdf8c2d74
MD5 9011fee729dec7a41107d4f454112552
SHA1 73f865540b275e380b802361923e75acfa8b3868
SHA512 7f1d1d813ba85f79258f93c1231d460306343c790ca43bb3b0cc272f8d451dbaa935c664c8e46985a8db2a58285e908dbf1697061460c2f31a38169df17661b6
SSDEEP 3:tnVlIlFnl9UXOHRZSRd//sssMURJ/AaRd//IFh8RC/Ld//:DmsOxZ0dXsV5JxdX4cC/LdX
TLSH
T1C0E1480370A1CE01DC0C0D34AE9CC0EC6A4A3F058D14060B30C0F72F0BF61C02461004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 7KB
SHA256 1e371ef37e7d6a75a510309fa9e669f09348546252ed59e5bbdecf89c054ae87
MD5 b5bed2b12a9e184e3fa415baf788eca9
SHA1 f0466be091e6b870047da414153e4775205e5e94
SHA512 93f99da5ae6a2589ce0500e8b6bf6492f882917dc4ddd027f76779600e76ec36b578ff8df9477ebcc8ebd909e9f3932ef5fa20932ce5b714f9bf25f36afeafca
SSDEEP 12:IT+zZJGSiNbmTycatdi//O00g40QDKxD3Bqt4aZcAM3vjMF0un+PbanXl3itnVDi:cSC1bjjmO0HXQDKxjBsYAofbIXlC4u
TLSH
T14AE15222B454C922CC082D32AFEED5ED8A227E48CD1813473988B35E6AFB0C01C16840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

03 - Computer Management.lnk

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk
Size 21KB
SHA256 0d0d9f69031f463798210d6e6a4c4840e4045191d10e3f0f83f849fd7abce6e3
MD5 3953b74e12d533f722b51ced1a818b5b
SHA1 2a85d15228354887feaa2785811fe1801bee4ec0
SHA512 d4f40cab0768e44360d878f301c14745016be1938e54aeedcf1b76b2e56b4c321fafe1f68325cee9fb9ada773b98f706b62b36598f15f8048b4458e665b2866d
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEEzovCAvESZVHkEH6jlHkFUKj4/MasF:J++OJ38hJU09uvCiPH8hKj4EasKXV3E
TLSH
T15DA2F948FE8D0488CF7915722F602A032E4B6250F76E4E915975442A235EA346B73BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content-track-digest256.sbstore

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\safebrowsing\content-track-digest256.sbstore
Size 20KB
SHA256 5513970c5dd7dbf29bd898c5c1389d9570807e7d09e0b66567cca942f52eddcf
MD5 abd42e950f57d1524cb7832a93298d61
SHA1 8ee02189f30bfe24cafc4fcf398daebc10982a46
SHA512 06ed08837b670b062f672c6ed52b6e787bdd8a179826281726edcc5ba4ecab0e40e16e980cadd82d8c698971aaf810afadde8b0fa3fd879a2e29645d19972265
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiELv3VpmqZcMv8WBvJut10kuU:J++OJ38hJU09gDvUOk9
TLSH
T199928686FF4906C0C72707F126455D03FD4FB6449B1D0A9225A9050E3254E3C58E36D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

social-tracking-protection-linkedin-digest256.sbstore

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\safebrowsing\social-tracking-protection-linkedin-digest256.sbstore
Size 20KB
SHA256 f2e5287370ee7d6fae036e60695e34ae09186665c11926a7d7e6725221abb715
MD5 474a3d9b6ed38a74f8e569ad1749c484
SHA1 1452fb2d72cefa0a6aad4811d4150c3471b5de65
SHA512 767e4201d99b597a6bf0898bfd0e9d0af3e703af3c19d2b8c18c5de24ba5cc7898210671361c7be9db1de14e22828f84eaae7db0e0a80e2b7839aea4015ea802
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEXXX+V+3:J++OJ38hJU09AR3
TLSH
T12892469A7F8D48D4C53702F22B504D03BE0BA254562D099376A64D0A3315B3DB6B25DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

social-tracking-protection-linkedin-digest256.vlpset

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\safebrowsing\social-tracking-protection-linkedin-digest256.vlpset
Size 20KB
SHA256 dc90062c08382b1d9d3e17728865e9a0f763ff241543f275af7ba7d808fce948
MD5 3088284fccecde505455406a0a1a9787
SHA1 014caf710b5355baacf4d4a2c674d6ec0363515e
SHA512 99f32180fc7c60b0e045beabf543ec7f0ffc5b04c1983475c71d9691fa13a10cde05f7b61af76bdadacae368876dbc4d1a70b6c808cf5b18f4a07acdda972905
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEQWzpaF2jL+:J++OJ38hJU09NWU
TLSH
T1309265867E5E15E0C67B17F237205F03ED07A754D62C491229694C093315F3C99E3ADC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
Size 3KB
SHA256 d7c4b754b563f164b8864d8898e145281d74c96a7960b5f782bf5a18a806adaa
MD5 ed992508087d5dafa3285ca14421adb5
SHA1 e3626137fe72fd88fb188e3be304fd3f17772ebf
SHA512 0f96a032ce9b88927dec6097b125fa12bc50d48d0ae5f6afcb2415a7099ed3f9891157e821a610ee43092ebde598052e9a12bc447da593c3ba2930b85d37480e
TLSH
T11F71F35077F40708F3F75F786AF62665983EBC168C01D29D1112928E496AEA5CE70F3B
MD5 SHA1 SHA512 TLSH

Submit Download

StartUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
Size 4KB
SHA256 5b9c663730812883904cf866009cd1727143dc8f50954053256bc157fb254d38
MD5 c0316e3f2a5c79b1641611a3967f5119
SHA1 44cff65c87c83674e842597ed28fd7161f2afe85
SHA512 9bab20e56786823f4873af8006bfaadb4d18a1c181061c0128a46e00c57a82279d524d38e61bfb0c3034b48e12d560ca6d15bbeaaae164305c334b6ddffd8bf0
SSDEEP 96:JhTsz0dBdnpdyDdX1dFddYLZ4OnZR/R4QRJ6r/RQcRGc07LLxP3cj+7HXr6kzWtd:TRuJNIKY6ra31x76vBpj
TLSH
T16591C41067F40708F2F39F785AF52566993ABC1A8D41D2DC1216924F4966FA1CE70F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftwindows.client[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\63HF7DQH\microsoftwindows.client[1].xml
Size 20KB
SHA256 a34da6740b81ad33929bfaa92830d6885b63b361605bc906f7a601f5273bdf30
MD5 51fc12e05ef2d71b0a5fdac544add3bd
SHA1 82f67e9c0dc1b573acef6643badc49e17678f783
SHA512 d7d55f3ce6563c25976a992c5e2f2bccfc4ce280dd5b41e1c04e99700c3cccc70c6d143f169a4401352c13a2cc13e3ffb0d0e18968b24fc236f92ecc22409821
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEh1Cf:J++OJ38hJU09+I
TLSH
T1479210597E8D08E4C67712F26B545D03FD07A768922C1D5279A9480A3324F3CA6F36EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoftwindows.client[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\63HF7DQH\microsoftwindows.client[1].xml
Size 96B
SHA256 0324f4717eadc9230cd08380ec170c9c2b6acc90e0bbbe30f33407a6ab884a31
MD5 27101da595e8bd4d08572161eb17bc05
SHA1 3bcd198199e9af234ff6c86bd19a1eaeb14b267b
SHA512 8b975f3e7bea5678e751cfd58360f64f3ea9fc842f3a8dabef33aaa550444ecced7fd9ea0928ce259439008b62b6503ccee2f3ebd223b2f2350d3c9e3628582b
TLSH
T153B012313548CC1D574446F53E09A0E031FD008653057CB434E4BD12B996E0AC017CF1
MD5 SHA1 SHA512 TLSH

Submit Download

SearchUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchUnifiedTileModelCache.dat
Size 4KB
SHA256 4f1757cb29c9cfc56a04d20e88a6d872f76c4b8b0963312250bcbcf451440b3f
MD5 fbe2fdb72bcfe438add94a9165be8144
SHA1 81b4db4ab6bc69d332ab4c2b8a9b46f4ebefe2e8
SHA512 3995978bd11157b31a9295e070a7a291cc151cac6dec36e5d5cd4bd672013684fef8b685899b1da9b6bc2859f6ce25ad301403a710defac6ce9d54d40d2628fe
SSDEEP 96:Bgz0dBdnpdyDdX1dFddYLFOnZR/R4QRJ6r/RQcRGc0cLLxPfcj+7HXr6kzWt7HJj:DuJNIRY6ra3GZ76vBpj
TLSH
T1D191C41067F40308F2F39F785AF52566A93ABC1A8D41D2DC1216924F0966E61CE70F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchUnifiedTileModelCache.dat
Size 3KB
SHA256 4f84d90ad82b684967ddd44b5a7d959ab42fc6704a3d664ba9ff57367a0ab93b
MD5 5bfaed9699bd3ea7b308979159cba9ec
SHA1 161fcf4005d40fc02a84c4ea526c5be46dab4750
SHA512 29f4415991ba9f5dfd1bf89c5e563d74a0b8a3bf50f20922960bc8f06c30226f806d3f4141b30364c8f47bbe7bc00bcd4d111dbaa5bd3c6298548c55302d15aa
TLSH
T12E81C41067F40308F2F75F785AF52666993ABC1A8D41D2DC1216928F0966EA1CE70F3B
MD5 SHA1 SHA512 TLSH

Submit Download

SettingsCache.txt

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SettingsCache.txt
Size 575KB
SHA256 bfef4a905afe500c0f805c24896ad9cfaa3b6258a39497c7d00ce8a6d3f7d19c
MD5 7d543014eae03b98584da85a58012f3c
SHA1 d0c6f45bd5e90075e685768bee7f0ef4169d84d4
SHA512 812416fc982b3cd59e6bcbd6ae2cb6d76cabd00548ff6581feafef0674e023d7d343b7c6b8c36df7b2b1414f770daf40a89d4d55c8a6c622194794d6773770f0
SSDEEP 6144:u9DZCDt+hOv1vUNFPWZgtQuqlG1tDN4xksq2maX+q2Rtg:uXZNF7QuqlG1tDNze
TLSH
T12AC4C53D3349DAED8A592E72F64DC3016AB803860095ED76B6D9D444E2AF1CC53F326B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini
Size 20KB
SHA256 b13522d10b06f6cf8023033df8eb1735bf49b2fd661b8bc4ffdab97ab189cac9
MD5 56208c6da180af474ff83419ccf39a15
SHA1 e4a1ccf1cb75432a91d5e582b3790676eb832d87
SHA512 e296b0718e1980cdc1ba5e64a1d75deaf340568cf803c1d314e3e84bc9211c640a6a3f40924453daa1dea5569df332bca6bf566129593eb69dd190dab6d6b1de
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEjywhTwB:J++OJ38hJU09YygTwB
TLSH
T11792654ABF4D0894CA7712F237545D03FE47A254572D096325B9480A3354F3C56627DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bluetooth File Transfer.LNK

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Bluetooth File Transfer.LNK
Size 21KB
SHA256 3104645e2fb830168d77903078a5ebaecca860d21331f66d5daf1dd4d4d1a9b8
MD5 886685349c977242d391f9ab721f557b
SHA1 5578351b7ec2915e4c8407c95e5ceb9c4400deae
SHA512 33b70025fff9f9ed70ebd2c81b6c29c8ce310d2359b61a79f33a2ec59fc13739dce0242a6a29a03dd76c8c222df5e618f142cf5356ab21287605214b70a1babf
SSDEEP 48:J++OJ38hJU09gmW6DuRYGa3aDpCD7/MTyg7G8/cy2W:7q38nUChWfCDjgSzW
TLSH
T1A6A2E68A7E058A50CFA712B2E2B49D03DF47834455684981A33D680C3A60D3CB5F3EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Desktop.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini
Size 20KB
SHA256 663ace7d173c1a75917d88520911b63a9b18a903f513faec6a7c864e5d672c10
MD5 956461a5b80f6887c73ee03a8f4d5659
SHA1 fc147061a6251fd922686ab551555396b316552c
SHA512 83095d3938460e50aaecbc1087e65522ae92ce264042998f5697a0fd819860a7376872a8fea102b41ea24728a1dc64a0211079527543ccdc09877db80bd6739f
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiESRXlS0J67VQmw4yTXYlT+FRfrk:J++OJ38hJU09B7S02VQ/TXYl2Jrk
TLSH
T10192B9597E8819F5C97715F51BA04E039D07A754D39C0DA3D61A8C073324F3CA5618EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LiveCaptions.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\LiveCaptions.lnk
Size 21KB
SHA256 af9e5da393d692d22f2528441e31a098e2d1381fc2d92fd08a02d17c01e4f1fe
MD5 2e8c429d9e20dc4e5dc81305ad85e342
SHA1 bb5a695e3f934f7dacd8d9b491b68663cdece0ae
SHA512 5f3b547cd65f395922aba589b5e4ab0e9e09d3384594c94c760606e6486bca0e255e36ce741b4977e3acb6ef7a88eb8b98f1f0a2d326fad54589544f56fab5df
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiETWva9ILCFQpAxU0OC1rE8rO0Needja:J++OJ38hJU09p83WpAxzOCy2fbnpOV
TLSH
T1BCA2E68DBDCF59C1C57501B373F85A22ED0BD354AB2C4A10B15859393320F788AA7ACD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Magnify.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk
Size 21KB
SHA256 5c3146a20f1063116986b126de630dc4508e9a0e6fe9ff07c5f710166ca71eda
MD5 a9681023c0bbd07bdc40f2e59c78644e
SHA1 19f6e94a5a0e6be04b5022709d122b5126279242
SHA512 1f7c2583d5b0badd897fab29cccb0f35fdad6144ea3c0c88067235f8a9d39250775ef251c17ad389ff149c20955b5c3cc0826e7f65d0104bc20fa2b4b28c792e
SSDEEP 48:J++OJ38hJU09p3j7cQR4ZqjcCn2US7VsvNggB:7q38nUCpfcaJj52Zk5B
TLSH
T115A20A497E4E06C9CAAA55F263945D13AD467380477E0E3015688C0D7240F39A8B1ECC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Narrator.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk
Size 21KB
SHA256 15c599b28bb1d1eaa99ee006a5edcdfe348238620fc992aa5a6912d81aadeb4a
MD5 d5e79514b8ffca53c2344b4b6b689e86
SHA1 1ee44b7f5b6f32d9b503c1add6a1e1ee4860b732
SHA512 ac192a81407f7a3ee26de638422a84e733ae0f49a035bf3fa6aa4d0ebad5f1fb37cf640d3e2c61679545c26bf3393637fe1351ae98a1dc566f0e7689513b33c5
SSDEEP 48:J++OJ38hJU09p83UCHa4DKliwr0nlMlCGw8:7q38nUCpzC64DKli00nlsA8
TLSH
T1D7A2E8547D0E49A0EE7602F267E46D03FE4BB628C62D0911759F4A0C3354A39D926EDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

On-Screen Keyboard.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk
Size 21KB
SHA256 4f8b317cd5018cd7ae3e66cd2dc6401dca30b377962eed7ff894c6dfa709904c
MD5 cee857f05a48ebf52dbcb854eb9fbc28
SHA1 4640e6597b0d3abd86afa2f87810bd6ac25addf9
SHA512 d87a565baa397770a7073a6025786494e4fec72934d0e2719636af4e4627a8d6edc882fda4dcb45178572cf3f4bc4e0ce4e7b77d0aa5e6f2ff262a9ab07230b3
SSDEEP 48:J++OJ38hJU09pbQFSXnThGQSVuGKk566l7/cwc:7q38nUCpbQF+oV7Kk56yjrc
TLSH
T14EA20A817D5904E1DB7B05F237F11E039E0BF764D72C0A72550A581E3526F3949E1AC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VoiceAccess.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\VoiceAccess.lnk
Size 21KB
SHA256 691a13dd99fe62b5025590dfad570555e4d457f6cb25f7e579605aa536f0d42f
MD5 325f2b21a6155e69af1b248272aea340
SHA1 bf3b54632d30ffd0e3aa6b9459ccd8f521e83aca
SHA512 d04033804f9dda8e337f96f1c039813b45ac31ba76fb49c5d85be8cde44725c6cd557eae8f90611b6c55d80a2e6b64e873b153e69d640762b92b57a14fceb783
SSDEEP 48:J++OJ38hJU09p83+NjNWVgWbs2pFoDB/ay3knt48Bp:7q38nUCpvNFks2po/ay3knzp
TLSH
T1A5A2E68D7D1D0287CEB621F066548A02FA978120590D0A93B662982E7310B3D5DA2DFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini
Size 20KB
SHA256 5cc96c416c161f5f5cc8f8cbb62fa31ebf16eda5e58fb8c708bdd86d5e6a4aad
MD5 13ec47479a48bcccc5e9bd6b5ae2e95e
SHA1 8b8b3b25995432c2bb82180baaba97e84174f03d
SHA512 49d2751e0e07f7b5faaec73eaf99858b91716e1b3d7c24be024be0d11663e0c0ee64d8a8114ad47e5073cb5fa70792eae7c8c668d289e7190ca0a22ece420715
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEDdQZ4KMyGXh+zZtqGXBmI8uu4zmy4j:J++OJ38hJU09Y0MxR+zZtsIVmyJ/bK
TLSH
T17EA2E8ECFE4B2992C76B037137D49D03DE0FA115226E1D577A99880E239193C85B9EEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Administrative Tools.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools.lnk
Size 21KB
SHA256 7dff860cded00f3be890586684fad7b6b3d4ee3d7f672e71eb18edf264cbc8ba
MD5 c0baceb9a3f1db2fda091cd0fb04bf18
SHA1 04567a315c7c07de6049423998163fed705e396a
SHA512 f23d362873d2065fca5bb84d84001a03efb399300772fe4c23407ce22d3d99bffc9b6e66630f22a2217136e4c29c1d3eba8a6cd5469a122be6f208106147a047
SSDEEP 48:J++OJ38hJU09ZRKogxZx6Ajx7IQmkULsP/y9EQFB:7q38nUCXKoMxpjyMqtz
TLSH
T1ADA2E9C8FA5A269ED5A542F63B9131037C03946417294952A9DECC373E41B39CE92AEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini
Size 20KB
SHA256 16a84bbb4f4fc638e6d7c62bd51299c3d54d3a51ded9b513adc38d0b47a44bc1
MD5 4a56d845414acd0513f9ec12408340af
SHA1 ca77a8c99fda05386e93c514b5a7a6eae5a56f97
SHA512 8df84ebb6cceb231e281ab5ae52e1685a10cf64d6736f2a81bbf935f1ff75d29b3b2666e406b146d539cd5e2bcdec35aaa68992e6a1c180a068b4d2687d876e0
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEQIL7fI7n5aJM:J++OJ38hJU09NcfIbgM
TLSH
T1CC92A588BE4D49E1C67312F137588C03ED07E2049B3D09527779581D3320B3C96B2ADC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

File Explorer.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\File Explorer.lnk
Size 20KB
SHA256 86dbc773ef8d7a4504cbb38d083a70d48d8bcff1d2bd65070f0ba3d83f3245ce
MD5 46dc4e1d3d9560e79edebbd83102b2e8
SHA1 b6fa919bd439e170676287e15f6c4ceaeae298f8
SHA512 884862df3a828165ac0353faa00e4711c170f71da60a186a1ccedc4268b6f4bd6f76ac1030b677392552fc8b7527fb32ff36a89277500bf27596a5e3375de7c9
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEpAJZeEqgoLQocIRXFemsURDn:J++OJ38hJU09He7socIRXFemsqDn
TLSH
T1A1928746BE4A04D4C6772BF227A08D03FE079750973F155267260D1A33B4A3D16A36DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDrive.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
Size 22KB
SHA256 a377e315aea84dd0592f6b49d7c11622639900eda15e8bb903318f34766b2800
MD5 587a6cdc63c8bbc9558726c24a1ec122
SHA1 1df53c3e984744eea2f40089d0fae039d7381e18
SHA512 5e2036da24cfe7442dcf5cb89f8690be90565f4731ec71f6e8b7ad7fc8c933b6ab24731f24cf8c1d3318ba5802fb0805e4b7040801254840103c1fe4aea54c32
SSDEEP 96:7q38nUC9fcNRcHIoD/0RLexxz53Jcp/DL:7qEUacNRsBsRLexb3JctL
TLSH
T117A21B4EFA642552D63226F137641A13ED2673287A2F4786E1BC8D192B10C3D86DB9FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Command Prompt.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk
Size 21KB
SHA256 cc3fee55a869dc1f7440f9716dd3b6a5b163edb1893e950f7b6ae82a67c949c9
MD5 095ddad9f0f895f03be22360a5731576
SHA1 1b530c4a14302e027d2badee074602899aef873d
SHA512 672981f13fc1e09b9eb8c90e269036e505297e14fe3cf83571dc54474307aabb949f9f1a227363f6f00a5f46a6db9188fa46564076d7a945f0a3181ae2e6aedb
SSDEEP 48:J++OJ38hJU09UbsM/FNOId+0gMn8NivCAsjU088AfAtUye:7q38nUC4U2xsjn81Xye
TLSH
T12EA20AD47BC85BD8C933167057604903AF65AA2407390D813B5A4E1E374877EBAA24CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Control Panel.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk
Size 20KB
SHA256 2e8ffcc34d242cdbfec5e71ddfc990afb22f4c8946f18390b9af6df09c0e8217
MD5 c45ed2fce15013e1752419f4c3743040
SHA1 8b0a757a7b89158acc89eb054095598e36336a87
SHA512 d66e8420e6e0b4009fa6f38b2ff6e1cc9e9431508b69bd564c5ca5609cb25d0a497f292de36d6627983b1b4d37b5b208530bdf387be7fe5508455a16c41a502e
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEpAJMowhCmhQ4G04pl9/SPZ1:J++OJ38hJU09xwhJhx41Sj
TLSH
T1CB92879AFE8E5480D67712B22B541903ED07E214932C0A52AA6C091E3339F3C66629DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Run.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk
Size 20KB
SHA256 60ee0b4ca5611ad958c403d3017b5f785cf48e485bdfc54577963383e0034ef4
MD5 4cc6dd98a26199987f8f44b4f0c15bfe
SHA1 58740459f38068b3913f1f47572deecd1fc13105
SHA512 52c73f8f07610de71ae1c9ad9efdadd281accf9df2d749d44f8e9f7ece1a89c3a01e7a6921d73ee89e6ea4857cd54e7f6dc4f2053ed14f1880d9c66654b17e8e
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEpAJD7hk8jSuHW0f:J++OJ38hJU09BG8jLV
TLSH
T11692684A7E4E15C0C5772AF127501D03ED03BB14561C0D52257A481A7324B3D66E25EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini
Size 20KB
SHA256 8b1ff382a0e382f29512325cebaccea4c1d7602e25dd5824000b2c29e8bf8370
MD5 2eead51c09a9bc2c9867063ecd4d9a3c
SHA1 3840a759dbe4ad55450d42e9d620684190e56cde
SHA512 52a754dca13dc554d4aa54f296eda98ce1df906702b96ec341d8befeb5d8b09f30f7c2a93b11d2a36a3949a4d57803a73c22f877c96507fbf22391884a90aa7f
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEIdQZ4KMyea15rks+FM13Ezj05p:J++OJ38hJU0930MY15As6wT5p
TLSH
T1F09286C97F4B1994CB770BB052982D03EE0BEB5892191D53392F480E3721B3CAA62DDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows PowerShell (x86).lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk
Size 22KB
SHA256 2cdc8c8f821e468790c8ec0a8a01406efde076333a3dd7d9139f6b388253a177
MD5 964b59808369d86c6732e3091a78bb2b
SHA1 a40e4b81b9a110af3fee56f183b91945395c2887
SHA512 2a5ee85160a0d448c1a1375779f924465d8ede013c89237a332bbeb0d3a4dedfef41eed311c16e8af74dbf19645384674cef38c43042cb17f7142352a1a45f42
SSDEEP 96:7q38nUChP+FaLXpX7QiIwhd3NdAmQPIkX2Lpss:7qEUq+F8V7QiB3nD+Iy2LWs
TLSH
T177A28E7BB8181D52C67B14727CFA4D232CC65248062C8D1726286E1A5B20E3C5AFBBDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini
Size 20KB
SHA256 c7ac4848578b63e77bcba0c0159124adc99cf7e81e6e01b94a5f5f7888a8706b
MD5 f0ec9feff48a6d3365d760cd5d7e25ea
SHA1 2b188252ead2f2b6ba3107f9f9ce5519429b1708
SHA512 a4e1ef63419f1b0908599578d09b95a819fdee7c609da966d95f3e68afd0278f7583a00d0d6a1d99d1f096a3796449725055d720160d1b1f979f794c3e3a8f62
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEucAmdw/05eiFgoKlJi:J++OJ38hJU096AV05ei2oqJi
TLSH
T17092A546BE8D2882C7B716F13724CA13ED17E258DB1C0C1229694A1E3656B385AA7ADC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Size 20KB
SHA256 7d8a658e28ac801e47e4075e08349e63593b8409fc82b1290e02a0b302725384
MD5 257a9f28c72044e7dc3ea9b07b613bba
SHA1 55c3f3741e5f40f35af09f77b257af01a4841f8e
SHA512 a31656936702051ac40196ca639e161a5c1285f2639631ce7075e85e65830cd77038c410f602a9769beeabe364313e6c3d2deb0fd80bdc51db92ada5c84ba553
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEQIL7fI7n5aJx1:J++OJ38hJU09NcfIbgT
TLSH
T17C92A589BE4D09E1C67702F127549C03ED03E6109A3E09527739581E3324B3C96A2ADC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\sessionCheckpoints.json
Size 20KB
SHA256 096df9cbcc37741e272ee9dadbc1f4a139bc04af72d4b00bfa57bf5a427785a8
MD5 1e21104f5e53c09ee4af926ec73e7ffe
SHA1 bd6b5b575026e4ed6ca99d0dc51047ee086061e1
SHA512 730512eb7ba19822a0d829d9965b08533f4213c8dbf0ce808eece2351f5e9c83e3a45db0df877d736664c771ad400c00a24e9ccce1256d877b758a391862e9c4
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEVsIxSn:J++OJ38hJU09+Bx2
TLSH
T181921089BE8E0984CAB703F137605E03FE03E218A62C09527569481A3224F3C96A2ADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\sessionstore.jsonlz4
Size 20KB
SHA256 9a44969009fb1e55aa1f32e4b6dfc5c77d7939c21bb2adc2b2fdfe45343aa6f5
MD5 3ee1218bc676a9edb58dc5920ffa20fb
SHA1 6971e4d95b903fc81e47e33c610e7bd95da2ced4
SHA512 e9fa4b40ca5868e86fed6404e7fc8d55af2c72d72456b99daf6c14b330db15afe0842836aef32146984479cb0f6458db7313804cf918678c895d76ca9a5e26b5
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEmMDDpw/uLKOWXJvk6XINnmVFBVu83j:J++OJ38hJU09PMHpwPDknmRd3Zkm
TLSH
T1E8A2E69DBE8A9840CA7B22F3B7141C035D43DB50B92E1D8264BE461F523DE384292DEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Desktop\desktop.ini
Size 20KB
SHA256 cd99fc8dcc5b20bbe30c8b99d586660c48f137a028314a2264e899814d6107a2
MD5 484828489c21690b2206d8c8032c6dae
SHA1 ee614977b45142eb17a3b32bebf7e386037aeafe
SHA512 d48be9eb0b3305460e260a151dfb222a2fbf62e755610084ef5e01a263ffdb10eef39380bbb1ffeddd17392b800215f8bd22d19ed4ec21e3d61825b494aa22fb
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEbL7fI7n5aJka8:J++OJ38hJU09efIbgV8
TLSH
T134929689BE4D04E1CA7716B137588D03FD03E304AA3D58667629581D3254B3C95E25CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Documents\desktop.ini
Size 20KB
SHA256 aaae94a9cda50123863b95b5e1d5f0455bac5c41500015515c92aa3a7961ef6d
MD5 91452f8c491800af71aed87cf86aa46d
SHA1 26c40553078b29d8b077dd12b2f861a05dfbca13
SHA512 c1808b0cd16ae100fc6a89d4a6ea93bd54bc76d4b3745468cf14b247073b7b875202ec7815b07af05e5aa7e1fc6d257dae1d1e0bd7cb13a45b3dba39d7d2e435
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEpmL7fI7n5aJcCqrGmQ0YK:J++OJ38hJU095fIbgLo3pz
TLSH
T19492954C7E9E58E0CAB613F11B589D03DD037110962D1551A63998493214F3CB3A2DD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Downloads\desktop.ini
Size 20KB
SHA256 0e0b96076ec414798050cc96844c035eebe3ef7ca4f95ad01285e8bf3ae29a1f
MD5 923f4b5f583d38abb575987edf614ecf
SHA1 f805418156d58d96450b9014fbfe3db4b55c88cf
SHA512 3d39a861d672c119129b39b345c9be68ef165c129e4bd073a8679683276f224a4e92c852a1273381943671c57f75ebcaa39595df70dcaf42fb777e163b8b0553
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEbL7fI7n5aJRWoZn6:J++OJ38hJU09efIbgRWoN6
TLSH
T1B2929688BD4C69E5CA7213B127995C03FD03A640963D1462777D18193764B3C92E39DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Downloads.lnk

Path C:\Users\Admin\Links\Downloads.lnk
Size 20KB
SHA256 7d030f32a30b08e5d522aee211b495073ac3dd829bd07a64c929ab2ba3aba2e1
MD5 b7f759b599332a40ae37d335ecca927d
SHA1 1bf7c98530cca96ea4a66d0f722f341526d8581e
SHA512 8e279dc1b381aa9ff502ac309420150b92dc71461d368bc5643de43a0328ee3be08a7455f15d02d93c8bc2bb219df423eb0f7fdfe1a8a8e4c8f87d8e5d3f9008
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEYOBhQ36+Y3YtZho/ek1tPC7CO97cK0:J++OJ38hJU098BwwrP1QH97cKn/lO
TLSH
T10AA20B88BF4E15F1D17312FA37904A037E0FB128471E0C62772CA9093754E395676ADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Music\desktop.ini
Size 20KB
SHA256 7410c61e921513915443ad426cb6ea1dd8b487ecac0ba7d060d8b2deb3a37b69
MD5 2d63b2b7c150fe809435406058f2f8eb
SHA1 b79d09e067fde1359a0a1c043e88bc3495a3c52f
SHA512 92fc56e2ba903346b316b7bb040bfefd65fbb7679b27b0f5a8015dce9f25420e9d27483d3c9ca3a231e0ceabf20ab1a4d5c03c78f44a946d105aaa09a1b4b3ee
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiERL7fI7n5aJ3nre5/EYNkxf4GvYkIS:J++OJ38hJU09QfIbgXre5/Ekkt4Kz
TLSH
T17D920B447D0E15E0CA7723F52388CD03AE03E610971D05953A2C540EB361B3D69F35DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Pictures\desktop.ini
Size 20KB
SHA256 1dc1b8d417210cb4a5cb29c036b9b52eae7db3b5f2fe4c4bffa3cdf334baf344
MD5 d261d700aa75d1686f7fcbccc9efaa99
SHA1 d8cba8b8a4591ef6c39331fa00cd968d78d5d38c
SHA512 fa9df0ea526dec654f359ac7f437ffb4fea6835be9bbf28de4449ad5e8fc1e330fea6f459f91b103dbc57f5972a9172774b214f0088793967a83b0661384ae12
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiERL7fI7n5aJT6tfYSj6:J++OJ38hJU09QfIbgTuYSW
TLSH
T10592D6C5FD0D14A1C53317F123A4EC03FE1FD540EA2C1222B764180A7368E389592AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\desktop.ini
Size 20KB
SHA256 1e2a702203bb8662deaed113076305816f18b19108762f38d442f26543f76534
MD5 56cdc0c6da42b70b67a9597e052af260
SHA1 99c8c004a8f2f2b35b01feba4b604a4e04d57853
SHA512 a97c4a21c670b91c32da4bdacee1948bb9fcc050a5b6a2438989f0c481825c38883cf8b7fca55e0e24c8c3a653315c01498de80218f794224744a734beeca9db
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiERL7fI7n5aJ1GYCy86lPPxktB9ncu8u:J++OJ38hJU09QfIbgrV86lPuBczu
TLSH
T1D892B889BE8A18D2D57B02F12758C903DD03E550CA3D15527669280D7224B3D96A29DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Shows Desktop.lnk

Path C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
Size 20KB
SHA256 05a01d0b1782d056391d4a51817dec1403f680f9dcd70de6890b69e5828d95bc
MD5 eb9b469a9ec66448fd58cab1a63c5b01
SHA1 86c1f48ded147ece07f966562140d8597b17c1a4
SHA512 47673026ee9d88ab750576650d1dcd966046875c363c01cbd63e5f66e4b1768afab93333a6b7db7f9a7c20fe912218d0909f767d802413597a4c7a4901a39bad
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiECJy0fRq5DEjfOw:J++OJ38hJU09JZqsT
TLSH
T181925445FF8D0AD5C67712F26B744902BD0B7754922E09A23558040B3315F386AF3EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows PowerShell.lnk

Path C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk
Size 22KB
SHA256 13da0e66128d458882dcaabd8f9cd778441db9689ea70c77c3eababeefcf4aba
MD5 3f7d55d3d4e797f740f1b214708356f3
SHA1 3f2c2e39b95ecd268b8f7afad050bca8e9d39044
SHA512 3a570731be55b5a4f0c35e8d3ff28824c446db8fe61a67656729f7c99bd61a0f3ce6e7be4a7ce491adfe5712629a3c0370bd80ede9bda7fcfc4900925a690795
SSDEEP 96:7q38nUChP+FaLRXBjrGqnPjwIK/kGJPiAAylLf:7qEUq+FYrGqnrwBJDPlD
TLSH
T1DBA22A6ABE8506E1E66117F235BC8B03AF229961A71E05516136502E2720F396932BEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\desktop.ini
Size 20KB
SHA256 9dcd993295299980fe50531217d5dfa312c6ebbdacb0c3391670ebd5beb5504d
MD5 96d106d544b53ac3f0daa949587b0ca9
SHA1 9ee5449cbdd57b7d901bf636bbcc9ad5567b83cf
SHA512 442b31a92aa8c8dc7710f903db79f0aaf8fbac69613d91857a95fce8724e5110faf65b7efdc84d9a7665a271f3d0354cc19d7c33836b2060d3db9ab40d8e5a8a
SSDEEP 24:J++x0u3FGL/kQZXMh6a9jvgRJQV0CApDiEQIL7fI7n5aJdg:J++OJ38hJU09NcfIbgdg
TLSH
T10492A588BE4D19E1C67302F127548D03ED03E2009A3D09527729581D3320B3C96A2ADC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1056-2940-0x000000000E680000-0x000000000EEFB000-memory.dmp

Download

memory/1056-2942-0x0000000009EB0000-0x000000000A5D5000-memory.dmp

Download

memory/3856-2717-0x0000025C801C0000-0x0000025C802C0000-memory.dmp

Download

memory/3856-2747-0x0000025C81C40000-0x0000025C81C60000-memory.dmp

Download

memory/3856-2718-0x0000025C801C0000-0x0000025C802C0000-memory.dmp

Download

memory/3856-2767-0x0000025C94320000-0x0000025C94340000-memory.dmp

Download

memory/3856-2730-0x0000025C81E00000-0x0000025C81F00000-memory.dmp

Download

memory/3856-2729-0x0000025C81A00000-0x0000025C81A20000-memory.dmp

Download

memory/3856-2719-0x0000025C801C0000-0x0000025C802C0000-memory.dmp

Download