Analysis

  • max time kernel
    124s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    15/08/2026, 01:02

General

  • Target
    2026-08-15_eea533fc9012062032b0d3a738d0888f_darkgate_elex_gcleaner_trigona.exe
  • Size 342KB
  • Sample260815-bdvaasda86
  • SHA256 022b195d505dc439f0b951d22123d273657f2be2db380f4461bbb85b86821cac
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10

Malware Config

Signatures

  • Detects command variations typically used by ransomware 10 IoCs
  • Drops desktop.ini file(s) 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-15_eea533fc9012062032b0d3a738d0888f_darkgate_elex_gcleaner_trigona.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-15_eea533fc9012062032b0d3a738d0888f_darkgate_elex_gcleaner_trigona.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1912

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        30tbk981dgwfr076g134na570bb4qq94ofi1blp.k74i9hj88r._r35mIR

        • Path C:\$Recycle.Bin\S-1-5-21-1074038928-2032447174-945360078-1000\30tbk981dgwfr076g134na570bb4qq94ofi1blp.k74i9hj88r._r35mIR
        • Size 2KB
        • SHA256 a54972ef956875f503d9e38fab582a411ef79e21c19d59a0197991e30394d3e0
        • MD5 SHA1 SHA512 TLSH

        desktop.ini

        • Path C:\$Recycle.Bin\S-1-5-21-1074038928-2032447174-945360078-1000\desktop.ini
        • Size 896B
        • SHA256 24bd24d02219352706605b3ec5c55e84c659e77462e0d61bed5ebd3844087448
        • MD5 SHA1 SHA512 TLSH

        Click on 'Change' to select default PDF handler.pdf

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Click on 'Change' to select default PDF handler.pdf
        • Size 183KB
        • SHA256 7ad97f00d72f3815bd357d917853c1b69dbf04437d26cd3da1c08d994d3aca97
        • MD5 SHA1 SHA512 SSDEEP TLSH

        s_export_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_export_18.svg
        • Size 8KB
        • SHA256 2b7ef6379cc374485759eec18e7c99aab5cd527c40f8a7bdf5dceafe611685ac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        s_download_pdf_18.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_download_pdf_18.svg
        • Size 8KB
        • SHA256 be945bf9dabe1a37de0cf18d23d0eb62ee71d8e573a486cc93c0f5d5f785a711
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ui-strings.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\ui-strings.js
        • Size 9KB
        • SHA256 4d0189dc6557cc47844c8e4565e1668b94432dddd6a4f090d0739262945548d0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ui-strings.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-ma\ui-strings.js
        • Size 4KB
        • SHA256 e64c1413f57faf113663eba497f215473e083957c5fc11d3ab1fe3cd555382b1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        available_for_trial.0.6h4b777r._r35mIR

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-ma\available_for_trial.0.6h4b777r._r35mIR
        • Size 11KB
        • SHA256 70a24164b9359dcde3f7ea5fd125c0355d9fa5bc6e7bfb220fa8111f54a74bbe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        text.cur

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\text.cur
        • Size 4KB
        • SHA256 60382889eb88c815e61a149def6bbc25ef432fa79ac253f7ca76042f409c3dff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        file_icons.png

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\images\themes\dark\file_icons.png
        • Size 24KB
        • SHA256 9088f6028d297cacdde50a8a8f934ae38894f1c6ed25e1d32d4b629fe2518ec8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        selector.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\selector.js
        • Size 47KB
        • SHA256 6d5f5d3788af5344b89830c46e603586377770d49ee48a26b08f67c15a09a4c4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ui-strings.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-il\ui-strings.js
        • Size 14KB
        • SHA256 e5a39acdaac60adb70fff782d6297204f44fc806a242cc93aae79ee29c640bef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vi_get.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\vi_get.svg
        • Size 7KB
        • SHA256 e984c9540fae02fa40804bd93454d5ac19dec70a37bdf0a06ca20e7cf0c49250
        • MD5 SHA1 SHA512 SSDEEP TLSH

        available_for_trial.rt9j55a39y2wo7w0a7628w59nh6ipjmhs3ue.mm1q0549gr._r35mIR

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fr-ma\available_for_trial.rt9j55a39y2wo7w0a7628w59nh6ipjmhs3ue.mm1q0549gr._r35mIR
        • Size 16KB
        • SHA256 9d7e86ad2157f7b6c1c2324ddb211debbb679e49ad4cc4a1848e928c402d4296
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ui-strings.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-il\ui-strings.js
        • Size 18KB
        • SHA256 f7ec3d8ea853306daf88bd1f8bae53741ecb372bb50a07d22973e37756ed4896
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ui-strings.js

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fr-ma\ui-strings.js
        • Size 22KB
        • SHA256 b87fa92978b3f236f468f1f3aecc287e8e9b9c093862e84fa48b5ed8b0b276a1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DisabledGoogleUpdate.exe

        • Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
        • Size 4.6MB
        • SHA256 0883c06bbf5f3140d18b82bad6967c5ced93cc8105bc672f8b8589e6ded360e6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Workflow.Targets

        • Path C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets
        • Size 5KB
        • SHA256 dfff807a42f89a40e2dbf221b8fb95b0e654869c98f25295e3289ab2d988ad19
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Workflow.VisualBasic.Targets

        • Path C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets
        • Size 5KB
        • SHA256 85bc189cc7b6af13197346dd02dc65f2e8793d8f0a00b9ef0d9bfc17aee4181d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        identity_helper.Sparse.Beta.msix

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_proxy\win11\identity_helper.Sparse.Beta.msix
        • Size 54KB
        • SHA256 bb069f3f7b06dc2b384a97615f129be3d951d3ff05068e6b16262065e38b60ec
        • MD5 SHA1 SHA512 SSDEEP TLSH

        manifest.json

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\AdSelectionAttestationsPreloaded\manifest.json
        • Size 897B
        • SHA256 f621e5d9307acb1dec2b1caf4a2e4b4e5a191773df7a75fbd4a86378a0cb9fc8
        • MD5 SHA1 SHA512 TLSH

        MicrosoftEdgeUpdate.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe
        • Size 202KB
        • SHA256 f72dd1d2184b26b45f671824590f2cc937066efa293fb01371b18f2e8fb4c268
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lb.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\lb.pak.DATA
        • Size 1.1MB
        • SHA256 2e8affd75fc07a668f90e51192380b5b6d01bc194e7115423133525618733607
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lo.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\lo.pak.DATA
        • Size 2.0MB
        • SHA256 8a649594413af9bd4a1d2d96d6253c38f584c5b7a681a643682f310263fac36c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lt.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\lt.pak.DATA
        • Size 1.1MB
        • SHA256 5c3d5496efdebba9610b2faee6d7eb3e7e3d69ba0a63636ec089b725279e6b19
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lv.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\lv.pak.DATA
        • Size 1.1MB
        • SHA256 1359dba4bc01f9844edf6355ec9f604cf5bbe8060474e9246923416e280ee62a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mi.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\mi.pak.DATA
        • Size 1.1MB
        • SHA256 7d3c5140e0e061d30a97a533d9e0e1439b0996cde240013da7b2bab88310c530
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mk.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\mk.pak.DATA
        • Size 1.7MB
        • SHA256 588d6360a1800c04933f30954625f127f7c34926c522f65f92457ddeb80ae796
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ml.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\ml.pak.DATA
        • Size 2.5MB
        • SHA256 42506625fb281bf9a452fce6651e82048699a0cca0194919e85d506ba18172d9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mr.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\mr.pak.DATA
        • Size 2.1MB
        • SHA256 3159a612b80ca66372b9205645ff6a264cc8e59ff775e94adc0402d192b49e67
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ms.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\ms.pak.DATA
        • Size 1012KB
        • SHA256 ff0ddfa3fec734e73f6684745a991c2f8158277d8c8d5007789f36cc57b5f7ea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mt.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\mt.pak.DATA
        • Size 1.1MB
        • SHA256 bf803f5764f2a42d1f5b1fb54df2d2e8255996111bf6e1ad2023be7de8493ffb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nb.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\nb.pak.DATA
        • Size 976KB
        • SHA256 9f3eef0419d6e6e5697d3f9dc5e0026c0d1e550b38c67ba654f00450a019ce9d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ne.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\ne.pak.DATA
        • Size 2.2MB
        • SHA256 c2a20d61a70231282ee7d8ca73c71a008be5671c1e3791e6e8eb7ce1bf20b2be
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nl.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\nl.pak.DATA
        • Size 1.0MB
        • SHA256 e374992e7aad3ea7f0aeedb646dc51de6a8d2a9c70a8a7050b550e9b7cf96b9d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nn.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\nn.pak.DATA
        • Size 979KB
        • SHA256 a8b1f688aa260aadff607f3ce6a998623bd13320f2cef966c4a157c8dc8a95d7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        or.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\or.pak.DATA
        • Size 2.3MB
        • SHA256 35d8d5dc11a9d90fa5633241a34bc2550708ce56fa20945fb3ce09114edba978
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pa.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\pa.pak.DATA
        • Size 2.1MB
        • SHA256 a35e3647c00d6da3229b401a60bb158e9dc24ca224aaf99ea53ba13e4cb4dab0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pl.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\pl.pak.DATA
        • Size 1.1MB
        • SHA256 d2e066b905c5fc9172271622b299e977f262370651bb61d5dacd7bd580c292de
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pt-BR.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\pt-BR.pak.DATA
        • Size 1.0MB
        • SHA256 53a1d2901450a226650d2adc8fa64c1d6eeaaecb677905b2b331468a8b1f81a5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pt-PT.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\pt-PT.pak.DATA
        • Size 1.1MB
        • SHA256 a86485a19703a546935c2fd16d9dd74ab2f65cf88ef9a229a373d221c32ee794
        • MD5 SHA1 SHA512 SSDEEP TLSH

        qu.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\qu.pak.DATA
        • Size 1.1MB
        • SHA256 5a8e8d575ddeb0caf17e7e7e352c9d3caec024e0d1d4f529dcdfe2a7096102bd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ro.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\ro.pak.DATA
        • Size 1.1MB
        • SHA256 43f0f2de0a6a2e82120a3223aa88a37110b61e4fae8ca1a2eea1a1138fb61e49
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ru.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\ru.pak.DATA
        • Size 1.7MB
        • SHA256 059e2967e6abd0fcbeb466c27ef4874506359793143014a7d3ee7db370ec4e09
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sk.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\sk.pak.DATA
        • Size 1.1MB
        • SHA256 1e337c3891b48fb77cdbd778028e049a66d40d8f0258e94f24ab0e4881e16177
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sl.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\sl.pak.DATA
        • Size 1.1MB
        • SHA256 477b1eceb5c6455e5fec205234ca49ccd560c68a5f2802bd75af919adda5f4c5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sq.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\sq.pak.DATA
        • Size 1.1MB
        • SHA256 f60a77741674cad6d139126c5e3c3ffe80bf5b8c454d8b36aef6e95c63ae321d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sr-Cyrl-BA.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\sr-Cyrl-BA.pak.DATA
        • Size 1.6MB
        • SHA256 47054609d46cfd1c92b118330585df0dc6fd493a466deec25b9a75515b0068f9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sr-Latn-RS.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\sr-Latn-RS.pak.DATA
        • Size 1.0MB
        • SHA256 038f6844a0e5a15cc7743a5b418bf9e0488d5fc6154794175634ffe734c02e7a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sr.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\sr.pak.DATA
        • Size 1.6MB
        • SHA256 86bb9c6f5a4b0117e1365d1ca45a24f9fed06376a204f18eda16b52776e51ab9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sv.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\sv.pak.DATA
        • Size 1001KB
        • SHA256 2129df04b985bdcd6b717288654718198e04b34965509a20a77ff6175379187b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ta.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\ta.pak.DATA
        • Size 2.5MB
        • SHA256 55338a6de52b9a1a7964068d51907aa500a9831f4dcb4296a97d8c63bfbdfe36
        • MD5 SHA1 SHA512 SSDEEP TLSH

        te.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\te.pak.DATA
        • Size 2.3MB
        • SHA256 de088a3cb2ce186f8971e017f16ee20d9e08b90cd3e2c93dd993de4077c8ae17
        • MD5 SHA1 SHA512 SSDEEP TLSH

        th.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\th.pak.DATA
        • Size 2.0MB
        • SHA256 998c3c37fad8f8e0c580cfe1ad608da063a6723199e8c9f4bdd7e6c4f661ec31
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tr.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\tr.pak.DATA
        • Size 1.0MB
        • SHA256 df25852954b632772c0746ba86002dd4e0c334fea62458e898cf4cdf513f6678
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tt.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\tt.pak.DATA
        • Size 1.6MB
        • SHA256 ab8c3a6d3b78a597803f50469c011accd71baf79ba407990dc124559689d6200
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ug.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\ug.pak.DATA
        • Size 1.6MB
        • SHA256 ee6d1f95f462916469821bbd26d61dc8e5ac7462d097f1d954279807c8c82b16
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uk.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\uk.pak.DATA
        • Size 1.7MB
        • SHA256 9c819d58c3db347e6f2f8609b3f2c3e1499537757ffffd26e9b805f4009ff4a7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ur.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\ur.pak.DATA
        • Size 1.5MB
        • SHA256 5421c36863786aa6e781e809ce1b13329300e4a4145ffbb92cb97eeb7d8e77f9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vi.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\vi.pak.DATA
        • Size 1.2MB
        • SHA256 cb274f3ea705ad7e00e5b11479e8e63433773050d0ab38d150526f59b1f3cc3b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh-CN.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\zh-CN.pak.DATA
        • Size 860KB
        • SHA256 7104eb543aba057d3b21d4ca655de0e2acdd96081db46aaa2a8304b52a772455
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh-TW.pak.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\zh-TW.pak.DATA
        • Size 887KB
        • SHA256 fa4ddf050992edbac5a3f74bd97d649b1c668af84ca49ea315e90cf3b6d3d7c8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        manifest.json.DATA

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\MEIPreload\manifest.json.DATA
        • Size 1007B
        • SHA256 70f3bf297943924d345b709f5628dec76a09ed6899bfb3c40150a1f5b9a27757
        • MD5 SHA1 SHA512 TLSH

        CompatExceptions

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Mu\CompatExceptions
        • Size 1KB
        • SHA256 4d84a54ad13d6f37e57c116095b6d6ba61295f54975dcbb9250b5ae8293b1344
        • MD5 SHA1 SHA512 TLSH

        Cryptomining

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Mu\Cryptomining
        • Size 1KB
        • SHA256 2563fe98b433a6217464e3afc40215859aefd7e2c7be7ae7bfef63c0d8db86cd
        • MD5 SHA1 SHA512 TLSH

        Fingerprinting

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Mu\Fingerprinting
        • Size 2KB
        • SHA256 c44ff0576df43a73c631ec508db4149e4e6c8d4f02fa61de84fa1f54d1c64e76
        • MD5 SHA1 SHA512 TLSH

        Other

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Mu\Other
        • Size 795B
        • SHA256 7ecae211e006d6c74f6b753d884c8b53cf5ceb4010db772e5977ebbf9996db98
        • MD5 SHA1 SHA512 TLSH

        Social

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Mu\Social
        • Size 1KB
        • SHA256 780ab6905861d25cae4f4276726f9ee162311304083aaf18f9417eba542037f0
        • MD5 SHA1 SHA512 TLSH

        TransparentAdvertisers

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Mu\TransparentAdvertisers
        • Size 883B
        • SHA256 e210992c89f0852ca1410c96cc8e16f0923c3c74aba5b6b128f72b3eef0e028b
        • MD5 SHA1 SHA512 TLSH

        Advertising

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Sigma\Advertising
        • Size 3KB
        • SHA256 9a27ba0b7b85b4350ae42346ca5747de724ae5c59205df3005ef8e7c0004443a
        • MD5 SHA1 SHA512 TLSH

        Analytics

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Sigma\Analytics
        • Size 1KB
        • SHA256 ce76ee3df9278077c3c0bca4d67a240213519dce799a43a7b0e36357156645f8
        • MD5 SHA1 SHA512 TLSH

        Content

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Sigma\Content
        • Size 811B
        • SHA256 5b3a216cd82414caede18e63366547cc046778860603dbb6224d295b740e5ac1
        • MD5 SHA1 SHA512 TLSH

        Cryptomining

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Sigma\Cryptomining
        • Size 800B
        • SHA256 b7ce39c842ee3bd2ffac5a0167149290df95f31e61f9bc0ced380693fdd4bfbb
        • MD5 SHA1 SHA512 TLSH

        Fingerprinting

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Sigma\Fingerprinting
        • Size 942B
        • SHA256 bb6f574b390ea171379db3892fb6815e0f0544c25d53bd28745e0146e6f14ac1
        • MD5 SHA1 SHA512 TLSH

        LICENSE

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Sigma\LICENSE
        • Size 829B
        • SHA256 091e341eaecafa507cf509c7063a27372a474b3b51d1f75c1f2283e9f1f59264
        • MD5 SHA1 SHA512 TLSH

        Other

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Sigma\Other
        • Size 852B
        • SHA256 5bff3e5632544b1ff2f4d8854c1c8965058fe70f82a2358d35989095982942cf
        • MD5 SHA1 SHA512 TLSH

        Social

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Sigma\Social
        • Size 4KB
        • SHA256 7c776c04a6186633d2d500711240acc6d8821718151f473600875e625fa51f0c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        manifest.json

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\manifest.json
        • Size 901B
        • SHA256 674790e14306b30e3365e3d806749f1e7a3085395276b75c865e718b6c1e9d0e
        • MD5 SHA1 SHA512 TLSH

        widevinecdm.dll.sig

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig
        • Size 2KB
        • SHA256 3e8d98fa89c7b0aea8078e6db9fbe1132e97fd02ceeec5a0b2e1b24736e94f45
        • MD5 SHA1 SHA512 TLSH

        manifest.json

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\WidevineCdm\manifest.json
        • Size 1KB
        • SHA256 a3edb24d9de1d63467a71097c2d16c6a93c12e44134ef6695dba12c9736f2a00
        • MD5 SHA1 SHA512 TLSH

        identity_helper.Sparse.Beta.msix

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_proxy\win11\identity_helper.Sparse.Beta.msix
        • Size 54KB
        • SHA256 435933a48a1adf4e9aae7d37c5ad93e87c73891a5b69bc7c683ece3320e41d7e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Uninstall.exe

        • Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
        • Size 101KB
        • SHA256 c04def5a8dcd6e3af283a4f5521ec2b901237b8e1b12c2cf02903b47413628f4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        maintenanceservice.exe

        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 272KB
        • SHA256 5d6cdefc316deb977001106f0193026d3993d84e21a8e3912110b55f6426d86c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MSFT_PackageManagementSource.psm1

        • Path C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\MSFT_PackageManagementSource.psm1
        • Size 24KB
        • SHA256 2da4edfae83c87c209bd7bc6407e6d59648c60827f59d27c69d1f2054cb28b03
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MSFT_PackageManagement.psm1

        • Path C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\MSFT_PackageManagement.psm1
        • Size 13KB
        • SHA256 463efc893f2c80bafc92f7c52bfc41be6d9c9288ff39ca94df01de5721c3cabf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PackageManagementDscUtilities.psm1

        • Path C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\PackageManagementDscUtilities.psm1
        • Size 9KB
        • SHA256 b739bfcf3379942d950d21a39e0ee0e26652db4d0c0d7dae06b9374f20bf2e85
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PackageManagement.format.ps1xml

        • Path C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.format.ps1xml
        • Size 16KB
        • SHA256 c74a23cb1532fac8924b780f66ce3f54cedad4189abcc5aba4b8fc91cfe3ec13
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PackageProviderFunctions.psm1

        • Path C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageProviderFunctions.psm1
        • Size 11KB
        • SHA256 abaef2dc05f9c348529c385077ac12804afc6d093bc43329b9f43666f420fe6a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PSGet.Format.ps1xml

        • Path C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSGet.Format.ps1xml
        • Size 8KB
        • SHA256 2baa4ffbc9fcd82d75ecfbdd05fa8bd7e3d2d7bb10a72b848dc766a94975eb45
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PSGet.Resource.psd1

        • Path C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSGet.Resource.psd1
        • Size 78KB
        • SHA256 1dcfb79a916b3e5ab1c902d8ac5da1a568fc5be41f2c3db235b82e7f36d43d73
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PSModule.psm1

        • Path C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1
        • Size 571KB
        • SHA256 0c5dc9a34e8769f5cead135a100809ac260b1ae327cc6c5bb7ab30d12317c333
        • MD5 SHA1 SHA512 SSDEEP TLSH

        setup.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 6.1MB
        • SHA256 9c7ad0d21a5aa04ce479a224491f5e99a1850ead3b38e312d78d04b80b26f29c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-console-l1-2-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-2-0.dll
        • Size 12KB
        • SHA256 fc054be69c741f497ab158cced06c5712b62e53f734c11aea8f00eaf90c2d861
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-datetime-l1-1-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll
        • Size 12KB
        • SHA256 a7f2dcbf64b52fd78a410eb0829ac11afc602f38d56d43c1c0f5bd9bd3901dbd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-debug-l1-1-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-debug-l1-1-0.dll
        • Size 12KB
        • SHA256 410d9207e3c21aa1a58d92cebd00e1a2ddc07a727fae4c42aa2c9b4bc0319f09
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-errorhandling-l1-1-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-errorhandling-l1-1-0.dll
        • Size 12KB
        • SHA256 22c6a905a1174801203786b9743a9f0d59fac0a812a78eae57bce3067498abe1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-file-l1-1-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-1-0.dll
        • Size 15KB
        • SHA256 aaa07ecd3d01e12ca161e3588eac45d29dc5fb1addfd95bbdec05f9b5edf9c42
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-file-l1-2-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-2-0.dll
        • Size 12KB
        • SHA256 def8ca72c60e5205271351e0ab7517f386924b377e372b68d02744fc0909ab48
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-handle-l1-1-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-handle-l1-1-0.dll
        • Size 12KB
        • SHA256 55fe912af8eac62519953e86b8be019013ee9d7cc04fa2c0820e298d8a48ba15
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-heap-l1-1-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-heap-l1-1-0.dll
        • Size 12KB
        • SHA256 eb33ff050aca77649b77a35f72d4d981d31967ca10fcf020adcedd6ff3514b6b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-interlocked-l1-1-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll
        • Size 12KB
        • SHA256 461c1c10c6b5e670ec077b46f7be22e0180e82d2ce289c17981664920d54513d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-libraryloader-l1-1-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll
        • Size 13KB
        • SHA256 de83d06a628cdafab4796ee5c822bd1ba2ee13f302186d2f66067928831ffa26
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-localization-l1-2-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-localization-l1-2-0.dll
        • Size 15KB
        • SHA256 a92a19c25d799b4ffba3f455dafac0cce6cd6325c19eec477a1034da40fba09e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-memory-l1-1-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-memory-l1-1-0.dll
        • Size 12KB
        • SHA256 9a7135767309855d5d7a66e2609bab15c05937166e3035868347f0037cfb1918
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-namedpipe-l1-1-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll
        • Size 12KB
        • SHA256 fa8e678f22f4d4a82a2552a7d29c3b36bf48d5ccca3130f4ea25b0a2a14d48da
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-processenvironment-l1-1-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll
        • Size 13KB
        • SHA256 d63d46a3ab18cae86e1f75533a38b5174d3d932b29145464febb2344aa557364
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-processthreads-l1-1-1.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-1.dll
        • Size 12KB
        • SHA256 9b966a1d398fba5bde868c99cf056e512fb2e6bb535e2f6441c50bfbd4592049
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-profile-l1-1-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-profile-l1-1-0.dll
        • Size 12KB
        • SHA256 a8c7b0da538feb0c96093635dd6407db7745cfe9cd496cad0f62317ccbf21556
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-rtlsupport-l1-1-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll
        • Size 12KB
        • SHA256 c5e7077d2a0e55d4475c22ab00914c2a26feb4ad1ea5356580b8710fe421d278
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-string-l1-1-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-string-l1-1-0.dll
        • Size 12KB
        • SHA256 8698d35f77cb6dc8aa92dda3ebda06322e1cd4aed2d356d27c9e283522988586
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-synch-l1-1-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-1-0.dll
        • Size 14KB
        • SHA256 727107782527e11b01bf4c8601ad738549ced2a319d8426d1b5567a98ae69eff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-synch-l1-2-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-2-0.dll
        • Size 12KB
        • SHA256 56dafdca5ecfe0e97bc7c1d13b76a7867a8a1c316ef437218ae812e63b24c979
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-sysinfo-l1-1-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll
        • Size 13KB
        • SHA256 529f78e00b1e1d0e50449d02c40ff0b2f4055b410bb75dee096df650c508894e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-timezone-l1-1-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-timezone-l1-1-0.dll
        • Size 12KB
        • SHA256 df7c89ff655388f87410837047411b79ec43e1ecaf520f784fe0143cd1bc1f55
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-util-l1-1-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-util-l1-1-0.dll
        • Size 12KB
        • SHA256 015560fab0f2f2573ed095d23d0b3c26b754b548047341ffbbabdd87f089ba28
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-conio-l1-1-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-conio-l1-1-0.dll
        • Size 13KB
        • SHA256 26ad9ada0595f047502d0e2881e22fe5ca867452982aba712caf1f08d0af6adf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-convert-l1-1-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-convert-l1-1-0.dll
        • Size 16KB
        • SHA256 ac6137332a8f86b1d51279efe263355f262d24ed479d954623f2836a41f9249a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-environment-l1-1-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-environment-l1-1-0.dll
        • Size 12KB
        • SHA256 c13a931cfa7b0200111ba8d4a0127557904ef1c88b1dd4355cd9ed5218f8b60a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-filesystem-l1-1-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-filesystem-l1-1-0.dll
        • Size 14KB
        • SHA256 0a81346a508a44884b419adc27e434c501d6ee1e0b8d5604c02dc51ff09baff2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-heap-l1-1-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-heap-l1-1-0.dll
        • Size 13KB
        • SHA256 05b3633e3ad0014a86c2edfbee3de9423c56df6e586beb07d15ad2002c62c175
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-locale-l1-1-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-locale-l1-1-0.dll
        • Size 12KB
        • SHA256 3947793d7e8df81316184b5664427a8f73a96365066d0e58cd31769170a46cca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-math-l1-1-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-math-l1-1-0.dll
        • Size 21KB
        • SHA256 ddc22414fed74edfd73f330914b91b25769a5e3cd3a45a5ac44fab11c9d614e8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-multibyte-l1-1-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-multibyte-l1-1-0.dll
        • Size 20KB
        • SHA256 cd09aa883fd4f6b3acab8506b31ec691cf0fa3d2e88b4aa7022e6c0ad56ad635
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-private-l1-1-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-private-l1-1-0.dll
        • Size 63KB
        • SHA256 5658d4798d46a6d3617c140f9ebd9794be3f58779d972d2494a7be5ba426a71c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-process-l1-1-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-process-l1-1-0.dll
        • Size 13KB
        • SHA256 fa6de8993e540b31aa5e3269ce6ecb27bad8ce10d56cdbd8942f37792a76f80c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-runtime-l1-1-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll
        • Size 16KB
        • SHA256 66d44d907ffa8d7db1e0cfc66bda8bbb3c86d215344caa21154b95de2495a893
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-stdio-l1-1-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll
        • Size 18KB
        • SHA256 050d1420c6e5f6c302ec3aac3223d05e36f2661c7b634b427397df67a315610f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-string-l1-1-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-string-l1-1-0.dll
        • Size 18KB
        • SHA256 34854ea528287dd749582c4aa2bd7b048d1dd28f0a8003b5bc2496c3e408a700
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-time-l1-1-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-time-l1-1-0.dll
        • Size 14KB
        • SHA256 81c07659a9f5be7b67279c764f285212203067d09e33c472d6fb67944d300398
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-utility-l1-1-0.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-utility-l1-1-0.dll
        • Size 12KB
        • SHA256 eac6a19ccd888a5e9dd7a1eccb5f6817a62787dfa3fb15b6d27a2e41774cb92a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        available_for_trial.d.p33n6r._r35mIR

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\available_for_trial.d.p33n6r._r35mIR
        • Size 12KB
        • SHA256 0db3c6cabd3355b57a497ec3eb26fd226e64444351095e1e919cd234e4e38425
        • MD5 SHA1 SHA512 SSDEEP TLSH

        available_for_trial.mwn98439v85n7b7.1t4gb062fr._r35mIR

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\available_for_trial.mwn98439v85n7b7.1t4gb062fr._r35mIR
        • Size 12KB
        • SHA256 1c836a71419f448c4388a42c693d3d6a050aa82057a5a2f3af6ba1eccb57177c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        available_for_trial.y.v455378r._r35mIR

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\available_for_trial.y.v455378r._r35mIR
        • Size 14KB
        • SHA256 6c5a568d1a30708c7554ef96d1c0577720a91905f4bcbb45eaf3eb509074b22c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msvcp140.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140.dll
        • Size 559KB
        • SHA256 b6e6710529d0d769c4b95bb3d0e25d32d7ea19f9a9e97619c28f867baa444b03
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ucrtbase.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ucrtbase.dll
        • Size 1012KB
        • SHA256 e5966039b6390e538bd7d88c930bc067ea7571099a0b46151c34d2d1d4ae919b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vcruntime140.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140.dll
        • Size 96KB
        • SHA256 68e8542beb54ece561782c67f8d9ec43729d591698c8f394691df61563ba8b31
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vcruntime140_1.dll

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140_1.dll
        • Size 37KB
        • SHA256 606691f3c3a9a6825148174f6416fe4ee75fe006bfd42f78b22adea56919b9cf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        messages_zh_TW.properties

        • Path C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_TW.properties
        • Size 4KB
        • SHA256 ea93df9d227ab8da032df7227d468d27cad7dd5e208294cb031b66fa8c95203c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mesa3d.md

        • Path C:\Program Files\Java\jdk-1.8\legal\javafx\mesa3d.md
        • Size 6KB
        • SHA256 6b98974e1225a5676f1488b56d830819120a0234a6ee0c86d2b2392245d4b5cf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libpng.md

        • Path C:\Program Files\Java\jdk-1.8\legal\jdk\libpng.md
        • Size 7KB
        • SHA256 39e8dc84c9e9cc5a41d7cba172b69a719b4ce08c0350b92963176ad4a0d10853
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pkcs11cryptotoken.md

        • Path C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11cryptotoken.md
        • Size 4KB
        • SHA256 5cb83b169a4d92d98f92b66451780c5e4440f7406c464a4487c579dd66dcd6e9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        xmlresolver.md

        • Path C:\Program Files\Java\jdk-1.8\legal\jdk\xmlresolver.md
        • Size 11KB
        • SHA256 23fe2ffe8884922b23715231996f34abf02e6603493154553c6113ff05662f77
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msvcp140_1.dll

        • Path C:\Program Files\Java\jre-1.8\bin\msvcp140_1.dll
        • Size 24KB
        • SHA256 83e60af8d4cb75512c6acfd72f581dfe9740c50200caf81c2cb849a04e81160e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msvcp140_2.dll

        • Path C:\Program Files\Java\jre-1.8\bin\msvcp140_2.dll
        • Size 183KB
        • SHA256 12eec31fc05ecfab16edf6ba8f193297b9f6f3c5471b705b0c2fa0c7d760577a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LucidaTypewriterRegular.ttf

        • Path C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterRegular.ttf
        • Size 237KB
        • SHA256 ac20ba07955b32477a4bd296f29e23edf01405c468dbf09d00f852989404ab4b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        psfontj2d.properties

        • Path C:\Program Files\Java\jre-1.8\lib\psfontj2d.properties
        • Size 10KB
        • SHA256 29698e7871210a6a8fb0b73e0c2dca90cc36bed84e694ff30a3b5dec78112cc6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OfficeClickToRun.exe

        • Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
        • Size 4.1MB
        • SHA256 b0c5c0cb9dd53b5e1ed979475d80e2e78d624a8c1f3af19e68350f400c2eda07
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-filesystem-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-filesystem-l1-1-0.dll
        • Size 20KB
        • SHA256 ebd7400bfbdd36fda962db1b9f8bcd8b856cde2e6ac0cc352745531ecb784012
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-runtime-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-runtime-l1-1-0.dll
        • Size 23KB
        • SHA256 842c429563166d587a774ef704ef3a05018cb50cba31c97946ac2944be07844f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-time-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-time-l1-1-0.dll
        • Size 21KB
        • SHA256 52bf2b378b044e0d1772251767df852f469d28e083786c4719c3b2a581c50157
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-utility-l1-1-0.dll

        • Path C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-utility-l1-1-0.dll
        • Size 19KB
        • SHA256 b28dac8bccbbdc655fd5cb1ef432abb142cc86a4a2e09dad95c3c8b3a1686fd6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        concrt140.dll

        • Path C:\Program Files\Microsoft Office\root\Client\concrt140.dll
        • Size 325KB
        • SHA256 35a6d9b4bccfaf4c38cb7999b3e2ae6ea7af549e86d73db3d77f70edac9d8265
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vccorlib140.dll

        • Path C:\Program Files\Microsoft Office\root\Client\vccorlib140.dll
        • Size 359KB
        • SHA256 d0e4085e1fe5c23dc407e78410862e3ce92dfec88a80cef1cbdc46cc747a0aa7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pkeyconfig-office.xrm-ms

        • Path C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office.xrm-ms
        • Size 905KB
        • SHA256 56a186b8237d969f9791c13c15bcf474412d02046d6073a972f703cfa126e943
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PREVIEWTEMPLATE2.POTX

        • Path C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE2.POTX
        • Size 292KB
        • SHA256 4fb920b38f9d435d875a7085d5883e932168b85fd7d90ad6ccb257d2d6b85e60
        • MD5 SHA1 SHA512 SSDEEP TLSH

        word2013bw.dotx

        • Path C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013bw.dotx
        • Size 12KB
        • SHA256 6c767c3ba9b44a36232e811699505149e2604a314f172177afb4499b98b73615
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ISO690.XSL

        • Path C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690.XSL
        • Size 265KB
        • SHA256 706a0803fa269094782e80d64661ff87a70f9aa4fdef33f6342e1c536c68a584
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libcrypto-1_1-x64.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\libcrypto-1_1-x64.dll
        • Size 2.5MB
        • SHA256 2a93624a4e1a9d483755cf2b5df22e40aca506155f084c5831340e7cccd81f9f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msvcr120.dll

        • Path C:\Program Files\Microsoft Office\root\Office16\msvcr120.dll
        • Size 941KB
        • SHA256 c86ff8d8aeddb796ed32d34cd9cf0243ffb25ee02f090ea6e589ae78761ac60f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SLINTL.DLL

        • Path C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\SLINTL.DLL
        • Size 19KB
        • SHA256 3e7c800f4c5136762a49a4ad90f9e31497338e69be81d58dd46f36e63112d0bf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        trdtv2r41.xsl

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\trdtv2r41.xsl
        • Size 101KB
        • SHA256 601ad864cc0fd3a627c0e345c7daa191d73d9de856a05bfec9be9000f761d06e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        available_for_trial.loy293dmkgi9.8q3r._r35mIR

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\available_for_trial.loy293dmkgi9.8q3r._r35mIR
        • Size 445KB
        • SHA256 ac1251cb2c6d70221c400bdc9ca7638dda23f1db43fed77b60caf87382cd92ae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vccorlib140.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\vccorlib140.dll
        • Size 264KB
        • SHA256 b702ef8b7c0dfa73633ee2a1a6c03cf8d3e36d1a874bf20bfaaf5ac7dd026272
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vcruntime140.dll

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\vcruntime140.dll
        • Size 79KB
        • SHA256 23f29e4c8e4a8bab4997e00c1e7eeca74a1a65e5a4ccb3a9aa83855a8e87796b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hive.xsl

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\hive.xsl
        • Size 80KB
        • SHA256 9f9cdcc672370c43a3968e1fe2b108d1ef3e660179342dca0150a73ff37ee445
        • MD5 SHA1 SHA512 SSDEEP TLSH

        499b07311ls1117ag93y8.873x0k2r._r35mIR

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\499b07311ls1117ag93y8.873x0k2r._r35mIR
        • Size 104KB
        • SHA256 71e1be9f5a758ef4be2ff61a20e687bac6291a652fdf67ebfe4d6b95f38a01f3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        as80.xsl

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\as80.xsl
        • Size 17KB
        • SHA256 7a614e7926e52dc8e658987f62245669809d8e4e49301bc5b40c7c0a5a494026
        • MD5 SHA1 SHA512 SSDEEP TLSH

        as90.xsl

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\as90.xsl
        • Size 20KB
        • SHA256 25277c320c829dba68ef8e54ef5fe0ade8e8127ab9427b493a4f86ab15f4af31
        • MD5 SHA1 SHA512 SSDEEP TLSH

        db2v0801.xsl

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\db2v0801.xsl
        • Size 30KB
        • SHA256 d5be47108d89d5e63a933a5214c8ff2b52c2164be720e08b1daec4d3b25bc0b5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msql.xsl

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\msql.xsl
        • Size 126KB
        • SHA256 cd1658808d9632fde965d3d3f2c58c0590a07a073d848e454839750049872e7b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orcl7.xsl

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\orcl7.xsl
        • Size 94KB
        • SHA256 0567297d28fef73605b4ebdb19b4a7062a8f0d0f601841df3a8f5ef8249809e0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sql120.xsl

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql120.xsl
        • Size 132KB
        • SHA256 1f08fb5f252cc59ea33c969f90d2c58f38ba42f01bdba75bad4800b6a92d6572
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sql90.xsl

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql90.xsl
        • Size 133KB
        • SHA256 8c4b0de1d2425a912de1d777687eff92e69646d7c96cba49fa24d551bbf66250
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sqlpdw.xsl

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sqlpdw.xsl
        • Size 103KB
        • SHA256 cfe133821c03a60949c89ecb2d139770d1e5a5855c80407490651b7f69daeffb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vlc.mo

        • Path C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\vlc.mo
        • Size 605KB
        • SHA256 2f19159e8f785c9e34f5b3a206f8bb60658a66dd00047aba017195a88c61845f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vlc.mo

        • Path C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo
        • Size 784KB
        • SHA256 4af069688ef874c28e40c45b8316aacd31c94e961a983008315b796e38bb8ed5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        available_for_trial.d30m.33s044i2z6r._r35mIR

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\available_for_trial.d30m.33s044i2z6r._r35mIR
        • Size 1.3MB
        • SHA256 8edc4fc0e3b2c1ecefbe4dcb44051aa91a7796a0f40c9aa9bcb270ed006169cc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Microsoft.DiaSymReader.Native.amd64.dll

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.DiaSymReader.Native.amd64.dll
        • Size 1.8MB
        • SHA256 8cdb4599a5ad5ca2fe024e923119dbcc609f96dadc08dba5d866bad8eccf6875
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mscordaccore_amd64_amd64_7.0.1624.6629.dll

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore_amd64_amd64_7.0.1624.6629.dll
        • Size 1.3MB
        • SHA256 9aa151121d58b18652eeaf5fcf1fefbc7e7966476b942fe71f4550e05e5a0528
        • MD5 SHA1 SHA512 SSDEEP TLSH

        available_for_trial.8v0t6n1ei4.x44r._r35mIR

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\available_for_trial.8v0t6n1ei4.x44r._r35mIR
        • Size 1.3MB
        • SHA256 8c7175247349441f819146d9e6681aadb3c833840bfeb0f84758406a619013c9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        D3DCompiler_47_cor3.dll

        • Path C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\D3DCompiler_47_cor3.dll
        • Size 4.7MB
        • SHA256 fbdb44685dca0947f2f73ee4c3b33415d92fc37c3f89b04ca29b1b7693e67c87
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vcruntime140_cor3.dll

        • Path C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\vcruntime140_cor3.dll
        • Size 117KB
        • SHA256 686c1be1b9e38f641757ab3f9fae0da250a3acbfed4284e0ce4883b2ac6e096d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        how_to_decrypt.hta

        • Path C:\how_to_decrypt.hta
        • Size 12KB
        • SHA256 db03405ea621cc04f329d0688d3841dd5c24a878f742839764c8f0cbd5df0362
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/1912-0-0x0000000000400000-0x0000000000463000-memory.dmp

        memory/1912-4767-0x0000000000400000-0x0000000000463000-memory.dmp

        memory/1912-19-0x0000000000400000-0x0000000000463000-memory.dmp

        memory/1912-15-0x0000000000400000-0x0000000000463000-memory.dmp

        memory/1912-8-0x0000000000400000-0x0000000000463000-memory.dmp

        memory/1912-7-0x0000000000400000-0x0000000000463000-memory.dmp

        memory/1912-6-0x0000000000400000-0x0000000000463000-memory.dmp

        memory/1912-3-0x0000000000400000-0x0000000000463000-memory.dmp

        memory/1912-2-0x0000000000400000-0x0000000000463000-memory.dmp

        memory/1912-1-0x0000000000400000-0x0000000000463000-memory.dmp