hxxps://github[.]com/youtube123456444/nitro-generator

Analysis

user interaction
yes
max time kernel
51s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/07/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/youtube123456444/nitro-generator
Sample260712-e1ckjscy4p

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
107	raw.githubusercontent.com
102	raw.githubusercontent.com
103	raw.githubusercontent.com
104	raw.githubusercontent.com
105	raw.githubusercontent.com
106	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1104	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134283038541451415"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{E295FA41-04C5-48F8-BB8F-0744596FBED5}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3040	OpenWith.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 4888	4976	msedge.exe	86
PID 4976 wrote to memory of 4512	4976	msedge.exe	88
PID 4976 wrote to memory of 1104	4976	msedge.exe	87
PID 4976 wrote to memory of 4512	4976	msedge.exe	88
PID 4976 wrote to memory of 5860	4976	msedge.exe	89
PID 4976 wrote to memory of 4512	4976	msedge.exe	88
PID 4976 wrote to memory of 5860	4976	msedge.exe	89
PID 4976 wrote to memory of 5080	4976	msedge.exe	91
PID 4976 wrote to memory of 5080	4976	msedge.exe	91
PID 4976 wrote to memory of 5080	4976	msedge.exe	91
PID 4976 wrote to memory of 2848	4976	msedge.exe	90
PID 4976 wrote to memory of 2848	4976	msedge.exe	90
PID 4976 wrote to memory of 2848	4976	msedge.exe	90
PID 4976 wrote to memory of 920	4976	msedge.exe	95
PID 4976 wrote to memory of 2984	4976	msedge.exe	96
PID 4976 wrote to memory of 920	4976	msedge.exe	95
PID 4976 wrote to memory of 2984	4976	msedge.exe	96
PID 4976 wrote to memory of 1484	4976	msedge.exe	98
PID 4976 wrote to memory of 6120	4976	msedge.exe	111
PID 4976 wrote to memory of 6120	4976	msedge.exe	111
PID 4976 wrote to memory of 6120	4976	msedge.exe	111
PID 4976 wrote to memory of 5856	4976	msedge.exe	110
PID 4976 wrote to memory of 5856	4976	msedge.exe	110
PID 4976 wrote to memory of 5204	4976	msedge.exe	112
PID 4976 wrote to memory of 980	4976	msedge.exe	116
PID 4976 wrote to memory of 4708	4976	msedge.exe	117
PID 4976 wrote to memory of 6000	4976	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/youtube123456444/nitro-generator
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffdf7aac188,0x7ffdf7aac194,0x7ffdf7aac1a0
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,8443466624817799428,13625598160509252562,524288 --field-trial-handle=2736,i,17815683527124413430,16815095535938237722,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,9353677544585109090,127295080781380261,262144 --field-trial-handle=2736,i,17815683527124413430,16815095535938237722,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:2
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,7752334315379707705,13007163749158249193,524288 --field-trial-handle=2736,i,17815683527124413430,16815095535938237722,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:8
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,14504101847202432773,1932480582670169726,2097152 --field-trial-handle=2736,i,17815683527124413430,16815095535938237722,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,14321043450187821161,7707933410298122894,2097152 --field-trial-handle=2736,i,17815683527124413430,16815095535938237722,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,11776033101926325099,3101957379784963348,524288 --field-trial-handle=2736,i,17815683527124413430,16815095535938237722,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,14779175039998422976,17275774782363012232,524288 --field-trial-handle=2736,i,17815683527124413430,16815095535938237722,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,6561896129265977007,17082522119400137144,524288 --field-trial-handle=2736,i,17815683527124413430,16815095535938237722,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,6561896129265977007,17082522119400137144,524288 --field-trial-handle=2736,i,17815683527124413430,16815095535938237722,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,5614407161415056543,2894431272623575145,524288 --field-trial-handle=2736,i,17815683527124413430,16815095535938237722,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6180,i,13439128210864749818,16709106616480140442,2097152 --field-trial-handle=2736,i,17815683527124413430,16815095535938237722,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,10503607394318284071,7785946000991509606,524288 --field-trial-handle=2736,i,17815683527124413430,16815095535938237722,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,15336488040906251954,2612759560319577489,524288 --field-trial-handle=2736,i,17815683527124413430,16815095535938237722,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:8
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,15551750403799871254,1097332313626375148,524288 --field-trial-handle=2736,i,17815683527124413430,16815095535938237722,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1532,i,10446058700343166113,1505966643177840936,524288 --field-trial-handle=2736,i,17815683527124413430,16815095535938237722,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:8
  2⤵
  PID:6000

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2208

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2252

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3040

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\nitro code gen\nitro code gen\gen start.bat" "
1⤵
PID:5140
- C:\Users\Admin\Downloads\nitro code gen\nitro code gen\importaintfiles\Newfolder\nitrocodegenerator.exe
  nitrocodegenerator.exe
  2⤵
  PID:5304
- - C:\Users\Admin\Downloads\nitro code gen\nitro code gen\importaintfiles\Newfolder\nitrocodegenerator.exe
    nitrocodegenerator.exe
    3⤵
    PID:5028
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:1532

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a58497ad00a99c1be93dee0e4ea746b37592165718bfa731732dfe30bc6b9d58
MD5 7ba373e28d8e961bab3fc278d6b2d3e4
SHA1 fb584b0090417f9743ef1e4e1effc2b5a1d0d7e8
SHA512 df7732de2be27ee3a1111ac075b26f6a8a0f0c704b18b267baa57a518329a9341141593ae03574b1964d84fe7dbe0623ba4c6b9c0845c792e01df9504ca6342d
TLSH
T138E02B66C866EC2718FD0719A04E9A56E70013672B80894F3B3C820D8FB0A3A45C5C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 548f4f68aaa0d70373de3181a713550e980598f7cdd8d34e206f70bf3e9c06aa
MD5 07993d300bac41da4545ee24b6242f60
SHA1 d8e00cf6b5fd26d22068fee436e57dc39233a71b
SHA512 3166c6d11091673db07a2583106071ec834e611e8960f88874bdc7463076a40b7ced888e9874738eacccbd361f0adf9bd69c3b546f12ed025f6bddbdd1d6af4e
SSDEEP 96:UfpYfaNcUMYYlIyxm47gTe6ojaic2HWcBMf3osXDsBIn:UmaNcySxx7gC6oWicy9MfYsXDio
TLSH
T119D13A300B558ED2F792893083D81E20F473ADE6FA839E5A214018FEECFAF764576915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe585ea5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe585ea5.TMP
Size 3KB
SHA256 c2e19681059357f0dfe4a732020d3f892285eb793263606d22f7ab79ac3b2ff1
MD5 0d2e028105be10165c6a46293b765285
SHA1 7a5064167a7e2c5658065dced8b96479d14d262e
SHA512 421ea9351d5b2a45897f73873e5a8718fd0d3d173308491f6a83394c6c6e12a2d0b39eb889aa4c6849c784b800c8e0a6f1eb99644f18ec19bd06e6a99cb2b6b1
TLSH
T13981FA30081291A3D393893181E8562034728AE9FDD3EE9E21901CF2FCFAF73857B956
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1fc81b10e349fbe57f86333aeb112077ed5a03bf9bd17a60cd0c023b6188ebd1
MD5 5de78983df1170bb58558279ab653e51
SHA1 09d937aa5a242c87d340c32458446169ec450ad7
SHA512 1d618b3ccb73d755d44aab5c27ee73d8107236da166939d97a088dc4951c252362fc19acf2f3f51d8dba34cecc1acb71c66f4e3cbc226eb6a940432cfc265464
TLSH
T10031C0F383E8856E8A1195F0B618BE2FDE1D0510436C3D9AC5E4AF1B93E2471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8568a2f86e6ad679ccff92e616d8bc8fc943196643ff822653742423e6a1b50d
MD5 a6cec36067f95bdaa5502a52b742155c
SHA1 fe4e4322ca36d1b27bcc7e80fe8077aadb1f3cec
SHA512 beff806fda430c3e38af55d2eb47180f0f702c44429e8d8939225c6643cec54da2e0b39cb2f64c28335a9c42c7b8d21ce782651304d2985b8ff9c634ec4a821f
SSDEEP 192:sxZJRvyMqZjK1Ml8MkY/fyssiRzaZdCzodpvAAHW6+WNY97/YvVuUtRjIgj4J:sxZJgMY/fyssitaz5ZHbu/U5jc
TLSH
T14372EA166974597BCDD7D219FA45BB93D2F91123E2909E489AFCCA0C00E7BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 2fcd7d93dfb3e61c6246e010f0e0a47d6e74331f4a550e3fecae3efa845605f2
MD5 8e264e8a17c8637cd5b9811aeb8432a6
SHA1 1cc0f022a69024f0b213d24db3d9a4e6f1958aae
SHA512 46c6545d27984d7531faa257214bc1d95661a6d8d7ad5fcdd0416379af3667c2426d2a61cf43f9e007bcb10938e51e52126819c84118058f04dcae2100813cef
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGK:05ppxnY753RNBvRJJdt7p5J9x9dQ
TLSH
T11FB26A5A703E0211397E6988B39696364F4235A37058E4BF7FB814A14F67E224CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 33cf0bf2c0909a88d55b477ddec48b0b2766c6d217c19e6f6e56cc5e295184b5
MD5 b17d45881d3eb72a4ea2ef7fb33a618a
SHA1 cdf9ea9d004ad8a0e80c1a7e4779570c967967f4
SHA512 0f523f42ee3be48498d04888f7b44b522a57a351c2bc2a462c9081461bfea323c02d7d3161b5b8dcefad0a0a472e5b95b6af93bee8d5c15fbe09fec192c8a053
SSDEEP 384:npCiF1tNn/s3n9SX3sNN8TUNTUlI49QckCrk9MphiftGm3p9JL/YCOObjI9G6w7z:pJF1j+9i3MwgekFaoGm3p91YC29Mz
TLSH
T17CD25A36E854CAABEDE74FD9B74A3A47DEE44263868C5AC8D6D85E0C00D71EC4307D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 caed8d891b0699057608a3d7f18eb854af31d5be666c11beff9ec1fe3f9fc8de
MD5 65c02ef4d4ff44103e4a3d322caaaf76
SHA1 d9e840deac3ba1175a780bc75d3bb80f48c964f5
SHA512 a28f5a31b5a5759666dd8ec20be918f75baecd9d72d96973c00eb99ed39906af6661b13c89fe23ec6fc5f8521bdc697bf88dfa3ea54e64c2fc8940e43cb1263e
SSDEEP 384:npCiF9CcmyWCP3sNN8TUNTUlI49QckCrS9MphiftGm3p9JLqYCLty/7Igo:pJFccpP3MwgekLaoGm3p9oYC1
TLSH
T193B23A32E868C9BBEDE74B99F75A3603DEE44163868C9AD8D6DC5E0C01971DD030BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 052113a09b9e0c603752f4a40e41bdd4d193853bb08efe29d46657d176032805
MD5 e05c4e9f8d0ada6c07a4599dc144b928
SHA1 63bdd82bca0b955f21264fb49cb5e01d5f820d52
SHA512 e734466823755594b70b94def9c9024986cb4ef9ce1383dc3ec171ee4287732cbadda3c69aa22e956641ebcbbe2d3d57b7fe007cacea1108e20d978870040ccb
SSDEEP 384:npciF9CcmyWCs3sNB8TUNTUlIm2QckCr9t8pphiftGm3p9JLlYCe4KV8p03LBtyA:pHFccps3cwgbkU+XoGm3p9nYCI8p03Lj
TLSH
T1B7C25B32E858CABBFDE74B99A74A3A03DEE4512386DC9AD4D6DC5D0C00971ED430BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 9087c47a5cf7dabff8b3b96cbd90cf48d98700b60fe0fea5e467e942553acc66
MD5 94dc91b8889ed118549237ffe0866ed7
SHA1 4c3f40047d476a842791bea94b0743f71b020232
SHA512 3c6aaac89e9ed2b22c80dbf673fb2fd818a6aeb750efec6e6cd97790d914b8ea9a84838389464e882fc0008a8557d3c1529683eb3a859c32c82afa8e59ea5e25
SSDEEP 384:npliF9CcmyWCs3sNu8TUNTUlIm2QckCr9ljKphiftGm3pfgpCe4KV8p03LBty/7M:psFccps3bwgbkUFkoGm3pf3I8p03Lj
TLSH
T194B25C36E868CABBFDE74F89B75E7A03DEE4116786D899D4DAD84D0C00971DD030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 5a86987e201b437e828ff2b60cc495ab55b907e7c572aa7f3b072d6d59a7859b
MD5 bb37f54f9003faef1af8ba880de50471
SHA1 7149104f656ad7b8c54193132f36670e15280064
SHA512 6a8c09b778c8ca1ebee905d26947ff34241b33919522d62fb271b8b0dc3050dfe775aa248a501b979717c8c39a2e26fea12d80250de0200b58cad50b4fa13a15
SSDEEP 384:niiFhtNn/s3n9S63sNN8TUNTUlI4BQckCr29MphiftGm3p9JL/YCOObjI9G6w7N5:pFhj+9L3Mwgak3aoGm3p91YC29Mz
TLSH
T14CD25B36E894CAABEDE74FD9B75A3A07DEE44163868C5AC8D6D85E0C00D71EC4307D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ffdfff3f1d72c1bf738642659e0fe32315f73305192b38028cbe4a50346d9973
MD5 04c15587d1703cf3e4c948c0f022df99
SHA1 a4e99b673d2ee84d71f0d9968cfedcfecef079fe
SHA512 091ddba51d10c9ac0f772391fcdf2feaae8c8988b97f1f9fcc648229a6ff95adaeba6f7cf86a0a8a33c1bafd40299d255df7981d66f0fcf27fda373bc083d039
TLSH
T17D412D4CBAFA1148B3B7AF169BF7A46D487ABD372E06D45D10110E4F0623B40C862733
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI53042\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
TLSH
T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI53042\VCRUNTIME140_1.dll
Size 48KB
SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
MD5 f8dfa78045620cf8a732e67d1b1eb53d
SHA1 ff9a604d8c99405bfdbbf4295825d3fcbc792704
SHA512 ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371
SSDEEP 768:wPIyGVrxmKqOnA4j3z6Su77A+i0QLxi9z9Rtii9zn+:fBr87uW1nA8QLx+zrti+zn+
TLSH
T194235B9097784446D96B99B0C0D6DE57BD3CFAA20B50928F0BA1D14C1E63BD0FB3D22E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53042\_asyncio.pyd
Size 69KB
SHA256 5bebeb765ab9ef045bc5515166360d6f53890d3ad6fc360c20222d61841410b6
MD5 477dba4d6e059ea3d61fad7b6a7da10e
SHA1 1f23549e60016eeed508a30479886331b22f7a8b
SHA512 8119362c2793a4c5da25a63ca68aa3b144db7e4c08c80cbe8c8e7e8a875f1bd0c30e497208ce20961ddb38d3363d164b6e1651d3e030ed7b8ee5f386faf809d2
SSDEEP 1536:VoxWFyB9uENvvAdAkc0TTILNPIasWxtISOno7Sysxg:ViWFyRNv4drc0TTILNPfsgtISOnoN
TLSH
T131638E83A3A0459ECD57A278D5632F67DBB1F2520A01478F62A8C14F2F6375247FE722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_brotli.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53042\_brotli.cp312-win_amd64.pyd
Size 802KB
SHA256 788acbfd0edd6ca3ef3e97a9487eeaea86515642c71cb11bbcf25721e6573ec8
MD5 9ad5bb6f92ee2cfd29dde8dd4da99eb7
SHA1 30a8309938c501b336fd3947de46c03f1bb19dc8
SHA512 a166abcb834d6c9d6b25807adddd25775d81e2951e1bc3e9849d8ae868dedf2e1ee1b6b4b288ddfbd88a63a6fa624e2d6090aa71ded9b90c2d8cbf2d9524fdbf
SSDEEP 12288:wA0uu7wLKRemz/MfQuZ3ekAHhly782XTw05nmZfRJ:wfTdkAFtAmZfRJ
TLSH
T1B9058D07D8B3173ACC27C0798DA71236EB357168971059A7B25CE5323A43A2417FB7AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53042\_bz2.pyd
Size 83KB
SHA256 3ed0e5058d370fb14aa5469d81f96c5685559c054917c7280dd4125f21d25f62
MD5 5bebc32957922fe20e927d5c4637f100
SHA1 a94ea93ee3c3d154f4f90b5c2fe072cc273376b3
SHA512 afbe80a73ee9bd63d9ffa4628273019400a75f75454667440f43beb253091584bf9128cbb78ae7b659ce67a5faefdba726edb37987a4fe92f082d009d523d5d6
SSDEEP 1536:i2sz7yc51BVo1QX/FPI11IK1cDm015ssO687sjkD1ISCV087Syyxt+:dsz2c5eQXB4am05spd7MkD1ISCVzL
TLSH
T1D8839E92E3956AF5F81F81BD56C1036AE771B954075083EFF348C25A2F02F816DAC36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53042\_cffi_backend.cp312-win_amd64.pyd
Size 178KB
SHA256 d8a76d1e31bbd62a482dea9115fc1a109cb39af4cf6d1323409175f3c93113a7
MD5 0572b13646141d0b1a5718e35549577c
SHA1 eeb40363c1f456c1c612d3c7e4923210eae4cdf7
SHA512 67c28432ca8b389acc26e47eb8c4977fddd4af9214819f89df07fecbc8ed750d5f35807a1b195508dd1d77e2a7a9d7265049dcfbfe7665a7fd1ba45da1e4e842
SSDEEP 3072:YRAMUp3K6YoDssyudy4VcRG+nR3hnW3mjwwOdkS9S7iSSTLkK/jftw3buz:Y6MyK65ssy+MG+LnSUwjD9zSSTLL/jl8
TLSH
T10A045B56329C12B2D597407889675B47E3F3B821135197CF00A0C6B53F2BBE67A7EB84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53042\_ctypes.pyd
Size 122KB
SHA256 74e0e8384f6c2503215f4cf64c92efe7257f1aec44f72d67ad37dc8ba2530bc1
MD5 fb454c5e74582a805bc5e9f3da8edc7b
SHA1 782c3fa39393112275120eaf62fc6579c36b5cf8
SHA512 727ada80098f07849102c76b484e9a61fb0f7da328c0276d82c6ee08213682c89deeb8459139a3fbd7f561bffaca91650a429e1b3a1ff8f341cebdf0bfa9b65d
SSDEEP 3072:CXw32spTVYgFoj6N2xE9sb7VFf/EkZBq5syCtYPU9pISLPTj:CgGEOgFoj68ksTf/ENs7
TLSH
T138C36C0B339400AAEBA34179C8B36E07D7F1B41B175183CF1294C69A2F637A76E6E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53042\_decimal.pyd
Size 251KB
SHA256 b8221d1c9e2c892dd6227a6042d1e49200cd5cb82adbd998e4a77f4ee0e9abf1
MD5 492c0c36d8ed1b6ca2117869a09214da
SHA1 b741cae3e2c9954e726890292fa35034509ef0f6
SHA512 b8f1c64ad94db0252d96082e73a8632412d1d73fb8095541ee423df6f00bc417a2b42c76f15d7e014e27baae0ef50311c3f768b1560db005a522373f442e4be0
SSDEEP 6144:vnXBJvhy8AJOMg4hmRWw710z4ez9qWM53pLW1AW/ZJJJWtCk1mGc:ByJJOMiRW+10EHFpNc
TLSH
T11E446C17A2490CA4DE73807488979B57E7B278960360D7CF43B48AA76F573A323BE744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53042\_hashlib.pyd
Size 64KB
SHA256 fd77a5756a17ec0788989f73222b0e7334dd4494b8c8647b43fe554cf3cfb354
MD5 da02cefd8151ecb83f697e3bd5280775
SHA1 1c5d0437eb7e87842fde55241a5f0ca7f0fc25e7
SHA512 a13bc5c481730f48808905f872d92cb8729cc52cfb4d5345153ce361e7d6586603a58b964a1ebfd77dd6222b074e5dcca176eaaefecc39f75496b1f8387a2283
SSDEEP 1536:JgHpgE4Z27b4ZWZnEmIAtISOIx7SyZUxN:i14ZeEmIAtISOIx7+
TLSH
T1D9538D09A69544E8C96781B8C8A35F57FAF2F1511B10A7DF0368C18D2F237C3A7BA752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53042\_lzma.pyd
Size 156KB
SHA256 7bf9ff61babebd90c499a8ed9b62141f947f90d87e0bbd41a12e99d20e06954a
MD5 195defe58a7549117e06a57029079702
SHA1 3795b02803ca37f399d8883d30c0aa38ad77b5f2
SHA512 c47a9b1066dd9744c51ed80215bd9645aab6cc9d6a3f9df99f618e3dd784f6c7ce6f53eabe222cf134ee649250834193d5973e6e88f8a93151886537c62e2e2b
SSDEEP 3072:Bsvkxuqgo7e2uONqG+hi+CSznfF9mNopXnmnu1ISZ1Vk:BnuFo7Jg1NYOp2uO
TLSH
T1ADF33992A394F0D5F6728C78D6624F17D7F6780A0320929A02CCD37D2B1FB759A2A317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53042\_multiprocessing.pyd
Size 34KB
SHA256 3c34031b464e7881d8f9d182f7387a86b883581fd020280ec56c1e3ec6f4cc2d
MD5 2bd43e8973882e32c9325ef81898ae62
SHA1 1e47b0420a2a1c1d910897a96440f1aeef5fa383
SHA512 9d51bbd25c836f4f5d1fb9b42853476e13576126b8b521851948bdf08d53b8d4b4f66d2c8071843b01aa5631abdf13dc53c708dba195656a30f262dce30a88ca
SSDEEP 768:W1Rp7eiajKCQnAxQ0zdudISWtl5YiSyvUAMxkEk:CRteiauAxQ0zIdISWtr7SyaxA
TLSH
T185F27D53E6A40856D823C9B5E8935F2AE571F7460B21C6CF2394C14E0F323426BFE79A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53042\_overlapped.pyd
Size 54KB
SHA256 d5f89859609371393d379b5ffd98e5b552078050e8b02a8e2900fa9b4ee8ff91
MD5 7e4553ca5c269e102eb205585cc3f6b4
SHA1 73a60dbc7478877689c96c37107e66b574ba59c9
SHA512 65b72bc603e633596d359089c260ee3d8093727c4781bff1ec0b81c8244af68f69ff3141424c5de12355c668ae3366b4385a0db7455486c536a13529c47b54ef
SSDEEP 1536:Zinr44gaZPXxCJ/+yZdDDrhISXtl7SyVxy:ZXJ/+yZdDDrhISXtlM
TLSH
T122437C06679004D9ED37C17DE4A70E1BEBB0B1965650931F62A8C64A2F737836BAF3C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53042\_queue.pyd
Size 31KB
SHA256 dbdabb5fe0ccbc8b951a2c6ec033551836b072cab756aaa56b6f22730080d173
MD5 b7e5fbd7ef3eefff8f502290c0e2b259
SHA1 9decba47b1cdb0d511b58c3146d81644e56e3611
SHA512 b7568b9df191347d1a8d305bd8ddd27cbfa064121c785fa2e6afef89ec330b60cafc366be2b22409d15c9434f5e46e36c5cbfb10783523fdcac82c30360d36f7
SSDEEP 768:xOz+R6rbVKMoNpISQUA5YiSyv86lAMxkEzc:xjgbVJoNpISQUS7SyU6dxPc
TLSH
T1AAE28D83AE545C56C473C97198A35E35F972B7924B0183EF2224C15E1F323837BBA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53042\_socket.pyd
Size 81KB
SHA256 b102522c23dac2332511eb3502466caf842d6bcd092fbc276b7b55e9cc01b085
MD5 dd8ff2a3946b8e77264e3f0011d27704
SHA1 a2d84cfc4d6410b80eea4b25e8efc08498f78990
SHA512 958224a974a3449bcfb97faab70c0a5b594fa130adc0c83b4e15bdd7aab366b58d94a4a9016cb662329ea47558645acd0e0cc6df54f12a81ac13a6ec0c895cd8
SSDEEP 1536:ldcydNgIznrvGvLfo4o7zfqwXJ9/s+S+pzo08/n1IsJhv6cpISLwV97Sy7UxV:l6ydrr+DgxjqwXJ9/sT+pzoN1IwhScpf
TLSH
T15D835A11A69050FADB77C0B5C2675E22FBB0B5C01395938F1166C51E1F33782BEBAB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53042\_sqlite3.pyd
Size 122KB
SHA256 ee0e9b0a0af6a98d5e8ad5b9878688d2089f35978756196222b9d45f49168a9d
MD5 c3a41d98c86cdf7101f8671d6cebefda
SHA1 a06fce1ac0aab9f2fe6047642c90b1dd210fe837
SHA512 c088372afcfe4d014821b728e106234e556e00e5a6605f616745b93f345f9da3d8b3f69af20e94dbadfd19d3aa9991eb3c7466db5648ea452356af462203706c
SSDEEP 3072:D2dTrLbXVx7Qt+HEG1CO4w5yWrrPrrrrrrbEOyfgD/pWwb8tISOQAZ:qNVxMt7ZC5zrWgbos8S
TLSH
T153C35B67235400AAE9B751B8C1630B17DBB5F422573083CF42A0C68A2F777C76E7AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53042\_ssl.pyd
Size 174KB
SHA256 a5d361707f7a2a2d726b20770e8a6fc25d753be30bcbcbbb683ffee7959557c2
MD5 c87c5890039c3bdb55a8bc189256315f
SHA1 84ef3c2678314b7f31246471b3300da65cb7e9de
SHA512 e750dc36ae00249ed6da1c9d816f1bd7f8bc84ddea326c0cd0410dbcfb1a945aac8c130665bfacdccd1ee2b7ac097c6ff241bfc6cc39017c9d1cde205f460c44
SSDEEP 3072:AHtmUArl7bOGLbfbmeq2wfq6XDQJsY2GvMe1ba+VRJNI7IM/H9o/PCrXuI51ISCQ:Ym5lfOGLbjBOq6XD4MejTGl
TLSH
T102046D47B5842EBBD813E4BAC1230913DBF1F015331257DE48D6D6460F17B4AAEAAB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53042\_wmi.pyd
Size 36KB
SHA256 752fb80edb51f45d3cc1c046f3b007802432b91aef400c985640d6b276a67c12
MD5 8a9a59559c614fc2bcebb50073580c88
SHA1 4e4ced93f2cb5fe6a33c1484a705e10a31d88c4d
SHA512 9b17c81ff89a41307740371cb4c2f5b0cf662392296a7ab8e5a9eba75224b5d9c36a226dce92884591636c343b8238c19ef61c1fdf50cc5aa2da86b1959db413
SSDEEP 768:9mqQhTcYv/NxO01ISCiO5YiSyvoAMxkEzef:9m7GINxO01ISCik7SyOxvef
TLSH
T161F28E67E7940895E93BCAB9C8965E27E971B5825B11C3CF331882590F323C1AE7E371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI53042\base_library.zip
Size 1.3MB
SHA256 d8de678c0ac0cecb7be261bda75511c47e6a565f0c6260eacf240c7c5039753b
MD5 55df3c98d18ec80bc37a6682ba0abcbb
SHA1 e3bf60cfecfee2473d4e0b07057af3c27afa6567
SHA512 26368c9187155ee83c450bfc792938a2908c473ba60330ce95bcc3f780390043879bbff3949bd4a25b38343eac3c5c9ba709267959109c9c99a229809c97f3bd
SSDEEP 12288:NttcY+bS4OmE1jc+fYNXPh26UZWAzLX7jOIqL3QtltIrdmoP0Hz1dc+4/BaYcUi:NttcY+NHSPL/eMKrdmoPuzFcaYcUi
TLSH
T1B055D6817A92A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53042\charset_normalizer\md.cp312-win_amd64.pyd
Size 10KB
SHA256 ecf12e2c0a00c0ed4e2343ea956d78eed55e5a36ba49773633b2dfe7b04335c0
MD5 d9e0217a89d9b9d1d778f7e197e0c191
SHA1 ec692661fcc0b89e0c3bde1773a6168d285b4f0d
SHA512 3b788ac88c1f2d682c1721c61d223a529697c7e43280686b914467b3b39e7d6debaff4c0e2f42e9dddb28b522f37cb5a3011e91c66d911609c63509f9228133d
SSDEEP 96:KGUmje72HzA5iJGhU2Y0hQMsQJCUCLsZEA4elh3XQMtCFXiHBpv9cX6gTim1qeSC:rjQ2HzzU2bRYoe1HH9cqgTimoe
TLSH
T15122060DFE5584FAEA618270C5274E0BB0B5FB10031273CF0374856A2EB63D2667AB82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md__mypyc.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53042\charset_normalizer\md__mypyc.cp312-win_amd64.pyd
Size 120KB
SHA256 4107b1d6f11d842074a9f21323290bbe97e8eed4aa778fbc348ee09cc4fa4637
MD5 bf9a9da1cf3c98346002648c3eae6dcf
SHA1 db16c09fdc1722631a7a9c465bfe173d94eb5d8b
SHA512 7371407d12e632fc8fb031393838d36e6a1fe1e978ced36ff750d84e183cde6dd20f75074f4597742c9f8d6f87af12794c589d596a81b920c6c62ee2ba2e5654
SSDEEP 3072:bA3W6Fck6/g5DzNa4cMy/dzpd1dhdMdJGFEr6/vD:MW6NzcMy/d13FErgvD
TLSH
T1B4C31917229500B7CA6351BACC777517DBE1B421073253CF04E4CA9AAF07BDAADBEA01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI53042\libcrypto-3.dll
Size 5.0MB
SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
MD5 e547cf6d296a88f5b1c352c116df7c0c
SHA1 cafa14e0367f7c13ad140fd556f10f320a039783
SHA512 9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d
SSDEEP 98304:n3+pefu6fSar+SJ8aqfPomg1CPwDvt3uFlDCE:3G+u6fb+SJ8aqfwmg1CPwDvt3uFlDCE
TLSH
T1E6366A6AA7A80188E5BAC13CCA534617D6B1F816577097CF19A1967C0F33FDA2B3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI53042\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI53042\libssl-3.dll
Size 768KB
SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
MD5 19a2aba25456181d5fb572d88ac0e73e
SHA1 656ca8cdfc9c3a6379536e2027e93408851483db
SHA512 df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337
SSDEEP 12288:ytPc2nnGoNg4kSHoxX09yO5EavUFe9Xb12:y9jnnpTHoxXUsFe9XbM
TLSH
T1CBF44B9DB3B8059CE9F6D13D86934623E3B6F4152370EBDB065186790F23BD52A3A348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53042\pyexpat.pyd
Size 197KB
SHA256 efd6099b1a6efdadd988d08dce0d8a34bd838106238250bccd201dc7dcd9387f
MD5 958231414cc697b3c59a491cc79404a7
SHA1 3dec86b90543ea439e145d7426a91a7aca1eaab6
SHA512 fd29d0aab59485340b68dc4552b9e059ffb705d4a64ff9963e1ee8a69d9d96593848d07be70528d1beb02bbbbd69793ee3ea764e43b33879f5c304d8a912c3be
SSDEEP 6144:Znguk4rd6FjFMww6c+K+7X5icE878J0JhivihkzOv/:PrrYivi9v/
TLSH
T1FF145C9B71A2C0EBD8938038E6D74A07DBB2B865078197CF12D4E77D4F277423A69325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI53042\python3.DLL
Size 66KB
SHA256 5146005c36455e7ede4b8ecc0dc6f6fa8ea6b4a99fedbabc1994ae27dfab9d1b
MD5 a07661c5fad97379cf6d00332999d22c
SHA1 dca65816a049b3cce5c4354c3819fef54c6299b0
SHA512 6ddeb9d89ccb4d2ec5d994d85a55e5e2cc7af745056dae030ab8d72ee7830f672003f4675b6040f123fc64c19e9b48cabd0da78101774dafacf74a88fbd74b4d
SSDEEP 768:GV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/L:GDmF61JFn+/OxpISL0v7Syqx0
TLSH
T15A637012BB54F8A3DBFA69FC39D199CD542B12CC872584ECA57893D30E1A310A6E734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI53042\python312.dll
Size 6.6MB
SHA256 21700f0bad5769a1b61ea408dc0a140ffd0a356a774c6eb0cc70e574b929d2e2
MD5 d521654d889666a0bc753320f071ef60
SHA1 5fd9b90c5d0527e53c199f94bad540c1e0985db6
SHA512 7a726835423a36de80fb29ef65dfe7150bd1567cac6f3569e24d9fe091496c807556d0150456429a3d1a6fd2ed0b8ae3128ea3b8674c97f42ce7c897719d2cd3
SSDEEP 49152:PPknDqOJlpxSupRo2vXDZ2lgghXQIX2CG4Ts99kdwQAvyodh1GCOepxk1NHh8yfE:kdlpx9p5Loehv6JfDvXHDMiETH+0Tn
TLSH
T1A6666B5A7258C0A9C967A0B48C13C29FE7B27C117F50830B31EBB75E2FB3792925A745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53042\select.pyd
Size 30KB
SHA256 411d6f538bdbaf60f1a1798fa8aa7ed3a4e8fcc99c9f9f10d21270d2f3742019
MD5 d0cc9fc9a0650ba00bd206720223493b
SHA1 295bc204e489572b74cc11801ed8590f808e1618
SHA512 d3ebcb91d1b8aa247d50c2c4b2ba1bf3102317c593cbf6c63883e8bf9d6e50c0a40f149654797abc5b4f17aee282ddd972a8cd9189bfcd5b9cec5ab9c341e20b
SSDEEP 384:2RVBC9t6Lhz64wHqFslDT90YpISQGrHQIYiSy1pCQ+42AM+o/8E9VF0Nyes:YGyIHqG1HpISQG75YiSyvB2AMxkEp
TLSH
T10DD28F476B60688AD923C97268A64E27DD35B752871182CF3358C15D1F227C27BBB3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI53042\sqlite3.dll
Size 1.5MB
SHA256 7ef475d27f9634f6a75e88959e003318d7eb214333d25bdf9be1270fa0308c82
MD5 e52f6b9bd5455d6f4874f12065a7bc39
SHA1 8a3cb731e9c57fd8066d6dad6b846a5f857d93c8
SHA512 764bfb9ead13361be7583448b78f239964532fd589e8a2ad83857192bf500f507260b049e1eb7522dedadc81ac3dfc76a90ddeb0440557844abed6206022da96
SSDEEP 24576:HU/QhAI889YyuQYZlm/8AgzMkf6G5MJ8NW/yKhh+ivz/LZ/Xm+5D3ovTKJz:AVyuQYZlm/8vP6G5MJ8NuF+IzDZ/XPoA
TLSH
T186658C4BF2B801ADC0A7C179C91B170BEBB2B405177497DF5594CA692F23EE217BA324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53042\unicodedata.pyd
Size 1.1MB
SHA256 bc2cf23b7b7491edcf03103b78dbaf42afd84a60ea71e764af9a1ddd0fe84268
MD5 cc8142bedafdfaa50b26c6d07755c7a6
SHA1 0fcab5816eaf7b138f22c29c6d5b5f59551b39fe
SHA512 c3b0c1dbe5bf159ab7706f314a75a856a08ebb889f53fe22ab3ec92b35b5e211edab3934df3da64ebea76f38eb9bfc9504db8d7546a36bc3cabe40c5599a9cbd
SSDEEP 12288:LrEHdcM6hbqCjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfcAjL:LrEXPCjfk7bPNfv42BN6yzUAjL
TLSH
T1D3355AC5BB828E66E87B31B944D1212F1361C273476B533BB25513294C8B3B74EE69EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nitro code gen.zip

Path C:\Users\Admin\Downloads\nitro code gen.zip
Size 16.7MB
SHA256 b9e91562c58f5e50e9dfc1b0060f6fd79a94260ed52a479388cf8891b772d100
MD5 64758300fb7440925032bfcff4e16f15
SHA1 6c22108315f1a477eae05663b3bdf5c745854caf
SHA512 928e672da7f68492ed933394151d55193ede1cb13a55ac186481b3bbc6d72f9948c093cbdc5f231be4cc51ceaa5ede0bf6db29bee4c3e0c1839aa3be261ae610
SSDEEP 393216:t0SXkMy69+G671Vn3LgX8rtgnTIT3j4QS34aiKhd9+1x:t9Xm6Mz1p3LYjMj+34ehL+1x
TLSH
T192073314E2D33C35A74AB80212734E198AD38DDAF42EE9DC1FD205E7A1D6527CD7D82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1484-411-0x000002811D610000-0x000002811E610000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads