Overview

overview

10

Static

static

3

2026-09-19...id.exe

windows10-2004-x64

10

2026-09-19...id.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    19/09/2026, 10:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-19_a6a2554ebd335aa12dfa6db01ecc28e9_cobalt-strike_icedid.exe
  • Size 116KB
  • Sample260919-msdrmszanf
  • SHA256 c7862295b6030c3611a5dbc529dc1400a3fac2db077a89b02751f41debcd089b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasionexecutionpersistencespywarestealer

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 6 IoCs
    persistence
  • Sets service image path in registry 3 TTPs 3 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 3 IoCs
  • Drops file in Windows directory 3 IoCs
  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies Control Panel 15 IoCs
    defense_evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-19_a6a2554ebd335aa12dfa6db01ecc28e9_cobalt-strike_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-19_a6a2554ebd335aa12dfa6db01ecc28e9_cobalt-strike_icedid.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Sets service image path in registry
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies Control Panel
    • Suspicious use of WriteProcessMemory
    PID:1700
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c schtasks /Create /TN "\WindowsFontCacheSvc" /SC ONLOGON /RL HIGHEST /F /TR "\"C:\Users\Admin\AppData\Local\Temp\2026-09-19_a6a2554ebd335aa12dfa6db01ecc28e9_cobalt-strike_icedid.exe\" /s"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2256
      • C:\Windows\system32\schtasks.exe
        schtasks /Create /TN "\WindowsFontCacheSvc" /SC ONLOGON /RL HIGHEST /F /TR "\"C:\Users\Admin\AppData\Local\Temp\2026-09-19_a6a2554ebd335aa12dfa6db01ecc28e9_cobalt-strike_icedid.exe\" /s"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2708
  • C:\Users\Admin\AppData\Local\Temp\2026-09-19_a6a2554ebd335aa12dfa6db01ecc28e9_cobalt-strike_icedid.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-19_a6a2554ebd335aa12dfa6db01ecc28e9_cobalt-strike_icedid.exe
    1⤵
    • Modifies WinLogon for persistence
    • Sets service image path in registry
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies Control Panel
    • Suspicious use of WriteProcessMemory
    PID:3328
    • C:\Windows\system32\cmd.exe
      cmd.exe /c schtasks /Create /TN "\WindowsFontCacheSvc" /SC ONLOGON /RL HIGHEST /F /TR "\"C:\Users\Admin\AppData\Local\Temp\2026-09-19_a6a2554ebd335aa12dfa6db01ecc28e9_cobalt-strike_icedid.exe\" /s"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1176
      • C:\Windows\system32\schtasks.exe
        schtasks /Create /TN "\WindowsFontCacheSvc" /SC ONLOGON /RL HIGHEST /F /TR "\"C:\Users\Admin\AppData\Local\Temp\2026-09-19_a6a2554ebd335aa12dfa6db01ecc28e9_cobalt-strike_icedid.exe\" /s"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:3664
  • C:\Users\Admin\AppData\Local\Temp\2026-09-19_a6a2554ebd335aa12dfa6db01ecc28e9_cobalt-strike_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-19_a6a2554ebd335aa12dfa6db01ecc28e9_cobalt-strike_icedid.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Sets service image path in registry
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies Control Panel
    • Suspicious use of WriteProcessMemory
    PID:1216
    • C:\Windows\system32\cmd.exe
      cmd.exe /c schtasks /Create /TN "\WindowsFontCacheSvc" /SC ONLOGON /RL HIGHEST /F /TR "\"C:\Users\Admin\AppData\Local\Temp\2026-09-19_a6a2554ebd335aa12dfa6db01ecc28e9_cobalt-strike_icedid.exe\" /s"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3060
      • C:\Windows\system32\schtasks.exe
        schtasks /Create /TN "\WindowsFontCacheSvc" /SC ONLOGON /RL HIGHEST /F /TR "\"C:\Users\Admin\AppData\Local\Temp\2026-09-19_a6a2554ebd335aa12dfa6db01ecc28e9_cobalt-strike_icedid.exe\" /s"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4052

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        Windows Command Shell

        1
        T1059.003

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Persistence

        Boot or Logon Autostart Execution

        3
        T1547

        Registry Run Keys / Startup Folder

        2
        T1547.001

        Winlogon Helper DLL

        1
        T1547.004

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Privilege Escalation

        Boot or Logon Autostart Execution

        3
        T1547

        Registry Run Keys / Startup Folder

        2
        T1547.001

        Winlogon Helper DLL

        1
        T1547.004

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Defense Evasion

        Modify Registry

        3
        T1112

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        2
        T1012

        System Information Discovery

        1
        T1082

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AcroRead.msi
        • Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRead.msi
        • Size 2.7MB
        • SHA256 842ae87388e1af8b8d777dc44f1f439fcbc1a93a3b0cd5a23e1df7dfa968d8e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Manifest.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\Manifest.xml
        • Size 4.3MB
        • SHA256 6681f96f338db9cb5284e9aa2b8bd7d5add8fc671baf26f3a59a903cf44adfe3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UserManifest.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\UserManifest.xml
        • Size 2.7MB
        • SHA256 6033fd899910df8444162054899dba7f11113113d1f43bb763623860bb0f0068
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MasterDescriptor.en-us.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\7E450321-DF48-4535-9261-41E41AB7A8D2\en-us.16\MasterDescriptor.en-us.xml
        • Size 28KB
        • SHA256 74b76611d990d054c914f9b9ed457165a712d4060b868582694b33db7afae785
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        stream.x64.en-us.db
        • Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\7E450321-DF48-4535-9261-41E41AB7A8D2\en-us.16\stream.x64.en-us.db
        • Size 438KB
        • SHA256 304984b18f5f66930606200fbb125c7b8a378edb40400d504f822af82398fe1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        stream.x64.en-us.man.dat
        • Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\7E450321-DF48-4535-9261-41E41AB7A8D2\en-us.16\stream.x64.en-us.man.dat
        • Size 622KB
        • SHA256 2b3d5983656ad23d40c667578e388aabb061384979c66609fcf84ad74aa49f40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mergedVirtualRegistry.dat
        • Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\7E450321-DF48-4535-9261-41E41AB7A8D2\mergedVirtualRegistry.dat
        • Size 6.5MB
        • SHA256 4b28598f814365c0b18934c93def068ac0cc0ba5a852053aead9d99b61a2edfa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MasterDescriptor.x-none.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\7E450321-DF48-4535-9261-41E41AB7A8D2\x-none.16\MasterDescriptor.x-none.xml
        • Size 27KB
        • SHA256 6efc8a51374283451f78c35598c5a46dd99ae5721fe759c44ac4834f72a71f7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        stream.x64.x-none.db
        • Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\7E450321-DF48-4535-9261-41E41AB7A8D2\x-none.16\stream.x64.x-none.db
        • Size 1.8MB
        • SHA256 c15ce10f5f68e20d5f3e61ac008295955ec7c5f5f826cb014f5e189ceec151bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        stream.x64.x-none.man.dat
        • Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\7E450321-DF48-4535-9261-41E41AB7A8D2\x-none.16\stream.x64.x-none.man.dat
        • Size 2.6MB
        • SHA256 7205b842879ad81517161690fde8983071ce94cff72ee79b016f4b7921ea080b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AirSpace.Etw.man
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\AirSpace.Etw.man
        • Size 412KB
        • SHA256 e0eb85822a27f1f0f9174fcff2e1de0442c59d88cc0e722f2952371206c8512e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml
        • Size 15KB
        • SHA256 0c3bbbd50d4311a69292db277e5045901723fb8cf8f1b6d9da27cf3fab569803
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml
        • Size 149KB
        • SHA256 70e4cc58cad2682a546b406d0f7b5afd6894d69813ec724674dc181091ed6e85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml
        • Size 98KB
        • SHA256 245f98e8b6709d41dd4747b52fd155b0dfa85b34947760c70b744f042b24d8b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml
        • Size 99KB
        • SHA256 281a06a2b340160a71168293c88732f0ed886622c00359c4071b511f725999b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml
        • Size 30KB
        • SHA256 9f28a0896cf55ef3dc535bcf0d3beb98cb9b6eadf7cf612e46687c5e5b4b4df2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml
        • Size 109KB
        • SHA256 725a9b955d180ad7116e2f33f62e2d14817a70b8e3c106926fea5d3d5452f013
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml
        • Size 14KB
        • SHA256 8df6a690f0c707b460b9066b808b434c25f1147b06ec980737d662377e00b675
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.Proof.Culture.msi.16.en-us.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.en-us.xml
        • Size 25KB
        • SHA256 c1d2d10033b3b645baf31bed649a0137acf52014c8615638503e994fca4580cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.Proof.Culture.msi.16.es-es.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.es-es.xml
        • Size 23KB
        • SHA256 e5595c03052b3d031963ea28c8f9b0cd84d93c580e824fdb2f85e45fed01add1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.Proof.Culture.msi.16.fr-fr.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.fr-fr.xml
        • Size 23KB
        • SHA256 cbdb11eb57219cda0594556400129ff02156ad5573c31f5163315d036224808a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.Word.Word.x-none.msi.16.x-none.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Word.Word.x-none.msi.16.x-none.xml
        • Size 93KB
        • SHA256 09594d7715289ca1df746becbfea548298129b221b5d1c285da0161e56990b75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.dcfmui.msi.16.en-us.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.dcfmui.msi.16.en-us.xml
        • Size 9KB
        • SHA256 1e84a982ed2a54809d5aa84fd1e120fde4e16fa4c1b2dd6051c556fa79d32a4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.excelmui.msi.16.en-us.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.excelmui.msi.16.en-us.xml
        • Size 39KB
        • SHA256 7cc91b9bf270700a85a20288bf54ecdc949cc980e1361c30c70f0b3b154e06b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.office32mui.msi.16.en-us.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office32mui.msi.16.en-us.xml
        • Size 16KB
        • SHA256 921a7239a89f6cbf70b53b1ddafe3a0a1076574454ba07b329b45fbd65a8a4c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.office32ww.msi.16.x-none.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office32ww.msi.16.x-none.xml
        • Size 331KB
        • SHA256 8e2851bf9d93d47ca874f072277297e717435916659cfdfaf0916d2bef8f15fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.officemui.msi.16.en-us.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.officemui.msi.16.en-us.xml
        • Size 122KB
        • SHA256 0f0461b299535b737b4158d05dfab689df994c4f8f7fc323eb5738235bdced3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.onenotemui.msi.16.en-us.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.onenotemui.msi.16.en-us.xml
        • Size 18KB
        • SHA256 6a9c88c5e0c8a3eaabc0e82ab85825a6051dbc5c861fbe62a5556dc9a313c830
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.osmmui.msi.16.en-us.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.osmmui.msi.16.en-us.xml
        • Size 10KB
        • SHA256 e3a2f82e31b68f3f5f66d73539598e47d80a6c11b26f554ba7b1f09d31db2bda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.osmuxmui.msi.16.en-us.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.osmuxmui.msi.16.en-us.xml
        • Size 10KB
        • SHA256 463f4c943900da06059a2929823a25de07916e1e82d7846b40a84a0d471f70b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.outlookmui.msi.16.en-us.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.outlookmui.msi.16.en-us.xml
        • Size 107KB
        • SHA256 419834bbc1478bc7a71e55f7b66a745bbaf40c71bdf03113ba5214b666e45574
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.powerpointmui.msi.16.en-us.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.powerpointmui.msi.16.en-us.xml
        • Size 27KB
        • SHA256 4c4be0b5abfcf22a052d1ff1aea93c3f0c7be112b4ca39d22a1533915686b44f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.shared.Office.x-none.msi.16.x-none.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.shared.Office.x-none.msi.16.x-none.xml
        • Size 719KB
        • SHA256 314f3ff24116bda1d3d99a7d785ff198bf6ab39573a84fe9626712d79ffbaae5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.wordmui.msi.16.en-us.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.wordmui.msi.16.en-us.xml
        • Size 77KB
        • SHA256 b521a72fcc5d10f01fc84ea4243bf68b46fe2cc97aae9378c727c2cde2b14711
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft_Office_Office Feature Updates.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_Office Feature Updates.xml
        • Size 6KB
        • SHA256 9c29309fc815d420dec7892709cb71421f7a65ad6be53bd461f0473c3c720d85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoutilstat.etw.man
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\msoutilstat.etw.man
        • Size 111KB
        • SHA256 e2006d844fec4f4739b1d8c3596f6e0eaa0046fba8890d4214456da70a804f37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wordEtw.man
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\wordEtw.man
        • Size 1.1MB
        • SHA256 116f6ba023690f15d81f6da01c71dc888aca9d349f5a15bb62269fc68553b73b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        telemetry.ASM-WindowsDefault.json
        • Path C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json
        • Size 179KB
        • SHA256 3062683ce6d543ddfbdc5672f42bddf9aa9d6ffba5201c9ca8d266c56430ff39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        utc.allow.json
        • Path C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.allow.json
        • Size 2.4MB
        • SHA256 e29346d2e44b0ce042fee1e50681b424c33fb95fa3b3299f440e157453c89594
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        utc.app.json
        • Path C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json
        • Size 135KB
        • SHA256 b0b99eaf736b5df6a30d75ea826fce4b85f06b47ef4dac8c7450d8670435e3e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        utc.app.json.bk
        • Path C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json.bk
        • Size 4KB
        • SHA256 9ed6fab1c91bfb02a718a103265bdf6f33a373b9fedb9cb9756add8fa9eaa87e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        utc.privacy.json
        • Path C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.privacy.json
        • Size 4.0MB
        • SHA256 8bc403f606b7d3191bd99543652c395a2b53282f0c5a5a6e641200c56097e1eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Diagtrack-Listener.etl
        • Path C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\Diagtrack-Listener.etl
        • Size 256KB
        • SHA256 facc7f93fe36db0d936b2e9643aaabb54482dc478895e112d52e4fc579d04ac7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EventStore.db
        • Path C:\ProgramData\Microsoft\Diagnosis\EventStore.db
        • Size 56KB
        • SHA256 48121110a8a974313662721285f1bbb52b2290d9c57fd6a8ea6575883d870afe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EventStore.db
        • Path C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\EventStore.db
        • Size 32KB
        • SHA256 2461417588c2cb0b722d38883d5d80acbb298951ae1ec142b99d0590a01bcea9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EventStore.db
        • Path C:\ProgramData\Microsoft\Diagnosis\TenantStorage\P-ARIA\EventStore.db
        • Size 20KB
        • SHA256 79bdbf99f848d0e080f4275da5f5987a2061b38455ede1ac0124d76696e9bb37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DiagnosticLogCSP_Collector_DeviceProvisioning_2026_9_11_15_4_53.etl
        • Path C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\DiagnosticLogCSP_Collector_DeviceProvisioning_2026_9_11_15_4_53.etl
        • Size 256KB
        • SHA256 717d37d3e856d19cdd54a64801ec0e3d584c0c243657e730a537f39aaa98e5aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DiagnosticLogCSP_Collector_DeviceProvisioning_2026_9_11_15_5_23.etl
        • Path C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\DiagnosticLogCSP_Collector_DeviceProvisioning_2026_9_11_15_5_23.etl
        • Size 256KB
        • SHA256 59d8e24f915deda4d6c02fe938886f1b2923c3f77c88dd0c7b43c56f692ce024
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wlidsvcconfig.xml
        • Path C:\ProgramData\Microsoft\IdentityCRL\INT\wlidsvcconfig.xml
        • Size 12KB
        • SHA256 bfb3c8355da32d71b4bb4763bc443236246193a5ad75ed16854743ff32c7b428
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wlidsvcconfig.xml
        • Path C:\ProgramData\Microsoft\IdentityCRL\production\wlidsvcconfig.xml
        • Size 13KB
        • SHA256 0c5c04f855751fac423ddcff0799a811aa9eb4f37dcb4c790e45af0a1d9843eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Active.GRL
        • Path C:\ProgramData\Microsoft\MF\Active.GRL
        • Size 14KB
        • SHA256 fa75524ad7973d848555289a76eafed2ca58ce25240ec028b306d4e35f0eecd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Pending.GRL
        • Path C:\ProgramData\Microsoft\MF\Pending.GRL
        • Size 14KB
        • SHA256 d07cb2137814baa017a695ed9b5cff9f302b8f7556f1cd35108f1a49812d6ba6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        edb.chk
        • Path C:\ProgramData\Microsoft\Network\Downloader\edb.chk
        • Size 8KB
        • SHA256 90bf06892a308ad595c0970dc0fa053552da2cf3a376bb2f7067c37a6d0b247f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        edbres00002.jrs
        • Path C:\ProgramData\Microsoft\Network\Downloader\edbres00002.jrs
        • Size 1.2MB
        • SHA256 5c61f7a218110422074c992e2aa646bb816135d5d3ff979e7559bc7cb5033971
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qmgr.db
        • Path C:\ProgramData\Microsoft\Network\Downloader\qmgr.db
        • Size 768KB
        • SHA256 2f0c8d7519c07ba70f24baf8a217b6032d8c3666f3dfcf1e40f949b7e85e1372
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qmgr.jfm
        • Path C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm
        • Size 16KB
        • SHA256 4e9a2d6cd34eb42e1f1e1ee1388f6e57bf9ca12686925a6180b8e799cf20e268
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SmsInterceptStore.db
        • Path C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db
        • Size 192KB
        • SHA256 e5c1f2d5f74e4ab330c720dc877abb54af9ac2144ee558e0c36e02fb7db374c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SmsInterceptStore.jfm
        • Path C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.jfm
        • Size 16KB
        • SHA256 b0015f31c2a1e7ac95f7ddebd0dee0d57a875011f373ee08280ce531ce7fdd4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        edb.chk
        • Path C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb.chk
        • Size 8KB
        • SHA256 de8246e2a9dcfc34fbbc240908374309c9bfe193cea8885a97d4f2968074173e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        edbres00001.jrs
        • Path C:\ProgramData\Microsoft\SmsRouter\MessageStore\edbres00001.jrs
        • Size 64KB
        • SHA256 0e057f3b0ad04989a50014b9701b11cfc3ec38ce0c65cc0dd48acbe710e24380
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        edbres00002.jrs
        • Path C:\ProgramData\Microsoft\SmsRouter\MessageStore\edbres00002.jrs
        • Size 64KB
        • SHA256 16b9f6fca68d5a454da1c6950f28cc987080ece9f3669e741b7e61130b8ddafd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        settings.dat
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat
        • Size 8KB
        • SHA256 21c147428953224d084dd06b5573144279181dcc792d05cda550380c7d3583bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        settings.dat
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat
        • Size 8KB
        • SHA256 3558a782e6644e51944e69ab47a00d66966238aef5c7e2f6ce04b14c31aa4072
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        settings.dat
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat
        • Size 8KB
        • SHA256 5c9448d75ed9f75360395170f9690c184c6e9b08a2dd47494bc46f9232f388f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        settings.dat
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Settings\settings.dat
        • Size 8KB
        • SHA256 cdc3634445cbbc2f8f218d8b50f5e79d93a07e53ced59ee28463e06fa9de2937
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        settings.dat
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Settings\settings.dat
        • Size 8KB
        • SHA256 6c6a3e682f640606b6e4fe5b3a2377ef379fae7c4ac1638e3181b2ef73fbcf80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        settings.dat
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\Settings\settings.dat
        • Size 8KB
        • SHA256 31493bd01d9c1fd131b0b58098f8947e225fbc4778902438ea02cbf6d7bb1474
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppCache134336130258824920.txt
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336130258824920.txt
        • Size 47KB
        • SHA256 2fcb566aa66780f4f85d1d803d16726ee16931d5a1b59063999402bb2f812207
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        settings.dat
        • Path C:\Users\Admin\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\Settings\settings.dat
        • Size 8KB
        • SHA256 50c2efcd9e64b0f98212662ea07ee63d0be7002c07439717bc91333d57cdca8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        settings.dat
        • Path C:\Users\Admin\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\Settings\settings.dat
        • Size 8KB
        • SHA256 db2ec4938d49a6a4d1f4ea64edf3c5d7bfc40ba1f5a82cbd5f4e0c0e7f0c6e11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        settings.dat
        • Path C:\Users\Admin\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\Settings\settings.dat
        • Size 8KB
        • SHA256 868c395eddf5aca6dc594b02853ae04b9c366d412eb8ae9945d5cc3e7bc211e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1216-2-0x00007FF8132B0000-0x00007FF8134A5000-memory.dmp
        Download

        memory/1700-0-0x00007FF8132B0000-0x00007FF8134A5000-memory.dmp
        Download

        memory/3328-1-0x00007FF8132B0000-0x00007FF8134A5000-memory.dmp
        Download