c6422ae0ed7568f683a8512fe2f8486a873f57751c1246d9e3d118585bc878d4

Analysis

user interaction
yes
max time kernel
137s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 23:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Swollstrap.exe
Size 94.5MB
Sample260731-3rynesar4v
SHA256 c6422ae0ed7568f683a8512fe2f8486a873f57751c1246d9e3d118585bc878d4
MD5 b5c73378fe9595f62a99ed29223f3b67
SHA1 01d815efc5073dd7244021c0aba5ee0ad2f3fea1
SHA512 a70951763c3e7612d066f5d710d20ebb33381bfd5dd45ce56cbd06f8dd6d32c220f96ed6189a373f28e1b40c326374946d75b41cd1a1045f604cafa0d4017bce
SSDEEP 1572864:1/CwVPNWuyPdb3i5rnq3nsl6Hg82nqMD3mOi6wuJ0D52krd9kkeAaiI2wymUZ7mH:/xNJyPdb3YqslvqMzmOj6Nd9sAw4N8H
TLSH
T1E22833A38334185BCDBA46368771DE507B63610B5F959C4BAF804182AD3FBCD87B27A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Loads dropped DLL 62 IoCs

pid	Process
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe
3104	Swollstrap.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Swollstrap.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5844_817007705\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5844_817007705\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5844_760215662\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5844_817007705\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5844_817007705\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5844_817007705\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5844_817007705\hyph-or.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5844_817007705\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5844_817007705\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5844_817007705\hyph-la.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5844_817007705\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\_locales\as\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5844_817007705\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5844_817007705\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5844_817007705\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5844_760215662\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5844_817007705\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5844_817007705\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5844_817007705\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5844_817007705\hyph-as.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5844_817007705\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5844_817007705\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5844_817007705\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5844_817007705\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5844_817007705\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5660_1330675888\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5844_817007705\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5844_817007705\hyph-cs.hyb	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5664	cmd.exe
5712	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4448	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134300151798025901"	msedgewebview2.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{3FE2A4C4-41B2-4292-99ED-DB26EEB6C46B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
768	msedgewebview2.exe
768	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5844	msedgewebview2.exe
5844	msedgewebview2.exe
5660	msedge.exe
5660	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3104	Swollstrap.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3104	Swollstrap.exe
3104	Swollstrap.exe
5660	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3104	Swollstrap.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 3104	3212	Swollstrap.exe	87
PID 3104 wrote to memory of 5664	3104	Swollstrap.exe	88
PID 3104 wrote to memory of 5712	3104	Swollstrap.exe	92
PID 3104 wrote to memory of 5844	3104	Swollstrap.exe	96
PID 5844 wrote to memory of 3548	5844	msedgewebview2.exe	97
PID 5844 wrote to memory of 4852	5844	msedgewebview2.exe	100
PID 5844 wrote to memory of 4852	5844	msedgewebview2.exe	100
PID 5844 wrote to memory of 4852	5844	msedgewebview2.exe	100
PID 5844 wrote to memory of 4880	5844	msedgewebview2.exe	101
PID 5844 wrote to memory of 5436	5844	msedgewebview2.exe	102
PID 5844 wrote to memory of 5436	5844	msedgewebview2.exe	102
PID 5844 wrote to memory of 4164	5844	msedgewebview2.exe	104
PID 5844 wrote to memory of 4164	5844	msedgewebview2.exe	104
PID 5844 wrote to memory of 4164	5844	msedgewebview2.exe	104
PID 5844 wrote to memory of 4416	5844	msedgewebview2.exe	106
PID 5844 wrote to memory of 4416	5844	msedgewebview2.exe	106
PID 5844 wrote to memory of 4416	5844	msedgewebview2.exe	106
PID 5844 wrote to memory of 5604	5844	msedgewebview2.exe	113
PID 5844 wrote to memory of 5604	5844	msedgewebview2.exe	113
PID 5844 wrote to memory of 3868	5844	msedgewebview2.exe	119
PID 5844 wrote to memory of 3868	5844	msedgewebview2.exe	119
PID 3104 wrote to memory of 5660	3104	Swollstrap.exe	120
PID 5660 wrote to memory of 3844	5660	msedge.exe	121
PID 5660 wrote to memory of 4448	5660	msedge.exe	122
PID 5660 wrote to memory of 5412	5660	msedge.exe	123
PID 5660 wrote to memory of 5412	5660	msedge.exe	123
PID 5660 wrote to memory of 5412	5660	msedge.exe	123
PID 5660 wrote to memory of 1184	5660	msedge.exe	124
PID 5660 wrote to memory of 1184	5660	msedge.exe	124
PID 5660 wrote to memory of 5328	5660	msedge.exe	126
PID 5660 wrote to memory of 5520	5660	msedge.exe	127
PID 5660 wrote to memory of 5520	5660	msedge.exe	127
PID 5660 wrote to memory of 5520	5660	msedge.exe	127
PID 5660 wrote to memory of 5328	5660	msedge.exe	126
PID 5660 wrote to memory of 5328	5660	msedge.exe	126
PID 5660 wrote to memory of 5664	5660	msedge.exe	130
PID 5660 wrote to memory of 2364	5660	msedge.exe	131
PID 5660 wrote to memory of 5664	5660	msedge.exe	130
PID 5660 wrote to memory of 2364	5660	msedge.exe	131
PID 5660 wrote to memory of 1996	5660	msedge.exe	133
PID 5844 wrote to memory of 1584	5844	msedgewebview2.exe	137
PID 5844 wrote to memory of 1584	5844	msedgewebview2.exe	137
PID 5660 wrote to memory of 5396	5660	msedge.exe	138
PID 5660 wrote to memory of 1144	5660	msedge.exe	139
PID 5660 wrote to memory of 1656	5660	msedge.exe	140
PID 5660 wrote to memory of 4452	5660	msedge.exe	141
PID 5660 wrote to memory of 4452	5660	msedge.exe	141
PID 5660 wrote to memory of 4060	5660	msedge.exe	142
PID 5660 wrote to memory of 4060	5660	msedge.exe	142
PID 5844 wrote to memory of 768	5844	msedgewebview2.exe	143

C:\Users\Admin\AppData\Local\Temp\Swollstrap.exe
"C:\Users\Admin\AppData\Local\Temp\Swollstrap.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Users\Admin\AppData\Local\Temp\Swollstrap.exe
  "C:\Users\Admin\AppData\Local\Temp\Swollstrap.exe"
  2⤵
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:5664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:5712
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Swollstrap.exe --user-data-dir="C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Data\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=3104.704.2569649607652454409
    3⤵
    - Drops file in Program Files directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:5844
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Data\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Data\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x158,0x15c,0x160,0x134,0x168,0x7ffeafa3b078,0x7ffeafa3b084,0x7ffeafa3b090
      4⤵
      PID:3548
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Data\EBWebView" --webview-exe-name=Swollstrap.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1704,i,11677431389508541090,16308633936943877043,262144 --variations-seed-version --mojo-platform-channel-handle=1700 /prefetch:2
      4⤵
      PID:4852
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Data\EBWebView" --webview-exe-name=Swollstrap.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2012,i,11677431389508541090,16308633936943877043,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:3
      4⤵
      PID:4880
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Data\EBWebView" --webview-exe-name=Swollstrap.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2348,i,11677431389508541090,16308633936943877043,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:8
      4⤵
      PID:5436
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Data\EBWebView" --webview-exe-name=Swollstrap.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3612,i,11677431389508541090,16308633936943877043,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:4164
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Data\EBWebView" --webview-exe-name=Swollstrap.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3880,i,11677431389508541090,16308633936943877043,262144 --variations-seed-version --mojo-platform-channel-handle=3912 /prefetch:1
      4⤵
      PID:4416
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Data\EBWebView" --webview-exe-name=Swollstrap.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4752,i,11677431389508541090,16308633936943877043,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:8
      4⤵
      PID:5604
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Data\EBWebView" --webview-exe-name=Swollstrap.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5096,i,11677431389508541090,16308633936943877043,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
      4⤵
      PID:3868
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Data\EBWebView" --webview-exe-name=Swollstrap.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5192,i,11677431389508541090,16308633936943877043,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
      4⤵
      PID:1584
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Data\EBWebView" --webview-exe-name=Swollstrap.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5048,i,11677431389508541090,16308633936943877043,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://swollstore.netlify.app/
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x2e8,0x7ffe987fc188,0x7ffe987fc194,0x7ffe987fc1a0
      4⤵
      PID:3844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,152501959290788218,13783893400659762094,524288 --field-trial-handle=2244,i,17289142046817190025,15947859943777754335,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
      4⤵
      System Time Discovery
      PID:4448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,13659387244614138264,17878674648028064892,262144 --field-trial-handle=2244,i,17289142046817190025,15947859943777754335,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
      4⤵
      PID:5412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,18066167357366433970,3645569699832213198,524288 --field-trial-handle=2244,i,17289142046817190025,15947859943777754335,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:8
      4⤵
      PID:1184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,15563526932015975374,9035951594898370330,2097152 --field-trial-handle=2244,i,17289142046817190025,15947859943777754335,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
      4⤵
      PID:5328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,10686209285676549461,2040922879489175079,2097152 --field-trial-handle=2244,i,17289142046817190025,15947859943777754335,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
      4⤵
      PID:5520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,6039755002955197135,6122532704896981045,524288 --field-trial-handle=2244,i,17289142046817190025,15947859943777754335,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
      4⤵
      PID:5664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,18079243234595559354,2523434845222764798,524288 --field-trial-handle=2244,i,17289142046817190025,15947859943777754335,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
      4⤵
      PID:2364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,884004966764020920,5476408083979789412,524288 --field-trial-handle=2244,i,17289142046817190025,15947859943777754335,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
      4⤵
      PID:4076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,884004966764020920,5476408083979789412,524288 --field-trial-handle=2244,i,17289142046817190025,15947859943777754335,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
      4⤵
      PID:1996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,4827615811757636963,10402897936608596723,524288 --field-trial-handle=2244,i,17289142046817190025,15947859943777754335,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
      4⤵
      PID:5396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,17316881817985108412,7723560435385465469,524288 --field-trial-handle=2244,i,17289142046817190025,15947859943777754335,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
      4⤵
      PID:1144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,15279830891676339774,6446993398435388059,524288 --field-trial-handle=2244,i,17289142046817190025,15947859943777754335,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
      4⤵
      PID:1656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,12883577128324533589,4516430228248724631,524288 --field-trial-handle=2244,i,17289142046817190025,15947859943777754335,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
      4⤵
      PID:4452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,16385395459167572252,6304617820884684422,524288 --field-trial-handle=2244,i,17289142046817190025,15947859943777754335,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
      4⤵
      PID:4060

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1268

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5844_760215662\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

hyph-af.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5844_817007705\hyph-af.hyb
Size 70KB
SHA256 5487ee44a4cd706d0086522e90c59c76cdf2ac68ce506fd3eae6054b9220c0cf
MD5 ffa9db945f0f0c15b8bba75a6e064880
SHA1 49217a9d5bb7a868464403b4e3c82e80df53456c
SHA512 cc67b2dfbbb009dd3fdb999fe86410425455613c12dac755a3cded435cd25ca4363782d70f3b7bb7c0fdd63e2eb649ae6a4053d929f463b646b43d7dbfda79c0
SSDEEP 1536:dH4Yzf/r1T2bhKC+wQ/MJ4tpBMfWDMxFaye3yrGZ3vGV9YODhX3yKfhGt:dxLr1qFKpNpufWIqye3KgGVnDxe
TLSH
T1D56329C3C62BDF90CC6419F4594D0AA811D816C6E7C039BE9B6C54797A27CB82BC13EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5844_817007705\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5844_817007705\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5844_817007705\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5844_817007705\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 36cf54ba859ec1bf516f72731e8b3c872c83fee766824596311fc7f455dbc3bf
MD5 cfd06b744c25698674dd41a59d8b4c98
SHA1 5a858e843d8c4af84e09e7f0b7bd3d7d569f9051
SHA512 e78f3ac81fb16cddb95130d72c9af3e3d89aa7c9b87c029a7825846cff466b3f5254e999aa7e6ca117603adf4c47b39396650fb0c8c2f484cad26065efb6a0d7
TLSH
T1FFE022BACC22EC271CFE0B59A04D8B46EB5013672B81896F3A3C920D8FB062B45C5C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dbb8f610-1d36-473d-9ddf-e94e65b19e1d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\dbb8f610-1d36-473d-9ddf-e94e65b19e1d.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 48d6e069408985b83186f9a9c8d95a261b4ec1ab69f3dd716c8739fedfaae118
MD5 b8f69482f4097a4d3b0d52b132b686e2
SHA1 e10dd323011db7efa6a7d682d4ab8fd2fbba1b44
SHA512 1e4a03e011a22f4c29d2f0030364135f637f8e4fb1b84640e7e211522b7917647acadf0e70bae7d80d82258684278480ec4f563e877d5a81472128183c2ab160
SSDEEP 192:sxZmAR5yMqZjK1Ml8Mjh/fKsH0aZdIaRuvnzodpT/HW6+WNew+XYv0u3irhJIg5a:sxZmA67h/fKsH0azIKYsjHb8X3rTr8
TLSH
T1D572E81A6A3459778CDBD209FA45BF53D3F9017392945E44A9FC8A0C04E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 e3ad774b399d68c2d64b7424cc0268bbcbb22afab64f88abae79ad2206c3a49a
MD5 e858e994d1992016add845d23db17f3c
SHA1 d2a289be2d58da85b5ad1ec8bd6821a9fcc57597
SHA512 748c88bcf0ab1742d654756cf2bc08ec6f2624f989b83a006455c00925d798d561d00ab553f7b3fd11b3a3b36e9c61d0d4f77cb830581749142615563c2938b0
SSDEEP 192:sxZmAR5yMqZjK1Ml8Mih/fKssJ0aZdIaRuvnzodpT/HW6+WNesD/YvAu3+rhJIgI:sxZmA6qh/fKssJ0azIKYsjHbR/lrTj8
TLSH
T16D62F9166A24597B8CDBD219FA44BF53D3F5157392904E449AFCCA0C04E7BEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 cc9e793ef078f16169e918502fdaa08fec8638c6e0d8caeea5a4b14fca7f6e11
MD5 14b8fea54f37c8b709c6a42c81eeac40
SHA1 3fb906f1ebad64929d57e99e21ab9bbf5dea67b3
SHA512 49231cf04046dc7cb92c363bf2044265116d96e4b3189815840814df1435cecbf6cab26ea5aafd84ac419141825571d78d9200d7621a6edb8712f6da9d6c62f9
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVyysy10Llj:eY8Od/HEnFhWvFvmXu1jaet10Lm2Nupu
TLSH
T114F2FB3B6C0CCB7E4F844E9CEC2A7F8A6DE802CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 f0fcb3d6898dbd0d573b3bfba344927cc642daca3cf2a7fa8e8c0dbcb13f6dca
MD5 fe64909fb3926b392ddadb7d9f124700
SHA1 191cb84815f5b2cd864f95b969ae36d4fc35a4eb
SHA512 e87b5990a8ff4ca4499c5e05e35d97858a47facd82fbfff4630993f1b399f9688a3d59c246501f6c551ad939a29423d8a5d11e46d89a53f100aa61f998f7274e
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGD:05ppxnY753RNBvRJJdt7p5J9XP5B
TLSH
T17BB2575A703E0211397E2988B39696364F4235A37058E4AF7FB814A54F67E224CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 0bfab7b000620ce0016a9d172f2996bce86b28f266648d0d441ac15d33c02835
MD5 ac6d17311b5698d7e1a69e296cd39ac6
SHA1 487c1233837285ea8dddcf0de2354ce736e2cef5
SHA512 8e6e957c86320740175f7a8300db159e6adf97a19068d83511974f312dec66704a7f803f5c11d9cf82bd6bb9e361f05b78c3976e16609c2aac94d4f9ba1865f0
SSDEEP 384:npRiF9CcmyWCs3sNr8TUNTUlI42QckCr0loUGpv4fxGgxiz0yJUHcvrBgAaX2tyt:p4Fccps3OwglkdoU4kGgGJccDWLXt
TLSH
T19FB24A36E858DEB7ADE74BC9F74A3A43DEE0016389CC9AD4DAD95E0C00872DD170B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 37cf41ac4dc2406d967a1c1754ce7a54362f57879387457343922da73be3a69c
MD5 934c1465ac67dedb70df2d36b4706dfd
SHA1 db9e704eedb07f4e47f07e8da746b91879019ec4
SHA512 a7c4f3f279bdf0d110a112b3d696244cc7ca88b571c288717ab8aa8785471b7e87d7392ec7bcc8d48237a420ebc38a7d8f4e457a3b1d8206476f0ffafb74fedf
SSDEEP 768:p4FQH3OwglkqoU4kGgGJccDJLnewBKZOy30z:HH3kABTcinevZz0
TLSH
T1DCD25B76D868DDB7EDE75B89B74A3A43DFE4016389CC5AD4DAD99E1C008329D030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 43b48cbe112db390f5068b410fbd1f4e8209ded7dc397e169c3662349ef21b9a
MD5 0febf7ce92b22c16af3f70a388059bb8
SHA1 e34efd45e6ddab3bba08a24595d2918b5ff2468a
SHA512 d99a5dd3686424bd1a858383fc5076fe09d249b221786071dcdb4828919cc2ace171c24f221a076825ff8605b7eacb31c072fbf6c1f79e1b4ce6eeb533ea8012
SSDEEP 768:GFQH3OwglkqoU4kGgGJccDJLnewBKZOy30z:TH3kABTcinevZz0
TLSH
T10DD25B76D868DDB7EDE75B89B74A3A43DFE4016389CC5AD4DAD99E1C008329D030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 4bc8def1119e691696f6320062b9b29adbd87ea97a60b494cc53b0e3eb359cfc
MD5 4fcb652c954904b3b8665460e2b0716a
SHA1 75fa724276c380d4347fe9ec10fe8eefe8b2b260
SHA512 83f4db03ae9b7861db0c33e4ace8e9d17959828cdad65a8cc893812c60ca44a5f8b34ed857a2636456fea3b5a1fb8c32ea04290b2ae1fe27fc27a91911183585
SSDEEP 384:np3iF9CcmyWCs3sNC8TUNTUlIm2QckCr9lnKpv4fxGgxiz0yJUH9ANpwe4KV8p0p:pyFccps3fwgbkUFkkGgGJc9BI8p0YM
TLSH
T112B25B36EC58DEBBEDE34F89B74A7A07DEE0026785D85AD4DAD85E0D00971DC130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 9eda209b4ba249734a7cbe3db75ee24fc9693b717fbe70a21a34722d6e86d994
MD5 fb09a8c04083edfc4707dc8bd1c5ce5a
SHA1 aea910ed6ba120aab6e222c286e36338c5827cec
SHA512 d9a61a01371e145d3b741e2f915d28d456ae2a59c154b7f55e3195b503e7ec7ec17ef3eee6f0b1716018c6783cd0f8f728b2aa3858d011820785a687b733d727
SSDEEP 768:puFccps3ewgbkUyCpkGgGJccDVLI8p0YM:8s3wrTcKI8p0p
TLSH
T1FFC25A35E858DEBBECE74B89B74A3943DEE0516389CC9AE4DAD95E0D00872DC170B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

D3DCompiler_47_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\D3DCompiler_47_cor3.dll
Size 4.7MB
SHA256 a05d04a270f68c8c6d6ea2d23bebf8cd1d5453b26b5442fa54965f90f1c62082
MD5 a7349236212b0e5cec2978f2cfa49a1a
SHA1 5abb08949162fd1985b89ffad40aaf5fc769017e
SHA512 c7ff4f9146fefedc199360aa04236294349c881b3865ebc58c5646ad6b3f83fca309de1173f5ebf823a14ba65e5ada77b46f20286d1ea62c37e17adbc9a82d02
SSDEEP 49152:FCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvpiD0N+YEzI4og/RfzHLeHTRhFRNS:EG2QCwmHXnog/pzHAo/A2L
TLSH
T19A367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDL2.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\SDL2.dll
Size 2.4MB
SHA256 520d0459b91efa32fbccf9027a9ca1fc5aae657e679ce8e90f179f9cf5afd279
MD5 83c5ff24eae3b9038d74ad91dc884e32
SHA1 81bf9f8109d73604768bf5310f1f70af62b72e43
SHA512 38ff01891ad5093d0e4f222c5ab703a540514271bf3b94fb65f910193262af722adb9d4f4d2bd6a54c090a7d631d8c98497b7d78bd21359fdea756ff3ac63689
SSDEEP 49152:7Vj3jF2sAlo/43FCPLQ+Ebh8NsB+f94OKLvci5R77CuiY:RrjFiOmC/65TowxCui
TLSH
T1B9C52A0AB3F6179CF6F78E749676A7225832FC298910DAAE2150953D0C31F908975F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDL2_image.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\SDL2_image.dll
Size 122KB
SHA256 1e364af75fee0c83506fbdfd4d5b0e386c4e9c6a33ddbddac61ddb131e360194
MD5 b8d249a5e394b4e6a954c557af1b80e6
SHA1 b03bb9d09447114a018110bfb91d56ef8d5ec3bb
SHA512 2f2e248c3963711f1a9f5d8baea5b8527d1df1748cd7e33bf898a380ae748f7a65629438711ff9a5343e64762ec0b5dc478cdf19fbf7111dac9d11a8427e0007
SSDEEP 3072:6bsejIuO504fzsOM05Nmy7iGpJ7SvFisgf:6bmX0qQOhmyPs
TLSH
T182C34A17F2E3A0FCC617D0B4A297B637F43138551630BEBE1BA09A345E61E207B9D916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDL2_mixer.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\SDL2_mixer.dll
Size 285KB
SHA256 2a0fc5e9f72c2eaec3240cb82b7594a58ccda609485981f256b94d0a4dd8d6f8
MD5 201aa86dc9349396b83eed4c15abe764
SHA1 1a239c479e275aa7be93c5372b2d35e98d8d8cec
SHA512 bb2cd185d1d936ceca3cc20372c98a1b1542288ad5523ff8b823fb5e842205656ec2f615f076929c69987c7468245a452238b509d37109c9bec26be5f638f3b7
SSDEEP 3072:uHT3KS12sljkvy5jXabgwdIFwix1Cvmm1xXLLPAgx+3BfZrzJ9qYdt2mTdIssFor:E3Kdy5eb+wix1Cv/7MBJJ95IssFo2p
TLSH
T199544B4BF2A365ECC127D03456BAE737B8B1B4A002217CBE5744DB316E12DA0A72DF65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDL2_ttf.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\SDL2_ttf.dll
Size 1.5MB
SHA256 fcdfabdfce868eb33f7514025ff59c1bb6c418f1bcd6ace2300a9cd4053e1d63
MD5 f187dfdccc102436e27704dc572a2c16
SHA1 be4d499e66b8c4eb92480e4f520ccd8eaaa39b04
SHA512 75002d96153dfd2bfdd6291f842fb553695ef3997012dae0b9a537c95c3f3a83b844a8d1162faefcddf9e1807f3db23b1a10c2789c95dd5f6fad2286bae91afb
SSDEEP 24576:jS8/9uHym3+c6zXD75JqzkiTPxk6saGjhn7+DNvY1vDe9tnYP05pi8ZpFUcjt:n/9ub3+c6zXDrqzkZ1vjhiDNvY98W2UQ
TLSH
T157756C96E2A394FCC22FC170429BD773F531B82000256DBF99A4DE70AE11ED06B5DB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
TLSH
T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\VCRUNTIME140_1.dll
Size 48KB
SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
MD5 f8dfa78045620cf8a732e67d1b1eb53d
SHA1 ff9a604d8c99405bfdbbf4295825d3fcbc792704
SHA512 ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371
SSDEEP 768:wPIyGVrxmKqOnA4j3z6Su77A+i0QLxi9z9Rtii9zn+:fBr87uW1nA8QLx+zrti+zn+
TLSH
T194235B9097784446D96B99B0C0D6DE57BD3CFAA20B50928F0BA1D14C1E63BD0FB3D22E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\_asyncio.pyd
Size 63KB
SHA256 746bc8fa88282afe19dc60e426cc0a75bea3bd137cca06a0b57a30bd31459403
MD5 07a6e6dcc30e1c4c7e0cdc41a457a887
SHA1 53bc820b63d88cbe889944e242b50662b4b2cb42
SHA512 837f1e40db9bdf1bc73b2a700df6086a3acdb7d52afc903239410b2d226ffd1dd5e8b5f317401bcf58dd042bd56787af6cdc49af96fcb588bcf0127d536b6c6d
SSDEEP 1536:/0f8MOytWQazE6XWpkJONIYOnsO7SyLzx1z:cf8X2sE6XWpkJONIYOndx
TLSH
T174538D83E2808595D957A074D8B30F56E771F6500B0403DE62A8D29E2F733229BFFB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\_bz2.pyd
Size 82KB
SHA256 00b8ca9a338d2b47285c9e56d6d893db2a999b47216756f18439997fb80a56e3
MD5 aa1083bde6d21cabfc630a18f51b1926
SHA1 e40e61dba19301817a48fd66ceeaade79a934389
SHA512 2df0d07065170fee50e0cd6208b0cc7baa3a295813f4ad02bec5315aa2a14b7345da4cdf7cac893da2c7fc21b201062271f655a85ceb51940f0acb99bb6a1d4c
SSDEEP 1536:CX8z7RFgpNVu5eYu00NI5OhgYNxx8bhm+uVIYCVH7Symxs:CszlF+uyIkNxebhEVIYCVHL
TLSH
T190839E93E3605AF5E45B92B9A6A04357E331BE49035093EFF75883162F13F813D6836A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\_cffi_backend.cp311-win_amd64.pyd
Size 175KB
SHA256 9dcbe427f86795a5dfc19d74e9b5f3d0994ff0221b1a111877ed11eccd42e026
MD5 5f477032e5074fdcda0b48c480c22f6a
SHA1 0c8e8fb2eb5fde5cafa70258cc09a9e1bb5a0391
SHA512 c868c5eccacf4616f83c06770141853175e6c2d12403b7070b45da405761eab3bcdc3978863f4bcd5d5141acf581e5a2bff0676e92282efa2d8f5cc2631a1de1
SSDEEP 3072:v/F2tMalBGbRd+ZFu+YX+ToB7UPLjOr2ZxeDLd+LEsP78FSTL7Kvo73nBMG:v/sCd+geoB7UPLar2ZqyHgFSTLOwbnBM
TLSH
T133047C5A329C11B2D6A251388A579B43E3B3B460175197CF0160C7B62F1BBE67A7FF80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\_ctypes.pyd
Size 121KB
SHA256 c148292328f0aab7863af82f54f613961e7cb95b7215f7a81cafaf45bd4c42b7
MD5 565d011ce1cee4d48e722c7421300090
SHA1 9dc300e04e5e0075de4c0205be2e8aae2064ae19
SHA512 5af370884b5f82903fd93b566791a22e5b0cded7f743e6524880ea0c41ee73037b71df0be9f07d3224c733b076bec3be756e7e77f9e7ed5c2dd9505f35b0e4f5
SSDEEP 3072:QjyeQXVhflFZtc/uTfLImTi6pX5DJIYLP0i:QGeI+/uTfLIm+cXxp
TLSH
T113C36B0B23581099EAA7807CC5B35F17C7B1B859171087CF02A4CAAD2F637A36E7E716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\_decimal.pyd
Size 249KB
SHA256 980a63f2b39cf16910f44384398e25f24482346a482addb00de42555b17d4278
MD5 c88282908ba54510eda3887c488198eb
SHA1 94ed1b44f99642b689f5f3824d2e490252936899
SHA512 312b081a90a275465787a539e48412d07f1a4c32bab0f3aa024e6e3fe534ac9c07595238d51dc4d6f13c8d03c2441f788dff9fe3d7ca2aad3940609501d273bd
SSDEEP 6144:E7W/Dmi0FD5KaN7VqqO9a3juVQt07Ou9qWM53pLW1AT3Otjm1+Br:L/Ki0FdVI9a3juKeqcO+Br
TLSH
T11C446C57A2490CA4DE738474D89B9B47FBB278854320C3CF03A48AA76F577A323B9744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_elementtree.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\_elementtree.pyd
Size 125KB
SHA256 02e30b6a2bee5be5336e40a9c89575603051bde86f9c9cdc78b7fa7d9b7bd1f0
MD5 e31fd445c65aec18c32a99828732264a
SHA1 1e7e9505954b8143faeee6ce0b459712f73018b1
SHA512 20802cae1b75f28a83e76b529caf16c8d00bc050e66f6d8665c4238c4579e391c78f121dccb369f64511fdf892619720f8c626a39a28c9aa44f2bff7472cf0f9
SSDEEP 3072:DJeqwp57DnMInmugVdkub0cTGugGdWp/g1Ap3ZrBvdL5bFIY6fvmU:mnMInmuoNb0ci0opQAp9BvHbk
TLSH
T146C34A6B6295C0AFE462407C95674F06D7B2FCA50E4083CF6284F6AD9F333923EA9355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\_hashlib.pyd
Size 63KB
SHA256 87dd0c858620287454fd6d31d52b6a48eddbb2a08e09e8b2d9fdb0b92200d766
MD5 b4ff25b1aca23d48897fc616e102e9b6
SHA1 8295ee478191eb5f741a5f6a3f4ab4576ceec8d2
SHA512 a7adcf652bc88f8878dae2742a37af75599936d80223e62fe74755d6bafaafd985678595872fb696c715f69a1f963f12e3d52cd3d7e7a83747983b2ee244e8a2
SSDEEP 1536:r5m8HQNUbaxjTvKzl9mjNLOjxNHeuNIYOIa7Syuxrm:r5m8H79mJOjPHeuNIYOIaum
TLSH
T174538E46A69544A4D96781B9CDA34F57E9F2F1001710ABDF0368C18D2F233C3ABFA766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\_lzma.pyd
Size 155KB
SHA256 f5e01b516c2c23035f7703e23569dec26c5616c05a929b2580ae474a5c6722c5
MD5 b86b9f292af12006187ebe6c606a377d
SHA1 604224e12514c21ab6db4c285365b0996c7f2139
SHA512 d4e97f554d57048b488bf6515c35fddadeb9d101133ee27a449381ebe75ac3556930b05e218473eba5254f3c441436e12f3d0166fb1b1e3cd7b0946d5efab312
SSDEEP 3072:esdh8kZbsOb0Mt4zorT81qjznf09mNoqCPAaQVIYZ1Ncf:esdhBZbsm0hi78YOqtX6
TLSH
T122F33A92A394F4D5F7628C78D6624F17DBF678090310929A02CCC36D2B1FB759A2E727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\_multiprocessing.pyd
Size 33KB
SHA256 975c1947798e3c39898c86675ca1eb68249f77361f41f172f9800275227213b9
MD5 cf0b31f01a95e9f181d87197786b96ca
SHA1 6214361452f7eaef5c710719a5cfb6109906975c
SHA512 d56b096780bb263e3f7282f163da02353ed5d8767f964937deaff997156e95749312180f25582d5963d3c351260b8ff196221652e7bf088a8c6a4e766118abd3
SSDEEP 768:z4MsRxarHWQXqTdywb7y9IYWt85YiSyv/AMxkEhERx:YzFQ6Tdywb7y9IYWtG7SyHxGRx
TLSH
T118F28D43AA54285AD837C97294A39E29D932F757075087DF2314C29E0F323837FEA75A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\_overlapped.pyd
Size 50KB
SHA256 ca106e4dfdeafeabf9e98956d3d8d0cb73e109f1a96f1a7e35bc47dbd7c7e164
MD5 78e8049e26df6fd3a4011562ff8e74a0
SHA1 d5a91c720e4672c40e1dd6d54b3197b4a1f8b633
SHA512 ea7a54d38cefed870cee65dd9460b6c51131ae5219933ddc998a86d12bb093784242cb5471c77bc324ccf59fa42c2914865dcf582f74c440fa52b7d15d9faeac
SSDEEP 768:OiqKtLpqCvqlB1QIb1D1N+gpOUpEkCZ9hIYXth5YiSyveAMxkEs:+KzqC/A1hNekCZ9hIYXtP7SyExA
TLSH
T193337B02670404DADD67C2BDD8735F16EA71B4D2470183AF52A8CA4A0F737C16BEEB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\_queue.pyd
Size 31KB
SHA256 3f8e7e6aa13b417acc78b63434fb1144e6319a010a9fc376c54d6e69b638fe4c
MD5 7f52ef40b083f34fd5e723e97b13382f
SHA1 626d47df812738f28bc87c7667344b92847fdf6a
SHA512 48f7723a8c039abd6ccb2906fbd310f0cfa170dcbdf89a6437dd02c8f77f20e6c7c402d29b922cdaabd357d3a33e34c3ad826127134f38d77a4d6d9c83371949
SSDEEP 768:R7Vej6rsdmxUnJIYQUA5YiSyvyAMxkEbF:R7LsdWUnJIYQUS7SyIx3F
TLSH
T1D1E29F83AA586C46C437C47594E25E39E876FA42570183EF2219C25D1F333427BBA765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\_socket.pyd
Size 77KB
SHA256 a19e3c7c03ef1b5625790b1c9c42594909311ab6df540fbf43c6aa93300ab166
MD5 b77017baa2004833ef3847a3a3141280
SHA1 39666f74bd076015b376fc81250dff89dff4b0a6
SHA512 6b24d0e038c433b995bd05de7c8fe7dd7b0a11152937c189b8854c95780b0220a9435de0db7ac796a7de11a59c61d56b1aef9a8dbaba62d02325122ceb8b003d
SSDEEP 1536:kHan8OG4wAM/Hh2JO9/s+S+pzpTzVs/tiTFVf77neJIYLw47Syt6xr:8an8OAF2JO9/sT+pzVVs/tYFVT7neJIh
TLSH
T1BE736B11A69011AAD2B3C07AC5634F23F774F4C1179597CF1264CA6E5F23782EE7AB82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\_ssl.pyd
Size 174KB
SHA256 ba5388d6a6557d431e086734a3323621dc447f63ba299b0a815e5837cf869678
MD5 0f02eccd7933b7a7c2bdedca2a72aab6
SHA1 0b4c551d8fe34d8128e5cf97daa19eb4c97db06e
SHA512 90a64082dab51380e05c76047ee40e259c719d7170fb4acb247b68a03b710461b350da3821b426fd13167895ded32f9c5ec0e07587ad4125683a18a3495f5ed5
SSDEEP 3072:mn5VVb4iZpIy+vgSf36XK7DapGB4JQELqOlh59YL48WKqgVl5pVIYC7Nb0CY:m5Vp4EaDD36XK7r4JkQY
TLSH
T10E047C47B59469B7E817E4FEC1230802EBB5F005331157CE49D6DA8A0F07746AEAAB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ada92cb5d92a588d1b93__mypyc.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\ada92cb5d92a588d1b93__mypyc.cp311-win_amd64.pyd
Size 216KB
SHA256 fc17eb621ecf2325e3c2d7501d3ee2c3848e3c7fec7027fda7c7fa1782874743
MD5 48939ec66bb9a4902acad835092465eb
SHA1 f1e10d14eb294eb70583b5019b52102a74ae6d7c
SHA512 263c7ee67cf2497b8ff9e6274f9d45929c4e0b13d785ca499a514423cb0bbc0fc257af964333e60c46b5a0fd3ce0b304bdf1cbed101ce4bd1376b1fc5900a2d6
SSDEEP 6144:IQSmadLchQ4xkP8VXaVlaz8fnt4HtFmiGJwMI70CuZmAYhe:azSmCXJh
TLSH
T146242A3AA2480020ED775279CC639223EAB3B552073156CF19D0CA755F17BEAB7BDB06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwollStrapHost.runtimeconfig.json

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\assemblies\SwollStrapHost.runtimeconfig.json
Size 250B
SHA256 172848c07813701b2969de3b278bc53bd32ccbf310b210b546e22da131bf0223
MD5 63acf2f244f2478e7be43d4beb922f05
SHA1 21569297c0f5f5b711b1a0624e332c3b7550b3a0
SHA512 b7f5b0226bcc14c8ca561c6ad5ee256896d7d185480522b99f45059835f0ef718b282d21d815f1e0ff42ebd150054c889669edceda71d4cdb5b97ceab94b510d
TLSH
T16BD05E79E8606CA315D624AD406AC482EE20A65380192D3479DD591CAF1A1AA5426799
MD5 SHA1 SHA512 TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\base_library.zip
Size 1.4MB
SHA256 6c3adeda4e6c385494cc9daee5885cc6f8b5b4e54cd53f4b93c88434cd9c9cb1
MD5 d84d9eaad674c3063d01bf65488a975e
SHA1 3688b55e2ac14758f31608dc9daf32c372285912
SHA512 73981715fee80cc1389e15244a3eb0a589b7e8d87ce280388b37bf816f777babcbecdbfe239d22474add7bbebb9ea56b0d0dc762197c8124197da11f9d5c0ddb
SSDEEP 24576:HT2l/R8VHHUafPWdmzs3OQR5p/3cnz/bucEvUFikwjwhw:al/RheQR5p5h
TLSH
T1996509817982B5F7F804F3BB4026090DB328C5B4BB44C75739ABC1A69F9E6A47E518DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

freetype.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\freetype.dll
Size 639KB
SHA256 1c487392d6d06970ba3c7b52705881f1fb069f607243499276c2f0c033c7df6f
MD5 236f879a5dd26dc7c118d43396444b1c
SHA1 5ed3e4e084471cf8600fb5e8c54e11a254914278
SHA512 cc9326bf1ae8bf574a4715158eba889d7f0d5e3818e6f57395740a4b593567204d6eef95b6e99d2717128c3bffa34a8031c213ff3f2a05741e1eaf3ca07f2254
SSDEEP 12288:9rVLid+Cjymyr99WvoHkeFP+MppfEWmHa:9x4+799HkPlZ
TLSH
T1BAD48D83F3A515A8C667C2388717832AE77670051310ABDB16E45B6B7F13FE66B3A314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\libcrypto-3.dll
Size 5.0MB
SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
MD5 e547cf6d296a88f5b1c352c116df7c0c
SHA1 cafa14e0367f7c13ad140fd556f10f320a039783
SHA512 9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d
SSDEEP 98304:n3+pefu6fSar+SJ8aqfPomg1CPwDvt3uFlDCE:3G+u6fb+SJ8aqfwmg1CPwDvt3uFlDCE
TLSH
T1E6366A6AA7A80188E5BAC13CCA534617D6B1F816577097CF19A1967C0F33FDA2B3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libjpeg-9.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\libjpeg-9.dll
Size 238KB
SHA256 3a224af540c96574800f5e9acf64b2cdfb9060e727919ec14fbd187a9b5bfe69
MD5 c540308d4a8e6289c40753fdd3e1c960
SHA1 1b84170212ca51970f794c967465ca7e84000d0e
SHA512 1dadc6b92de9af998f83faf216d2ab6483b2dea7cdea3387ac846e924adbf624f36f8093daf5cee6010fea7f3556a5e2fcac494dbc87b5a55ce564c9cd76f92b
SSDEEP 6144:I7wNZIYb0maLgCaqrWqg7EdP8J1dJHoFaeghCbBL:I7we7gCaqrWqg7EdP8jpY
TLSH
T1FC347E16EBE3ACECC927C1B4079BE732E860B4651215ED2F1694DA313E52DA05F4DF28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libmodplug-1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\libmodplug-1.dll
Size 259KB
SHA256 0c1a9032812ec4c20003a997423e67b71ecb5e59d62cdc18a5bf591176a9010e
MD5 ead020db018b03e63a64ebff14c77909
SHA1 89bb59ae2b3b8ec56416440642076ae7b977080e
SHA512 c4742d657e5598c606ceff29c0abb19c588ba7976a7c4bff1df80a3109fe7df25e7d0dace962ec3962a94d2715a4848f2acc997a0552bf8d893ff6e7a78857e5
SSDEEP 6144:AT91DT7fIooHEx09YvFTAPMH3eqSy9eNdUAK0l:ATPDnIKxWm2MXeqD3
TLSH
T1BF447D16F7D35CBEC267C07482DBD773A97274220312AD3A42A0DA733D65D901B6AB2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libogg-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\libogg-0.dll
Size 25KB
SHA256 57abc4f6a9accdd08bf9a2b022a66640cc626a5bd4dac6c7c4f06a5df61ee1fe
MD5 307ef797fc1af567101afba8f6ce6a8c
SHA1 0023f520f874a0c3eb3dc1fe8df73e71bde5f228
SHA512 5b0b6049844c6fef0cd2b6b1267130bb6e4c17b26afc898cfc17499ef05e79096cd705007a74578f11a218786119be37289290c5c47541090d7b9dea2908688e
SSDEEP 384:OJJhN0Zr3dtX7q96ZSd/Y7AulE5P1P/X7WCRsS7TP:Ork3dVnSW7AMEp1PPaCqS
TLSH
T1DCB2291A729299ECC64FD1F8C6E9977062FE7840C6963B7A07B0C3361D7198A1738E35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libopus-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\libopus-0.dll
Size 359KB
SHA256 771cae79410f7fcc4f993a105a18c4ed9e8cbddd6f807a42228d95f575808806
MD5 e1adac219ec78b7b2ac9999d8c2e1c94
SHA1 6910ec9351bee5c355587e42bbb2d75a65ffc0cf
SHA512 da1912243491227168e23fb92def056b229f9f1d8c35ae122e1a0474b0be84ceb7167b138f2ee5fffd812b80c6aca719250aca6b25931585e224e27384f4cc67
SSDEEP 6144:giqhiJwDR6q7f4jNOSO7lMv1EzSvwz4LhPqu7c6m1OOzzih22:5yDRpf4jXO72IcLNqHtzzi0
TLSH
T19F746C06E6A38CEDD167E470539AB733E831781412285C7B57E0CAB02F76E505A8E77B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libopusfile-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\libopusfile-0.dll
Size 45KB
SHA256 ccaaca81810bd2d1cab4692b4253a639f8d5516996db0e24d881efd3efdcc6a4
MD5 245498839af5a75cd034190fe805d478
SHA1 d164c38fd9690b8649afaef7c048f4aabb51dba8
SHA512 4181dea590cbc7a9e06729b79201aa29e8349408cb922de8d4cda555fc099b3e10fee4f5a9ddf1a22eaec8f5ede12f9d6e37ed7ad0486beb12b7330cca51a79e
SSDEEP 768:fjSfWfmLgQ4sKxsyEZtUeM3xZaGYWJajk0qgm/v/40:uufmF2zEZtUdxZaW4q1n/4
TLSH
T11B230847F18590FCC2EBC03887E69233BA72B85589253F2E9BA0D7365B25E50772C725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libpng16-16.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\libpng16-16.dll
Size 206KB
SHA256 e688b4a4d18f4b6ccc99c6ca4980f51218cb825610775192d9b60b2f05eff2d5
MD5 3a26cd3f92436747d2285dcef1fae67f
SHA1 e3d1403be06beb32fc8dc7e8a58c31e18b586a70
SHA512 73d651f063246723807d837811ead30e3faca8cb0581603f264c28fea1b2bdb6d874a73c1288c7770e95463786d6945b065d4ca1cf553e08220aea4e78a6f37f
SSDEEP 3072:VatMOImapxER0/vnm2mjq61IJJT1fX0yuWUQstxZw2TnzFEY5IQ:VatMOImapaR03nmnYJV1cjtnwunw
TLSH
T194246C47F3A35DBDCA97C1748257E772A671BC242234EEBF1294DB302E11C60771AA29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\libssl-3.dll
Size 768KB
SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
MD5 19a2aba25456181d5fb572d88ac0e73e
SHA1 656ca8cdfc9c3a6379536e2027e93408851483db
SHA512 df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337
SSDEEP 12288:ytPc2nnGoNg4kSHoxX09yO5EavUFe9Xb12:y9jnnpTHoxXUsFe9XbM
TLSH
T1CBF44B9DB3B8059CE9F6D13D86934623E3B6F4152370EBDB065186790F23BD52A3A348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libtiff-5.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\libtiff-5.dll
Size 422KB
SHA256 ebfe97ac5ef26b94945af3db5ffd110a4b8e92dc02559bf81ccb33f0d5ebce95
MD5 7d40a697ca6f21a8f09468b9fce565ad
SHA1 dc3b7f7fc0d9056af370e06f1451a65e77ff07f7
SHA512 5a195e3123f7f17d92b7eca46b9afa1ea600623ad6929ac29197447bb4d474a068fd5f61fca6731a60514125d3b0b2cafe1ff6be3a0161251a366355b660d61a
SSDEEP 6144:d8x4RKXHtEOtiYFJEn9RX9kgr+6Dr1Xu1ih/QpGJylW:qx4RK3tvKRH3Dt4ih9Ji
TLSH
T13194C505CED109BFC97A813056E7C621B273B4953B12EF6BA258F1303E51B9026976FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwebp-7.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\libwebp-7.dll
Size 437KB
SHA256 9a53563b6058f70f2725029b7dd2fe96f869c20e8090031cd303e994dfe07b50
MD5 2c5aca898ff88eb2c9028bbeefebbd1e
SHA1 7a0048674ef614bebe6cc83b1228d670372076c9
SHA512 46fe8b151e3a13ab506c4fc8a9f3f0f47b21f64f37097a4f1f573b547443ed23e7b2f489807c1623fbc41015f7da11665d88690d8cd0ddd61aa53789586c5a13
SSDEEP 6144:t2lROjMXfhVy+tEZzshykv2SxgQceWni1UC2JCsJ5zIGWexIaZOovMPVt9ACB/1O:JMtVykiiiCsJdpxIaZOokPVtW
TLSH
T131945B0EE69335DDD51BC47046AEA7B3B9647C2D4220A83B1755FE312D32F80970AF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

portmidi.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\portmidi.dll
Size 41KB
SHA256 c9f8d9043ac1570b10f104f2d00aec791f56261c84ee40773be73d0a3822e013
MD5 df538704b8cd0b40096f009fd5d1b767
SHA1 d2399fbb69d237d43624e987445694ec7e0b8615
SHA512 408de3e99bc1bfb5b10e58ae621c0f9276530913ff26256135fe44ce78016de274cbe4c3e967457eb71870aad34dfeb362058afcebfa2d9e64f05604ab1517d4
SSDEEP 384:GZBiKpE2uNn13biY3zlwbRk5pDrXdJx+CxY0IF5ETUhYF3STo0Mte4TxL1e1/s7e:MrbELdnDrtJzghYF494Zp0Vr
TLSH
T12113EA7B9773C45CC0EFF134AAC785B3A075BC211A71566E07468A123F678A09E7E8D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\pyexpat.pyd
Size 194KB
SHA256 c7c7564f7f874fb660a46384980a2cf28bc3e245ca83628a197ccf861eab5560
MD5 79561bc9f70383f8ae073802a321adfb
SHA1 5f378f47888e5092598c20c56827419d9f480fa7
SHA512 476c839f544b730c5b133e2ae08112144cac07b6dfb8332535058f5cbf54ce7ed4a72efb38e6d56007ae755694b05e81e247d0a10210c993376484a057f2217c
SSDEEP 6144:VK/lLDYZL1p13eiG7eDT9AmNfLVuOgOgOgOgOgOgNltwZSm:VglkZHLVuOgOgOgOgOgOgN0sm
TLSH
T131146C5BB1A2C0EBD8838038D6D34A0BDBB1B865039197CF52C4EB7D5F277523A69319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\python311.dll
Size 5.5MB
SHA256 0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364
MD5 387bb2c1e40bde1517f06b46313766be
SHA1 601f83ef61c7699652dec17edd5a45d6c20786c4
SHA512 521cde6eaa5d4a2e0ef6bbfdea50b00750ae022c1c7bd66b20654c035552b49c9d2fac18ef503bbd136a7a307bdeb97f759d45c25228a0bf0c37739b6e897bad
SSDEEP 49152:4kkzsT7AzjUaeLdj6UTSGKzuePQaOviRvYD4Kus0GYr3jDKPpWjrM06biCnCIS7E:wsgreBltVe1EsJ5CrSQHyMAwdp09U
TLSH
T146467C22B2609460C9BB4172DB2F865ACB71BC505F10CF0B51A4B7AA2F73B531AEF745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pythoncom311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\pywin32_system32\pythoncom311.dll
Size 665KB
SHA256 f20794876cd77d37d893512bdd8f2112bb791e134ebf2697c9034fa32eb93c11
MD5 9e901da03e11dea3125e07e91104edef
SHA1 c765e0a5bdcb766f14afb0e7d13035fb8f060abd
SHA512 d274f396de7a10d2a1b5670554c328c8f061e7753eb3bd066f82ce3eda27bf181d998bcc616fac9f7e31fe7c7e68744e27237ff2582dd969c0bd28f1141edd84
SSDEEP 6144:tlPYKt4telo5oi5dX3NBOLs6CEhgBjmuQx+X/rX+jD59pdfM1jYYF:tlPY/Io5N33NBOLZdhqmM+j7pdkf
TLSH
T1FFE43A5AB7E50690F63AA0BECD138B12D2A2B4511781A7CF01B0C76E4F677D1373AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\pywin32_system32\pywintypes311.dll
Size 132KB
SHA256 dcc14a7ed85a324e357eab7db970d8db61387c8b5d6baa23283aabd8300c4e09
MD5 7e2a89358ac141372344bf2477129638
SHA1 cde0171b594def052db33de1aacab333beed7813
SHA512 1826c9d08617b8514f3499cdf53b392a67d92f14044b12b6ee79ec08d589e291a18e73b2f10ef314f7e635c2099e09b6442c0681fce50d3dffd11fa9f52cb7e1
SSDEEP 3072:eZEUU1WHbmqnx3qcf99if9Y/rZ6Yrx//4ZgaeYH5vcSJf:eZET16bmqnRHS9Y/rPV4ZgjYHp
TLSH
T19DD31747374684CAE936937DCD671A02D3A2B0110715E3CF06A5C29B5F63BE26E3BB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\select.pyd
Size 29KB
SHA256 bae0974390945520eb99ab32486c6a964691f8f4a028ac408d98fa8fb0db7d90
MD5 e4ab524f78a4cf31099b43b35d2faec3
SHA1 a9702669ef49b3a043ca5550383826d075167291
SHA512 5fccfb3523c87ad5ab2cde4b9c104649c613388bc35b6561517ae573d3324f9191dd53c0f118b9808ba2907440cbc92aecfc77d0512ef81534e970118294cdee
SSDEEP 384:oG0ICxeeLn0XHqYK/57AvB0KJIYQGFHQIYiSy1pCQuRWAM+o/8E9VF0NyMl+:tieOGHqlGxJIYQGp5YiSyvHAMxkEN
TLSH
T15ED28F57AF646845D923C9B2ACE28E1ADE31B6924710C2CB3368C15D1F317C27BB77A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\unicodedata.pyd
Size 1.1MB
SHA256 37c68617fa02a2cadced17ef724e2d450ef12a8a37215da789a4679fde1c5c02
MD5 fd9132f966ee6d214e0076bf0492fb30
SHA1 89b95957f002bf382435d015e26962a42032cb97
SHA512 e35729abc45e5561aae1fb9e0e7c711dd7d3c1491520aa5c44fcc50c955f549f81d90897959327e930d02a5356afe08d6195adf002c87801a7a11235670639b5
SSDEEP 12288:bdYbfjwR6nbYonRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eD85U:RYbM10IDJcjEwPgPOG6Xyd4685U
TLSH
T195355BC9BB828D66D87B31B944D2212F1361C273476B133BB65513285C8B3B74EE69EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32api.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\win32\win32api.pyd
Size 135KB
SHA256 cd9ec02d502dc1548233aa2efe9fcbf47e4677b28c169553f36194a50f55ff28
MD5 284be277fc54cef6bcc01873ea46a570
SHA1 a729e0597ec03e8d970e4e937bdb20347211c16c
SHA512 ba68643b7cd40547d35eb25f499b14538eaf8f8e65aa5068005f0f92ed1e76922d0dff81306ad25cfb8306be14e9917b4e7d11bfb0ddb28ab19826e13e95f9da
SSDEEP 3072:4CadNVBKr86F1rfkQclRVlhLaN/PiQh9qTmbkMDES1np5e:4CcNvKrnFtfilRVsPicqz4ESNp
TLSH
T1A1D31883B35410D6D86AA2BCD4675F13E772B8240321A7CF0670C68A1F63BD97E39B95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\zlib1.dll
Size 106KB
SHA256 b1f58a17f3bfd55523e7bef685acf5b32d1c2a6f25abdcd442681266fd26ab08
MD5 5eac41b641e813f2a887c25e7c87a02e
SHA1 ec3f6cf88711ef8cfb3cc439cb75471a2bb9e1b5
SHA512 cad34a495f1d67c4d79ed88c5c52cf9f2d724a1748ee92518b8ece4e8f2fe1d443dfe93fb9dba8959c0e44c7973af41eb1471507ab8a5b1200a25d75287d5de5
SSDEEP 3072:wLmjK8n5MYk+NqZSB23eRenGvTBfs9Yy0J:wLl8n5MYCjFnaTBwYy0
TLSH
T16FB38E9BBA9362FDD972C17052E69BB4E930BC0109705ADB5148FBB02F12C906F597EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Data\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0d5eb1f3b9f7276b23bb75dc981626aed2ba5d8dfb62ad12bdbb51084f9a3430
MD5 71dd554547a240753bbc364375048a05
SHA1 7737e57a20b99fb82d0f5f1add1b8a99e379dc56
SHA512 f2c758fa181c71281440b63ee532182ae4359a47582289d2238d2bac0b6138c13377ad08dc1c93cabaa79fdfd236b31248926f4a47244eeb3aa7d3c6920714f8
TLSH
T188D0122336010134C02024330006710C1510E50F400582005428952F1A4C0D58D22481
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Data\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 f0f417e6e10e073579cd4aa3dbe935414e871c45f7a556c20ee628ef5c72288f
MD5 cd4079a4d58d3a2e4f34400be3b9efc1
SHA1 a1f0631c15cb4d93b1406ce8c868896239b4ab09
SHA512 bbcc8939d34bc47a4340faed17453c7eea12fee73887004e990981cb1faa07f39d332e6a3ed576369b301e77417f3bfa7691bb2bc7ea722d14d1446a3d6315ae
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Data\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 011c9e720a1c80222504a560d3713a38581db9a9dd1adcf0b4578f85a2112fa6
MD5 69bae6668e691cc78f6ca0f0d9f5ca24
SHA1 7f5f9016fe7cd86b70f7bd50349cad6d9fceb3a7
SHA512 0fcd81b0c872224500e6c3cbe62ea133f15c56bbed25dba66cd979f57a898c1944837fd752e3515e26c35123209449db11ba374ac7f66021ba89fe42db769933
TLSH
T186C09B6041511041C354B371EDED24C1267D24E535560F7725C1405CA96B66086E5D47
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Data\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 6352cee677da5b7a126602134f8a9a77f4d803c3154b29eb784677e4e3aaaf36
MD5 4de563de35e90fd37e95f3f80bea402d
SHA1 5f5b22d10e8aaa6b1aed95e57e95832d54e1c28c
SHA512 4eaf4f79e003844a3833e845134c64d0d91a453841be49d9b6fbf08cdcec5bd134a37eb427751dfc892bf512c8d3ece96cc7c1ac74a65d0381bbd02b00051799
SSDEEP 3:LstlNllkll/lxul:LsX3lEtx
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Data\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Data\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Data\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Data\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Data\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Data\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 791af69b6d4e0cefa414663dd5d70c00dddcd548c5beb9c1dde784cc75bdbb25
MD5 13285e661d572ad6dbd4580eed243318
SHA1 f80768e26530777b9d7deac59897141ba622c6c2
SHA512 396cc88a066bdad7594f1616ad77ecf34f9b72150d8cdd3cb705c78ec03065a6ee72abc923c7bca6090ee2d6edc366f4e75fbb7d6bfe24dd8dd58feb2ee7f910
TLSH
T11C5192D7C6E4A9BEC8515BF56535AD1BCD2D0D6843387D2DC4E8BF4A9BE1030D60241D
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe595d59.TMP

Path C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Data\EBWebView\Default\Network\Network Persistent State~RFe595d59.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Data\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Data\EBWebView\Default\Preferences
Size 7KB
SHA256 d1d31004126f0a461fc469ac535842dee4ce4fe42cc9186ffae5a52970db5fd0
MD5 f8868971540226c52dec7f41e77a8bcd
SHA1 a7446735b00e6955072b6b0be69700fa272fc89f
SHA512 f7816df54136081ff9f73ca6a4aff76e9cc44a3038c61fdcab0182deb5c7120ce83a14926d151aac1fe4a12bf2ee612c6e4dac188dfaa7cb2793d6212f9f62f1
SSDEEP 192:stB0byfBZ8paD5S/S+WiLGpxIqYt8IprIFcBMFQCMC:stibyMwS/VAIqM8Kr3C
TLSH
T181E1C9435E3469BB4CCBF559B925FF12E3F6106266C40E94ABFDC61C04E66DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Data\EBWebView\Default\Preferences
Size 7KB
SHA256 4da061e492803b7beb4823877439fda8017ce952b49305a1d7bda94c42f2d1dc
MD5 2b51f2efc19ea1baa99aa5a9ba4a99d4
SHA1 ca3d3fe4335e18d865911d1d71b7e8036799fa8a
SHA512 458111251ff9675ce3bc270dcd4a3237476a00a22bf4daed9c98b13702652e39cac8903e9699820918620643643e58417987071b7990250d026082128011a858
SSDEEP 192:stB0VyfBZ8paD5S/S+WiLV9eYt8IprIFcBMmpCMC:stiVyMwS/VXeM8Kr5C
TLSH
T10BE1C7426E7869BB4CCBE56DB925FF12E3F6106267D00E94ABFD861C04E67DD2207807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58d9f0.TMP

Path C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Data\EBWebView\Default\Preferences~RFe58d9f0.TMP
Size 6KB
SHA256 c5dffd5499818404f15d540e7c593324b1164cff7b45a6909acb9065ef62c2f9
MD5 a5c302901a08ce76d8f42646a5a1ad26
SHA1 59311ec27b44746f16647834dc2d8fe3e7d6e6e6
SHA512 ef5316569c99be1473555c840b408d523d7d35f56942ab980b4e7a9882e169260f2f710f59860d4fe15084ac9b3e628a39d118686eb1292d8c5e2f7ab259e2c4
SSDEEP 192:stB0blfBZ8paD5S/S+WiL3MwYt8IprIFcBM8CM8:stiblMwS/VowM8Krn8
TLSH
T15FE1D8425E78A9BB4CCBE56DB935FB13D3F6106266D40EA8ABFD851C04D66DC220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Data\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Data\EBWebView\Default\WebStorage\1\CacheStorage\index.txt
Size 138B
SHA256 24227a73862a0dfc109c2c6529571dc352d17ab6fd18456c24f1930b6e7221e8
MD5 18991c11fa068e2577c9e4d3cfb5a8cc
SHA1 af877fa755d323c1490c76cdd8a3e2b6aac7c9eb
SHA512 3af9296a37d100d24e58ff2a1cb2e954bb48d87cf53cfed4193b565dcb7732367d414d75042498a502f65568ae6a8be791db68b16ee16d91d4f28b970f23443b
TLSH
T17BC02B973802440E0B70B8E8213EB25CD00B840CCCD6D9F5400D408301A47230032B68
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe589fd5.TMP

Path C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Data\EBWebView\Default\WebStorage\1\CacheStorage\index.txt~RFe589fd5.TMP
Size 145B
SHA256 a43b8d216bd80a2c30248a4dcac8f56356f577fd2cf81db4b9e567b304ce8d12
MD5 315e558ef7075760671c66cd756eb3bf
SHA1 5c4df606dfaebfbc3cddae8d8a60ff0af0da5aa8
SHA512 278f297bc2b5d02f36d1a956ba16cd33783623b1b1be550b318e34b9f234a63ff45b7d89ba1460d320e933f50115caa6dc6978267c55886f0e82d6616d7adfe2
TLSH
T19AC08C972802040A0B60A4E9612AB16C900B8C4CCCD9E8E49009608711B42234020A68
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Data\EBWebView\Local State
Size 17KB
SHA256 1c4c401b19d56c7b063db88f3cfe2502882c331ef8541dc30f79fa70b1fd24d0
MD5 d683835178c79bfc87c303670bcea72b
SHA1 fefa0a6fc3671f1bbffbba13e64f2632ca805a1b
SHA512 22f98ac8054410194e0f5b69ee1d975c909bc2666a2680bf182e8c7716152c0f2757ffb8c173e0b6995bcbb987856c3b1329988738bdd92121bb4b7f6da4b30f
SSDEEP 384:zQY+aQikB+z/xvxjg/qhE5NgjuNRdfIzB79zb:W/UxvxjgC+nRgB7Fb
TLSH
T1EB828E3AE468AE2359F7AA8576096B4BDBB444A291C52EE84DDE6F0D06C73DC1307C06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Data\EBWebView\Local State
Size 1KB
SHA256 45486210be4eb28d5d7d54c36828d5ea902f958968e1a6c9fc2774bffd1317cb
MD5 1248308ba0797c3923e091fd241b57bf
SHA1 a378e55db2224badec7b559c88c54ba4182911c3
SHA512 49baf9b67cff0317c7b1c1974df7525c137a0c3ce4640c69459e6ef62f1e9052b5876842ddfca02bd8ac38805e3b6fb0f7573000317e92b1c1904de15d385f73
TLSH
T19E31B5B1E8843F736D976A9DB2123F072F2110B6C1424F9C61DE5B2C02D7A9C262AC23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Data\EBWebView\Local State
Size 2KB
SHA256 9a9e7b7da299b07386f6b992899d881a4287489ab05a637537c484576a15fedb
MD5 c1b058b75172be49e5132707aa741d00
SHA1 92c468c0414650af46d65bb56ecddfbbac8f1a3d
SHA512 5336338dbac5a96d55ab3cdb06cf7b586c1e64c751ddfbb4e43ac9c96293a242b76811d1fa0abeeae7b1a9d4a44f035582133409c2e887afaada4b9fdd941a42
TLSH
T19B51D872AC04BA774AE74E98B9453F139F3551A2C6922FA495DE1B1C01DBA5C2302C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Data\EBWebView\Local State
Size 3KB
SHA256 deb9e9031be3d1abfc55aac123f0ed523e3e682bd9814589a21826f9947c2754
MD5 159127a56dacb2282b336b609c5ae742
SHA1 ecf7b96ead793b319145ab1b5ae6d01aa18ba033
SHA512 bd6bab24aa3a01248e83579e53c84c7e69d40136221a3e24bd5a12ce8d015207ccef191d94c6d9bde780c05a15658c4c19c7de22bf2354918a770937729f682a
TLSH
T12B719326A864A9374EE39E48B9813F03BBA15163D1C13FA8C5ED1F1C02DB7982302C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Data\EBWebView\Local State
Size 16KB
SHA256 bd38eabddd1faa3eef3555e4d79a93fc9147a977968c231d024d261745330ebc
MD5 c09569a66092b719492f29fcefa3f3f7
SHA1 767c62ca859ed323f05c8ce5ce8c674bc8638b41
SHA512 388fbd2b1896bae880454c5d3deb42fc9e58968325e443f4b2b9c56c36df64a206656e96c8e487fd5a48103e6eed81260e3103ef9b2c76a1228df57648b48a34
SSDEEP 384:zQc+aQikB+z/xvxjg/qhEwNbyuNRdfp79zb:s/UxvxjgC+cRn7Fb
TLSH
T173729E2B65687D3359F7ED447A581B4BDBB594B2D0C26EB849EE6F0D06CB3D80302D06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe584496.TMP

Path C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Data\EBWebView\Local State~RFe584496.TMP
Size 1KB
SHA256 4fced3b8608b867d4e22dcceb7ab32c5038bf5e7e03b54efdb2d7d534819d9fc
MD5 ddadd270fab8412ff32047fedaa56ecd
SHA1 d09112e595584add8c3bdc0d61c1831d2b31f4ae
SHA512 f4193cbb02521658b4c6c7d3d64e92c5ce31d2d715bb0373c5b13e1c66f0184d5ff2b309b87ef0f2cfd457654914fcd3c242bab80f9e2d048146119951cb320e
TLSH
T13D215072D8843A777D970968F2217F072F6151A281404E5C91CE062C02C7AA81626C23
MD5 SHA1 SHA512 TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Roaming\Swollstrap\WebView2Loader.dll
Size 162KB
SHA256 271b57e3ec03c436a15d80cafeb9fd1618a43793233d8b05c9446f8de0a51be4
MD5 c732e408181c4d36a170323e8481c6ae
SHA1 ded12bec0428cc3d5cacccb6a7828495326fdb3b
SHA512 1608cfb5d61014853307aabccdeee5023ed27582257394ca224bf985a30a7ca06d6a209610b5af48693bebaad202c9ca21ff7538ce66f61e3f240caac98e858b
SSDEEP 3072:ZPQJpSFTlTRTzWGbThTNTFSkD0bHYVNqGM2h9P58LZZ5Aalq/TbmEtJfy2a3NJn:tMMTlTRTzWiThTNTFSzjiBM2h9P5oZ9D
TLSH
T150F35B5772E4407BE16A8274C9A34A11E777B4510B60ABEF03A4477A1F237D4EE3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

accounts.json

Path C:\Users\Admin\AppData\Roaming\Swollstrap\accounts.json
Size 609B
SHA256 bc1500f0d3759cea10d9459a309b07cf4f9cee062b84961e6217762e0b4b1a15
MD5 a0693236276d76ab07e72a1eac8b69ed
SHA1 54ca8e4a25f9d3130e768680a7b421a393648d99
SHA512 1b735f1f97346bc0f313b231b22892724f7b606a31eae2eca217843fa4812dc05d9689d407e13db626cc15eca48750a8b5e3cd3bd8797e4bc63216214d147135
TLSH
T145F04663C1540E7F9CF5029999240246F749535F02420E1BF6F58E0D2FB246564CABA2
MD5 SHA1 SHA512 TLSH

Submit Download

icon.ico

Path C:\Users\Admin\AppData\Roaming\Swollstrap\icon.ico
Size 134KB
SHA256 3ea906b588c8747ee2014003c9fb6c5767ad1dc0d90be812602e1e75e41e0c7f
MD5 baa092ebecef010d632337061b103130
SHA1 4e6929ed9a7d2a74d53eb5bad364f8a82783d3ee
SHA512 1537e433b737cafa1fb0d45d645cb7b51828e3877a87a1f20b00b94da698aed15bd1b1712e08f7b0a05717ef82b3c2b20f8f0e2536bf6bc8306713ff3d9cf1b8
SSDEEP 3072:wfO9fIiu1cCQVpBNWfIyLHhVFaHMVmyhqusP0vJIjgEJfVXvN6Gexk:wmx56oefbLH3FasVm9oJyl+k
TLSH
T114D3128E26B43F897A14AB7DF7BEC4A59B9E324314649489271432FA042D9909F0737D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui.html

Path C:\Users\Admin\AppData\Roaming\Swollstrap\ui.html
Size 552KB
SHA256 87fbabbd3444431dbe767231e5a35d52c47f2dabd9352a5f5f6f9e3c38628520
MD5 8f47052232a2c96039ccc0a66148c731
SHA1 1df0ca36522f2056fc4bfdddefac2de97dfda27f
SHA512 d264cce41d7d7fdb743b836fede098f9e6610787d623765f30500e14f16b26ac15062a93c464243c615c071d3859af2afcde2428e306593b1089a28f7d3831bf
SSDEEP 6144:FjGDFq4WrAS+w79Vp/ldwCc+96U8egh/p5BPUWIfgc+ugaucrVh3FTs:FjG5WrAS+WVp96CB4igh/pUWIfHZha
TLSH
T11AC45AB2B2B4153628B7C1E7775A539F7A65C003EA079108BAEC46980FC3CD6D97F285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/768-1826-0x0000026319100000-0x0000026319101000-memory.dmp

Download

memory/768-1823-0x0000026319100000-0x0000026319101000-memory.dmp

Download

memory/768-1816-0x0000026319100000-0x0000026319101000-memory.dmp

Download

memory/768-1817-0x0000026319100000-0x0000026319101000-memory.dmp

Download

memory/768-1818-0x0000026319100000-0x0000026319101000-memory.dmp

Download

memory/768-1828-0x0000026319100000-0x0000026319101000-memory.dmp

Download

memory/768-1827-0x0000026319100000-0x0000026319101000-memory.dmp

Download

memory/768-1822-0x0000026319100000-0x0000026319101000-memory.dmp

Download

memory/768-1825-0x0000026319100000-0x0000026319101000-memory.dmp

Download

memory/768-1824-0x0000026319100000-0x0000026319101000-memory.dmp

Download

memory/4164-917-0x00007FFED0290000-0x00007FFED0291000-memory.dmp

Download

memory/4852-792-0x00007FFED0290000-0x00007FFED0291000-memory.dmp

Download

memory/5436-841-0x00007FFED0290000-0x00007FFED0291000-memory.dmp

Download

memory/5436-842-0x00007FFECFB10000-0x00007FFECFB11000-memory.dmp

Download

memory/5844-1094-0x00000293907B0000-0x00000293907C6000-memory.dmp

Download

memory/5844-1408-0x00000293907B0000-0x00000293907C6000-memory.dmp

Download