hxxps://buzzheavier[.]com/7xt54u6svq9v

Analysis

user interaction
yes
max time kernel
133s
max time network
134s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
19/04/2026, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://buzzheavier.com/7xt54u6svq9v
Sample260419-se3fqsax21

Score

7^/10

discovery persistence ransomware

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1056	vape.exe
4028	vape.exe
1648	aplychr.exe
5704	aplychr.exe

Loads dropped DLL 64 IoCs

pid	Process
548	VapeV4.exe
548	VapeV4.exe
548	VapeV4.exe
548	VapeV4.exe
548	VapeV4.exe
548	VapeV4.exe
548	VapeV4.exe
548	VapeV4.exe
548	VapeV4.exe
548	VapeV4.exe
548	VapeV4.exe
548	VapeV4.exe
548	VapeV4.exe
548	VapeV4.exe
548	VapeV4.exe
548	VapeV4.exe
548	VapeV4.exe
548	VapeV4.exe
548	VapeV4.exe
548	VapeV4.exe
548	VapeV4.exe
548	VapeV4.exe
548	VapeV4.exe
548	VapeV4.exe
548	VapeV4.exe
548	VapeV4.exe
548	VapeV4.exe
548	VapeV4.exe
548	VapeV4.exe
548	VapeV4.exe
548	VapeV4.exe
548	VapeV4.exe
548	VapeV4.exe
548	VapeV4.exe
1056	vape.exe
1056	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
1648	aplychr.exe
1648	aplychr.exe

Contacts third-party web service commonly abused for C2 1 TTPs 20 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
155	discord.com
135	raw.githubusercontent.com
138	raw.githubusercontent.com
148	discord.com
127	raw.githubusercontent.com
137	raw.githubusercontent.com
145	raw.githubusercontent.com
147	raw.githubusercontent.com
128	raw.githubusercontent.com
129	raw.githubusercontent.com
131	raw.githubusercontent.com
134	raw.githubusercontent.com
136	raw.githubusercontent.com
139	raw.githubusercontent.com
140	raw.githubusercontent.com
149	discord.com
130	raw.githubusercontent.com
132	raw.githubusercontent.com
133	raw.githubusercontent.com
154	discord.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_1848_986508009\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\mn\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1642598403\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1569160178\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1550224745\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1569160178\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1642598403\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1770355205\_locales\zh_TW\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6024	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134210846110669953"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2626041545-1565650712-3224088082-1000\{C21BCCE5-8304-4044-8870-ED79B650F1C4}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2626041545-1565650712-3224088082-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4028	vape.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
548	VapeV4.exe
548	VapeV4.exe
548	VapeV4.exe
548	VapeV4.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe
4028	vape.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4028	vape.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	548	VapeV4.exe
Token: SeDebugPrivilege	4028	vape.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4604	VapeV4.exe
548	VapeV4.exe
1056	vape.exe
4028	vape.exe
1648	aplychr.exe
5704	aplychr.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2664	1848	msedge.exe	82
PID 1848 wrote to memory of 6024	1848	msedge.exe	83
PID 1848 wrote to memory of 5328	1848	msedge.exe	84
PID 1848 wrote to memory of 5328	1848	msedge.exe	84
PID 1848 wrote to memory of 5328	1848	msedge.exe	84
PID 1848 wrote to memory of 2672	1848	msedge.exe	85
PID 1848 wrote to memory of 2672	1848	msedge.exe	85
PID 1848 wrote to memory of 3296	1848	msedge.exe	86
PID 1848 wrote to memory of 3296	1848	msedge.exe	86
PID 1848 wrote to memory of 3296	1848	msedge.exe	86
PID 1848 wrote to memory of 8	1848	msedge.exe	88
PID 1848 wrote to memory of 8	1848	msedge.exe	88
PID 1848 wrote to memory of 8	1848	msedge.exe	88
PID 1848 wrote to memory of 5412	1848	msedge.exe	92
PID 1848 wrote to memory of 5412	1848	msedge.exe	92
PID 1848 wrote to memory of 1724	1848	msedge.exe	93
PID 1848 wrote to memory of 1724	1848	msedge.exe	93
PID 1848 wrote to memory of 5032	1848	msedge.exe	95
PID 1848 wrote to memory of 236	1848	msedge.exe	98
PID 1848 wrote to memory of 236	1848	msedge.exe	98
PID 1848 wrote to memory of 236	1848	msedge.exe	98
PID 1848 wrote to memory of 5204	1848	msedge.exe	101
PID 1848 wrote to memory of 5204	1848	msedge.exe	101
PID 1848 wrote to memory of 5204	1848	msedge.exe	101
PID 1848 wrote to memory of 3860	1848	msedge.exe	107
PID 1848 wrote to memory of 3860	1848	msedge.exe	107
PID 1848 wrote to memory of 3860	1848	msedge.exe	107
PID 1848 wrote to memory of 4400	1848	msedge.exe	108
PID 1848 wrote to memory of 4396	1848	msedge.exe	109
PID 1848 wrote to memory of 4400	1848	msedge.exe	108
PID 1848 wrote to memory of 4396	1848	msedge.exe	109
PID 1848 wrote to memory of 4396	1848	msedge.exe	109
PID 1848 wrote to memory of 4944	1848	msedge.exe	110
PID 1848 wrote to memory of 5812	1848	msedge.exe	112
PID 1848 wrote to memory of 5612	1848	msedge.exe	113
PID 1848 wrote to memory of 544	1848	msedge.exe	114
PID 1848 wrote to memory of 1896	1848	msedge.exe	115
PID 1848 wrote to memory of 1896	1848	msedge.exe	115
PID 1848 wrote to memory of 984	1848	msedge.exe	116
PID 1848 wrote to memory of 984	1848	msedge.exe	116
PID 4604 wrote to memory of 548	4604	VapeV4.exe	121
PID 548 wrote to memory of 1056	548	VapeV4.exe	122
PID 1056 wrote to memory of 4028	1056	vape.exe	123
PID 1848 wrote to memory of 5388	1848	msedge.exe	124
PID 1848 wrote to memory of 5388	1848	msedge.exe	124
PID 548 wrote to memory of 1648	548	VapeV4.exe	126
PID 1648 wrote to memory of 5704	1648	aplychr.exe	128
PID 1848 wrote to memory of 5460	1848	msedge.exe	130
PID 1848 wrote to memory of 5460	1848	msedge.exe	130
PID 1848 wrote to memory of 1932	1848	msedge.exe	131
PID 1848 wrote to memory of 1932	1848	msedge.exe	131
PID 1848 wrote to memory of 996	1848	msedge.exe	132
PID 1848 wrote to memory of 996	1848	msedge.exe	132
PID 1848 wrote to memory of 5024	1848	msedge.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://buzzheavier.com/7xt54u6svq9v
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2cc,0x7ff83612c188,0x7ff83612c194,0x7ff83612c1a0
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,12855354699305188711,3193771524827747187,524288 --field-trial-handle=2348,i,10077615167743593926,988073689603319187,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - System Time Discovery
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,12627713433222347932,9434390423226240502,262144 --field-trial-handle=2348,i,10077615167743593926,988073689603319187,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2640,i,9570190381235413829,14704239974442083480,524288 --field-trial-handle=2348,i,10077615167743593926,988073689603319187,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,9595554575185616298,12145420090103693783,2097152 --field-trial-handle=2348,i,10077615167743593926,988073689603319187,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,12635438955926101164,2541824190544277466,2097152 --field-trial-handle=2348,i,10077615167743593926,988073689603319187,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,4091345940128113617,15591825706215095352,524288 --field-trial-handle=2348,i,10077615167743593926,988073689603319187,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,8960713404847525915,15394110759125776863,524288 --field-trial-handle=2348,i,10077615167743593926,988073689603319187,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,3022320203167527749,12912990189825464693,524288 --field-trial-handle=2348,i,10077615167743593926,988073689603319187,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,3022320203167527749,12912990189825464693,524288 --field-trial-handle=2348,i,10077615167743593926,988073689603319187,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5996,i,3799547182203973561,97444716259723810,2097152 --field-trial-handle=2348,i,10077615167743593926,988073689603319187,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6260,i,10363503566292625963,11101976708332977333,2097152 --field-trial-handle=2348,i,10077615167743593926,988073689603319187,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6124,i,18397970283787315188,6368868072277194636,2097152 --field-trial-handle=2348,i,10077615167743593926,988073689603319187,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,5534733301795663231,2296419527809131028,524288 --field-trial-handle=2348,i,10077615167743593926,988073689603319187,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6336,i,10061126799142436164,14365003792746182322,2097152 --field-trial-handle=2348,i,10077615167743593926,988073689603319187,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7060,i,8093021448548239918,4686000614927518613,524288 --field-trial-handle=2348,i,10077615167743593926,988073689603319187,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,2800222273659188831,14092546228119849341,524288 --field-trial-handle=2348,i,10077615167743593926,988073689603319187,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:8
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,12016888223512727570,10933014198141510924,524288 --field-trial-handle=2348,i,10077615167743593926,988073689603319187,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:8
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7152,i,17241519523034222486,3620530262792544773,524288 --field-trial-handle=2348,i,10077615167743593926,988073689603319187,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:8
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7136,i,9694760445645960892,5082898796099480932,524288 --field-trial-handle=2348,i,10077615167743593926,988073689603319187,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:8
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7188,i,13653753614907582797,632202779996145058,524288 --field-trial-handle=2348,i,10077615167743593926,988073689603319187,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:8
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,5940465005913686774,9864170451382956632,524288 --field-trial-handle=2348,i,10077615167743593926,988073689603319187,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,11130261327634258128,1523497456302250379,524288 --field-trial-handle=2348,i,10077615167743593926,988073689603319187,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:8
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,12368912735660329066,841532391870271399,524288 --field-trial-handle=2348,i,10077615167743593926,988073689603319187,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1244,i,17556875399648538200,7328863138498407258,524288 --field-trial-handle=2348,i,10077615167743593926,988073689603319187,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5212,i,7725646905665494565,17486527592791949886,262144 --field-trial-handle=2348,i,10077615167743593926,988073689603319187,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1236

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3780

C:\Users\Admin\Downloads\mods\VapeV4.exe
"C:\Users\Admin\Downloads\mods\VapeV4.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Users\Admin\Downloads\mods\VapeV4.exe
  "C:\Users\Admin\Downloads\mods\VapeV4.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:548
- - C:\Users\Admin\AppData\Local\Temp\_MEI46042\vape.exe
    C:\Users\Admin\AppData\Local\Temp\_MEI46042\vape.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1056
  - - C:\Users\Admin\AppData\Local\Temp\_MEI46042\vape.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI46042\vape.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:4028
- - C:\Users\Admin\AppData\Local\Temp\_MEI46042\aplychr.exe
    C:\Users\Admin\AppData\Local\Temp\_MEI46042\aplychr.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\_MEI46042\aplychr.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI46042\aplychr.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5704

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x248 0x450
1⤵
PID:3308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 96f45b5bf3f547d17e5732304dc980fbe456d82f6d2ff767a06a514f19299746
MD5 a3e3f2365b4a9f5e892bdab0cb23f5ff
SHA1 00437210a19ac4044fc5ab8b05fc67fb3d2c3e39
SHA512 61f23f7d3bb28843c3e55b500350240a688ef13fea94a492e7dd1721000f5fbe101214ecb44b96a44e9b73a8654ea1975ab3fa42ab07cca58e408d71a26671fc
TLSH
T17DD0C04C11F07C33C0488A700F417306350ED89BEF4193151833286C0CC300040D25C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2701018cd27c4946846a233b2808bfc7993b76fae755e7a22a791e82b176a546
MD5 dbc933955c11aa81b70b640f18e125dc
SHA1 724ef17c28aa600c64cde137098694e56f2fcbaa
SHA512 8ba15a50d96e6f9648bcb90820eb75148f7696d9c2c80d4773f9d62ca1d7f7386ac02d68288dc5670d6f30eb57100831998a442260dbf894b42313ad84257ada
TLSH
T1ECD0C04811F07C33C0448A700F817306361ED49BEF4193151833287C0CC300044D25C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 383adae7fcf2c233040443cb55ae57a3e848810908a468c8163ba8793c6362fa
MD5 c41bc41f25a9afdb260da8c2d10a24d3
SHA1 c7b0e86ee0ec9bc75e2f15819f80aae1891c2513
SHA512 f47869a81d381763b6c831a32b67b6db1a7454c2fd8ddfb9aad3337c472c7e228ffc56011e29d04d05bdc501302e9346637e74fa020197571b3cfd58875ffcfc
TLSH
T133E02B9EC861EC3719F90B1D94511787F65513672B40544F7A3C420D4FB453B068685C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c16289e58e2957fbc191b298734fbe96dc5320cb8f9b2f86656e8f48eb81dd6a
MD5 d6f1915379cf8ebdc18f07a6d2ea9cba
SHA1 42b5ed0e5f23133df785253c1e208fd4d1353896
SHA512 210b8e72cd253f82a3325e0f55227d39549442235458fe7d05e2e2c4495a3f6ba2245dd8a5d7bb4e68759c780c7fdbda2399e20c7bf8a97bfe2a356d8c251641
TLSH
T1F7714E87CC538425E7E04174DEDE319D3E30AA684FCB0F6155DE687C4A667E18181C1D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586721.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586721.TMP
Size 3KB
SHA256 8ddac18db76406b54c9aecc551e234113d945c093da37a151c6a7941e332a3ad
MD5 7e9027c15746efbdc2f73de27ea35fc5
SHA1 971c903fba4049d361f5db43325fd1632f0ba387
SHA512 1f1536010ea7b8b6bbddde444cc472fd75d9a1af8fcd27847948e99a1081c5473865f4a5a90db7a26449827e527faae31317f195f32f0360941d7ee547d8ba4c
TLSH
T1F7614C87CC578829E3E041B4DEEE319D3E30AB684FDB0F6151DE587C8A667E08285C1C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 a8999c2bc9550ca14148993394bb0c3eabd7d1e457fb828b2d2a0d67c3999427
MD5 8c54d975ec4b792c6daeab5f4619378c
SHA1 051ca9af99626af5c0c2f805177bd4191a00800b
SHA512 72cdd4fced8122f01db14bdcc292440903798376d6467006afb014bf39ed31bb4da83b367c6b90c0ca999f6e3ff8928f4cb1df3e4ce31f31d2ef16fe7a1ed9ba
SSDEEP 96:D1KOdtVuE5uEs0joMuE6Nq/zBsTd/xTFj6t9lmuES1uEzDRuEvQ5UfFq88uE/wBB:D15XVf5fXsMf6Nq/1sTd/xTFj6TlmfS9
TLSH
T171C1ACF7C3E48A2DC91252F0AB186E2FCE190964532C3D1AC9E59F4B97E2871E151A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 3e20f75db76e46cea6d5c9285690abf4b89a50b2589e0caa5d223ea83091c0a9
MD5 ad81726ec58f6d5baab6e5a8fee38310
SHA1 2a6b578858ded0e91d8343d9665c6fdfbeb60d7e
SHA512 661fa7e85baf98ce89a2a28d1e4085ddb2a94ab67f2fa48756eb5226839711f75bbbe50c12e296fb1b8a1a4a47c9d6a1e5fa674402215c4fcfd871eee4902d0a
SSDEEP 384:sxZr+qLb/fSs0jMuBEdcrWHb8/19SrNUa:sDBLb/fiQu6xHb+19Srz
TLSH
T10D72E856A678597B8CDBC219F5457B53D6F9016296901E44AEFC8F0C00EABED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 94d0c890fa2465db0173c8855f139ecd3c9c18de611757bcd15e40020a3d2cf2
MD5 7ac03bc4d7d01b26c697c21621773966
SHA1 dce7289f1935a9a5737180d32f604b28380d4ba0
SHA512 0f86a6e214fed5f5ac7d9c08636423946af6f631fc5d0726ab68c2a4ab9e2e891884454ccb0073bd1d679608f91ddab649242c0e6dcb0337ac27c91c35054e87
SSDEEP 192:sxZrR9yMqZ/K1Ml8Mkb/fSszjZsRBYFu6hCYzodpFm1THW6+WN989V9/zhHacE1+:sxZr+Mb/fSszjZuBEdcrWHb8/5cSrNjp
TLSH
T18D72E8166678597BCCDBD219F545BB53D6F9116396901E44AEFC8F0C00E6BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 6a6939cfc5e08434fbe7227eabdf84c7adffac5abba622e4efffae22a0da0f78
MD5 3250c99ef40aa25bf8dbddbdd5e9176a
SHA1 431cb082470453a6974492169ff72f6563de1c23
SHA512 44a777e9c525414ee971fc3c92fe4db758ef8295b8c815a332c01c0c6ab612e442217c1eb57df2bfb74d9c6be4b88393595b3f19f70466e91123c253403f8501
SSDEEP 768:/E0HmkK7pLuL/+SWv+2p28F1+UoAYDCx9Tuqh0VfUC9xbog/OVhMuNLlpvGl0roH:/E0HmkiE/+SWv+2p2u1ja4MuNLfOlf++
TLSH
T1D7F2FB3B680CCB7F4F844E9CED2A7E8A6DE8018F96D8895447FA840C03C76EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 dccd364b523447588203555867e493d9d44758e9dc666f1d327f104191ff1aaa
MD5 254d6e9c46ef10aff050ed9b86d2167f
SHA1 60e558da516cdf57b6ae498d2d5766ec6e91d85a
SHA512 e367593fc2bee1d9890ecaba846417c268f01ecb82e07c0ada8d91edec051fc9a85e0b768592450350da328250cd835c71ef28e9bb27d2d8509fbf31f3f64b90
SSDEEP 384:chg7IZUdoEOKm7K3w8QBIGLkEXOwnAFCffT3ZvDI:chg7IZUdoEOKm7K3w8QBIGLkEXOwnAF9
TLSH
T143B20711753702803A7EA9CA85A5B92E46C734773028A53B7BF904A64F67E20DDFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 7af5a7a95c1cba2da1d3f67d29093f1bfd0d9daf43666dea7634408083d77345
MD5 935e5b6f1b9923fa85f587860cacb12a
SHA1 27d35b2dd567c038514373decd2a6665054b4ced
SHA512 3860ecc4b73c18d8a6c8a287c550e362dd8c8dd672106b349a06b2bb70ac8c25970cc6b5100c63953482069ea398074054f82f1255bab1d7d5c02d0d9d8d6d22
SSDEEP 768:OFQccQ830wgPoNiYaA4X3mB8XabW6pNeL:XccQ832NmB8yWQcL
TLSH
T199E2B3F198D78977E8AE4B97A33D2E069AFCC167B5485594FB840D0DCC861BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 fcd36089b9e12150be6f40b86a2bf720ebb91d0c2bafe85332a60f871d94029e
MD5 0ed583047ecb9526d0104464b3dd374f
SHA1 b45aa545f79c4f82f9575820cf024324726e619f
SHA512 eaf8bbd0b5cb6ad730c0918253563f3c058986315c39a59169bbd5feae1ef7402c021ed499078afaa3c84b31a9c2690a2ec9312a3886f87d3fec4477fd03e649
SSDEEP 384:nc2iFavqMg3sN+8TUNTUlImkrIJWlcZrf7YYdAIAHxm1QndnS4mtmXYrNlk+5vIw:gFayv3twg+I0YaATm6ndS4smXoZ
TLSH
T105C23B35EC98DABBECEA4FC9E7497606DEE00267D59C4AC8D6D81D0E00D719E170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ca193c21dbf0b797efc66cc22a09b7158572678368089c4c111efb8263123d2f
MD5 bcb98ca8a63cd242c8c073ea8a97556d
SHA1 14bd8ac99b109c0384a5c027f5e7854497a1871b
SHA512 58c7fe8aae1125db22430ae18db2ed75152dcb97339798e2d7075206f4cd6fd650db2897866ffc814d5a04afdb14250ebec64f34def45b000947242d3b525586
SSDEEP 384:nf2iFavqMg3sNH8TUNTUlImkrIJjB5Zrf7YYdAIAHmnXrHRmoQ8dnS4mtmXYrNlZ:FFayv3Ewg+3/YaA4X9mB8dS4smXoZ
TLSH
T1A5C25C75EC98DAB7EDD64FD6E7497606DEE002A7958C4AC4CAD81D0E00D71EE130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 74155d01a451032ea20349f444c65c6833ddf06be9b4d05d3c170e06494f512d
MD5 0b45959098156fbe144d5b15b759d184
SHA1 f0785df53dd27e0f3f9bc927ccc8913e1aeaf3a4
SHA512 77a596eb4648ff0d8c6fb94f7c96f82b00e2e19ab7de7b90db07955039a6ad53b1e6e976d93adf32e79453b63288738a367105c797202bd26d9d6a4db46cf750
SSDEEP 768:HFQccQO30wgP1NiYaA4XUmB8XabW6pNeL:2ccQO3/NNB8yWQcL
TLSH
T1CCC26D32E8A8DDB7EDE68FD5E34A3607EEE01167968C5AD4D9D84E4D00871ED130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 62fd2eb2a08177ec64019bcce02979a3a527bdb718f477825bc2bd87be348e5a
MD5 8a901bfa9aa4563cd5c0def65b6a20c5
SHA1 d9dd8879bdabf0d9b87a597f6a8b0c77176be38c
SHA512 0f87334c23f7399bf16e5dcf33b582f8d0b1659dfecfa3bb1e4063eb3c10323438e86fc9e242b99a1bbca468094e254613dc80ba6e012fca2edb2cb7b460f2b3
SSDEEP 384:ny2iFJjccCs+Bt0S3E3sNr8TUNTUlI4kiIJa58Zrf7YYdAIAHmnXrHwmoQ8XU/AZ:6FJccQk30wgDCUYaA4XUmB8XabW6pNeL
TLSH
T1E7C25D32E8A8DDB7EDE68FD5E34A3607EEE01167968C5AD4D9C84E4D00871ED130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f85b64228713d818e93d520daf3a69b6e110b52e1b3e5a1dd1a492c587c4861f
MD5 8c3b04ba7b818d86b06c337126fa28e2
SHA1 a978b63d4809a13a90def0df7e4163cd5818757a
SHA512 0cb9b87679991fcd796801292f44eab94ba840d8cd29fa107f10d45b614ba17a5eb0395f35399fecbe3c2675803a873a6de49cde7c3e118bcc9c7003735a6c15
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe58658b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58658b.TMP
Size 392B
SHA256 7505f043620cc59d09dd9ff2e7481c523df8cab0c83236dbd58bd7e799d98861
MD5 a6f2d2102700deb8c96701243f427152
SHA1 e5d883d530639ce94d74d8812ea40a7d5fac77f7
SHA512 cdc9a3542d728d9c8d3cc3e841108e41e33277b355629b988cd9d566fb768a8aa9397e59cd3f918d1c3a49c6094a12da11407d4879629db9e03200eea569ae6c
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 cb6ddf487785cbc34abe606fed4468a57246cc80ca791249bb483a53ab67fa9c
MD5 a4fbc57697fc41d43a3cec1530c962ec
SHA1 a76260da0d3e6eb3f8ccf5690543d878b6066772
SHA512 2123dc0e94266c1cad9d095d06f5ee2e71e09cd0c2cf8e5877aa99811e5ddecc3dea133f7d94e6a35a5c192decaf2679d72f3711c627ee7dc70282f7fa0397b0
TLSH
T1754160D05C7D2AD1D1BD1A3EB48B38FC95DCC62AF1A4347E6858EE88463A61D248543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 677ab99f9bcde31168bb9ae8d0cfcbbab752c81e404c1bb73d68b9352f9a0fea
MD5 240c5cf1fa72cc0c66bf9b10c8bb9b70
SHA1 97bd5188fe9e025a9a22c670eb83ff2f5a161739
SHA512 06489d1c81371cbbaf8988e1e365bc1c384a5fd029ad141a7fff879e9c1d58974857b5bb47dd479559b0dc1cd0be1b0062b73706442e68f0eca32a70a0c5e992
TLSH
T1B5417FE05C3D6AD1D0BD1A7EB08B38FCD5DCC626F5A0343E2868EA88463A61D248443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 77e86eb707d5212b19e8d13bad802a652bae2bbbcb75da1b26faa7af8f79af32
MD5 1d72e8938358c912a6e80bf58ba8a224
SHA1 bda9a2a157050dc945e766567ef9610e01809e22
SHA512 df8c5a32747aa3914cef31a6dc95bef57f7ff51210d3fc64cf2d696274abc3cc1737dc755ba20d1f5ff7ab6a876fbfab9b1ba1278a6ffb08e8abf68be9295025
TLSH
T12B4171D08C3D6AD1D4BD1A3EB08B38FC94DCC626F0A4347E6858EA88463A51D644543F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cc050e771005cc3473f6619fa2fe7d390e4cb98cb9e70f29120cb07b59302eab
MD5 2345099da5363a0c2aba13cd873ef9eb
SHA1 47c6b0d6e1b695782eedec7342c403c3461db282
SHA512 88473bdc4bd0393825167627cc9f8f31c057bf2895fa81c8ed3eb1f3a7fc558a22926c080fd3bf4311f3c9c5df415277691661f29b2ad1ebd5123b1fc3b4cd00
TLSH
T16141F799AAF91148F3B76E5AAFF6A86D487FB8771F06D09D00110D4E4672B40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\Temp\_MEI16482\importlib_metadata-8.7.1.dist-info\INSTALLER
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\_bz2.pyd
Size 85KB
SHA256 a4be36fffeefa8b24c1234d548da8f05558aba53c2ea7d1d2614776eaad8fbf4
MD5 a0946ac3236b70d27de6046ccc467977
SHA1 84f2aa56e58849cf30e632e7eaab4901a681f08c
SHA512 02429781f017b534918657e5c152ea022b52bcddd15ecca7f8b4629940dd4367a09af4d86a1f05d946ca97f2709718b136003693088c480d9b791e4d18361174
SSDEEP 1536:vZAVNz7DkEvkmFfR/l/kM4KPkM/gg8IWRbG3II13VAyvcvR9qfIk2:vGVNzUERn9R4KRg7NlSII13Vk
TLSH
T1A2838E96F3B552B6F59B91B886840793F730BB860750A3AFF14882853F13BD06E5C369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\_ctypes.pyd
Size 139KB
SHA256 f8a9f7831e81b2bfba12456e589f8198114f24986bd527ac231a844565afcddb
MD5 03fb3055ed0c56155bbf030596726e03
SHA1 fba03bbf844c08ccf20854d717a84fa62ab291fd
SHA512 9ba8f50f75b37858b3d81d6f7323ae981ae21f57a9897955142bc53098ad74c8ae119e61ccd0bb5cd0071e092e8c2bbb5c146688e29f2cf7d1d3740f47ec9117
SSDEEP 3072:HDpx2Lp7KRmFrkdOJWWcovIMzTF4FyxpEI1GPny:jpxCdK8r8WDvIMn+8xpx
TLSH
T160D37E4B736841A6DA678138C6739E47EBB1F452261087CF4264C99B1F633A2AF3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\_lzma.pyd
Size 157KB
SHA256 f7ad11fbbb7aeaf7b6566a532a3243e3ae5f92bac480dbe5c2ef300fe2c1dabe
MD5 1dfaf924b4576f551f6dfe3cae50b230
SHA1 ef19846989f337e600c8f9ccacbd4276cc4d35f0
SHA512 2df6a600ecd03de76f066f87a8dd13bf138a51f89fe745813d7a00418fb716c670cb04a9b5573d2b852fc8885acac8b960ba4c42d38fcb7e9a1d2aa2e84f90a9
SSDEEP 3072:z+0m6DKDYtwipfxAbDcoAL+Uznfx9mNoV+dREOII1I1+ZgTT:iTCKDYvNoopYOyGOjeT
TLSH
T182F34C86B794F0D6F3628C78D6618F53E7F5781A0320929A01CC976D2B1FB759A2B313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\_zstd.pyd
Size 491KB
SHA256 536a3b521a3c42d2827ece0ccfbe40b83a2fd96a0f5496cd60b943b10e1266d4
MD5 b89f5d1345ef95f80ddcbe5b3e4e5bb3
SHA1 2daee236009cc3efe02dc9bbbd8c6faa8ac56478
SHA512 fc925424ad4bd8bdfae04b95fdadfcdbffcac76270997b4ce365be8a47d4c636b7e0b31e78d785a3dc6c9b2dd0f108aa716a92ee4f0506f3a0329e4a424b48e9
SSDEEP 12288:X/WcJlzAwk9mH+65GRRfODoHWDTrWl93mFgR:X/WcJywk9mH+KGRRf2o2YR
TLSH
T1A5B48D43F29983EDE17BC4B8CF465A53FBB1780B1214565B93A5CB943F07B309A6A308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\api-ms-win-core-console-l1-1-0.dll
Size 19KB
SHA256 8f0188d00d062f3d650cb811607a64eb7a3b923397da473f38883d942f4f5184
MD5 815bd17033aa15f6937eff710101c784
SHA1 651f373b703cf3e02e77e26119a2a925ded509f0
SHA512 b836e6a83a21d32c2c61c98aae05490da2f77b8459c334e3959a02ec31639fb9ac190b53f08e2fa01a953e8c65038ed148f9fd4ea71b6369f7ef466c6ccfac54
SSDEEP 192:FFOhoWyhWyXjbnruJPN0f7LD2oEhZnpH3GCwgEfeyZpV4zNT9Xgo:FFJWyhWyXnrh3b8ZpH3GCJEWyWNH
TLSH
T1DC925DD31EE86901FC938EB0D4EA9533DC3576E05AF0428D71B582096966351EF2D72F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\api-ms-win-core-datetime-l1-1-0.dll
Size 19KB
SHA256 daaacd2fdf366e2c36b42398e850412c8be3093e5b7a8f608684a656d27e4d6e
MD5 5e43b4314980eb7f19506613d4523e63
SHA1 fc2788632181476092a5cb4aa63ef57e4106703a
SHA512 acc730e49b6f59d0e76fdff10d16d89c46ec6a7002af6dfd15407af40813e92e585074bb4bcc71c2b8d7ea44c3e7abaeac7b8a877609de0fdb72324417d7cfea
SSDEEP 192:lWyhWzXjbnruJPN0f7LD2oEhZnpH3GCwgEfkytx8jaTNdeTj/i:lWyhWzXnrh3b8ZpH3GCJEMytx82C/i
TLSH
T133926BE71BBC6501FD974E7090E78A33EE3172E0AFA0429F18A480056956B15FE6973F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\api-ms-win-core-debug-l1-1-0.dll
Size 19KB
SHA256 301a110ed905f10243437c5bc2a92cdf7c8609c19cb8baff92c99d8645c8d6f0
MD5 6e84207402f5cd66e00abb1689ded080
SHA1 72559bedd082049c79f2b9fa59b7875a0ddd4551
SHA512 58cc81404b88e133524d7c62b51f1c0ff9cfbf600e01b912e181529f03af74300a5fec98f85a7303e1dc6ce1ddba519b01b296db8a94a234884ca493567bcf0b
SSDEEP 192:cWyhWFXjbnruJPN0f7LD2oEhZnpH3GCwgEfayxstLyPl:cWyhWFXnrh3b8ZpH3GCJEyyxstSl
TLSH
T175926CD317B87800FAD75F30D1DA9A33DC71B2A1AEB0028E01608415666B791BE35B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\api-ms-win-core-errorhandling-l1-1-0.dll
Size 19KB
SHA256 c119a34d7ac08eccb645a85415b4abfa5a8fb05afe20838eb6ffb558f01657fd
MD5 8c717ad4c92fc26b40ec6830fd9289c7
SHA1 c5ed74b59bcdca1e26639c245900444b894aa06d
SHA512 b734de4228232b423595bf87bf3b26a5297c6829a1ac976064dea30289e6bd646ff15d6daf40b6885480c9a58e80de31b429f2d233f6294b603e91f72e99e130
SSDEEP 384:9zQ5WyhW3Xnrh3b8ZpH3GCJERynCTJQB8:9zQrGn5iRBER0W
TLSH
T146926CD75BE86802F9E78F3094E29933DC3172E5AEB0025E156490152A2B3A1FE7473F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-fibers-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\api-ms-win-core-fibers-l1-1-0.dll
Size 19KB
SHA256 d4f607fbf213e9e036269574a904ab8868bba26fd42e4fb2c60a425f03934bdc
MD5 2c2939389d78665ec3a34b1cfed44a8d
SHA1 c86a82c007be025baf8d02b15dc1d9277a1c49a5
SHA512 698b6a4c036a1d812f82140fed33cb9039c8774aa75b0b63ec8122084b2fc5d24b99876c82b0207d2e8ee79c7ac5ac11029347fb1beec55282e72d528e179163
SSDEEP 192:NWyhW6XjbnruJPN0f7LD2oEhZnpH3GCwgEfNyC8bdiguIa:NWyhW6Xnrh3b8ZpH3GCJEVyPiwa
TLSH
T1B0926EE717BC6541FC934F3090EA8933EC3172F1AEF0429E56A48105696A391FE65A3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\api-ms-win-core-file-l1-1-0.dll
Size 23KB
SHA256 df372db5e119520d56f73c1733bdf7f6134c7209e375c7ba6a4c80f37565b35b
MD5 3370535abeb8dc8ef37c2c5146d048f7
SHA1 b7a4d43b7948e93ded5b9a4a714ea69efd51cb26
SHA512 75eb9a907af3b873787165589dd3505bf634c52e0826feb44f88019a6be385e4086d40f27330387497bda8f4917045833cd0859c8114f275f2416acfb8942608
SSDEEP 384:6PvVXIWyhWUXnrh3b8ZpH3GCJE2yHFSel:6PvVXg3n5iRBE2zo
TLSH
T12AB2099799B4F75AFCCF8F3260E3C81388316291442441CA1BD4476DBDF7246E6EC6AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\api-ms-win-core-file-l1-2-0.dll
Size 19KB
SHA256 fbd5e958f6efb4d78fd61ee9ee4b4d1b6f43c1210301668f654a880c65a1be86
MD5 ac28edb5ad8eaa70ecbc64baf3e70bd4
SHA1 1a594e6cdc25a6e6be7904093f47f582e9c1fe4d
SHA512 a25b812b9fa965af5f7de5552e2c2f4788a076af003ac0d94c3b2bc42dd9ab7e69af2438ce349b46a3387bf2bfcf27cec270d90ca6a44c9690861331c9e431e1
SSDEEP 192:NxGWWyhWrXjbnruJPN0f7LD2oEhZnpH3GCwgEfmyhMWgdM:N0WWyhWrXnrh3b8ZpH3GCJEuyJJ
TLSH
T168924CD71BB86441F9A75F30D0EA8637DC3172B1AEA0019E54B841086A16792FE7973F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\api-ms-win-core-file-l2-1-0.dll
Size 19KB
SHA256 9f096475d4ba1533f564dd4a1db5dfeb620248fe14518042094b922539dc13e3
MD5 b5832f1e3a18d94cd855c3d8c632b30d
SHA1 6315b40487078bbafb478786c42c3946647e8ef3
SHA512 f3016ded97591e25a6d4c70d89251a331402455ab589604e55c486fec37ee8e96bd1be2d4e4e59ba102dad696b3e1f754b699f9ebe8ae462e8b958ed2d431a5b
SSDEEP 192:orWyhW0XjbnruJPN0f7LD2oEhZnpH3GCwgEfp+vy58MsN0o/:orWyhW0Xnrh3b8ZpH3GCJER+vyCNH
TLSH
T176925CD76BA87541F8D39F3090E58933CE3272E16AA0414E117482186E66381BF79A6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\api-ms-win-core-handle-l1-1-0.dll
Size 19KB
SHA256 1e7a0823130ca36e2f061ed8c40554ceb5faa906e10b6c042628e8ee6c776b4a
MD5 3486de24e09bc08b324c1c3e9e03b35c
SHA1 85743f027ace6e7da355c420ab162ad4a88c20b1
SHA512 053ed4bc2867fbed924b8ff47fba2cf4c302c9f95fedad8dca450b26509c0f6bfdc33e0d19b1afa3cd09e8c218228d0e3475df0200180acbbe97ee6a72482d2f
SSDEEP 192:43WyhW5IXjbnruJPN0f7LD2oEhZnpH3GCwgEfuyltJPx:43WyhWmXnrh3b8ZpH3GCJEWyhPx
TLSH
T10A924CE79BAC1401F9975E3090E69633DD32B2A0AAA042DE197481192D2A741FF7573F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\api-ms-win-core-heap-l1-1-0.dll
Size 19KB
SHA256 2c93dddf2fc65c99565d104a1078d663ebe590ecb74a47bc2ecf1b2e658574ac
MD5 8d01d04941918b5d5ddaa4a9d4b1a8c6
SHA1 27b1c293b58cd6af9a951127612857018da482a6
SHA512 1d902a947c79e9d7157a32ca0a8ac6da25ee7726ac996f17e060ec6fdf5aee6d717e9e6ea3b0f4539dc3aea632e484082303537e17248a26f7ff1b1db9e4e796
SSDEEP 384:8dxltWyhWUXnrh3b8ZpH3GCJE2yPv7qHS:gPn5iRBE2Wjqy
TLSH
T1F3926CCF57A87502FC9B4F3090E6D523EC72B2D05EA0015E25A482192A56751BFBAB3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\api-ms-win-core-interlocked-l1-1-0.dll
Size 19KB
SHA256 d8e6d80a4fa4d0c3da6c179c551ce65f9e872db5625ae58b8bd69802c09c5d7b
MD5 a68eddda85e1c77ee3c316d05e215db0
SHA1 eef3809b52bdf0a8a42aa60040d1d0ec34b1c2aa
SHA512 24c27a2894ac3ce764f0cb3225e80bf5f7637d3446b25a636917b4332814b9e7af9bdc8706ec6f8088529214367310a61df4bc2df4738ac06fec1f4e4a04e5d8
SSDEEP 192:asWyhWejXjbnruJPN0f7LD2oEhZnpH3GCwgEfjby7juj7:FWyhWejXnrh3b8ZpH3GCJELby7jO
TLSH
T195925CE35ABC3500F9E74F7184E59933DC31B3B06AA0015E16A0C158AA9BB91BE7172F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\api-ms-win-core-libraryloader-l1-1-0.dll
Size 19KB
SHA256 fb09d45296d3175e7cfcf5b0c284fe3bb3bfd5dea6e90c5c52c4f4c3aa1b0dc7
MD5 cfb04fb6e6f578655b08a6d50054e4a5
SHA1 e9336808b24ebe24eff535f2a158ff65a693441d
SHA512 1b9d752494f82075dc959b121dd0641418b5902a597c4427d792ffaea32f254cd7b5ee04f53cfaf20c36b5f0904242d6c0f2b67273ebac465aaa745d8daa470d
SSDEEP 384:BTvuBL3BWWyhWIXnrh3b8ZpH3GCJETyTX:UBL3Bajn5iRBET4
TLSH
T1D1925DD75AAC7941F9EA5F31D4E28827CC32B291DE7040AD05E8431C69A7351FA64B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\api-ms-win-core-localization-l1-2-0.dll
Size 19KB
SHA256 1fd044fdbc424779b01b79d477ee79dfbb508a04e86c62e1c8fc4f6d22f6a16a
MD5 fd59ee6be2136782225dcd86f8177239
SHA1 494d20e04f69676c150944e24e4fa714a3f781ca
SHA512 2250d54c3b9e6aeb2f5406e1428536564357a48ceab51596b33ff0843086fb420ad886af61725b25a58e2f50a4c17ddee10696d6041db9b60891eff8e495775c
SSDEEP 384:5naOMw3zdp3bwjGzue9/0jCRrndb7WyhWkXnrh3b8ZpH3GCJEyys1D0ZTf:IOMwBprwjGzue9/0jCRrndbh7n5iRBE3
TLSH
T16B924BD3D7A4F70AF84DC9317067C8229C7171548861898A07F18B24B6F3755FAF6329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\api-ms-win-core-memory-l1-1-0.dll
Size 19KB
SHA256 effb3bc6746e41e4139779aface86afc4e14454b95fc4a999dfdd07b03122a0f
MD5 671bc514f0373f5775448215da9ecc19
SHA1 8a1ce5f0c482ff9b7adc9da0c4e7c5876df3dc57
SHA512 dad926d9046a73f46be7d52bc5df61ea7178f42ff18fcf57064d78d0f94bca4e7641cc467606891f69985b860e80ec028475ecefd17f3765763b51df256822fc
SSDEEP 192:/AWyhW5XjbnruJPN0f7LD2oEhZnpH3GCwgEfyyYVl:/AWyhW5Xnrh3b8ZpH3GCJEqyYVl
TLSH
T139924BCA0AA86C02F8D74E35C1D78933DD73B1E15DF0429E12748201A9A6392EE25B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\api-ms-win-core-namedpipe-l1-1-0.dll
Size 19KB
SHA256 5b93dc92eee5dcc91aaa2a479cfd989c41a8ffaeb29e92959a730e7a632dce1b
MD5 ff505a3c725c068f0177d27e3def4707
SHA1 72e5942aaebf0e942d71d7f2231fcc2243ac165d
SHA512 072d6e1d843af90e19d356773317df491a06b952673ed34c7731242796ad647716e2c7544a4ca0ee37a1c7e738462973201d57f20fc57705db8b8e8061badd26
SSDEEP 192:aWyhWTZXjbnruJPN0f7LD2oEhZnpH3GCwgEfDyyTc3Wpy:aWyhWdXnrh3b8ZpH3GCJELyyT3y
TLSH
T100927DF6176CB541FD9B4F7081E6CA33CC72B2916AB0416D62B4CD0139663A0BA7972F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\api-ms-win-core-processenvironment-l1-1-0.dll
Size 19KB
SHA256 9b6f3d134547f882f476173a857a865dd9373c9befcfac0c324f1be673a2c9b2
MD5 83dd9755271b3e32e9ccc44602b170c5
SHA1 a7c3cd5b6c0cce5d85e666cb181d6a0247521cb6
SHA512 f41e644feebe5b41320f0272b2106e62d9f835f710e4035bbe15bcc997dfc6d503a5a946ba1f2437e3c149c095f7fade7a7929393a1821290a27c6859c70150c
SSDEEP 192:IEFPiWyhWCjXjbnruJPN0f7LD2oEhZnpH3GCwgEfoy/gduHndXoKs5:nFqWyhWCjXnrh3b8ZpH3GCJEwy/pHdYh
TLSH
T1B0924BC765BC3101F9D75E3090DBA933DC31B3B22DA0409D5164471AB9AB721FAA4B2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\api-ms-win-core-processthreads-l1-1-0.dll
Size 19KB
SHA256 6c2268cfc9b365e9683ed1f7b704d4fdc60938be8fcd2074ec3e1c35112b5785
MD5 f3d59040c56520a117d3e7f0d4df50b0
SHA1 cde5fbc4cc283338bbc98b4c87ec21874369d98f
SHA512 aba461363630ac9a429af794c9c43ad2ce23bafebb4902b5d40d370205fbe91dbf22a97aa4d355202d2d3c74721d3e6d547d84ac740ea24a1bdcbb8ee6a2c5b8
SSDEEP 384:5ck1JzNcKSIAWyhWiXnrh3b8ZpH3GCJERy/v6:lcKSBNn5iRBER5
TLSH
T1669229D645BCA682F8CA8E31B1C6D9338CB2E2545E39416502B4C25A7FFF342D57923E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\api-ms-win-core-processthreads-l1-1-1.dll
Size 19KB
SHA256 53cea73c248a49389bc2da01acac1d8e8022a7e034bcd522306e43a937200897
MD5 8ff0692d32f2fcb0b417220b98f30364
SHA1 5eeb1d781d44e4885284c8b535f051efca64aef8
SHA512 f73249f70953c537da02b890308cb18a9c6676401975bf13aeb61b1db9dfa042e908c52ee266b404948a568b23b0cfb37ecd4b80379c398c15f56ce7a82cf7a5
SSDEEP 384:DuDfIegWyhW8Xnrh3b8ZpH3GCJEHyT7Qx8:teobn5iRBEHm71
TLSH
T1C5925DD366BC6441FCD74F30A0E69533CC72B7A06A70816D11B4C1196EDB741BA6972E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\api-ms-win-core-profile-l1-1-0.dll
Size 19KB
SHA256 97f18741abb1d6d215503234b603755dec3d0e8d4c5f08060dababe7660a420d
MD5 59a815641390eeff6badaee84e8de7d0
SHA1 ca63e4696de7f5e913f942f1fd0b807959a8c972
SHA512 b91cedabc790aed85b9a1eed4241add1f73b1f890c1bb48efec750be7b59d44ca03d62cf1a011f23cdbf66bf80ef26ac01b7d8ef9e7ead3fa45306620aa1a056
SSDEEP 192:OWyhW0+XjbnruJPN0f7LD2oEhZnpH3GCwgEf/y3mMvLpfOASXY:OWyhW0+Xnrh3b8ZpH3GCJEXy5TVB2Y
TLSH
T155923AD39AA82501FDE39F30A0DA9933EC3172F4ABB0829E15A184096956741EF7573F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 19KB
SHA256 8ed0ffbd5462ed7fa2a82efaa5f5de4cb3849699b6cf1be93ce5fe746ef7c58e
MD5 3493376565524418af30afc7a97b0561
SHA1 abcfdcad703e05cbae97d004119b966920e04a5f
SHA512 01254e63ad3ae9194f74a6a992f8e236afc934b04e8568fcab4b6460f179d40641b1483c0a12463f004bd0b16909bcc2381a8996c96e151cae4ce2f287f00eaa
SSDEEP 192:JDGeVjWyhWkXjbnruJPN0f7LD2oEhZnpH3GCwgEfNyPFW:JDGeVjWyhWkXnrh3b8ZpH3GCJEVyPFW
TLSH
T1D8924BEB67683441FDE74F7090EB9A37CC7377A059E8426A047481095A963A0FF2963F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\api-ms-win-core-string-l1-1-0.dll
Size 19KB
SHA256 b1a9c3e26fc2dd6d701d624969a29a16e04681c057999b4773d9fd4f4d3bbbe7
MD5 a7e6fd9da0b366256e39dc7a227af909
SHA1 068e54604e0cd8cc9e0149f9cf139cd8d6b6665f
SHA512 cdc7ed374cc4f109d84270981888ff9eafc21325ff85db9439a103f4a4d49e8f64d53f8b5d7ca2f983dd607fe765d80b3dfe321c2d22216924dbd3c8aa468720
SSDEEP 384:zZyMvJWyhWAXnrh3b8ZpH3GCJECy41WIqb:zZyMvbDn5iRBEC/1Wn
TLSH
T1FC926CE727A87000FDD38F3090DBA933DC35B3E1AA7042BA556481116A56791FF6972F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\api-ms-win-core-synch-l1-1-0.dll
Size 19KB
SHA256 28e499c8ff5146fadb3799f88ba2cabc42d3a3fed0d2de43e6d194eb0a5e93a6
MD5 b84fb9322caa36fdf409f18e8304a5bf
SHA1 876721afbef99f771fe6db783f950602b8e9abea
SHA512 4b65930cc152b9fd7acc5a3156487a2bf3a5d2d6731fa48189c47f65784797d224094fe56f8bd48a02aef3d1207d81ac09d747c251c6de2a93efb9afd7cfafb9
SSDEEP 384:DGwidv3V0dfpkXc0vVaC4WyhWSXnrh3b8ZpH3GCJE2ydXwOt2:6Hdv3VqpkXc0vVajZn5iRBE2/I2
TLSH
T1B8924B97A3E0BA53F85FCD7181D78533C83032608A70457B65D5C6197AF3390AF2A62B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\api-ms-win-core-synch-l1-2-0.dll
Size 19KB
SHA256 ef94c2a19bd9a30a7e099572402737c1b6bfcb60f3074d3dcda85de0ce6fb674
MD5 5a9f2ce42bb237a8d25d2b8d3e905bd4
SHA1 f2eb1be1b6bbf48f09e3220cbcac85ce4c1a371c
SHA512 2f986a8629f9b59e9d9a380aa65d42f2c9241c02a4050721add0cca3a4e16ea8b0b1ce1f81fa1c521c2f7810b9aa4642f37f5173d6ca53fc176ab3e91b5c5c29
SSDEEP 192:xtZ3FWyhWrXjbnruJPN0f7LD2oEhZnpH3GCwgEfuyVfszT:xtZ3FWyhWrXnrh3b8ZpH3GCJE2yVfYT
TLSH
T159926EE75B983643FC97CE7085E39433D871B2905BB0055E117981162ABF391AB25E3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\api-ms-win-core-sysinfo-l1-1-0.dll
Size 19KB
SHA256 4d499a6cb6f5bc31ac5d1ad25dd3283f888907c17aa6846da16d3761777986a6
MD5 10b937bfe0a4b9759af343dbb9070596
SHA1 d9305a0015dbb8bdd28cf5898d943b4e2ed2f9f6
SHA512 f5b0bf4418a64bec22316d16dc5f535caba9e4ede6790b555115af9089db647e7c36fbfeadb23d0aa9222059dadb4235bbec6029e99625d66d6e3a7da1aa6276
SSDEEP 192:xgdKIMFqumaRWyhWEXjbnruJPN0f7LD2oEhZnpH3GCwgEfqXyNYBTZdwm:OW7RWyhWEXnrh3b8ZpH3GCJEyyNYNnwm
TLSH
T17E922BE36AB87601F8974F31A0D79523DD707390AA60814D05F08319EBB7755EBB463B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\api-ms-win-core-timezone-l1-1-0.dll
Size 19KB
SHA256 171ca9df2b9ecfa545748af724c1c56ab396b299503a14c4da2197b0e5a44401
MD5 863ed806b4f16be984b4f1e279a1f99b
SHA1 b9a919216ef90064ac66b12ccde6b3bf1f334ee8
SHA512 fb8f195d9a1885c16aa2cc6eff38e627ea127b18978016d6046dc0120a19ab40cc4fe4b799c06f133b02f7cd6a634ae1665f05f9be5fcae609229dfaae0ce478
SSDEEP 384:IrWyhWAXnrh3b8ZpH3GCJEYyVHeZCDT+N:enn5iRBEY8eZey
TLSH
T1D0923AE39B646505FCDF1F7089D6E433DD30B3B08DA0429E49F28105B9AA705AB2562F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\api-ms-win-core-util-l1-1-0.dll
Size 19KB
SHA256 56dbccf349622daee692a2a6feb846f7018d4d049ea4e972d5cd61a34e3b87b3
MD5 26484ca59ac50eef4a5b9886173cb389
SHA1 111e11b27c2df193d8aa3707aae45a9b78930e04
SHA512 4d1c7e179aea6bd8e258cc6720bdd8fb45f7ad0814dbd61b960f46d379146de35d8e28217b70d577de4189f778b89907f8075e2e480a2bc6530b00696dc479db
SSDEEP 192:XWyhWYXjbnruJPN0f7LD2oEhZnpH3GCwgEfnHyibI:XWyhWYXnrh3b8ZpH3GCJEvHyibI
TLSH
T13C924BE71AA87801FDD75E7080D6CE33DC3172E0AAF0029E556085046A577A2FE6973F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\base_library.zip
Size 1.3MB
SHA256 4fd73d762473e271fe8ff01a6f160c960e5d8da65db899cb74e4b3c179c32741
MD5 90019f772490f730e9c5c11031172f4b
SHA1 880c85d19ab8d54268e42c0a3a35137035e75bd3
SHA512 e32d0541d78d75cbad602b009a5b413f1416adc1d179bed1d882357a4f3c8f0c86d2483746c8b1dae3c828418284fd6b2811361bc7b44ac47359c340904ebab9
SSDEEP 24576:MeRptdxQeOdP2m2dft83tuUFNtslbNiL8f:ZRbdx/y3tuUFPi
TLSH
T11F552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\python3.DLL
Size 72KB
SHA256 be1017ca4ca8ff837efbb343d5c8f739bd67bd1c43fb41068a539b19357c0213
MD5 8d3d1ffbe3bb9539402e8bccb7fadcf8
SHA1 904397a69e08c93fc2080a3cdbf6810bc40313fc
SHA512 312fd7f95d2a76d9dd09336949d3b8ca9b53753a9f45da9d2fec128b2746f128fc1354693e0a995c1e1859a3d90497c8a4a8d4fedffc8bceee0392c456efc68a
SSDEEP 768:IQlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKIU:xbTrnXngXMBEI1G0hyvcvR9NfIko
TLSH
T1C0734D5E6B54F8A2D6B629FC78D199CE242B12FC5F2984DFA47CD3D20D1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\python314.dll
Size 6.4MB
SHA256 1ac15e2224581fc678bbd17728b9aa538d47b891b72c76499ef07e54cd74f151
MD5 5bc0adc1fed509f353832bde6b2add62
SHA1 b2204b0bc93877fcd186d72fbe5006130aa0fb88
SHA512 7b1e52aff81e5e79872d9a22c0218dd8fc46e99cb33adb69d277ea07b21eee0399f0a6a72d190b91f26a96e69aa63a23a06384b9d93db44355f3eb1d7f727650
SSDEEP 98304:YvvKimE4QWS5v+kr/YFboltx9E8rDvQHDMiE2hx0S:qdcQWS5v+kLMolGmidx0S
TLSH
T107668D26737505A5D8BB8076C9034647DBB1BC00AB30D34B49A4B6DA3F733635BAEB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\ucrtbase.dll
Size 1.1MB
SHA256 1854cd0f850da28835416e3b69ed6dae465df95f8d84e77adbbc001f6dbd9d78
MD5 988755316d0f77fc510923c2f7cd6917
SHA1 ccd23c30c38062c87bf730ab6933f928ee981419
SHA512 8c52210a919d9f2856f38bd6a59bbc039506650a7e30f5d100a5aa5008641707122ff79f6f88c268c9abc9f02ba2792eed6aad6a5c65891a9ce7d6d5f12c3b0a
SSDEEP 24576:PJG9DZM19A7ieC9dQ8dDtLV8+BaC6EOx/cEz5RmxvSZX0ypHNH5:w/qtvdhq+BaPHxxdf
TLSH
T1B8359E28B75C02AAD97BE17CC923550AF973780047709ACB03A74BBA3E277E556B7311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/548-1039-0x0000023AF74D0000-0x0000023AF74D8000-memory.dmp

Download

memory/548-1038-0x0000023AF5480000-0x0000023AF5529000-memory.dmp

Download

memory/3308-1078-0x0000013140390000-0x0000013140439000-memory.dmp

Download

memory/3848-35-0x000001911F7A0000-0x000001911F849000-memory.dmp

Download

memory/4028-948-0x00007FF8118D0000-0x00007FF811DB0000-memory.dmp

Download

memory/4028-1042-0x0000020B22BA0000-0x0000020B22C49000-memory.dmp

Download

memory/4028-950-0x00007FF8106E0000-0x00007FF810914000-memory.dmp

Download

memory/4028-949-0x00007FF811280000-0x00007FF8118C7000-memory.dmp

Download

memory/4028-947-0x00007FF812780000-0x00007FF812A0D000-memory.dmp

Download

memory/5032-215-0x000001B02D320000-0x000001B02D3C9000-memory.dmp

Download

memory/5704-1040-0x0000014DF7DF0000-0x0000014DF7E99000-memory.dmp

Download

memory/5704-1041-0x0000014DF7F00000-0x0000014DF7F08000-memory.dmp

Download