a3bfc0780ade271d462ce6f612edc283b84e781d7ae6dbca2018fb61ac5ae83c

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
05-08-2023 03:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

remover.exe
Size

9.8MB
MD5

c0f73739b27e74631d559d53ce352d84
SHA1

dcc94df4448ac0198b41f4f515d92ddde62a48de
SHA256

a3bfc0780ade271d462ce6f612edc283b84e781d7ae6dbca2018fb61ac5ae83c
SHA512

5245756e23db3c055a83676297825ea529ae126979612b5b1d882f19a2f4b4dd636ef521d95427a49b6599bd1887e946a06eccec0d29eb5bd71457581e853831
SSDEEP

196608:Lux7QC8ICteEroXxWVfEqlbkkwR7VTE548RmU/3ZlsPvu4DoDTvN8CXLNGO/639X:Qx8InEroXgfEqirRRo5tN3ZWu4DSTtLr

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
114	3584	powershell.exe
116	3584	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
5504	dismhost.exe

Loads dropped DLL 30 IoCs

pid	Process
1992	remover.exe
1992	remover.exe
1992	remover.exe
1992	remover.exe
1992	remover.exe
1992	remover.exe
1992	remover.exe
1992	remover.exe
1992	remover.exe
1992	remover.exe
1992	remover.exe
5504	dismhost.exe
5504	dismhost.exe
5504	dismhost.exe
5504	dismhost.exe
5504	dismhost.exe
5504	dismhost.exe
5504	dismhost.exe
5504	dismhost.exe
5504	dismhost.exe
5504	dismhost.exe
5504	dismhost.exe
5504	dismhost.exe
5504	dismhost.exe
5504	dismhost.exe
5504	dismhost.exe
5504	dismhost.exe
5504	dismhost.exe
5504	dismhost.exe
5504	dismhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe

Launches sc.exe 29 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3572	sc.exe
5132	sc.exe
5772	sc.exe
5824	sc.exe
5956	sc.exe
6116	sc.exe
184	sc.exe
3068	sc.exe
1200	sc.exe
5848	sc.exe
5372	sc.exe
5492	sc.exe
2932	sc.exe
5900	sc.exe
2044	sc.exe
5400	sc.exe
5980	sc.exe
5904	sc.exe
6056	sc.exe
5532	sc.exe
1876	sc.exe
5356	sc.exe
5488	sc.exe
3432	sc.exe
4996	sc.exe
4416	sc.exe
5728	sc.exe
5940	sc.exe
5228	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3011986978-2180659500-3669311805-1000\{132181AA-FE70-4669-BE4A-DA2BC1EF8B5F}	msedge.exe

Modifies registry key 1 TTPs 19 IoCs

Modify Registry

T1112

pid	Process
2944	reg.exe
5992	reg.exe
4116	reg.exe
1048	reg.exe
3112	reg.exe
5140	reg.exe
5700	reg.exe
5740	reg.exe
5784	reg.exe
5496	reg.exe
3068	reg.exe
5864	reg.exe
5760	reg.exe
1068	reg.exe
5816	reg.exe
5936	reg.exe
5428	reg.exe
5468	reg.exe
5516	reg.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5368	PING.EXE

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1492	msedge.exe
1492	msedge.exe
4572	msedge.exe
4572	msedge.exe
1228	identity_helper.exe
1228	identity_helper.exe
5076	msedge.exe
5076	msedge.exe
3584	powershell.exe
3584	powershell.exe
3584	powershell.exe
5900	powershell.exe
5900	powershell.exe
5900	powershell.exe
4332	powershell.exe
4332	powershell.exe
4332	powershell.exe
5968	powershell.exe
5968	powershell.exe
5968	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3584	powershell.exe
Token: SeDebugPrivilege	5900	powershell.exe
Token: SeIncreaseQuotaPrivilege	6076	WMIC.exe
Token: SeSecurityPrivilege	6076	WMIC.exe
Token: SeTakeOwnershipPrivilege	6076	WMIC.exe
Token: SeLoadDriverPrivilege	6076	WMIC.exe
Token: SeSystemProfilePrivilege	6076	WMIC.exe
Token: SeSystemtimePrivilege	6076	WMIC.exe
Token: SeProfSingleProcessPrivilege	6076	WMIC.exe
Token: SeIncBasePriorityPrivilege	6076	WMIC.exe
Token: SeCreatePagefilePrivilege	6076	WMIC.exe
Token: SeBackupPrivilege	6076	WMIC.exe
Token: SeRestorePrivilege	6076	WMIC.exe
Token: SeShutdownPrivilege	6076	WMIC.exe
Token: SeDebugPrivilege	6076	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6076	WMIC.exe
Token: SeRemoteShutdownPrivilege	6076	WMIC.exe
Token: SeUndockPrivilege	6076	WMIC.exe
Token: SeManageVolumePrivilege	6076	WMIC.exe
Token: 33	6076	WMIC.exe
Token: 34	6076	WMIC.exe
Token: 35	6076	WMIC.exe
Token: 36	6076	WMIC.exe
Token: SeIncreaseQuotaPrivilege	6076	WMIC.exe
Token: SeSecurityPrivilege	6076	WMIC.exe
Token: SeTakeOwnershipPrivilege	6076	WMIC.exe
Token: SeLoadDriverPrivilege	6076	WMIC.exe
Token: SeSystemProfilePrivilege	6076	WMIC.exe
Token: SeSystemtimePrivilege	6076	WMIC.exe
Token: SeProfSingleProcessPrivilege	6076	WMIC.exe
Token: SeIncBasePriorityPrivilege	6076	WMIC.exe
Token: SeCreatePagefilePrivilege	6076	WMIC.exe
Token: SeBackupPrivilege	6076	WMIC.exe
Token: SeRestorePrivilege	6076	WMIC.exe
Token: SeShutdownPrivilege	6076	WMIC.exe
Token: SeDebugPrivilege	6076	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6076	WMIC.exe
Token: SeRemoteShutdownPrivilege	6076	WMIC.exe
Token: SeUndockPrivilege	6076	WMIC.exe
Token: SeManageVolumePrivilege	6076	WMIC.exe
Token: 33	6076	WMIC.exe
Token: 34	6076	WMIC.exe
Token: 35	6076	WMIC.exe
Token: 36	6076	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3680	WMIC.exe
Token: SeSecurityPrivilege	3680	WMIC.exe
Token: SeTakeOwnershipPrivilege	3680	WMIC.exe
Token: SeLoadDriverPrivilege	3680	WMIC.exe
Token: SeSystemProfilePrivilege	3680	WMIC.exe
Token: SeSystemtimePrivilege	3680	WMIC.exe
Token: SeProfSingleProcessPrivilege	3680	WMIC.exe
Token: SeIncBasePriorityPrivilege	3680	WMIC.exe
Token: SeCreatePagefilePrivilege	3680	WMIC.exe
Token: SeBackupPrivilege	3680	WMIC.exe
Token: SeRestorePrivilege	3680	WMIC.exe
Token: SeShutdownPrivilege	3680	WMIC.exe
Token: SeDebugPrivilege	3680	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3680	WMIC.exe
Token: SeRemoteShutdownPrivilege	3680	WMIC.exe
Token: SeUndockPrivilege	3680	WMIC.exe
Token: SeManageVolumePrivilege	3680	WMIC.exe
Token: 33	3680	WMIC.exe
Token: 34	3680	WMIC.exe
Token: 35	3680	WMIC.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1992	remover.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 1992	1068	remover.exe	88
PID 1068 wrote to memory of 1992	1068	remover.exe	88
PID 1992 wrote to memory of 3684	1992	remover.exe	89
PID 1992 wrote to memory of 3684	1992	remover.exe	89
PID 4572 wrote to memory of 2456	4572	msedge.exe	103
PID 4572 wrote to memory of 2456	4572	msedge.exe	103
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 4384	4572	msedge.exe	104
PID 4572 wrote to memory of 1492	4572	msedge.exe	105
PID 4572 wrote to memory of 1492	4572	msedge.exe	105
PID 4572 wrote to memory of 2220	4572	msedge.exe	106
PID 4572 wrote to memory of 2220	4572	msedge.exe	106
PID 4572 wrote to memory of 2220	4572	msedge.exe	106
PID 4572 wrote to memory of 2220	4572	msedge.exe	106
PID 4572 wrote to memory of 2220	4572	msedge.exe	106
PID 4572 wrote to memory of 2220	4572	msedge.exe	106
PID 4572 wrote to memory of 2220	4572	msedge.exe	106
PID 4572 wrote to memory of 2220	4572	msedge.exe	106
PID 4572 wrote to memory of 2220	4572	msedge.exe	106
PID 4572 wrote to memory of 2220	4572	msedge.exe	106
PID 4572 wrote to memory of 2220	4572	msedge.exe	106
PID 4572 wrote to memory of 2220	4572	msedge.exe	106
PID 4572 wrote to memory of 2220	4572	msedge.exe	106
PID 4572 wrote to memory of 2220	4572	msedge.exe	106
PID 4572 wrote to memory of 2220	4572	msedge.exe	106
PID 4572 wrote to memory of 2220	4572	msedge.exe	106

C:\Users\Admin\AppData\Local\Temp\remover.exe
"C:\Users\Admin\AppData\Local\Temp\remover.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Users\Admin\AppData\Local\Temp\remover.exe
  "C:\Users\Admin\AppData\Local\Temp\remover.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:3684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffbf3aa46f8,0x7ffbf3aa4708,0x7ffbf3aa4718
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3461795420499784645,12334349960300268949,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,3461795420499784645,12334349960300268949,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,3461795420499784645,12334349960300268949,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3461795420499784645,12334349960300268949,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3461795420499784645,12334349960300268949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3461795420499784645,12334349960300268949,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3461795420499784645,12334349960300268949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3461795420499784645,12334349960300268949,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3624 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3461795420499784645,12334349960300268949,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3624 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3461795420499784645,12334349960300268949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3461795420499784645,12334349960300268949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3461795420499784645,12334349960300268949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3461795420499784645,12334349960300268949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2096,3461795420499784645,12334349960300268949,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2096,3461795420499784645,12334349960300268949,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3461795420499784645,12334349960300268949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3461795420499784645,12334349960300268949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2072 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3461795420499784645,12334349960300268949,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2032 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3461795420499784645,12334349960300268949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3461795420499784645,12334349960300268949,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:5544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4996

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\Temp\MAS_718.cmd" "
  2⤵
  PID:5248
- - C:\Windows\System32\findstr.exe
    findstr /rxc:".*" "MAS_718.cmd"
    3⤵
    PID:5300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ver
    3⤵
    PID:5316
- - C:\Windows\System32\find.exe
    find /i "0x0"
    3⤵
    PID:5340
- - C:\Windows\System32\reg.exe
    reg query "HKCU\Console" /v ForceV2
    3⤵
    PID:5332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c echo prompt $E | cmd
    3⤵
    PID:5368
  - - C:\Windows\System32\cmd.exe
      cmd
      4⤵
      PID:5392
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "
      4⤵
      PID:5384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Windows\Temp\MAS_718.cmd" "
    3⤵
    PID:5420
- - C:\Windows\System32\find.exe
    find /i "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:5428
- - C:\Windows\System32\fltMC.exe
    fltmc
    3⤵
    PID:5452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
    3⤵
    PID:5468
  - - C:\Windows\System32\reg.exe
      reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
      4⤵
      PID:5484
- - C:\Windows\System32\mode.com
    mode 76, 30
    3⤵
    PID:5500
- - C:\Windows\System32\choice.exe
    choice /C:12345670 /N
    3⤵
    PID:5520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ver
    3⤵
    PID:5760
- - C:\Windows\System32\find.exe
    find /i "0x0"
    3⤵
    PID:5784
- - C:\Windows\System32\reg.exe
    reg query "HKCU\Console" /v ForceV2
    3⤵
    PID:5776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c echo prompt $E | cmd
    3⤵
    PID:5808
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "
      4⤵
      PID:5824
  - - C:\Windows\System32\cmd.exe
      cmd
      4⤵
      PID:5832
- - C:\Windows\System32\mode.com
    mode 102, 34
    3⤵
    PID:5860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%')"
    3⤵
    PID:5884
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%')
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo "Windows 10 Pro" "
    3⤵
    PID:6044
- - C:\Windows\System32\find.exe
    find /i "Windows"
    3⤵
    PID:6052
- - C:\Windows\System32\find.exe
    find /i "computersystem"
    3⤵
    PID:6084
- - C:\Windows\System32\wbem\WMIC.exe
    wmic path Win32_ComputerSystem get CreationClassName /value
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6076
- - C:\Windows\System32\sc.exe
    sc start sppsvc
    3⤵
    - Launches sc.exe
    PID:3572
- - C:\Windows\System32\wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL) get Name /value
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3680
- - C:\Windows\System32\findstr.exe
    findstr /i "Windows"
    3⤵
    PID:4180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn 2>nul
    3⤵
    PID:5228
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn
      4⤵
      PID:5244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST" 2>nul
    3⤵
    PID:5312
  - - C:\Windows\System32\wbem\WMIC.exe
      wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST
      4⤵
      PID:5324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
    3⤵
    PID:5348
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
      4⤵
      PID:5404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 1 l.root-servers.net
    3⤵
    PID:5396
  - - C:\Windows\System32\PING.EXE
      ping -n 1 l.root-servers.net
      4⤵
      Runs ping.exe
      PID:5368
- - C:\Windows\System32\find.exe
    find /i "0x0"
    3⤵
    PID:5428
- - C:\Windows\System32\reg.exe
    reg query "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
    3⤵
    PID:5440
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
    3⤵
    PID:5496
- - C:\Windows\System32\find.exe
    find /i "0x0"
    3⤵
    PID:5488
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ImagePath
    3⤵
    - Modifies registry key
    PID:5516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Start 2>nul
    3⤵
    PID:5500
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Start
      4⤵
      Modifies registry key
      PID:3068
- - C:\Windows\System32\sc.exe
    sc start ClipSVC
    3⤵
    - Launches sc.exe
    PID:4996
- - C:\Windows\System32\sc.exe
    sc query ClipSVC
    3⤵
    - Launches sc.exe
    PID:1200
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ImagePath
    3⤵
    - Modifies registry key
    PID:3112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Start 2>nul
    3⤵
    PID:4332
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Start
      4⤵
      Modifies registry key
      PID:1068
- - C:\Windows\System32\sc.exe
    sc start wlidsvc
    3⤵
    - Launches sc.exe
    PID:2932
- - C:\Windows\System32\sc.exe
    sc query wlidsvc
    3⤵
    - Launches sc.exe
    PID:5132
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ImagePath
    3⤵
    - Modifies registry key
    PID:5140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Start 2>nul
    3⤵
    PID:5156
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Start
      4⤵
      Modifies registry key
      PID:5700
- - C:\Windows\System32\sc.exe
    sc start sppsvc
    3⤵
    - Launches sc.exe
    PID:4416
- - C:\Windows\System32\sc.exe
    sc query sppsvc
    3⤵
    - Launches sc.exe
    PID:5728
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ImagePath
    3⤵
    - Modifies registry key
    PID:5740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Start 2>nul
    3⤵
    PID:4804
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Start
      4⤵
      Modifies registry key
      PID:2944
- - C:\Windows\System32\sc.exe
    sc start KeyIso
    3⤵
    - Launches sc.exe
    PID:5532
- - C:\Windows\System32\sc.exe
    sc query KeyIso
    3⤵
    - Launches sc.exe
    PID:5772
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ImagePath
    3⤵
    - Modifies registry key
    PID:5760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Start 2>nul
    3⤵
    PID:5788
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Start
      4⤵
      Modifies registry key
      PID:5784
- - C:\Windows\System32\sc.exe
    sc start LicenseManager
    3⤵
    - Launches sc.exe
    PID:5824
- - C:\Windows\System32\sc.exe
    sc query LicenseManager
    3⤵
    - Launches sc.exe
    PID:5848
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ImagePath
    3⤵
    - Modifies registry key
    PID:5816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Start 2>nul
    3⤵
    PID:5868
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Start
      4⤵
      Modifies registry key
      PID:5864
- - C:\Windows\System32\sc.exe
    sc start Winmgmt
    3⤵
    - Launches sc.exe
    PID:5956
- - C:\Windows\System32\sc.exe
    sc query Winmgmt
    3⤵
    - Launches sc.exe
    PID:5980
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v ImagePath
    3⤵
    - Modifies registry key
    PID:5992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v Start 2>nul
    3⤵
    PID:5944
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v Start
      4⤵
      Modifies registry key
      PID:5936
- - C:\Windows\System32\sc.exe
    sc start wuauserv
    3⤵
    - Launches sc.exe
    PID:5904
- - C:\Windows\System32\sc.exe
    sc query wuauserv
    3⤵
    - Launches sc.exe
    PID:5940
- - C:\Windows\System32\net.exe
    net start ClipSVC /y
    3⤵
    PID:5948
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start ClipSVC /y
      4⤵
      PID:5896
- - C:\Windows\System32\sc.exe
    sc query ClipSVC
    3⤵
    - Launches sc.exe
    PID:5900
- - C:\Windows\System32\find.exe
    find /i "4 RUNNING"
    3⤵
    PID:6048
- - C:\Windows\System32\sc.exe
    sc start ClipSVC
    3⤵
    - Launches sc.exe
    PID:6056
- - C:\Windows\System32\net.exe
    net start wlidsvc /y
    3⤵
    PID:6040
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start wlidsvc /y
      4⤵
      PID:4988
- - C:\Windows\System32\find.exe
    find /i "4 RUNNING"
    3⤵
    PID:6100
- - C:\Windows\System32\sc.exe
    sc query wlidsvc
    3⤵
    - Launches sc.exe
    PID:6116
- - C:\Windows\System32\sc.exe
    sc start wlidsvc
    3⤵
    - Launches sc.exe
    PID:1876
- - C:\Windows\System32\net.exe
    net start sppsvc /y
    3⤵
    PID:5192
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start sppsvc /y
      4⤵
      PID:372
- - C:\Windows\System32\sc.exe
    sc query sppsvc
    3⤵
    - Launches sc.exe
    PID:184
- - C:\Windows\System32\find.exe
    find /i "4 RUNNING"
    3⤵
    PID:2348
- - C:\Windows\System32\sc.exe
    sc start sppsvc
    3⤵
    - Launches sc.exe
    PID:2044
- - C:\Windows\System32\net.exe
    net start KeyIso /y
    3⤵
    PID:4180
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start KeyIso /y
      4⤵
      PID:5264
- - C:\Windows\System32\sc.exe
    sc query KeyIso
    3⤵
    - Launches sc.exe
    PID:5228
- - C:\Windows\System32\find.exe
    find /i "4 RUNNING"
    3⤵
    PID:5344
- - C:\Windows\System32\sc.exe
    sc start KeyIso
    3⤵
    - Launches sc.exe
    PID:5356
- - C:\Windows\System32\net.exe
    net start LicenseManager /y
    3⤵
    PID:5324
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start LicenseManager /y
      4⤵
      PID:5408
- - C:\Windows\System32\sc.exe
    sc query LicenseManager
    3⤵
    - Launches sc.exe
    PID:5400
- - C:\Windows\System32\find.exe
    find /i "4 RUNNING"
    3⤵
    PID:5420
- - C:\Windows\System32\sc.exe
    sc start LicenseManager
    3⤵
    - Launches sc.exe
    PID:5372
- - C:\Windows\System32\net.exe
    net start Winmgmt /y
    3⤵
    PID:5460
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start Winmgmt /y
      4⤵
      PID:5464
- - C:\Windows\System32\sc.exe
    sc query Winmgmt
    3⤵
    - Launches sc.exe
    PID:5492
- - C:\Windows\System32\find.exe
    find /i "4 RUNNING"
    3⤵
    PID:5476
- - C:\Windows\System32\sc.exe
    sc start Winmgmt
    3⤵
    - Launches sc.exe
    PID:5488
- - C:\Windows\System32\net.exe
    net start wuauserv /y
    3⤵
    PID:5508
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start wuauserv /y
      4⤵
      PID:1668
- - C:\Windows\System32\sc.exe
    sc query wuauserv
    3⤵
    - Launches sc.exe
    PID:3068
- - C:\Windows\System32\find.exe
    find /i "4 RUNNING"
    3⤵
    PID:5500
- - C:\Windows\System32\sc.exe
    sc start wuauserv
    3⤵
    - Launches sc.exe
    PID:3432
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State"
    3⤵
    PID:4392
- - C:\Windows\System32\find.exe
    find /i "IMAGE_STATE_COMPLETE"
    3⤵
    PID:1948
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinPE" /v InstRoot
    3⤵
    PID:5124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe $ExecutionContext.SessionState.LanguageMode
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4332
- - C:\Windows\System32\find.exe
    find /i "Full"
    3⤵
    PID:5128
- - C:\Windows\System32\find.exe
    find /i "computersystem"
    3⤵
    PID:5768
- - C:\Windows\System32\wbem\WMIC.exe
    wmic path Win32_ComputerSystem get CreationClassName /value
    3⤵
    PID:5532
- - C:\Windows\System32\Dism.exe
    DISM /English /Online /Get-CurrentEdition
    3⤵
    - Drops file in Windows directory
    PID:5840
  - - C:\Users\Admin\AppData\Local\Temp\F5830181-364A-4D60-A9A8-788BDC654861\dismhost.exe
      C:\Users\Admin\AppData\Local\Temp\F5830181-364A-4D60-A9A8-788BDC654861\dismhost.exe {A23D3D1E-EC2A-4629-8CE1-F874D80854A4}
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      PID:5504
- - C:\Windows\System32\cmd.exe
    cmd /c exit /b 0
    3⤵
    PID:5896
- - C:\Windows\System32\cscript.exe
    cscript //nologo C:\Windows\system32\slmgr.vbs /dlv
    3⤵
    PID:2420
- - C:\Windows\System32\cmd.exe
    cmd /c exit /b 0
    3⤵
    PID:1064
- - C:\Windows\System32\reg.exe
    reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedTSReArmed"
    3⤵
    PID:3572
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ClipSVC\Volatile\PersistedSystemState"
    3⤵
    PID:3484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm" 2>nul
    3⤵
    PID:2856
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm"
      4⤵
      PID:880
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Plugins\Objects\msft:rm/algorithm/hwid/4.0" /f ba02fed39662 /d
    3⤵
    PID:4632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE" 2>nul
    3⤵
    PID:1328
  - - C:\Windows\System32\wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE
      4⤵
      PID:5240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore 2>nul
    3⤵
    PID:5316
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore
      4⤵
      PID:5340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo: "
    3⤵
    PID:5348
- - C:\Windows\System32\findstr.exe
    findstr /i "wuauserv"
    3⤵
    PID:5400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /v Start 2>nul
    3⤵
    PID:5456
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /v Start
      4⤵
      Modifies registry key
      PID:5468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /v Start 2>nul
    3⤵
    PID:5200
- - C:\Windows\System32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v SettingsPageVisibility
    3⤵
    - Modifies registry key
    PID:5496
- - C:\Windows\System32\find.exe
    find /i "windowsupdate"
    3⤵
    PID:5488
- - C:\Windows\System32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdateSysprepInProgress
    3⤵
    - Modifies registry key
    PID:4116
- - C:\Windows\System32\reg.exe
    reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate /s
    3⤵
    - Modifies registry key
    PID:1048
- - C:\Windows\System32\findstr.exe
    findstr /i "NoAutoUpdate DisableWindowsUpdateAccess"
    3⤵
    PID:1296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo: "
    3⤵
    PID:1648
- - C:\Windows\System32\find.exe
    find /i "wuauserv"
    3⤵
    PID:5512
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Policies\Microsoft\WindowsStore" /v DisableStoreApps
    3⤵
    PID:5184
- - C:\Windows\System32\find.exe
    find /i "0x1"
    3⤵
    PID:5728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v BuildBranch 2>nul
    3⤵
    PID:2944
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v BuildBranch
      4⤵
      PID:540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo "040fa323-92b1-4baf-97a2-5b67feaefddb 0724cb7d-3437-4cb7-93cb-830375d0079d 0ad2ac98-7bb9-4201-8d92-312299201369 1a9a717a-cf13-4ba5-83c3-0fe25fa868d5 221a02da-e2a1-4b75-864c-0a4410a33fdf 291ece0e-9c38-40ca-a9e1-32cc7ec19507 2936d1d2-913a-4542-b54e-ce5a602a2a38 2c293c26-a45a-4a2a-a350-c69a67097529 2de67392-b7a7-462a-b1ca-108dd189f588 2ffd8952-423e-4903-b993-72a1aa44cf82 30a42c86-b7a0-4a34-8c90-ff177cb2acb7 345a5db0-d94f-4e3b-a0c0-7c42f7bc3ebf 3502365a-f88a-4ba4-822a-5769d3073b65 377333b1-8b5d-48d6-9679-1225c872d37c 3df374ef-d444-4494-a5a1-4b0d9fd0e203 3f1afc82-f8ac-4f6c-8005-1d233e606eee 49cd895b-53b2-4dc4-a5f7-b18aa019ad37 4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c 4f3da0d2-271d-4508-ae81-626b60809a38 60b3ec1b-9545-4921-821f-311b129dd6f6 613d217f-7f13-4268-9907-1662339531cd 62f0c100-9c53-4e02-b886-a3528ddfe7f6 6365275e-368d-46ca-a0ef-fc0404119333 721f9237-9341-4453-a661-09e8baa6cca5 73111121-5638-40f6-bc11-f1d7b0d64300 7a802526-4c94-4bd1-ba14-835a1aca2120 7cb546c0-c7d5-44d8-9a5c-69ecdd782b69 82bbc092-bc50-4e16-8e18-b74fc486aec3 8ab9bdd1-1f67-4997-82d9-8878520837d9 8b351c9c-f398-4515-9900-09df49427262 90da7373-1c51-430b-bf26-c97e9c5cdc31 95dca82f-385d-4d39-b85b-5c73fa285d6f a48938aa-62fa-4966-9d44-9f04da3f72f2 b0773a15-df3a-4312-9ad2-83d69648e356 b4bfe195-541e-4e64-ad23-6177f19e395e b68e61d2-68ca-4757-be45-0cc2f3e68eee bd3762d7-270d-4760-8fb3-d829ca45278a c86d5194-4840-4dae-9c1c-0301003a5ab0 d552befb-48cc-4327-8f39-47d2d94f987c d6eadb3b-5ca8-4a6b-986e-35b550756111 df96023b-dcd9-4be2-afa0-c6c871159ebe e0c42288-980c-4788-a014-c080d2e1926e e4db50ea-bda1-4566-b047-0ca50abc6f07 e558417a-5123-4f6f-91e7-385c1c7ca9d4 e7a950a2-e548-4f10-bf16-02ec848e0643 eb6d346f-1c60-4643-b960-40ec31596c45 ec868e65-fadf-4759-b23e-93fe37f2cc29 ef51e000-2659-4f25-8345-3de70a9cf4c4 f7af7d09-40e4-419c-a49b-eae366689ebd fa755fe6-6739-40b9-8d84-6d0ea3b6d1ab fe74f55b-0338-41d6-b267-4a201abe7285" "
    3⤵
    PID:1068
- - C:\Windows\System32\find.exe
    find /i "4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c"
    3⤵
    PID:5724
- - C:\Windows\System32\wbem\WMIC.exe
    wmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call InstallProductKey ProductKey="VK7JG-NPHTM-C97JM-9MPGT-3V66T"
    3⤵
    PID:4332
- - C:\Windows\System32\cmd.exe
    cmd /c exit /b 0
    3⤵
    PID:4520
- - C:\Windows\System32\wbem\WMIC.exe
    wmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call RefreshLicenseStatus
    3⤵
    PID:4588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKCU\Control Panel\International\Geo" /v Name 2>nul
    3⤵
    PID:5820
  - - C:\Windows\System32\reg.exe
      reg query "HKCU\Control Panel\International\Geo" /v Name
      4⤵
      PID:5756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKCU\Control Panel\International\Geo" /v Nation 2>nul
    3⤵
    PID:5832
  - - C:\Windows\System32\reg.exe
      reg query "HKCU\Control Panel\International\Geo" /v Nation
      4⤵
      PID:5992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell.exe [convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes("""OSMajorVersion=5;OSMinorVersion=1;OSPlatformId=2;PP=0;Pfn=Microsoft.Windows.48.X19-98841_8wekyb3d8bbwe;DownlevelGenuineState=1;$([char]0)"""))
    3⤵
    PID:5880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe [convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes("""OSMajorVersion=5;OSMinorVersion=1;OSPlatformId=2;PP=0;Pfn=Microsoft.Windows.48.X19-98841_8wekyb3d8bbwe;DownlevelGenuineState=1;$([char]0)"""))
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5968
- - C:\Windows\System32\find.exe
    find "AAAA"
    3⤵
    PID:6080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo "TwBTAE0AYQBqAG8AcgBWAGUAcgBzAGkAbwBuAD0ANQA7AE8AUwBNAGkAbgBvAHIAVgBlAHIAcwBpAG8AbgA9ADEAOwBPAFMAUABsAGEAdABmAG8AcgBtAEkAZAA9ADIAOwBQAFAAPQAwADsAUABmAG4APQBNAGkAYwByAG8AcwBvAGYAdAAuAFcAaQBuAGQAbwB3AHMALgA0ADgALgBYADEAOQAtADkAOAA4ADQAMQBfADgAdwBlAGsAeQBiADMAZAA4AGIAYgB3AGUAOwBEAG8AdwBuAGwAZQB2AGUAbABHAGUAbgB1AGkAbgBlAFMAdABhAHQAZQA9ADEAOwAAAA==" "
    3⤵
    PID:5876
- - C:\Windows\System32\net.exe
    net stop ClipSVC /y
    3⤵
    PID:5896
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop ClipSVC /y
      4⤵
      PID:8
- - C:\Windows\System32\net.exe
    net start ClipSVC /y
    3⤵
    PID:6120
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start ClipSVC /y
      4⤵
      PID:2440

C:\Windows\System32\reg.exe
reg query HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /v Start
1⤵
- Modifies registry key
PID:5428

C:\Windows\system32\Clipup.exe
"C:\Windows\system32\Clipup.exe" -o
1⤵
PID:3572
- C:\Windows\system32\Clipup.exe
  "C:\Windows\system32\Clipup.exe" -o -ppl C:\Windows\TEMP\temC663.tmp
  2⤵
  PID:4632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\ClipSVC\GenuineTicket\GenuineTicket

Filesize
955B

MD5
d7b515ba435019604522d1283122e703

SHA1
843d4e5d5b822b7ea9936d1808736fb1f44708b9

SHA256
3f3e5aa495b9bd3cbf6a62656a0030d7235ec93451200e46224ee709b9a69072

SHA512
49a2477d6564ea62711fa5a1197be016edebefa2f039e37693697323595f974c298b9d666bd05e333828d99a6bc56f8d139178c27c2247b0feeeeea0ad27eacc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b5f5369274e3bfbc449588bbb57bd383

SHA1
58bb46d57bd70c1c0bcbad619353cbe185f34c3b

SHA256
4190bd2ec2c0c65a2b8b97782cd3ae1d6cead80242f3595f06ebc6648c3e3464

SHA512
04a3816af6c5a335cde99d97019a3f68ade65eba70e4667c4d7dd78f78910481549f1dad23a46ccf9efa2e25c6e7a7c78c592b6ace951e1aab106ba06a10fcd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7e4b00bb-9819-414d-a432-cb10847eb106.tmp

Filesize
6KB

MD5
e698c972fe3c54df06c86c3a22c8184e

SHA1
f5369cc0b9729b8a58c5c9a8432ff665931dcdd2

SHA256
56a8b4e7d238e03f587c8f4080fd1757d2859e0a67f434f2eac2aff0f9024cda

SHA512
f78054e310c71b31249feeebcd51525b86bacbe407fe6441be698948fe50eb4afbdf1c81d7bea246c1bf57240af47accd2a968338559b5ad02d612239dd94893

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
962d029e22c705258037f959c18dc94f

SHA1
18dfd4488feb7a25057519efcd03d0d5f8788a76

SHA256
043ae2818a7cd908cfc416c4453ca67ccbbf8799521f705f206d9b23ce87c9c0

SHA512
124c75151df6dee279100dcca0181fe337d5889ef01d418d52711ba3ad760976e924db7ee407f8d310f7d36e5637c10441b22c0a019118c860bd8bb4f4b8a19b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f1a08e77170f71b58722f11cf5e9aa1d

SHA1
18b23e6e4896f9b0a1c0f7cf6a83369ca58a6bef

SHA256
2c97ff43fdab822bd8775068016e340b6adcc486e8c0e1dbd453aec4cd05be7e

SHA512
77664aab60a7447ea400f66360c06c107a0277b3f147bf72d6c88529ad13f0429d4fb9ecd6ee0ee3ed9fc47772d5e6f8d97e88d89497be77abf2ec84fb392e98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3d46b60898efc1cba5eaa50b57fe1ab6

SHA1
1bdf3ea38219894aebb066d5c6fc034b74259af7

SHA256
3b23cfa22ec12226d889812ac732abca1a4ea3f5f3b260e5ccad650d30bc2f7c

SHA512
8f5d45b28ddb31a45da1da7074634b5a4b88985a8f88a623d07bbf28ccd35f02f89f8b8a7669923fc5020f0988d268a0c712c03a56bc67579d54f128c22507ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
15a05a21a74ef59dff1488c8d684e5dc

SHA1
f41a81f8c35b656f816a1190f250518cd2eb6171

SHA256
bf368369235c30c91377b8f22857a69f7a6e5a4fdc0cc378f08f8838b6b0ec30

SHA512
58c228de994527237b11f1af523707d5ac5a22c9d09541ea7e7d0885fdb4a49fe5edae99a075ae5db2727e222d7fb6796e02b8f847c5261aa56aaca7075a61c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
29213338df67d29d6454ee5d61ad3970

SHA1
8c69ca76a2e639060d5ce835a9600e6ea3764a83

SHA256
d29fc0d97fa74d382d0f557ecea4e42b7d50dbce43915bfc0c114c16e532aa51

SHA512
14db25eba8a863d390b97fce4315402ed7c249598ff6c31d5a191b0f71c274eead42ba0658403e744110de072e6ff1cac3bccee1e48875bde6b1fe39a60d2407

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
38724d87295faed704b4708b56901337

SHA1
2a5b91a885fcf7019cb49532d3adeb8d36aa693d

SHA256
9bc29b82d5ae19f57b006c3fe380eb91a6f339f713ae98a0c4d7ce4c314c4e26

SHA512
73303eee70fe3afee88cdcb76481baa39d9f1282cba66d8e4fdaed74a95d3630818f37acace25d3d1508ec88284d1eb0b367d21a10c7b9b03ecc0a09892ce215

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59520e.TMP

Filesize
1KB

MD5
1d7e098aa9e7aeb9ff9cc71e06ca41ca

SHA1
2b4724cd4d677b3fcc9b1b23782a7df78a51da8c

SHA256
0e03ea08b1ace90c8e06fd320dcf88f125c5ee21eb323b9f4bfd9f033baecebf

SHA512
302921ffe0511bb914084e524942ba3290d6d876be04c7bea8d4fa27d971df1ef363f97887dffaa1ca4c6c2644eb85852018f871b8aa8185a14a72c345e26f6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
9b3456f6aefb4532b28d18491d003f8d

SHA1
efb5557c95602f15de9fba6c901d9ef760ba2988

SHA256
e9ef88891acde1cd7544b2711345c827ff8850088033b90fb9db1b4cde2dbf7f

SHA512
bbdd9652741f1a9c092d20092cc08eb9616528bb62e810b40ad6184b93282d42c3eead35b235322ee029685953bf0c96798ed6ca67bd42f25927f05901728168

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
580209bf1740ff2fe1d59816263facce

SHA1
1515509f4130e1f6123b140b5f8a77f1631599c2

SHA256
e124521d1bc35db84653846dc17f124ba4442df2e3ab531e04fd9f96fe138fbd

SHA512
eb8c1ba037f1f9ec581f7f04be97662d6f1a0eb58272a8d7d8e8cd4944e075d23b1410be17d7a1ab1c2ce79bf080ca244276b788f344993ab2e5d187fb36eb54

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\VCRUNTIME140.dll

Filesize
94KB

MD5
11d9ac94e8cb17bd23dea89f8e757f18

SHA1
d4fb80a512486821ad320c4fd67abcae63005158

SHA256
e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e

SHA512
aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\VCRUNTIME140.dll

Filesize
94KB

MD5
11d9ac94e8cb17bd23dea89f8e757f18

SHA1
d4fb80a512486821ad320c4fd67abcae63005158

SHA256
e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e

SHA512
aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\_bz2.pyd

Filesize
84KB

MD5
124678d21d4b747ec6f1e77357393dd6

SHA1
dbfb53c40d68eba436934b01ebe4f8ee925e1f8e

SHA256
9483c4853ca1da3c5b2310dbdd3b835a44df6066620278aa96b2e665c4b4e86b

SHA512
2882779b88ed48af1e27c2bc212ddc7e4187d26a28a90655cef98dd44bc07cc93da5bce2442af26d7825639590b1e2b78bf619d50736d67164726a342be348fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\_bz2.pyd

Filesize
84KB

MD5
124678d21d4b747ec6f1e77357393dd6

SHA1
dbfb53c40d68eba436934b01ebe4f8ee925e1f8e

SHA256
9483c4853ca1da3c5b2310dbdd3b835a44df6066620278aa96b2e665c4b4e86b

SHA512
2882779b88ed48af1e27c2bc212ddc7e4187d26a28a90655cef98dd44bc07cc93da5bce2442af26d7825639590b1e2b78bf619d50736d67164726a342be348fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\_ctypes.pyd

Filesize
123KB

MD5
7ab242d7c026dad5e5837b4579bd4eda

SHA1
b3ff01b8b3da2b3a9c37bfffafc4fb9ee957cc0f

SHA256
1548506345d220d68e9089b9a68b42a9d796141eb6236e600283951cb206eaa1

SHA512
1dd09cf14c87f60b42e5e56d0104154513902c9bfa23eef76a92f4a96c2356b2812dd6eee5e9a74d5ed078ade5f8f6d1f1b01961d7efadfebb543d71c2d31a30

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\_ctypes.pyd

Filesize
123KB

MD5
7ab242d7c026dad5e5837b4579bd4eda

SHA1
b3ff01b8b3da2b3a9c37bfffafc4fb9ee957cc0f

SHA256
1548506345d220d68e9089b9a68b42a9d796141eb6236e600283951cb206eaa1

SHA512
1dd09cf14c87f60b42e5e56d0104154513902c9bfa23eef76a92f4a96c2356b2812dd6eee5e9a74d5ed078ade5f8f6d1f1b01961d7efadfebb543d71c2d31a30

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\_lzma.pyd

Filesize
159KB

MD5
a77c9a75ed7d9f455e896b8fb09b494c

SHA1
c85d30bf602d8671f6f446cdaba98de99793e481

SHA256
4797aaf192eb56b32ca4febd1fad5be9e01a24e42bf6af2d04fcdf74c8d36fa5

SHA512
4d6d93aa0347c49d3f683ee7bc91a3c570c60126c534060654891fad0391321e09b292c9386fb99f6ea2c2eca032889841fce3cab8957bb489760daac6f79e71

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\_lzma.pyd

Filesize
159KB

MD5
a77c9a75ed7d9f455e896b8fb09b494c

SHA1
c85d30bf602d8671f6f446cdaba98de99793e481

SHA256
4797aaf192eb56b32ca4febd1fad5be9e01a24e42bf6af2d04fcdf74c8d36fa5

SHA512
4d6d93aa0347c49d3f683ee7bc91a3c570c60126c534060654891fad0391321e09b292c9386fb99f6ea2c2eca032889841fce3cab8957bb489760daac6f79e71

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\_socket.pyd

Filesize
78KB

MD5
4b2f1faab9e55a65afa05f407c92cab4

SHA1
1e5091b09fc0305cf29ec2e715088e7f46ccbbd4

SHA256
241db349093604ab25405402ba8c4212016657c7e6a10edd3110abeb1cc2e1ba

SHA512
68070db39cd14841bcd49db1acf19806b0aa4b4ac4c56518b3a3baddaac1cd533f0b3ef70a378f53d65c0d6c0f745a6102b63303ea7978c79f688c787efe9cc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\_socket.pyd

Filesize
78KB

MD5
4b2f1faab9e55a65afa05f407c92cab4

SHA1
1e5091b09fc0305cf29ec2e715088e7f46ccbbd4

SHA256
241db349093604ab25405402ba8c4212016657c7e6a10edd3110abeb1cc2e1ba

SHA512
68070db39cd14841bcd49db1acf19806b0aa4b4ac4c56518b3a3baddaac1cd533f0b3ef70a378f53d65c0d6c0f745a6102b63303ea7978c79f688c787efe9cc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\_tkinter.pyd

Filesize
64KB

MD5
cebd6a4f8e0f98e61f4e9fa89520c6b3

SHA1
f7726a7680c9968645b7b42bef82a0f0b2ab13e6

SHA256
cea57bb0f8c71c526e8bf799c3b53264b2405ed954122498f92e29735dde2901

SHA512
907e2eb58143fbfb5f8f3a8e955a97aa78123f9af84f5a03a2f03fdb810b476e6cb0ab29b6e1a99d33d11aae2663a3c24f8832dc89f31fde5813d96662182260

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\_tkinter.pyd

Filesize
64KB

MD5
cebd6a4f8e0f98e61f4e9fa89520c6b3

SHA1
f7726a7680c9968645b7b42bef82a0f0b2ab13e6

SHA256
cea57bb0f8c71c526e8bf799c3b53264b2405ed954122498f92e29735dde2901

SHA512
907e2eb58143fbfb5f8f3a8e955a97aa78123f9af84f5a03a2f03fdb810b476e6cb0ab29b6e1a99d33d11aae2663a3c24f8832dc89f31fde5813d96662182260

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\base_library.zip

Filesize
781KB

MD5
fa1dbd258977aa199159d1c9345054d4

SHA1
2b328f7fbd1ca4ad058841cebd1c65bcb59435e8

SHA256
f22c9545970e2e5528e6816e386bdbbdd9546c5f73d51d2d1768c5a2fdbed1ef

SHA512
3b148b7aeaf56a9279895de337e6aaf509e08b7c85f6950c6f6794d297586051a242961ade77230f609576e560bfdc85a775224830af966ae84993d5206cdbf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\customtkinter\assets\themes\blue.json

Filesize
2KB

MD5
dc9db14c46bf7733a587348f07d82577

SHA1
b083ddce85ad622fd071ff5dd0304885b62c1d2b

SHA256
d6aca6cb08b07c898a2d4d858587b4e2dc29600130b7adcc9f77f254fd2d3c18

SHA512
e1d05dbd1934b01b44b6c6dc493aac0b752f0ca05dd7abad1ec4845c4124810570a140660768bccdb10118746e5e3e6fc588bca9d2f4442a696e62f804896b20

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\python39.dll

Filesize
4.3MB

MD5
7e9d14aa762a46bb5ebac14fbaeaa238

SHA1
a5d90a7df9b90bdd8a84d7dc5066e4ea64ceb3d9

SHA256
e456ef44b261f895a01efb52d26c7a0c7d7d465b647a7b5592708ebf693f12a3

SHA512
280f16348df1c0953bbc6f37ff277485351171d0545ebe469bacd106d907917f87584154aec0f193f37322bc93ac5433cd9a5b5c7f47367176e5a8b19bbd5023

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\python39.dll

Filesize
4.3MB

MD5
7e9d14aa762a46bb5ebac14fbaeaa238

SHA1
a5d90a7df9b90bdd8a84d7dc5066e4ea64ceb3d9

SHA256
e456ef44b261f895a01efb52d26c7a0c7d7d465b647a7b5592708ebf693f12a3

SHA512
280f16348df1c0953bbc6f37ff277485351171d0545ebe469bacd106d907917f87584154aec0f193f37322bc93ac5433cd9a5b5c7f47367176e5a8b19bbd5023

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\select.pyd

Filesize
28KB

MD5
f8f5a047b98309d425fd06b3b41b16e4

SHA1
2a44819409199b47f11d5d022e6bb1d5d1e77aea

SHA256
5361da714a61f99136737630d50fa4e975d76f5de75e181af73c5a23a2b49012

SHA512
f0a96790fcdabf02b452f5c6b27604f5a10586b4bf759994e6d636cc55335026631fa302e209a53f5e454bea03b958b6d662e0be91fa64ce187a7dc5d35a9aa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\select.pyd

Filesize
28KB

MD5
f8f5a047b98309d425fd06b3b41b16e4

SHA1
2a44819409199b47f11d5d022e6bb1d5d1e77aea

SHA256
5361da714a61f99136737630d50fa4e975d76f5de75e181af73c5a23a2b49012

SHA512
f0a96790fcdabf02b452f5c6b27604f5a10586b4bf759994e6d636cc55335026631fa302e209a53f5e454bea03b958b6d662e0be91fa64ce187a7dc5d35a9aa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tcl86t.dll

Filesize
1.6MB

MD5
c0b23815701dbae2a359cb8adb9ae730

SHA1
5be6736b645ed12e97b9462b77e5a43482673d90

SHA256
f650d6bc321bcda3fc3ac3dec3ac4e473fb0b7b68b6c948581bcfc54653e6768

SHA512
ed60384e95be8ea5930994db8527168f78573f8a277f8d21c089f0018cd3b9906da764ed6fcc1bd4efad009557645e206fbb4e5baef9ab4b2e3c8bb5c3b5d725

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tcl86t.dll

Filesize
1.6MB

MD5
c0b23815701dbae2a359cb8adb9ae730

SHA1
5be6736b645ed12e97b9462b77e5a43482673d90

SHA256
f650d6bc321bcda3fc3ac3dec3ac4e473fb0b7b68b6c948581bcfc54653e6768

SHA512
ed60384e95be8ea5930994db8527168f78573f8a277f8d21c089f0018cd3b9906da764ed6fcc1bd4efad009557645e206fbb4e5baef9ab4b2e3c8bb5c3b5d725

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tcl8\8.5\msgcat-1.6.1.tm

Filesize
33KB

MD5
db52847c625ea3290f81238595a915cd

SHA1
45a4ed9b74965e399430290bcdcd64aca5d29159

SHA256
4fdf70fdcedef97aa8bd82a02669b066b5dfe7630c92494a130fc7c627b52b55

SHA512
5a8fb4ada7b2efbf1cadd10dbe4dc7ea7acd101cb8fd0b80dad42be3ed8804fc8695c53e6aeec088c2d4c3ee01af97d148b836289da6e4f9ee14432b923c7e40

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tcl\auto.tcl

Filesize
20KB

MD5
5e9b3e874f8fbeaadef3a004a1b291b5

SHA1
b356286005efb4a3a46a1fdd53e4fcdc406569d0

SHA256
f385515658832feb75ee4dce5bd53f7f67f2629077b7d049b86a730a49bd0840

SHA512
482c555a0da2e635fa6838a40377eef547746b2907f53d77e9ffce8063c1a24322d8faa3421fc8d12fdcaff831b517a65dafb1cea6f5ea010bdc18a441b38790

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tcl\encoding\cp1252.enc

Filesize
1KB

MD5
5900f51fd8b5ff75e65594eb7dd50533

SHA1
2e21300e0bc8a847d0423671b08d3c65761ee172

SHA256
14df3ae30e81e7620be6bbb7a9e42083af1ae04d94cf1203565f8a3c0542ace0

SHA512
ea0455ff4cd5c0d4afb5e79b671565c2aede2857d534e1371f0c10c299c74cb4ad113d56025f58b8ae9e88e2862f0864a4836fed236f5730360b2223fde479dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tcl\http1.0\pkgIndex.tcl

Filesize
735B

MD5
10ec7cd64ca949099c818646b6fae31c

SHA1
6001a58a0701dff225e2510a4aaee6489a537657

SHA256
420c4b3088c9dacd21bc348011cac61d7cb283b9bee78ae72eed764ab094651c

SHA512
34a0acb689e430ed2903d8a903d531a3d734cb37733ef13c5d243cb9f59c020a3856aad98726e10ad7f4d67619a3af1018f6c3e53a6e073e39bd31d088efd4af

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tcl\init.tcl

Filesize
23KB

MD5
b900811a252be90c693e5e7ae365869d

SHA1
345752c46f7e8e67dadef7f6fd514bed4b708fc5

SHA256
bc492b19308bc011cfcd321f1e6e65e6239d4eeb620cc02f7e9bf89002511d4a

SHA512
36b8cdba61b9222f65b055c0c513801f3278a3851912215658bcf0ce10f80197c1f12a5ca3054d8604da005ce08da8dcd303b8544706b642140a49c4377dd6ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tcl\opt0.4\pkgIndex.tcl

Filesize
607B

MD5
92ff1e42cfc5fecce95068fc38d995b3

SHA1
b2e71842f14d5422a9093115d52f19bcca1bf881

SHA256
eb9925a8f0fcc7c2a1113968ab0537180e10c9187b139c8371adf821c7b56718

SHA512
608d436395d055c5449a53208f3869b8793df267b8476ad31bcdd9659a222797814832720c495d938e34bf7d253ffc3f01a73cc0399c0dfb9c85d2789c7f11c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tcl\package.tcl

Filesize
22KB

MD5
55e2db5dcf8d49f8cd5b7d64fea640c7

SHA1
8fdc28822b0cc08fa3569a14a8c96edca03bfbbd

SHA256
47b6af117199b1511f6103ec966a58e2fd41f0aba775c44692b2069f6ed10bad

SHA512
824c210106de7eae57a480e3f6e3a5c8fb8ac4bbf0a0a386d576d3eb2a3ac849bdfe638428184056da9e81767e2b63eff8e18068a1cf5149c9f8a018f817d3e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tcl\tclIndex

Filesize
5KB

MD5
e127196e9174b429cc09c040158f6aab

SHA1
ff850f5d1bd8efc1a8cb765fe8221330f0c6c699

SHA256
abf7d9d1e86de931096c21820bfa4fd70db1f55005d2db4aa674d86200867806

SHA512
c4b98ebc65e25df41e6b9a93e16e608cf309fa0ae712578ee4974d84f7f33bcf2a6ed7626e88a343350e13da0c5c1a88e24a87fcbd44f7da5983bb3ef036a162

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tcl\tm.tcl

Filesize
11KB

MD5
f9ed2096eea0f998c6701db8309f95a6

SHA1
bcdb4f7e3db3e2d78d25ed4e9231297465b45db8

SHA256
6437bd7040206d3f2db734fa482b6e79c68bcc950fba80c544c7f390ba158f9b

SHA512
e4fb8f28dc72ea913f79cedf5776788a0310608236d6607adc441e7f3036d589fd2b31c446c187ef5827fd37dcaa26d9e94d802513e3bf3300e94dd939695b30

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tk86t.dll

Filesize
1.4MB

MD5
fdc8a5d96f9576bd70aa1cadc2f21748

SHA1
bae145525a18ce7e5bc69c5f43c6044de7b6e004

SHA256
1a6d0871be2fa7153de22be008a20a5257b721657e6d4b24da8b1f940345d0d5

SHA512
816ada61c1fd941d10e6bb4350baa77f520e2476058249b269802be826bab294a9c18edc5d590f5ed6f8dafed502ab7ffb29db2f44292cb5bedf2f5fa609f49c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tk86t.dll

Filesize
1.4MB

MD5
fdc8a5d96f9576bd70aa1cadc2f21748

SHA1
bae145525a18ce7e5bc69c5f43c6044de7b6e004

SHA256
1a6d0871be2fa7153de22be008a20a5257b721657e6d4b24da8b1f940345d0d5

SHA512
816ada61c1fd941d10e6bb4350baa77f520e2476058249b269802be826bab294a9c18edc5d590f5ed6f8dafed502ab7ffb29db2f44292cb5bedf2f5fa609f49c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tk\button.tcl

Filesize
20KB

MD5
309ab5b70f664648774453bccbe5d3ce

SHA1
51bf685dedd21de3786fe97bc674ab85f34bd061

SHA256
0d95949cfacf0df135a851f7330acc9480b965dac7361151ac67a6c667c6276d

SHA512
d5139752bd7175747a5c912761916efb63b3c193dd133ad25d020a28883a1dea6b04310b751f5fcbe579f392a8f5f18ae556116283b3e137b4ea11a2c536ec6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tk\entry.tcl

Filesize
16KB

MD5
be28d16510ee78ecc048b2446ee9a11a

SHA1
4829d6e8ab8a283209fb4738134b03b7bd768bad

SHA256
8f57a23c5190b50fad00bdee9430a615ebebfc47843e702374ae21beb2ad8b06

SHA512
f56af7020531249bc26d88b977baffc612b6566146730a681a798ff40be9ebc04d7f80729bafe0b9d4fac5b0582b76f9530f3fe376d42a738c9bc4b3b442df1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tk\icons.tcl

Filesize
10KB

MD5
2652aad862e8fe06a4eedfb521e42b75

SHA1
ed22459ad3d192ab05a01a25af07247b89dc6440

SHA256
a78388d68600331d06bb14a4289bc1a46295f48cec31ceff5ae783846ea4d161

SHA512
6ecfbb8d136444a5c0dbbce2d8a4206f1558bdd95f111d3587b095904769ac10782a9ea125d85033ad6532edf3190e86e255ac0c0c81dc314e02d95cca86b596

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tk\listbox.tcl

Filesize
14KB

MD5
c33963d3a512f2e728f722e584c21552

SHA1
75499cfa62f2da316915fada2580122dc3318bad

SHA256
39721233855e97bfa508959b6dd91e1924456e381d36fdfc845e589d82b1b0cc

SHA512
ea01d8cb36d446ace31c5d7e50dfae575576fd69fd5d413941eebba7ccc1075f6774af3c69469cd7baf6e1068aa5e5b4c560f550edd2a8679124e48c55c8e8d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tk\menu.tcl

Filesize
37KB

MD5
181ed74919f081eeb34269500e228470

SHA1
953eb429f6d98562468327858ed0967bdc21b5ad

SHA256
564ac0040176cc5744e3860abc36b5ffbc648da20b26a710dc3414eae487299b

SHA512
220e496b464575115baf1dede838e70d5ddd6d199b5b8acc1763e66d66801021b2d7cd0e1e1846868782116ad8a1f127682073d6eacd7e73f91bced89f620109

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tk\panedwindow.tcl

Filesize
5KB

MD5
2da0a23cc9d6fd970fe00915ea39d8a2

SHA1
dfe3dc663c19e9a50526a513043d2393869d8f90

SHA256
4adf738b17691489c71c4b9d9a64b12961ada8667b81856f7adbc61dffeadf29

SHA512
b458f3d391df9522d4e7eae8640af308b4209ce0d64fd490bfc0177fde970192295c1ea7229ce36d14fc3e582c7649460b8b7b0214e0ff5629b2b430a99307d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tk\pkgIndex.tcl

Filesize
363B

MD5
a6448af2c8fafc9a4f42eaca6bf6ab2e

SHA1
0b295b46b6df906e89f40a907022068bc6219302

SHA256
cd44ee7f76c37c0c522bd0cfca41c38cdeddc74392b2191a3af1a63d9d18888e

SHA512
5b1a8ca5b09b7281de55460d21d5195c4ee086bebdc35fa561001181490669ffc67d261f99eaa900467fe97e980eb733c5ffbf9d8c541ede18992bf4a435c749

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tk\scale.tcl

Filesize
7KB

MD5
1ce32cdaeb04c75bfceea5fb94b8a9f0

SHA1
cc7614c9eade999963ee78b422157b7b0739894c

SHA256
58c662dd3d2c653786b05aa2c88831f4e971b9105e4869d866fb6186e83ed365

SHA512
1ee5a187615ae32f17936931b30fea9551f9e3022c1f45a2bca81624404f4e68022fcf0b03fbd61820ec6958983a8f2fbfc3ad2ec158433f8e8de9b8fcf48476

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tk\scrlbar.tcl

Filesize
12KB

MD5
4cbffc4e6b3f56a5890e3f7c31c6c378

SHA1
75db5205b311f55d1ca1d863b8688a628bf6012a

SHA256
6ba3e2d62bd4856d7d7ae87709fcaa23d81efc38c375c6c5d91639555a84c35d

SHA512
65df7ae09e06c200a8456748dc89095bb8417253e01ec4fdafb28a84483147ddc77aaf6b49be9e18a326a94972086a99044bee3ce5cf8026337dfc6972c92c04

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tk\spinbox.tcl

Filesize
15KB

MD5
9971530f110ac2fb7d7ec91789ea2364

SHA1
ab553213c092ef077524ed56fc37da29404c79a7

SHA256
5d6e939b44f630a29c4fcb1e2503690c453118607ff301bef3c07fa980d5075a

SHA512
81b4cec39b03fbeca59781aa54960f0a10a09733634f401d5553e1aaa3ebf12a110c9d555946fcdd70a9cc897514663840745241ad741dc440bb081a12dcf411

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tk\text.tcl

Filesize
32KB

MD5
03cc27e28e0cfce1b003c3e936797ab0

SHA1
c7fe5ae7f35c86ec3724f6a111eaaf2c1a18abe9

SHA256
bccc1039f0eb331c4bb6bd5848051bb745f242016952723478c93b009f63d254

SHA512
5091b10ee8446e6853ef7060ec13ab8cada0d6448f9081febd07546c061f69fc273bbf23ba7af05d8359e618dd68a5c27f0453480fe3f26e744db19bfcd115c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tk\tk.tcl

Filesize
22KB

MD5
3250ec5b2efe5bbe4d3ec271f94e5359

SHA1
6a0fe910041c8df4f3cdc19871813792e8cc4e4c

SHA256
e1067a0668debb2d8e8ec3b7bc1aec3723627649832b20333f9369f28e4dfdbf

SHA512
f8e403f3d59d44333bce2aa7917e6d8115bec0fe5ae9a1306f215018b05056467643b7aa228154ddced176072bc903dfb556cb2638f5c55c1285c376079e8fe3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tk\ttk\altTheme.tcl

Filesize
3KB

MD5
8ff9d357af3806d997bb8654e95f530c

SHA1
62292163299cc229031bb4eafbe900323056561a

SHA256
e36864b33d7c2b47fe26646377be86fb341bbf2b6df13e33bd799e87d24fc193

SHA512
ecdc47e7d1f0f9c0c052aca2eb2de10e78b2256e8db85d7b52f365c1074a4e24cdb1c7a2780b36dfa36f174ff87b6a31c49f61cc0ac3d2412b3915234d911c9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tk\ttk\button.tcl

Filesize
2KB

MD5
ea7cf40852afd55ffda9db29a0e11322

SHA1
b7b42fac93e250b54eb76d95048ac3132b10e6d8

SHA256
391b6e333d16497c4b538a7bdb5b16ef11359b6e3b508d470c6e3703488e3b4d

SHA512
123d78d6ac34af4833d05814220757dccf2a9af4761fe67a8fe5f67a0d258b3c8d86ed346176ffb936ab3717cfd75b4fab7373f7853d44fa356be6e3a75e51b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tk\ttk\classicTheme.tcl

Filesize
3KB

MD5
7dbf35f3f0f9fb68626019ff94efbcd3

SHA1
213f18224bf0573744836cd3bedc83d5e443a406

SHA256
30e6766e9b8292793395324e412b0f5a8888512b84b080e247f95bf6efb11a9d

SHA512
9081e5c89ecde8337c5a52531def24924c0bcb3a1f0596d3b986cc59e635f67a78327abf26209bf71a9ba370a93174298e6abd11586382d7d70adea7e5ccf854

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tk\ttk\combobox.tcl

Filesize
12KB

MD5
fbcaa6a08d9830114248f91e10d4c918

SHA1
fa63c94824bebd3531086816650d3f3fa73fe434

SHA256
9d80aa9701e82862467684d3dff1a9ec5bbc2bbba4f4f070518bbde7e38499bb

SHA512
b377c31cc9137851679cba0560efe4265792d1576bd781dd42c22014a7a8f3d10d9d48a1154bb88a2987197594c8b728b71fa689ce1b32928f8513796a6a0aa3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tk\ttk\cursors.tcl

Filesize
3KB

MD5
74596004dfdbf2ecf6af9c851156415d

SHA1
933318c992b705bf9f8511621b4458ecb8772788

SHA256
7bdffa1c2692c5d1cf67b518f9acb32fa4b4d9936ed076f4db835943bc1a00d6

SHA512
0d600b21db67bf9dadbdd49559573078efb41e473e94124ac4d2551bc10ec764846dc1f7674daa79f8d2a8aeb4ca27a5e11c2f30ede47e3ecee77d60d7842262

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tk\ttk\defaults.tcl

Filesize
4KB

MD5
0e03292f7678540cb4f3440859863b0c

SHA1
909849894b02f2c213bde0fbced8c1378eb9b81e

SHA256
304ff31fc82f6086c93aaa594d83d8da25866ce1c2af1208f9e7585d74ca9a51

SHA512
87e5d2484e5e7e3c00b319219028b012576b7d73b84a9a13ed15551c9431bf216c0b96376ae5a7070b5a391d9887e55abf9fa4afee971177408b7969363d9302

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tk\ttk\entry.tcl

Filesize
16KB

MD5
f9b29ab14304f18e32821a29233be816

SHA1
6d0253274d777e081fa36cc38e51c2abb9259d0e

SHA256
62d1df52c510a83103badab4f3a77abb1aa3a0e1e21f68ece0cecca2ca2f1341

SHA512
698db665e29b29864f9fe65934cca83a5092d81d5130ffd1eac68c51327ae9ebc007a60a60e1af37063017e448ce84a4024d4a412990a1078287b605df344c70

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tk\ttk\fonts.tcl

Filesize
5KB

MD5
7017b5c1d53f341f703322a40c76c925

SHA1
57540c56c92cc86f94b47830a00c29f826def28e

SHA256
0eb518251fbe9cf0c9451cc1fef6bb6aee16d62da00b0050c83566da053f68d0

SHA512
fd18976a8fbb7e59b12944c2628dbd66d463b2f7342661c8f67160df37a393fa3c0ce7fdda31073674b7a46e0a0a7d0a7b29ebe0d9488afd9ef8b3a39410b5a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tk\ttk\menubutton.tcl

Filesize
4KB

MD5
db24841643cebd38d5ffd1d42b42e7f4

SHA1
e394af7faf83fad863c7b13d855fcf3705c4f1c7

SHA256
81b0b7818843e293c55ff541bd95168db51fe760941d32c7cde9a521bb42e956

SHA512
380272d003d5f90c13571952d0c73f5fce2a22330f98f29707f3d5bfc29c99d9bf11a947cf2ca64cf7b8df5e4afe56ffa00f9455bb30d15611fc5c86130346be

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tk\ttk\notebook.tcl

Filesize
5KB

MD5
82c9dfc512e143dda78f91436937d4dd

SHA1
26abc23c1e0c201a217e3cea7a164171418973b0

SHA256
d1e5267cde3d7be408b4c94220f7e1833c9d452bb9ba3e194e12a5eb2f9adb80

SHA512
a9d3c04ad67e0dc3f1c12f9e21ef28a61fa84dbf710313d4ca656bdf35dfbbfba9c268c018004c1f5614db3a1128025d795bc14b4fffaa5603a5313199798d04

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tk\ttk\panedwindow.tcl

Filesize
1KB

MD5
a12915fa5caf93e23518e9011200f5a4

SHA1
a61f665a408c10419fb81001578d99b43d048720

SHA256
ce0053d637b580170938cf552b29ae890559b98eb28038c2f0a23a265ddeb273

SHA512
669e1d66f1223cca6ceb120914d5d876bd3cf401ee4a46f35825361076f19c7341695596a7dbb00d6cff4624666fb4e7a2d8e7108c3c56a12bda7b04e99e6f9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tk\ttk\progress.tcl

Filesize
1KB

MD5
b0074341a4bda36bcdff3ebcae39eb73

SHA1
d070a01cc5a787249bc6dad184b249c4dd37396a

SHA256
a9c34f595e547ce94ee65e27c415195d2b210653a9ffcfb39559c5e0fa9c06f8

SHA512
af23563602886a648a42b03cc5485d84fcc094ab90b08df5261434631b6c31ce38d83a3a60cc7820890c797f6c778d5b5eff47671ce3ee4710ab14c6110dcc35

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tk\ttk\scale.tcl

Filesize
2KB

MD5
b41a9df31924dea36d69cb62891e8472

SHA1
4c2877fbb210fdbbde52ea8b5617f68ad2df7b93

SHA256
25d0fe2b415292872ef7acdb2dfa12d04c080b7f9b1c61f28c81aa2236180479

SHA512
a50db6da3d40d07610629de45f06a438c6f2846324c3891c54c99074cfb7beed329f27918c8a85badb22c6b64740a2053b891f8e5d129d9b0a1ff103e7137d83

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tk\ttk\scrollbar.tcl

Filesize
3KB

MD5
93181dbe76ef9c39849a09242d6df8c0

SHA1
de3b47afc3e5371bf1cd0541790a9b78a97570ab

SHA256
5932043286a30a3cffb2b6ce68ccdb9172a718f32926e25d3a962ae63cad515c

SHA512
5c85284e063a5de17f6ce432b3ef899d046a78725bd1f930229576bed1116c03a3ee0611b988e9903f47da8f694483e5a76464450c48eb14622f6784004b8f7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tk\ttk\sizegrip.tcl

Filesize
2KB

MD5
3c8916a58c6ee1d61836e500a54c9321

SHA1
54f3f709698fad020a048668749cb5a09ede35ab

SHA256
717d2edd71076ea059903c7144588f8bbd8b0afe69a55cbf23953149d6694d33

SHA512
2b71569a5a96cac1b708e894a2466b1054c3fae5405e10799b182012141634bd2a7e9e9f516658e1a6d6e9e776e397608b581501a6cfe2eb4ec54459e9ecb267

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tk\ttk\spinbox.tcl

Filesize
4KB

MD5
86bca3ab915c2774425b70420e499140

SHA1
fd4798d79eeba9cffabcb2548068591db531a716

SHA256
51f8a6c772648541684b48622ffe41b77871a185a8acd11e9dec9ec41d65d9cd

SHA512
659fb7e1631ed898e3c11670a04b953eb05cecb42a3c5efbdd1bd97a7f99061920fd5db3915476f224bb2c72358623e1b474b0fc3fbb7fd3734487b87a388fd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tk\ttk\treeview.tcl

Filesize
8KB

MD5
46b1d0eadbcf11ac51dd14b1a215ae04

SHA1
339026ae9533f4c331adf8c71799b222ddd89d4f

SHA256
db6faa8540c322f3e314968256d8afff39a1e4700ec17c7efe364241f355d80f

SHA512
0fc81426857949d5ac9fe7ff3c85a1270bd35bf6e6eaf3fe7ae0de22a0c0e5cd96d6c9471216dc1da673fad949ca96a3751c3d3222474d2206aa9d8a455ba12e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tk\ttk\ttk.tcl

Filesize
4KB

MD5
e38b399865c45e49419c01ff2addce75

SHA1
f8a79cbc97a32622922d4a3a5694bccb3f19decb

SHA256
61baa0268770f127394a006340d99ce831a1c7ad773181c0c13122f7d2c5b7f6

SHA512
285f520b648f5ec70dd79190c3b456f4d6da2053210985f9e2c84139d8d51908296e4962b336894ee30536f09fae84b912bc2abf44a7011620f66cc5d9f71a8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10682\tk\ttk\utils.tcl

Filesize
8KB

MD5
65193fe52d77b8726b75fbf909ee860a

SHA1
991dedd4666462dd9776fdf6c21f24d6cf794c85

SHA256
c7cc9a15cfa999cf3763772729cc59f629e7e060af67b7d783c50530b9b756e1

SHA512
e43989f5f368d2e19c9a3521fb82c6c1dd9eeb91df936a980ffc7674c8b236cb84e113908b8c9899b85430e8fc30315bdec891071822d701c91c5978096341b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xuwcuh4m.2ir.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\Logs\DISM\dism.log

Filesize
213KB

MD5
e46fd696a6078e8fcef62d7aaf65fbbf

SHA1
ba7c68f868733b244be19f96e62b9114b098c0d4

SHA256
a32ee200c13eee76e06f6a10a944928e403480c69467449a1bc6538ac77b66e0

SHA512
5e249259930809a6d1b6a136c472328465ff768adc612813751f55b8fd274219e308a42eb5ae54b0b175c342cf1b2427f5d026dad143e0e1ae5c39d1186d4206

Download Submit
memory/3572-2830-0x00000228B2AF0000-0x00000228B2B00000-memory.dmp

Filesize
64KB

Download
memory/3572-2832-0x00000228B2AF0000-0x00000228B2B00000-memory.dmp

Filesize
64KB

Download
memory/3572-2833-0x00000228B2AF0000-0x00000228B2B00000-memory.dmp

Filesize
64KB

Download
memory/3572-2843-0x00000228B2AF0000-0x00000228B2B00000-memory.dmp

Filesize
64KB

Download
memory/3572-2844-0x00000228B2AF0000-0x00000228B2B00000-memory.dmp

Filesize
64KB

Download
memory/3584-2441-0x000001E6AE920000-0x000001E6AE964000-memory.dmp

Filesize
272KB

Download
memory/3584-2450-0x000001E6AEC40000-0x000001E6AEE02000-memory.dmp

Filesize
1.8MB

Download
memory/3584-2488-0x000001E695480000-0x000001E695490000-memory.dmp

Filesize
64KB

Download
memory/3584-2489-0x000001E695480000-0x000001E695490000-memory.dmp

Filesize
64KB

Download
memory/3584-2490-0x000001E695480000-0x000001E695490000-memory.dmp

Filesize
64KB

Download
memory/3584-2437-0x000001E6956B0000-0x000001E6956D2000-memory.dmp

Filesize
136KB

Download
memory/3584-2438-0x00007FFBF0A80000-0x00007FFBF1541000-memory.dmp

Filesize
10.8MB

Download
memory/3584-2439-0x000001E695480000-0x000001E695490000-memory.dmp

Filesize
64KB

Download
memory/3584-2487-0x00007FFBF0A80000-0x00007FFBF1541000-memory.dmp

Filesize
10.8MB

Download
memory/3584-2440-0x000001E695480000-0x000001E695490000-memory.dmp

Filesize
64KB

Download
memory/3584-2442-0x000001E695480000-0x000001E695490000-memory.dmp

Filesize
64KB

Download
memory/3584-2443-0x000001E6AE9F0000-0x000001E6AEA66000-memory.dmp

Filesize
472KB

Download
memory/4332-2518-0x0000028AF4B50000-0x0000028AF4B60000-memory.dmp

Filesize
64KB

Download
memory/4332-2520-0x00007FFBF0A80000-0x00007FFBF1541000-memory.dmp

Filesize
10.8MB

Download
memory/4332-2517-0x0000028AF4B50000-0x0000028AF4B60000-memory.dmp

Filesize
64KB

Download
memory/4332-2516-0x00007FFBF0A80000-0x00007FFBF1541000-memory.dmp

Filesize
10.8MB

Download
memory/4632-2841-0x0000015EF3DD0000-0x0000015EF3DE0000-memory.dmp

Filesize
64KB

Download
memory/4632-2838-0x0000015EF3F50000-0x0000015EF3F60000-memory.dmp

Filesize
64KB

Download
memory/4632-2837-0x0000015EF3DD0000-0x0000015EF3DE0000-memory.dmp

Filesize
64KB

Download
memory/4632-2834-0x0000015EF3DD0000-0x0000015EF3DE0000-memory.dmp

Filesize
64KB

Download
memory/4632-2836-0x0000015EF3DD0000-0x0000015EF3DE0000-memory.dmp

Filesize
64KB

Download
memory/4632-2842-0x0000015EF3DD0000-0x0000015EF3DE0000-memory.dmp

Filesize
64KB

Download
memory/5900-2505-0x00007FFBF0A80000-0x00007FFBF1541000-memory.dmp

Filesize
10.8MB

Download
memory/5900-2502-0x000001A3B8B30000-0x000001A3B8B40000-memory.dmp

Filesize
64KB

Download
memory/5900-2501-0x000001A3B8B30000-0x000001A3B8B40000-memory.dmp

Filesize
64KB

Download
memory/5900-2500-0x00007FFBF0A80000-0x00007FFBF1541000-memory.dmp

Filesize
10.8MB

Download
memory/5968-2822-0x00007FFBF0A80000-0x00007FFBF1541000-memory.dmp

Filesize
10.8MB

Download
memory/5968-2810-0x000001342A070000-0x000001342A080000-memory.dmp

Filesize
64KB

Download
memory/5968-2809-0x000001342A070000-0x000001342A080000-memory.dmp

Filesize
64KB

Download
memory/5968-2808-0x00007FFBF0A80000-0x00007FFBF1541000-memory.dmp

Filesize
10.8MB

Download