Overview

overview

10

Static

static

3

2026-09-19...id.exe

windows10-2004-x64

10

2026-09-19...id.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/09/2026, 10:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-19_a6a2554ebd335aa12dfa6db01ecc28e9_cobalt-strike_icedid.exe
  • Size 116KB
  • Sample260919-msdrmszanf
  • SHA256 c7862295b6030c3611a5dbc529dc1400a3fac2db077a89b02751f41debcd089b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasionexecutionpersistencespywarestealer

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 6 IoCs
    persistence
  • Sets service image path in registry 3 TTPs 3 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 3 IoCs
  • Drops file in Windows directory 3 IoCs
  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies Control Panel 15 IoCs
    defense_evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-19_a6a2554ebd335aa12dfa6db01ecc28e9_cobalt-strike_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-19_a6a2554ebd335aa12dfa6db01ecc28e9_cobalt-strike_icedid.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Sets service image path in registry
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies Control Panel
    • Suspicious use of WriteProcessMemory
    PID:4536
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c schtasks /Create /TN "\WindowsFontCacheSvc" /SC ONLOGON /RL HIGHEST /F /TR "\"C:\Users\Admin\AppData\Local\Temp\2026-09-19_a6a2554ebd335aa12dfa6db01ecc28e9_cobalt-strike_icedid.exe\" /s"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3928
      • C:\Windows\system32\schtasks.exe
        schtasks /Create /TN "\WindowsFontCacheSvc" /SC ONLOGON /RL HIGHEST /F /TR "\"C:\Users\Admin\AppData\Local\Temp\2026-09-19_a6a2554ebd335aa12dfa6db01ecc28e9_cobalt-strike_icedid.exe\" /s"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2868
  • C:\Users\Admin\AppData\Local\Temp\2026-09-19_a6a2554ebd335aa12dfa6db01ecc28e9_cobalt-strike_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-19_a6a2554ebd335aa12dfa6db01ecc28e9_cobalt-strike_icedid.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Sets service image path in registry
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies Control Panel
    • Suspicious use of WriteProcessMemory
    PID:3380
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c schtasks /Create /TN "\WindowsFontCacheSvc" /SC ONLOGON /RL HIGHEST /F /TR "\"C:\Users\Admin\AppData\Local\Temp\2026-09-19_a6a2554ebd335aa12dfa6db01ecc28e9_cobalt-strike_icedid.exe\" /s"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5128
      • C:\Windows\system32\schtasks.exe
        schtasks /Create /TN "\WindowsFontCacheSvc" /SC ONLOGON /RL HIGHEST /F /TR "\"C:\Users\Admin\AppData\Local\Temp\2026-09-19_a6a2554ebd335aa12dfa6db01ecc28e9_cobalt-strike_icedid.exe\" /s"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4936
  • C:\Users\Admin\AppData\Local\Temp\2026-09-19_a6a2554ebd335aa12dfa6db01ecc28e9_cobalt-strike_icedid.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-19_a6a2554ebd335aa12dfa6db01ecc28e9_cobalt-strike_icedid.exe
    1⤵
    • Modifies WinLogon for persistence
    • Sets service image path in registry
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies Control Panel
    • Suspicious use of WriteProcessMemory
    PID:1328
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c schtasks /Create /TN "\WindowsFontCacheSvc" /SC ONLOGON /RL HIGHEST /F /TR "\"C:\Users\Admin\AppData\Local\Temp\2026-09-19_a6a2554ebd335aa12dfa6db01ecc28e9_cobalt-strike_icedid.exe\" /s"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5800
      • C:\Windows\system32\schtasks.exe
        schtasks /Create /TN "\WindowsFontCacheSvc" /SC ONLOGON /RL HIGHEST /F /TR "\"C:\Users\Admin\AppData\Local\Temp\2026-09-19_a6a2554ebd335aa12dfa6db01ecc28e9_cobalt-strike_icedid.exe\" /s"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4120

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        Windows Command Shell

        1
        T1059.003

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Persistence

        Boot or Logon Autostart Execution

        3
        T1547

        Registry Run Keys / Startup Folder

        2
        T1547.001

        Winlogon Helper DLL

        1
        T1547.004

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Privilege Escalation

        Boot or Logon Autostart Execution

        3
        T1547

        Registry Run Keys / Startup Folder

        2
        T1547.001

        Winlogon Helper DLL

        1
        T1547.004

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Defense Evasion

        Modify Registry

        3
        T1112

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        2
        T1012

        System Information Discovery

        1
        T1082

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AcroRead.msi
        • Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRead.msi
        • Size 2.7MB
        • SHA256 9f60b5ae21a45c37d571d3492df625b1ce01318d976b384651e9c5505be7f98b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Manifest.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\Manifest.xml
        • Size 4.3MB
        • SHA256 0d71c9fd7896d9ecd16d327bc4fcc9985b3fcd65e1c914d1f1099373fc007a59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UserManifest.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\UserManifest.xml
        • Size 2.7MB
        • SHA256 0b240343df1171a43ad52594cf0283f43c1914b6fc2f46b54203ee9bbda97d09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MasterDescriptor.en-us.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\D52EB6C9-B94A-4977-9225-81C417473941\en-us.16\MasterDescriptor.en-us.xml
        • Size 28KB
        • SHA256 cf61efc3337a1bfe53d8dfc017484e73e7c2996923e0276f44f2a6f4ba45996a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        stream.x64.en-us.db
        • Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\D52EB6C9-B94A-4977-9225-81C417473941\en-us.16\stream.x64.en-us.db
        • Size 438KB
        • SHA256 fc1dce67aa4def9f69670731eed7a6a505d6faf8d54dd9736085845e5d1207fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        stream.x64.en-us.man.dat
        • Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\D52EB6C9-B94A-4977-9225-81C417473941\en-us.16\stream.x64.en-us.man.dat
        • Size 622KB
        • SHA256 5800e26aee53e6a58c9a37ba21b08ef8ea404132c78f2e946e304d13fc903a62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mergedVirtualRegistry.dat
        • Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\D52EB6C9-B94A-4977-9225-81C417473941\mergedVirtualRegistry.dat
        • Size 6.5MB
        • SHA256 f27ff6c9d20717333a0e5aed2c6dd7983b550d891be002fce3eeb1d27fc1ba0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MasterDescriptor.x-none.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\D52EB6C9-B94A-4977-9225-81C417473941\x-none.16\MasterDescriptor.x-none.xml
        • Size 27KB
        • SHA256 5963c9fb33cb803e87407fcf3509e1f6f082dd4fefc30e6a725ca47972bc67e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        stream.x64.x-none.db
        • Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\D52EB6C9-B94A-4977-9225-81C417473941\x-none.16\stream.x64.x-none.db
        • Size 1.8MB
        • SHA256 288d5ccb8edc934b868d0480c10a06327e28d288bc2e1484b505b017ccee3935
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        stream.x64.x-none.man.dat
        • Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\D52EB6C9-B94A-4977-9225-81C417473941\x-none.16\stream.x64.x-none.man.dat
        • Size 2.6MB
        • SHA256 cb9dd35f5b7f6a9010ace86726c771423ff0a7fbe6779c8023fa378496f97448
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AirSpace.Etw.man
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\AirSpace.Etw.man
        • Size 412KB
        • SHA256 9f6568bd52d7c8a0f37c892cfcd27a64f389e0a6bf2fde3147b98373badc9f56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml
        • Size 15KB
        • SHA256 de5799c48730218873e9190108c3ff8bda7412df06bccbe3aeace29777ccbb2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml
        • Size 149KB
        • SHA256 c05c7aa0558700eeb15dbfa66e9ba4b65fe3b4a156ab701fad61243296210857
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml
        • Size 98KB
        • SHA256 85f53d9e1f37fcc9c1d34c2b2ff033e1a87e49b7a16f37e4388f73204a04e1bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml
        • Size 99KB
        • SHA256 10d617fafc1ff0638efe1c5468382923a852241d3ffae3268403b1fbc860461b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml
        • Size 30KB
        • SHA256 a2154b786a8adf7e51696e53f957c0637d178fb8419560bbc785eabed73dfead
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml
        • Size 109KB
        • SHA256 8987353e06da165c0d4715579795df3dc3c4ec009895ba19ad08f11c776ab023
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml
        • Size 14KB
        • SHA256 a0926e44173f1d20b01d06dc43dd49c2579e7dfb553335c03bc3a0393d378e2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.Proof.Culture.msi.16.en-us.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.en-us.xml
        • Size 25KB
        • SHA256 c837ef6016a2aace5bf0880e5b7ec1451ab00fef35a70dfe09a6692aab385b01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.Proof.Culture.msi.16.es-es.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.es-es.xml
        • Size 23KB
        • SHA256 731383d79ae4542202bb9e04e35a77fa4d9b7c84ecf99f3be2839ec28bb103c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.Proof.Culture.msi.16.fr-fr.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.fr-fr.xml
        • Size 23KB
        • SHA256 bf40aa1521ad712223aaa80b1d6ecf960114b5a9a370bfed58ab99d26f39a772
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.Word.Word.x-none.msi.16.x-none.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Word.Word.x-none.msi.16.x-none.xml
        • Size 93KB
        • SHA256 870ff23b26819d75620425f6eee8c0ecd1481bbb9e60d825ec95b93c57bac4be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.dcfmui.msi.16.en-us.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.dcfmui.msi.16.en-us.xml
        • Size 9KB
        • SHA256 3aa100921beb83adf118cd397445227c631e17458fd5d68fca54529fefd0f153
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.excelmui.msi.16.en-us.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.excelmui.msi.16.en-us.xml
        • Size 39KB
        • SHA256 aacc25facc3c5abeec282c882f2d493028eaca32a0658f945ce72244419218dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.office32mui.msi.16.en-us.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office32mui.msi.16.en-us.xml
        • Size 16KB
        • SHA256 70eb3929f13a2ff61f5eac650937ec3abbfafd56da34ff1d8ec088534b6efec6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.office32ww.msi.16.x-none.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office32ww.msi.16.x-none.xml
        • Size 331KB
        • SHA256 3316b686e1bc757402d33b9f28556774981fb42859af5538cd69016cdac718ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.officemui.msi.16.en-us.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.officemui.msi.16.en-us.xml
        • Size 122KB
        • SHA256 2200b0e053839058359d83835fa40699bc78912f3db2f6087437a81f77a73c37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.onenotemui.msi.16.en-us.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.onenotemui.msi.16.en-us.xml
        • Size 18KB
        • SHA256 a8424e542aa8a60e13215c3e231ddf60325ceeeeaa3d0fe1f68c99143c7793b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.osmmui.msi.16.en-us.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.osmmui.msi.16.en-us.xml
        • Size 10KB
        • SHA256 b4238e9803827135ee3cc1078dae1bb055f79ce7a421faedf1af1d0528b29358
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.osmuxmui.msi.16.en-us.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.osmuxmui.msi.16.en-us.xml
        • Size 10KB
        • SHA256 52cb2bb55e4ab68bc28830cb04317e769dacf5420be0960703cef530e38050a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.outlookmui.msi.16.en-us.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.outlookmui.msi.16.en-us.xml
        • Size 107KB
        • SHA256 53252d378b80434171163c51e28a3bef3e53f1acc65ff22e401e9fc4808f081a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.powerpointmui.msi.16.en-us.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.powerpointmui.msi.16.en-us.xml
        • Size 27KB
        • SHA256 adfac46c106c8f0c63292f8d92c2e85206f4865d7c7a335a43945f6393a4b336
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.shared.Office.x-none.msi.16.x-none.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.shared.Office.x-none.msi.16.x-none.xml
        • Size 719KB
        • SHA256 24502bffde73829ad73e911680b644e19d9bd4e148dbf09c5930da679621f988
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C2RManifest.wordmui.msi.16.en-us.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.wordmui.msi.16.en-us.xml
        • Size 77KB
        • SHA256 3bcb21c6b2171a963d507c92bc4a9f33d6722bc84904beddeaf4845248e7a20c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft_Office_Office Feature Updates.xml
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_Office Feature Updates.xml
        • Size 6KB
        • SHA256 3e9294b4de14f2d54a829b85ff049cac677ce5805d74adf0f1b62b27c830ab4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoutilstat.etw.man
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\msoutilstat.etw.man
        • Size 111KB
        • SHA256 a65b01cef8ef03c180f68b37f8e6a31eff5373fb17be3bdce40aff48044564b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wordEtw.man
        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\wordEtw.man
        • Size 1.1MB
        • SHA256 70bea7b46220024e77810d358c4f195827542e1343d16ad8c7d273b0441479d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        utc.app.json
        • Path C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json
        • Size 4KB
        • SHA256 4884fd445fd721ec80e825cef3523d7ba4e9572c6af95c4985878bb596096d0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Diagtrack-Listener.etl.004
        • Path C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\Diagtrack-Listener.etl.004
        • Size 448KB
        • SHA256 b8283d4cd73b3a4453d000499b20420f2a3457f247fc53bf2fc5d577807d6545
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EventStore.db
        • Path C:\ProgramData\Microsoft\Diagnosis\EventStore.db
        • Size 92KB
        • SHA256 96acfbcc5f79d0dccb12494c7173ad8421b15ddd3e9d15a1584eabe903f15bae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EventStore.db
        • Path C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\EventStore.db
        • Size 48KB
        • SHA256 92df1507d19a224f22429f84e0db6a29e25cd697b62ca7fef57bff7a1eda0876
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EventStore.db
        • Path C:\ProgramData\Microsoft\Diagnosis\TenantStorage\P-ARIA\EventStore.db
        • Size 20KB
        • SHA256 bc405ed22090e1a7d13d2c9c907c33895e2e7a256b0a23d8d8370f43a3b3098a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wlidsvcconfig.xml
        • Path C:\ProgramData\Microsoft\IdentityCRL\INT\wlidsvcconfig.xml
        • Size 14KB
        • SHA256 d9548b1cc7e5884f5bba62592d1145315a1fa0aa01260e713f8eadd79fd742c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wlidsvcconfig.xml
        • Path C:\ProgramData\Microsoft\IdentityCRL\production\wlidsvcconfig.xml
        • Size 13KB
        • SHA256 95b6a0445292972fe6cff51683fde6c7997d97771cc20376c72cb14b97599902
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Active.GRL
        • Path C:\ProgramData\Microsoft\MF\Active.GRL
        • Size 14KB
        • SHA256 8554f07487fb542e6d2f2799b8e4d4ad706f6bcc3d5fdf941c365ccd9568a9f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Pending.GRL
        • Path C:\ProgramData\Microsoft\MF\Pending.GRL
        • Size 14KB
        • SHA256 5739f16bf0cf7309a1b3ac0175d4b758a39d85d85418ca2a5968647778d30959
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        edb.chk
        • Path C:\ProgramData\Microsoft\Network\Downloader\edb.chk
        • Size 8KB
        • SHA256 a9a6713d79fd66f309a70d26891a1469774e030dfb4b7422df350480d5ae1dd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        edbres00002.jrs
        • Path C:\ProgramData\Microsoft\Network\Downloader\edbres00002.jrs
        • Size 1.2MB
        • SHA256 cd465db195cd5f35fecf98bc6463602b2672da60c53204436a07001b2e86c17d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qmgr.db
        • Path C:\ProgramData\Microsoft\Network\Downloader\qmgr.db
        • Size 768KB
        • SHA256 dec34838bae4adf4d5bdae695ac35ba40e746943ad1a072e60a1585c844dfb03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qmgr.jfm
        • Path C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm
        • Size 16KB
        • SHA256 4616593a5a82c01a4e0f4a61668db30c6bf8458f5b50a07b8060a0631dc3b370
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        guest.bmp
        • Path C:\ProgramData\Microsoft\User Account Pictures\guest.bmp
        • Size 392KB
        • SHA256 6b353f5ea33ac90c440d89bfb7b8af289c48f3adef6b1e5213110d76dc373196
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        user.bmp
        • Path C:\ProgramData\Microsoft\User Account Pictures\user.bmp
        • Size 392KB
        • SHA256 172b3c210e611d37b2cb0915d91b724680f5fcd4a26e2599f370a3845e0707c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SHS-09122026-000956-7-1ff-26100.1.amd64fre.ge_release.240331-1435.etl
        • Path C:\ProgramData\Microsoft\Windows Security Health\Logs\SHS-09122026-000956-7-1ff-26100.1.amd64fre.ge_release.240331-1435.etl
        • Size 12KB
        • SHA256 4791fa7a8b12862652a3a66e9599727d3c54a851c6dcdf02c6eb3daf7defeec3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SHS-09122026-001024-7-1ff-26100.1.amd64fre.ge_release.240331-1435.etl
        • Path C:\ProgramData\Microsoft\Windows Security Health\Logs\SHS-09122026-001024-7-1ff-26100.1.amd64fre.ge_release.240331-1435.etl
        • Size 12KB
        • SHA256 79c1f6da06a3e3e8307e55d47a159e5479e639a035cdf7d07ab015f4922918d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SHS-09122026-001129-7-1ff-26100.1.amd64fre.ge_release.240331-1435.etl
        • Path C:\ProgramData\Microsoft\Windows Security Health\Logs\SHS-09122026-001129-7-1ff-26100.1.amd64fre.ge_release.240331-1435.etl
        • Size 16KB
        • SHA256 f49bd5932b4dbafff4f5bc8129998b20a882c4415a6f5fb86ef795605a3615aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SHS-09122026-001241-7-1ff-26100.1.amd64fre.ge_release.240331-1435.etl
        • Path C:\ProgramData\Microsoft\Windows Security Health\Logs\SHS-09122026-001241-7-1ff-26100.1.amd64fre.ge_release.240331-1435.etl
        • Size 16KB
        • SHA256 d61c2892bb576217059fff93861820b383b7fc784770d3076361b7297678c5f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SHS-09122026-001306-7-1ff-26100.1.amd64fre.ge_release.240331-1435.etl
        • Path C:\ProgramData\Microsoft\Windows Security Health\Logs\SHS-09122026-001306-7-1ff-26100.1.amd64fre.ge_release.240331-1435.etl
        • Size 16KB
        • SHA256 6e1878b60c70c5c4ae2c8ef151f4aa95e9613421b55dc2a47b4b12db8e3d682d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SHS-09122026-001402-7-1ff-26100.1.amd64fre.ge_release.240331-1435.etl
        • Path C:\ProgramData\Microsoft\Windows Security Health\Logs\SHS-09122026-001402-7-1ff-26100.1.amd64fre.ge_release.240331-1435.etl
        • Size 16KB
        • SHA256 af9dbcbc7cbd6751f7f0c24bc4c44eccae7b7f104b1e5698a6fd1ea1a66acba7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SHS-09122026-001546-7-1ff-26100.1.amd64fre.ge_release.240331-1435.etl
        • Path C:\ProgramData\Microsoft\Windows Security Health\Logs\SHS-09122026-001546-7-1ff-26100.1.amd64fre.ge_release.240331-1435.etl
        • Size 12KB
        • SHA256 76db66b05eddd98e3db0137bf124028be6b2c456be99c232b1a7e7aa49f3811d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SHS-09122026-001650-7-1ff-26100.1.amd64fre.ge_release.240331-1435.etl
        • Path C:\ProgramData\Microsoft\Windows Security Health\Logs\SHS-09122026-001650-7-1ff-26100.1.amd64fre.ge_release.240331-1435.etl
        • Size 12KB
        • SHA256 3f7a9f52dbe511d03109c51dde42219952f2ed06fd17a63fd7c24f74e5798e96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SHS-09122026-001726-7-1ff-26100.1.amd64fre.ge_release.240331-1435.etl
        • Path C:\ProgramData\Microsoft\Windows Security Health\Logs\SHS-09122026-001726-7-1ff-26100.1.amd64fre.ge_release.240331-1435.etl
        • Size 12KB
        • SHA256 e95d2409730c6d00f26093fa2fa2d60fadc67d2d25ec845738ae419c1de84e16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1328-2-0x00007FFF48FC0000-0x00007FFF49223000-memory.dmp
        Download

        memory/3380-1-0x00007FFF48FC0000-0x00007FFF49223000-memory.dmp
        Download

        memory/4536-0-0x00007FFF48FC0000-0x00007FFF49223000-memory.dmp
        Download