f2704143b5250c835bee348a32d9d1bb5a0b15135f71c26ce4cdbbcdbdc6c9fd

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
299s
max time network
315s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Viper.exe
Size 288.5MB
Sample260809-c8drgagm7v
SHA256 f2704143b5250c835bee348a32d9d1bb5a0b15135f71c26ce4cdbbcdbdc6c9fd
MD5 caf394a3679843df2917011d41520004
SHA1 8db253124440bb7b7e14dee5d8b5cc5347a46717
SHA512 c66b3e4c0145be9ab7bcd4dff19f2146cde44ef3ed03a34326e8d6018be5fd33dbc3aebd32e12da40cd89525b246083f480adae285fca432f034518e34e85d14
SSDEEP 3145728:9lmY4JTsT05OBuQjLJjeU8XSOePY5wvbouuqw5r+PXz4ZUM9X6KPuMGQYBn:afhsT6QrLZeUrIfp+PXw9X6KPuv
TLSH
T16CE8CF056FD85A55F23AC27892B3C261E6B5BC525311D2CF1084FA493F73BC1AA3E276
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	Viper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	Viper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	Viper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	Viper.exe

Executes dropped EXE 3 IoCs

pid	Process
1392	Viper.exe
1060	Viper.exe
760	Viper.exe

Loads dropped DLL 64 IoCs

pid	Process
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe
1856	Viper.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
57	raw.githubusercontent.com
79	raw.githubusercontent.com
91	raw.githubusercontent.com
176	raw.githubusercontent.com
56	raw.githubusercontent.com

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
1856	Viper.exe
1392	Viper.exe
1060	Viper.exe
760	Viper.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3816_1449094237\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3816_973052830\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3816_1277482839\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3816_1277482839\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3816_1277482839\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3816_1277482839\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3816_1821336785\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3816_1821336785\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3816_1180314876\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3816_1449094237\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3816_973052830\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3816_1821336785\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3816_1821336785\_metadata\verified_contents.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4084	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307175893418910"	msedge.exe

Modifies registry class 52 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Viper\\Viper.exe\" -player \"%1\""	Viper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox-player\URL Protocol	Viper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox-player\ = "URL:Roblox Protocol"	Viper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox-player\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Viper\\Viper.exe"	Viper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox-player\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Viper\\Viper.exe\" -player \"%1\""	Viper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox\URL Protocol	Viper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox-player\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Viper\\Viper.exe\" -player \"%1\""	Viper.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox-player\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Viper\\Viper.exe"	Viper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox\URL Protocol	Viper.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox	Viper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Viper\\Viper.exe\" -player \"%1\""	Viper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox-player\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Viper\\Viper.exe\" -player \"%1\""	Viper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox-player	Viper.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox-player\shell	Viper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox-player\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Viper\\Viper.exe"	Viper.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox-player\shell\open	Viper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Viper\\Viper.exe\" -player \"%1\""	Viper.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{5486F5BB-809E-4E95-A08D-7A1A4E83D761}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox\ = "URL:Roblox Protocol"	Viper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox-player\ = "URL:Roblox Protocol"	Viper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox-player\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Viper\\Viper.exe"	Viper.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox\shell	Viper.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox\shell\open	Viper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox\ = "URL:Roblox Protocol"	Viper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox\URL Protocol	Viper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox-player\ = "URL:Roblox Protocol"	Viper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox\URL Protocol	Viper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox-player\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Viper\\Viper.exe\" -player \"%1\""	Viper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Viper\\Viper.exe"	Viper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Viper\\Viper.exe"	Viper.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox-player\DefaultIcon	Viper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox-player\URL Protocol	Viper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox\ = "URL:Roblox Protocol"	Viper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Viper\\Viper.exe"	Viper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox-player\ = "URL:Roblox Protocol"	Viper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox\ = "URL:Roblox Protocol"	Viper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox-player\URL Protocol	Viper.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox\DefaultIcon	Viper.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox\shell\open\command	Viper.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox-player\shell\open\command	Viper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Viper\\Viper.exe\" -player \"%1\""	Viper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox-player\URL Protocol	Viper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\roblox\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Viper\\Viper.exe"	Viper.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1856	Viper.exe
1392	Viper.exe
1060	Viper.exe
760	Viper.exe
2200	msedge.exe
2200	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1856	Viper.exe
Token: SeDebugPrivilege	1392	Viper.exe
Token: SeDebugPrivilege	1060	Viper.exe
Token: SeDebugPrivilege	760	Viper.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
1856	Viper.exe
1392	Viper.exe
1060	Viper.exe
3816	msedge.exe
3816	msedge.exe
760	Viper.exe
3816	msedge.exe
3816	msedge.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3816	msedge.exe
3816	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1392	Viper.exe
1392	Viper.exe
1060	Viper.exe
1060	Viper.exe
760	Viper.exe
760	Viper.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 3816	760	Viper.exe	121
PID 3816 wrote to memory of 5084	3816	msedge.exe	122
PID 3816 wrote to memory of 4084	3816	msedge.exe	123
PID 3816 wrote to memory of 3968	3816	msedge.exe	124
PID 3816 wrote to memory of 3968	3816	msedge.exe	124
PID 3816 wrote to memory of 3968	3816	msedge.exe	124
PID 3816 wrote to memory of 2304	3816	msedge.exe	125
PID 3816 wrote to memory of 2304	3816	msedge.exe	125
PID 3816 wrote to memory of 1704	3816	msedge.exe	127
PID 3816 wrote to memory of 1704	3816	msedge.exe	127
PID 3816 wrote to memory of 1704	3816	msedge.exe	127
PID 3816 wrote to memory of 1060	3816	msedge.exe	128
PID 3816 wrote to memory of 1060	3816	msedge.exe	128
PID 3816 wrote to memory of 1060	3816	msedge.exe	128
PID 3816 wrote to memory of 3236	3816	msedge.exe	129
PID 3816 wrote to memory of 668	3816	msedge.exe	130
PID 3816 wrote to memory of 3236	3816	msedge.exe	129
PID 3816 wrote to memory of 3236	3816	msedge.exe	129
PID 3816 wrote to memory of 668	3816	msedge.exe	130
PID 3816 wrote to memory of 668	3816	msedge.exe	130
PID 3816 wrote to memory of 5176	3816	msedge.exe	133
PID 3816 wrote to memory of 5176	3816	msedge.exe	133
PID 3816 wrote to memory of 5256	3816	msedge.exe	134
PID 3816 wrote to memory of 5256	3816	msedge.exe	134
PID 3816 wrote to memory of 5596	3816	msedge.exe	135
PID 3816 wrote to memory of 5604	3816	msedge.exe	136
PID 3816 wrote to memory of 5596	3816	msedge.exe	135
PID 3816 wrote to memory of 5604	3816	msedge.exe	136
PID 3816 wrote to memory of 5780	3816	msedge.exe	139
PID 3816 wrote to memory of 6108	3816	msedge.exe	140
PID 3816 wrote to memory of 6108	3816	msedge.exe	140
PID 3816 wrote to memory of 4820	3816	msedge.exe	141
PID 3816 wrote to memory of 4820	3816	msedge.exe	141
PID 3816 wrote to memory of 5284	3816	msedge.exe	142
PID 3816 wrote to memory of 5284	3816	msedge.exe	142
PID 3816 wrote to memory of 5440	3816	msedge.exe	143
PID 3816 wrote to memory of 5440	3816	msedge.exe	143
PID 3816 wrote to memory of 6120	3816	msedge.exe	144
PID 3816 wrote to memory of 6120	3816	msedge.exe	144
PID 3816 wrote to memory of 6104	3816	msedge.exe	146
PID 3816 wrote to memory of 6104	3816	msedge.exe	146
PID 3816 wrote to memory of 5744	3816	msedge.exe	147
PID 3816 wrote to memory of 5584	3816	msedge.exe	148
PID 3816 wrote to memory of 5640	3816	msedge.exe	149
PID 3816 wrote to memory of 5184	3816	msedge.exe	150
PID 3816 wrote to memory of 5184	3816	msedge.exe	150
PID 3816 wrote to memory of 1996	3816	msedge.exe	153
PID 3816 wrote to memory of 1996	3816	msedge.exe	153
PID 3816 wrote to memory of 1284	3816	msedge.exe	154
PID 3816 wrote to memory of 1284	3816	msedge.exe	154
PID 3816 wrote to memory of 2652	3816	msedge.exe	155
PID 3816 wrote to memory of 2652	3816	msedge.exe	155
PID 3816 wrote to memory of 5892	3816	msedge.exe	156
PID 3816 wrote to memory of 5892	3816	msedge.exe	156
PID 3816 wrote to memory of 2200	3816	msedge.exe	157
PID 3816 wrote to memory of 5960	3816	msedge.exe	158
PID 3816 wrote to memory of 5960	3816	msedge.exe	158
PID 3816 wrote to memory of 5072	3816	msedge.exe	159
PID 3816 wrote to memory of 5072	3816	msedge.exe	159
PID 3816 wrote to memory of 452	3816	msedge.exe	160
PID 3816 wrote to memory of 452	3816	msedge.exe	160
PID 3816 wrote to memory of 3348	3816	msedge.exe	161
PID 3816 wrote to memory of 3348	3816	msedge.exe	161
PID 3816 wrote to memory of 5800	3816	msedge.exe	162

C:\Users\Admin\AppData\Local\Temp\Viper.exe
"C:\Users\Admin\AppData\Local\Temp\Viper.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1856

C:\Users\Admin\AppData\Local\Viper\Viper.exe
"C:\Users\Admin\AppData\Local\Viper\Viper.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1392

C:\Users\Admin\AppData\Local\Viper\Viper.exe
"C:\Users\Admin\AppData\Local\Viper\Viper.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1060

C:\Users\Admin\AppData\Local\Viper\Viper.exe
"C:\Users\Admin\AppData\Local\Viper\Viper.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://itssanty.pages.dev/
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffe6685c188,0x7ffe6685c194,0x7ffe6685c1a0
    3⤵
    PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,14637428038159138939,9510163954316871860,524288 --field-trial-handle=2340,i,14408140765958729526,10906775089059051511,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1880,i,11725331439556725066,5381785181650581264,262144 --field-trial-handle=2340,i,14408140765958729526,10906775089059051511,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
    3⤵
    PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,10595029224798797607,13292708348593438300,524288 --field-trial-handle=2340,i,14408140765958729526,10906775089059051511,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
    3⤵
    PID:2304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,4896286131416549667,12087562968844116735,2097152 --field-trial-handle=2340,i,14408140765958729526,10906775089059051511,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:1704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,16862890422048786314,7663176722637656132,2097152 --field-trial-handle=2340,i,14408140765958729526,10906775089059051511,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:1060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,858438603236789808,4257887921080806524,2097152 --field-trial-handle=2340,i,14408140765958729526,10906775089059051511,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
    3⤵
    PID:3236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,7430075876852805222,14854328372948791666,2097152 --field-trial-handle=2340,i,14408140765958729526,10906775089059051511,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:2
    3⤵
    PID:668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,365105566511656682,22484482020525655,524288 --field-trial-handle=2340,i,14408140765958729526,10906775089059051511,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:8
    3⤵
    PID:5176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,9379860006549265838,1201467915453057641,524288 --field-trial-handle=2340,i,14408140765958729526,10906775089059051511,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
    3⤵
    PID:5256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,11267139398006592784,18315108730122521473,524288 --field-trial-handle=2340,i,14408140765958729526,10906775089059051511,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:8
    3⤵
    PID:5596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,13390615823855688728,14566693521866225394,524288 --field-trial-handle=2340,i,14408140765958729526,10906775089059051511,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
    3⤵
    PID:5604
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,13556765886808162032,13069067931002565317,524288 --field-trial-handle=2340,i,14408140765958729526,10906775089059051511,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
    3⤵
    PID:5732
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,13556765886808162032,13069067931002565317,524288 --field-trial-handle=2340,i,14408140765958729526,10906775089059051511,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
    3⤵
    PID:5780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,12650815834746191794,16335952530603164212,524288 --field-trial-handle=2340,i,14408140765958729526,10906775089059051511,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
    3⤵
    PID:6108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,18041910924267675289,127511941719103405,524288 --field-trial-handle=2340,i,14408140765958729526,10906775089059051511,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
    3⤵
    PID:4820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,6214127667589028306,9066127502798208661,524288 --field-trial-handle=2340,i,14408140765958729526,10906775089059051511,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
    3⤵
    PID:5284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,7241439971336540434,13823787976704488163,524288 --field-trial-handle=2340,i,14408140765958729526,10906775089059051511,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:8
    3⤵
    PID:5440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,11736348342091963431,268038002173392533,524288 --field-trial-handle=2340,i,14408140765958729526,10906775089059051511,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:8
    3⤵
    PID:6120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,4283013551719045666,2504334546399834152,524288 --field-trial-handle=2340,i,14408140765958729526,10906775089059051511,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:8
    3⤵
    PID:6104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,12655119483100732658,3501251443612504408,524288 --field-trial-handle=2340,i,14408140765958729526,10906775089059051511,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:8
    3⤵
    PID:5744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,13251949705943134022,5774673209207259249,524288 --field-trial-handle=2340,i,14408140765958729526,10906775089059051511,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:8
    3⤵
    PID:5584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,10335673045834151826,2127418616581207466,524288 --field-trial-handle=2340,i,14408140765958729526,10906775089059051511,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:8
    3⤵
    PID:5640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,15832632524990980020,12501746731949383221,524288 --field-trial-handle=2340,i,14408140765958729526,10906775089059051511,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
    3⤵
    PID:5184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,13400794269027763779,9351790407473572307,524288 --field-trial-handle=2340,i,14408140765958729526,10906775089059051511,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
    3⤵
    PID:1996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,9754511112676339752,7912624793706523011,524288 --field-trial-handle=2340,i,14408140765958729526,10906775089059051511,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
    3⤵
    PID:1284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=868,i,15759322653074249498,8931360511545936491,524288 --field-trial-handle=2340,i,14408140765958729526,10906775089059051511,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
    3⤵
    PID:2652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,6088600410255988395,5180025319824558611,524288 --field-trial-handle=2340,i,14408140765958729526,10906775089059051511,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
    3⤵
    PID:5892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6228,i,12463717431333429525,9177965426488204286,262144 --field-trial-handle=2340,i,14408140765958729526,10906775089059051511,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,9277849066570366707,1416468044528061206,524288 --field-trial-handle=2340,i,14408140765958729526,10906775089059051511,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
    3⤵
    PID:5960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,7742744045387397904,12197230331046532130,524288 --field-trial-handle=2340,i,14408140765958729526,10906775089059051511,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
    3⤵
    PID:5072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,5319327655337986276,11272533646425111753,524288 --field-trial-handle=2340,i,14408140765958729526,10906775089059051511,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:8
    3⤵
    PID:452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,2305560851121411918,1020968146712905260,524288 --field-trial-handle=2340,i,14408140765958729526,10906775089059051511,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:8
    3⤵
    PID:3348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3444,i,18223104076419991249,2262859566453737587,524288 --field-trial-handle=2340,i,14408140765958729526,10906775089059051511,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
    3⤵
    PID:5800

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3816_1180314876\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3816_1277482839\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3816_1449094237\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3816_1821336785\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
TLSH
T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3816_973052830\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 7a2d4f71aacfa0c0a422bc2be0aee9c16db6e59164cfb4ed910856a6539ab345
MD5 36c0716e00e27d47c057ea9d6d5bc304
SHA1 96c250fd4592cd581124de92d3b2c084213bac1d
SHA512 6c4d07c333d6d9e7c2b84ff43c2533137fced4939651aef15ea2ed169c955dedf5803c7cc0cb63fd8de30280e3f4b750d39389a4a74743e0edaeb7b160ecd02f
TLSH
T19EE07DD454CCC3AFA6C9784F51E8530CE2C0370ADBCAA95B1B00C9C6F002980B3C2EB0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 4d74e5cba3fc10d42d88303ac03f5f53c71d4bd81e58d394b79db1934ea85ba6
MD5 988e878fea9eb2099e14d5e4dd414ed3
SHA1 b11fcf267ffbd25a16494a17919391738266ea82
SHA512 add5efcc88423b047de3d757d7b7c89aaba9d4bddc6af0af4bf9194d288bbf6dbf829f1acaebd4c6a545a4cb851a3669a571d6f61d1c5ba1cb76c75cce2f060e
TLSH
T150715DFE18E30EA5EB22F2705AC10242B13081EBF613ED274D80D7FB6D12731495A198
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a4e8f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a4e8f.TMP
Size 3KB
SHA256 3fe6b3269aa010f4d740444db03b8e0e137e71db5b4a3c191a24a365922dc82d
MD5 61b9335fa00846c6170ad69e60e7d9b7
SHA1 28062295446f7cdb3732dec26b3d724fa4e14e7b
SHA512 604474666638d996031f969425e3fb37a2a4d74dd3d29633c7ff0e0f57c63e5affbe44ff7f4b24fea1ab750662d6361feb55868228be593edff17442e7c1846b
TLSH
T1D2716DFE18E30FA5EB22F2705AC10242B13081EBF613ED238D90C7FB6D12731899A158
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 966d65452385d208b85b0d7792ac663376be4d06d53c8b8fd5dcdf57fe87c090
MD5 d3ed7e2445754e217e815d07bc2e204a
SHA1 01eecb6f1136ef99401897993827286f1c5d13c2
SHA512 118ddfcc3975aee3226ea2712b7a6b44b578966d0f55ecce8d2e27c8f26ba0c329ebbc9e0c757e1b36e9689704b7533a1d765f339fc1b65e7915acff4531c0f9
TLSH
T1FC61BCF7C2E8866EC90156F4AA186E2BDE2E0918431C3D4FC9E8AF4BD7E2470D10574E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e4589c616995ab3a83f452fafbb9033cfdd08b8851e40a7bfe6875a836f08822
MD5 79885402310d2ce3bca1b4bcc5b6db09
SHA1 9aec727afee9a09580048605624c4569fa890055
SHA512 a8f5f7ac98def5ef8895f3fca962e07f73e0d4afa5716e48cd461a172d0f55e62c9c2c9604ba9ff0359602b3a1dfb11161293290fe5ff2718918f84aa5f6482d
SSDEEP 192:sxZ0RSmk/fosnOurKK1IdpPLHW6+WNEhwf/YIsKkr0Ig4J:sxZ0hk/fosOuozHbX/g4c
TLSH
T19C32D8126E24A57B8CCAE21DBA19BF53D7F91032A1D11E58A6FCD61C05E76DD230B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 0c8d4dbbfb0765826dfc92e136121543a78e97800854674fb5caec04ea4ab0f4
MD5 129baa27c0be1e606cf90f18f0ed8e03
SHA1 c39d54db5fced758f9d3eed31181212e1e6e5f91
SHA512 53d28c2a36196f81467cb2612ed905b934438977de19332a06280193bd46d597b16a5841efe830add617b7aa343df5881b852c9d4a55ee2b55747ba8e71a5f90
SSDEEP 192:sxZ0RSmk/fosSOurKK1IdpPLHW6+WNEhwf/YIsKkr0Ig5RJ:sxZ0hk/fosbuozHbX/g4d
TLSH
T13132D8126E24A57B8CCAD21DBA19BF53D7F91032A1D11E58A6FC961C05E77DD230B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e72375b2209b063e1ec91f703eacfb08bbdbc76062c7d0bea0f91edc728b6814
MD5 b0e6fed013ed4c86e5ff6f9133ab37df
SHA1 a0445735d15e378e7b448cad17fed1c1d4c68d97
SHA512 3c5a93f52468e5d315dfcc705828bec1b8c5607a81bd9d7a19345b728962e99b8ac8af3db44f6ae8bc8654be6a80c69f4097b5635082b4350aace66db12abbab
SSDEEP 192:sxZ0RSmk/fosSONrKK1IdpPLHW6+WNEhwf/YI9+kr0Ig5fJ:sxZ0hk/fosbNozHbX/V4f
TLSH
T15A32C7126A2465778CCAE21DBA19BF53E7F95032A1911E58A6FCDA1C05E76CD230B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 07d345dfca87f000f0f70fc5f20126b5d05bd2033a71438536f445b3b59944a2
MD5 f29ce2a192494be201b5ea2d33b0e6c8
SHA1 543010f1bceaf235d236f0e3b157be33e2887343
SHA512 8e250ac9d80a36c1018671f538b46b0805f9a2aa9873a3302617722a85c2d665941822e06335b7f14d27bd0095b8802d1fe0e62a704df2803e9274e3083d8a49
SSDEEP 192:sxZ0RSjk/fosSONrKK1IdpPLHW6+WNEhwf/YI9tkr0Ig5fJ:sxZ0Uk/fosbNozHbX/A4f
TLSH
T1D832D8116E24657B8CCAE21DBA15BF53E7F91032A1911E58A7FCDA1C05E76DD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 371f18813cb35581a6aabb4a540ae5226ec678810f7ad6c4a331407526b9ab91
MD5 63c0d883fafe4bf8fbddefc90287c566
SHA1 16840b954b2e3ec814fc02a1c25584548e40fbc6
SHA512 9e5b98b7be0682dccd03f5c78180d84b6f3e1c92b2ede70420303167cec86bf805472c939647603a39d3f18d6593e575162c1c8f65cec1f14b4f1ed2bda2beef
SSDEEP 768:L+yqb557pLuLfllWvJDjT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVV6h4Ll6AR7kroz:L+yqb5PEfllWvJDjTu1ja06h4LAs7vS2
TLSH
T19DE2FA3B790CCA7E4F800A9DDD1A7FDB7EA802CB9698C94047FA941C02C77EA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a823a2e1-d637-42c2-a360-d14bc54f7430.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a823a2e1-d637-42c2-a360-d14bc54f7430.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dff9a47886ebf9e487734db1be35eb71e0c202a0532ff899455ad13458945dcb
MD5 6567b19197413d28beedb6839f2d13ec
SHA1 3dc03cf9528ca0de24ab6e804cd12de982b8fac7
SHA512 25b386f318b3cc709fb8bc3e1cc1535a0d7d0db9909606cb75dfbdf98e1e011804dd517e2ba17d601d1236d93e8f7a9ea13c1f3f97f285e68b833cffc11854a6
SSDEEP 192:LONx6JkR5QmiUy1bi+RN3OmNOmSC9QjM1VccqDaRU6:LONx6UXii+RN3OKZ9QPuU6
TLSH
T18012183068389C675EE6A405F58736A39FA82077ED866F44D2D51F0C05D7B8C274E826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 5b6b6aff3e3e09cb03bd33b19b81a664c24ec917a2e4035fffdfcf6e6ec46d48
MD5 902e7ec1b2494d765dadfb4d9fdea1e6
SHA1 2c175f771cc121d2272026927b39e4a94af31ca3
SHA512 d225713fedc0b34e3ea3fc09949765218e1bdcb9aa185e62080b7db304bfa1d2d943365a8cb71e1ff65aa4629f186fa0c33f29f2be21b4948bb708c8f35793cd
SSDEEP 384:nhZcIusNIiBgDb+P2VRN3OKZ9QXuXK9Li6Uq58bhP+WFoHEBur:pu4FUH3Om9MuwLwn1Bur
TLSH
T1D5928CB12835AC334AEEE006F94736678FF860B7A9845E84D5E95F0D01DA69C270EC36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 5bda56cc71e02ff5fbf1d1c51729154948b95d6f3c7669ae6449bfb5906849ab
MD5 2e2b5133f737b51b736abbc8b1874fb3
SHA1 37946fcd9e79b5831c6512a5c50e2ee1dcccb683
SHA512 65ea887e4948c64e5098cbe5faca62747d37631d136ffa0ae4888a6ba9dcdfedc2b7cb6e6031203409485abd57887fd1b07f666ae26098d1a674075da07bc3a6
SSDEEP 384:n+ZcIWsNI+BgDbzP2VRN3OKZ9QXuXK9Li6Uq58bhP+WFoHEBur:8WMYUH3Om9MuwLwn1Bur
TLSH
T18C928DB128396C334AEEE006F94736678FF86077A9845E84D5D95F0D01DA6AC270E836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 3d46bc5f549b189ccd69e1d4760bc06c2b901dba36e94f195e178d050c73d72f
MD5 70fb13db59edd52b1024f993d053a120
SHA1 9002672602c1bdbfdd730d1d794852e75f8b1682
SHA512 39ee07796e4c231a434938840909bf11ce84f97413deae76022263d5e84cf7444e07b6c96191c8cd5187faca41cd0dffbbba5b0f88cf10098039adf245259b9c
SSDEEP 384:njiFtZcIA0sN48TUNTUlIliBgDb+52ZDfQZRN3OKZ9QkuXK9Li6Uq58bhP+WFoHF:OF13dwgyr1ZH3Om95uwLwn1Bur
TLSH
T14BE2C4F198E78937D9AE5383A73E6E568EBCD063B5885984F7851D0CCC861BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 6bdbfe32b13c03cab15d66845b45bede29cb21b9f67afe6bdff2b6366ac6c25c
MD5 49780e15a75b7c2c065ca02b9a04ecbf
SHA1 077d7d28748ffee32eb28c387055e954e9e3a0ca
SHA512 1d0370601712a3f7b3a41a65f3a7947dc929ad44ea4acc1e3928a5918ce8720310908044e02dac6774ad7632bfec1276fc3301f814779c6da13f694af554f9a0
SSDEEP 384:nyZcIPsNIrBgDb2P2VRN3OKZ9QXuXK9Li6Uq58bhP+WFoHEBur:APpBUH3Om9MuwLwn1Bur
TLSH
T1D0928DB12835AC734AEEE006F94736638FF8607799845E84D5DA5F0C01DA6AC170EC36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 718ef27c46f4c9577e3739929a261b9eb05d32b14f1354f7e25a663145c3e8da
MD5 f284fa42b7d7cfee8e6cbb82848a5aa9
SHA1 dd06de8383bb3c1a64ffba6bf1437263974f75bb
SHA512 9f78ca84514cb212e70ec359b6330f52473d95af9162fd98561ea2c05644d873e1e20301fc32f11d611761a569d42336f8884749c07110baae8ce2216f612bd8
SSDEEP 192:tONK6JkRtQmiUytbW+RN3OmNOmFHh3bROFU6:tONK6Ur+W+RN3OKBpYU6
TLSH
T18C02E935AD386C778FF2AD09B98B27135FA8206BE9952F84DAD81B1C01D765C2346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

aecdbf28-a2a5-4557-b564-7b7076b269d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\aecdbf28-a2a5-4557-b564-7b7076b269d8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b5272f48cc06e7389c0050d7d2c1d62585205c7d72c1d07aa9e8fc06cd8e1467
MD5 577807749b89f5dc5f1d5f9e2560b610
SHA1 dfc7506b34bbf429b400d43798102a61d363e97e
SHA512 78c0ffcdf1a298e239759bda7a5f59cf39073683311842f168d9309d4398e1af57ce51a42b4eaeb4f8358c7b65e85b0d749539476f14c3d98fff24b19d848ce8
TLSH
T14A41489CB6ED1108B3B7BE5A9BF6A86E487A78772F16C49E10510D4F0A32A40CC71733
MD5 SHA1 SHA512 TLSH

Submit Download

a50f6563c50ca4d5dcb255ee5cfab097

Path C:\Users\Admin\AppData\Local\Roblox\rbx-storage\a5\a50f6563c50ca4d5dcb255ee5cfab097
Size 1KB
SHA256 5e710f0e8ff474aa78b2b472e371cb869268c3e033626dc6bca0d33bae704eeb
MD5 d81ce1c2102492344712a919ce2a173c
SHA1 85589cd62d0554ec6d7180230dd3e6150af0d9b9
SHA512 bc51ed0b00eff71906108351b025ca0b7edc9080c3d3631bb723f9779fdd7793ed892de87e1254e888bfb08f3586878ca92ec266bc094d74c6c46796ad9d96b8
TLSH
T1B411F6A25341A5A0FB166B7439B0FEF06171829053B29D8EF44522DD13D069D9E650A5
MD5 SHA1 SHA512 TLSH

Submit Download

D3DCompiler_47_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\D3DCompiler_47_cor3.dll
Size 4.7MB
SHA256 a05d04a270f68c8c6d6ea2d23bebf8cd1d5453b26b5442fa54965f90f1c62082
MD5 a7349236212b0e5cec2978f2cfa49a1a
SHA1 5abb08949162fd1985b89ffad40aaf5fc769017e
SHA512 c7ff4f9146fefedc199360aa04236294349c881b3865ebc58c5646ad6b3f83fca309de1173f5ebf823a14ba65e5ada77b46f20286d1ea62c37e17adbc9a82d02
SSDEEP 49152:FCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvpiD0N+YEzI4og/RfzHLeHTRhFRNS:EG2QCwmHXnog/pzHAo/A2L
TLSH
T19A367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DirectWriteForwarder.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\DirectWriteForwarder.dll
Size 470KB
SHA256 d8a4c634ea7ddba0d58a2dc28f6a246d90c806274d798d1500b64a657ba2bc8f
MD5 df5e6846161d605057e987c4a99d6fc8
SHA1 94b3634f528bf6478c885c712592ad84c6f92c15
SHA512 4370d5c885be8069cfae1c6a253bca7651e959b2ce59b4e4995ce61bbb6a7906d1a33d97f53a2bb876ff120d401166c08a5a6af9195911985dd377f90f56598e
SSDEEP 12288:ngsPaNTfOf8JGy4fT4Lrl+Rx5Iq8EvtrI:gEaJfOfrJoraIqxtrI
TLSH
T1ACA48E25B7C92663E81EC2BA8357C162D630E9F25703E3C3C64186652D2F7C5D73B6A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Win32.Registry.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\Microsoft.Win32.Registry.dll
Size 114KB
SHA256 f9957093a5206b0c2d863703e4c23e0c38c8f9317f0feec32c52138ed25704d6
MD5 1f44b2a361ac48115db8f42ccade3369
SHA1 22469e1b990201a4126b4b0104fcda3de208f916
SHA512 4fbd4b706c3239f68e495f7291e6bd7e0dd36066ca0381cfa0eb34f1d909967189d82c98b57663dad1e5a0d7fa37a7c20d2b9b2babd05907580ce9fdde33b4a7
SSDEEP 3072:KnAYwrbx6bAYMteaJSvEdy7IVi0rv5/atHi+VwP:UwVteaJSvEdEURd+Vs
TLSH
T1D8B36B20BBC4410FEA7E45B89C734846E236F5A61741ABDF0695C0DD2FA3BC6F632562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationCore.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\PresentationCore.dll
Size 7.9MB
SHA256 17a4a645b39ea3034957ce0622178b0aa00d977c32f358800f48a6bf04f080aa
MD5 0c3b8188fe7dbc7aa48a69c5a643d710
SHA1 da3c44fe354132a16fc3d21569b2613628dbcc14
SHA512 7c7495012865f9699c879ff0d5c9b63cf6eeadf7095d777d4dbdb9b7aa0cc0dcee4ccf01c1088896831c892434bda84af29aeb54578ce95b2df1492b45fc95f1
SSDEEP 196608:zJKPa+yKJqSCqa6SCc/4blNr+0s5PFxb0yNhQeTukiYE:zJKTNJCg0RhQeTdXE
TLSH
T128868D18E3C94E25D23F85BDD2A34142F9B0A063571192CB386DDB1B2F93BD1AA77163
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationFramework-SystemXml.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\PresentationFramework-SystemXml.dll
Size 34KB
SHA256 96f40c9ccc0be595bd5ccc510512e01a3391f351ab4356a216c5c6f41bb4759b
MD5 57bb9708b159a16779f11c3878c8be6c
SHA1 274098fe12e3804d7ef16ab14da9493f2e8ae6c8
SHA512 7ff4107be77bf5f6d8fa030aaa7a22577935cd1bf7d42932da65f5da2f6b098e75366f0454760dab29990a6588c80b5fa5e7694f24f2e20b7bc8808068d145a1
SSDEEP 384:8W+ddy8yx+GtH6fDoxpiN20G/hljHRN7ul8BR9zcaD7:edy8yKkxg20GDj19zb7
TLSH
T1DFF26C669BBC8903DDAB4A705395C5C2BD34E3817710C6EF06A5FA484CA33C99B3163D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationFramework.Aero2.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\PresentationFramework.Aero2.dll
Size 434KB
SHA256 824ec37b822919499fd40a04d277c231abe0db5e5af92d27216b00033af93815
MD5 cd989fe7da1f71b1876fbf4fad1e6919
SHA1 da64c09124918573de68f290c93f648cc414f759
SHA512 09203abff8b01c2a6223196467b7230285e91a8f861d45df2fd51b3438f5a5d47bdefd79b235bed1329724ce990d34838101ee034ee0cf458c61c847cc809c9c
SSDEEP 6144:Eg4bKU69O+QFqfhSxB48IWlyVwaq9DPYfWZM:Eg4bKU6MRqZSxB4wlyVwaq9DPYfaM
TLSH
T183944B8827400971DA3644B886E3C459F670BC5213E0D4EB26EB4F9D6FEAFC2566522F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationFramework.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\PresentationFramework.dll
Size 15.1MB
SHA256 d676df80a91dd93ccfd8b45c5044872e34e326b352a97cc8ab718d2c7412daec
MD5 dc2b62969d5abd032d5b5cf873c93c05
SHA1 1249004370e3667f548897c0b0432d771ba8829d
SHA512 4741c7b14809a579227900d708b9e0737eef10d4f625d7bfbf88c6a05c692ac1b0c6362a0cdfe36d17e637ce8f3a9ac547a5dc47e6acb1322398cf10ca91953a
SSDEEP 196608:g6A3buyljBxsHJVOd72ZCzkgr/erKHvAtScfgMbgD7:i9ljBxsjOd72Ze3PAtSr
TLSH
T1D4F67D19E3D84A05D37EC1BF82632102E5F5F8B6937285DF0527DA492F83FC1A676262
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationNative_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\PresentationNative_cor3.dll
Size 1.2MB
SHA256 ac85222567293f695d972ef2edabd999372701d27b6d55f2d5721fa48b215f13
MD5 bd33368d12bc185c25770002a4eee9dd
SHA1 97da8bc1e1d3272061ec4437c25a4838af88e678
SHA512 764c3fb7cc46f7fe92301651266d407310a509d030c025bd953d29689d529d8244d61c898445412994fd2bd21f5b3b74dbfe11bb5180c6a44ab4dc0242c2b4d1
SSDEEP 24576:ygaltAn1r1sE33slrVCP0QSeDOM8zT3n6kcNbNUdah6ox3GmOBlIefATbpwwPIFv:jnR+g8lYP00OM8zT3GbNUdvoxWZBlIu9
TLSH
T1A1453A22E2E642E5C47FC1B8C6469717FBB1740A131C66DB87608B652F27FE0963E364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.Concurrent.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Collections.Concurrent.dll
Size 290KB
SHA256 bb7f6b4cd731ea6228c912c8dde615da5405ae7ea8b1537d6c2ba6f63f3db90e
MD5 3133249be1320c1265954d3e583b7253
SHA1 f32b8f6636e08ea303803fd4491dc54a4d43f39c
SHA512 59cbee526e0f0e0e4b029c89d77a53623e9b221781ea43fda681a3b3273901314f4c97ee53fe90d1a4d4dd7b938c46bad915c40c1f53da5362d384ced7cdd1df
SSDEEP 6144:k8j3LgMTXwUG7nL75h6rg76qmc2Psmd7mATV:ko3LgQwt7nLEGUc2nT
TLSH
T1E8546C20F3880317EC6FA93D99A3C605D57A54561332E1EF0278E5446FAFBC36BB6192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.Immutable.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Collections.Immutable.dll
Size 858KB
SHA256 96fce00abcc592eeed599c72fcd524c444bb76e88c051b39c49fb3f0b7304ef7
MD5 168318dd82cd7d27000d109f4848bdaa
SHA1 2e6a4835bf88ff97c514e797cc406ad62d4f526c
SHA512 b1dcf7c4104e4ece4b38d767f9d58edec12f16fc77f0deb01e4c7b158fd4670750784a5fdeb81ae30b68ab98ab98cef6cceaf7e0b0020d366f86534f7d348248
SSDEEP 24576:IvnroGV1p/UfINNeylsrk32dI2vN5IL8fgIs8L2lqY/4FaED49uPRymVXJGG/tAy:4Afg18L2lqVDT
TLSH
T100154919D38C0731E23F82BED5135195DA919413D3A292DF24EAF6B43FA37C1A6BB811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.NonGeneric.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Collections.NonGeneric.dll
Size 102KB
SHA256 73366c7058762b467732f9932a2d83f2ecfc3f1f755dc91e51d747bbc5cf163d
MD5 838f1776d21f8825495cbfb0e76f6ce1
SHA1 18319218a2fd033c6427fd3199aa43a343417d53
SHA512 dc8613bd07bcd12559f9ea59f1318890fcb11b2caa3feb10de9b1d5a973cc563a7f2dbd4005e63e33bdd0578d26f3830508ef89a36eb5abdfe41dc40fabfdf47
SSDEEP 1536:aIRjtoofN5YHieJ3+IOj4mwsxmDagF79Jj51RlLHLFAbDDyp0F1zDrW:aEtoofyRJ3+Hwskm0LRljLFAbmk3rW
TLSH
T109A33829B39C4722CAAA62BCD1978446E270F5E32702D6DF1408588E1FA7BC5C7F7167
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.Specialized.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Collections.Specialized.dll
Size 102KB
SHA256 1574f7db145d363905accdbd535feac581910a741f2d90978dccba1b79b0b11f
MD5 53c52557143038a0418b123e5fce5273
SHA1 dd1c6a7399c1fe71558f8fdc12a3b0d87f8a54ef
SHA512 d10cb51394622c7e0bbd8f361d7ba1820a9b18bbd26496d7ec8b37f473a3640e6642ddf455f615db3b994ce0e8b363e1d454bf5f437f27400e726c25f3800145
SSDEEP 1536:5xzip4R0Eo1u7oNfE3A0Jivc9EywNSeNYrDJrhXzMhZWzw:5cp4RKggMtTeNYrDJrhX0WE
TLSH
T1A7A34928B3888B25CB7E92FC85A38A42E770F1D31352E6CF194AD4495E977C0867716F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Collections.dll
Size 290KB
SHA256 607bbdb52a275eae0311449c8423e0f7175d9d8c42e6a6e4c9d987e68740f2e0
MD5 ec0fb78d039a53cc253fd5ccede3890c
SHA1 9b82868783f075b39caf0e7997b1bd9c40405aa5
SHA512 e93c12dd46fc71d7531ac7de44e668d25f14368d9d82ee27f56bdb3d1f25760b9e57dd3c65d93c3215f06cbcda2ce8b49cc19e22ba88c7fcd33856a0fc62fa89
SSDEEP 6144:Ec6WbutPcHh128/xcML8ph2wP0SwJ3JPr:XycH3vxcML9wPEJpr
TLSH
T1DD54172C738C6710FD7F41BAE693C006E37E9056834096EB06BEE5509F9BFD16ABA015
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.Primitives.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.ComponentModel.Primitives.dll
Size 78KB
SHA256 a8dc1d2813df0556a187c4860c6909d851b1a938498f9f50d2d8ce2709b73797
MD5 d42f175e6f493e676ea9d341f741860f
SHA1 964fefae18f309c57fcbedc2174b07e2cc26b269
SHA512 a7ba9d8e1814afb617b0b495667ea6abccf88afc7ec4158233919a0cf6aa99ed90fcf7de62d1cfa8d47caa94c4a054100cb697893670a4797518619f85070569
SSDEEP 1536:e2T9l797h4qjUzMJVLvrYu2nClrItVWwzNQ:eYl797h4BIrLvr52Clr3whQ
TLSH
T1AA733A1913E80319EAAD567CD5B3A9109574F5971323D9CF86A0DE0E2F8B7C1F231A3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.TypeConverter.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.ComponentModel.TypeConverter.dll
Size 750KB
SHA256 18a9508bae22acd1ca80c657be13f7532cc3950352082ae9dc5d7da37eeaf7bb
MD5 814f586a76c823fdcdacae724431a47f
SHA1 1f92ce89514f01d326f95b143ae0641e054b2f6a
SHA512 6d2b9045da171aa52ec4e79279b449c1cda06be2c25ee4d46bec06876295c91fc6b145b6bdecad492141851d8bfe65412976ba08e663999bf12c37faee72447f
SSDEEP 12288:7MYOiLZh7kL83a2PN/Xivt7uP2oD4Tq0Wb/2Qm54K+4rBvq+IXY25V121d:jD4Y3a29ivt7uP2Amq0Wbj4rBveYg12
TLSH
T173F46C18ABC86A36D7BE827EC6230502D275D883A332D6CB2594DD951FC77C0A3B5772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.ComponentModel.dll
Size 30KB
SHA256 8cabff4863dd55c6110ead70b38145ea5588e9674cc538e10d6aaf5494ef931a
MD5 4931ba69180fcc7a8ff208201e6d4fcc
SHA1 596210a06a81475648090dc34841e66c817dba22
SHA512 4a03a4dbf6faa90e2a2a025415170be965c969db00c3bbd559c7f78190e543b2f5eee61eee1e7b0080f582eb3091dc1239add0598d9d82ffe5f4b03ab0bb8f8e
SSDEEP 384:BzW4l1W5B03d6+142YG/hljHRN7nPl8BR9zca6:7Q+dMGDjnC9zC
TLSH
T1DBD24CE68B988707DD674EB097FCDA433D3D63CAAA02866B0295FA451D537C0AB3053D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Configuration.ConfigurationManager.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Configuration.ConfigurationManager.dll
Size 1022KB
SHA256 8427ff4e771dc448ea77718d6b6a532c437103cd09748f54902fba55f38198af
MD5 9f7fb2d837062a065f3b33bef5e6c799
SHA1 74ccae02c9be0a122ba6649ed02794f689dee2fb
SHA512 3803b996eb82fa6fc642ffb24ecfcf36fd520cfcb294c22ba253f57faed0cc274b86df1fd1db73c1dd5a63f726c1e25a9e51ca38f1a5ba3704272f867eb01376
SSDEEP 12288:0ISTDBQp0Dv+3Mu6fOsdV0Z8oApKK1sPTdokGH5OTNWLOdNDsX0UNHyhvW6lfM/F:ATXvCDmDm+6lqg7oU8UMn0C
TLSH
T1CA254A2553D84B19F3BA1778D12A0A01DAF9ED570321C6CFD446B84E2F93BC296F2267
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Console.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Console.dll
Size 166KB
SHA256 ccd66d99b980bd58de311528b071b9bcf64b348e286b28bbdb0e717c6a5565c6
MD5 9cb14c27e948cf6d0a74bc044e2670ab
SHA1 89e6598c0b54520b95f0d9c0e4598656d7af9bae
SHA512 c6bce2cca00171100e26e45a44537359187581ac16285b03d7e24be5123ec33330c0fefa41e371f49f84e8ad9f6870847c5d4e5884f4cb8d8afb403ab2648dba
SSDEEP 1536:9gW/JEWVMrKRWY3kaloRuYx8d4vkZqu57v9QLYM/+aE6xqiF5RyywnJ2jQ8wzT:9b/WmMuV9lmun4MZB7v9QJlEkRfwnOwX
TLSH
T16FF36C2A97DC2427E67F867845934301DB377E962316E6EB058584881F63BC3FB316E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.DiagnosticSource.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Diagnostics.DiagnosticSource.dll
Size 490KB
SHA256 b599497c6f52bdf497e3e5557e45263d33fa9b06226b6c0b70c98a0675cf40f6
MD5 85a0c2110ffe5bd0685549c978d71b5f
SHA1 ef3b3ff8d21d404bbf1c9051c66460feba9d9c61
SHA512 dbe2e3f765702e7a9a63840e8e2ba00696a145bc2b0a618d27394d6dff1bd2322d27529372345760e3f1ff643c6cbead095dcaa9178593c1f37c552a06a7bc02
SSDEEP 6144:1clA57C0xVZa6mMb87g7BbJKAYBXYxDuIChmYb7gHudF:95ekVZxYAbJkBgCFQOL
TLSH
T12BB47D14A3D80F11CA6FDA7DC2738812D3B266426750D6CB8845DE899F77BC2FE36225
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.Process.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Diagnostics.Process.dll
Size 322KB
SHA256 934782a25d2368e27807e28b549175bcf8dbc61c3598b5eba3a53143ee76124a
MD5 2ea2bd28040356e72e1b2389917552b9
SHA1 5d905693ae3e175efcd4ea556fce3c7973a5e080
SHA512 2174dfca7d7e24f5ce90d2dec97f9ca2e922a0a91b089a24184f89ec6487cf6d7963fb3b3e74ff18606a60074dd6cb71f5d18653dc1e20f99cbcd61f7d4aa459
SSDEEP 6144:Kx3GXLBygGlS+LeRq9fyv9jb3bG1PjdlMOWWpNnJKP:KxW7BygGYqeRYT23cNnQP
TLSH
T193649F2867881509FF6E5778E057E802E27DA44227C1EBCB4250D9A92F9B3C3D737267
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.TraceSource.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Diagnostics.TraceSource.dll
Size 138KB
SHA256 cbb7546f36b7d7f936128c8f35df2d0492541097fe2f98dddc540007e5350ddc
MD5 f448f479b296bea73c57ab7e059acd54
SHA1 21eae9d045eb48e1dc585e482d7b8095e1628288
SHA512 08719918340eca55e75c5f172bb424c76b8129aae64052754fdd35388f07da9f74242e3eb3c7f98ac6939fbe5b0a6e764895f44bbe4e9569510541059117d090
SSDEEP 1536:0qJz/ocSjpgkccwFjWDWApFe8zM2uMbcWLgChzbAMwGXEuZtsRm94Xzw1X+2KYZr:0vxMvnWsaAMCfm9Awd+2KdeBpy+9Cw
TLSH
T172D36B2523CC960ACB6E0978D6638A21E6B7D8930713DBCB48819C4F1F937D4FB764A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Drawing.Common.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Drawing.Common.dll
Size 902KB
SHA256 d267ffd9ffcf0593bca2bfef82e54f19fcfadcbe2ba8ed5a626e5cb4a1d1d8b2
MD5 c1c871b3f1accb26765f199e1d9465d7
SHA1 c4d1a4e4ef0b0422ffea5f33d518dcc1d9046a6f
SHA512 f0cdfe9731747bd7978939c8f9284d03ed9024174d0088ec35405f4e69d93e1fe6e35534b1062fbbbb3a2d75d93214a0eb985ac030cb4a60ab46469c816e97be
SSDEEP 24576:fwgl8eIV5Q9lw4eqK/AkWLQ3VDzNQVTYPgpa:fwa8/V5Q9lw4RkW0zNQVTvM
TLSH
T1C9157D27A3C40A2FE62EC6F9D15B8C12D532E0469B22D2CB8584DD393F47BD2DA37152
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Drawing.Primitives.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Drawing.Primitives.dll
Size 130KB
SHA256 e74fb730c60f4d9ba0dcce6584e048eddd66f3530604738dacf9cb1ba958bdf1
MD5 f7dad4de5707a3958f015574f7155ea4
SHA1 4367609c888a10a903b1f71ce1dba0c17cb7450d
SHA512 70a18294fbd015a5572fd8f5431dc159512f325d17c7b4b719bde9aa76925decd4c228ae9093badf39ab2e23f884db005fd7642af1af0e7c44895977c69a66f9
SSDEEP 1536:4S7KJ7QoJLA2C4g951reQBl5v4fiBSgEAazQApxVrtaC2R4elbpmFNOdN1ez2:4TJ7QopA2C4ggUoiBJp6qR4iUjsNUy
TLSH
T15ED34B6EF71489A8DE7D527C22975577CE3AF1860312D0DF8885448CAF12BD8F6B10BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.IO.Packaging.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.IO.Packaging.dll
Size 314KB
SHA256 deb6d930de291267317a79e99e2a8cf16707959e9f7d7c99d26139f98877eb49
MD5 55009e4d45d32cad7398378d92d89639
SHA1 f30dcb5c5e27fd34225e442694f09228b2ac7576
SHA512 3baf6ef5720580181378ce3b29826b1fb2a0ae0b1473c95b5a17f0572e16d92be30b32d19e14b0aaf08b75f449d19cd9436e4d9315fe5e3cfed70af8cb2efade
SSDEEP 6144:v0b6ThxuA6WnSCLSF5y+//2WbEUy9v9f0lKUV6h:v0bgxuAFSCeF//2Wdw9TUMh
TLSH
T1B464F72633E80506FBBB5BF891F3A051E27AB45327A1C6CF0521D59D1B93BC18EB1762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.IO.Pipelines.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.IO.Pipelines.dll
Size 186KB
SHA256 e8be292ccfdd68ddf4c061235ee6890c66384592df4a29d65215ac5bc33c0d1c
MD5 a4ca0ecf43a428d15a80efd4eabba510
SHA1 33ce0cec14b34a3b8fc03f529bab0b49d907a5cf
SHA512 50e6af4b3343deb443f8267ead1c66902d9c8bc8c28451b9efec25ba7fe7f052b64401c4e7a2ff2057dda31484994ad0580c7b3e8953a4db94e1c26714481ec4
SSDEEP 3072:9TO6TzMwcnPRyI4DyA+XR4bgN0xmRBewipN8h/LvlCOPShWrssfPsl:QyMwIRlAcewaEJCOPSkrssMl
TLSH
T165146D1AC39C4613EE5F85FCC15352029FB394A25702F3CB414AE8A42D9B7C5FA3E166
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Linq.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Linq.dll
Size 682KB
SHA256 35d3db8aae98b0b8f94e9f3d94dc823e29a729c41c50b007c7383603d6b422b4
MD5 6c244d0a8c9342c821322cd757b17ce0
SHA1 993b588f110b2d3240e1ebb9795a5650fae3fa93
SHA512 fe5712c5f2bc2884862a7be49714cb9de5ad4f71c943148c6cab225e240c44ff94a48843232179603f0dba71012570e01a0a504bad73a88b59305e4447d815d6
SSDEEP 6144:v9UvYZP/UqaxAMMbgChncRshEidVMJoPwAx8BpFjhek5mGvX06FPTfn7sVjzcQAw:vOcfAah9VMMOpykHfnQE+pUBzS63esG
TLSH
T1D2E46D28D38C8B12C62E4A7A95235363DAB196A3D356C8CB844CFD642FD3FD16379724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Memory.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Memory.dll
Size 158KB
SHA256 2edc8f3bbc0e60ee613a0d9d456846bfb2635118772b3d9d51c3cc116d5c5aa2
MD5 40e90cab9bb11ab9a551845c69e599d7
SHA1 0b2f1034830c42a19bbe2ef17dd6e47ea71e1be5
SHA512 e6f694d095bb19cb82e68ee9def9297617b4bb205dc23c49a616ca7f9701b8b17609a706d334d5ac08b9630ac6aecd97d496d598844d5dbdb59ebd0164b2d245
SSDEEP 3072:HtbiB5cL8oVRXZsqhpw74pwaGrpXMKf4T/hcIUb:U7cLzP07AwaGrLfw5cII
TLSH
T16CF35A2BC3980257D92FDABA8756C202DF336051D701A2CB48D4DA491F53BE2BF77626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Http.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Net.Http.dll
Size 1.7MB
SHA256 49883dba5c99ffad5e43230be4ee38566429d4e307f711058a8141c8b0904076
MD5 5ca9eddd0e39165607773b8b8aec8c03
SHA1 9cd6c905cc67ea2adee5f54ac5954929f91dbb39
SHA512 c18f89e607630af38b0b4650f6b622b3e6c951a4e9cb2e291e78867988f7351a2db024e80970c2c8d64d390c9226eb41f82c9eb542025fb1af7a08d72ef483b8
SSDEEP 24576:pk/wB4u1RTuboo6gxCKr4zUtNFKHGOJQWfUyQmt7RZgYAQGX4EeiUc:zTeotgEtUTmtNfGow
TLSH
T1A1857C16B3ECC613DA6FC6BAC1625525C672B4824F12E7CF9408DD892F933C1AA31367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.NameResolution.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Net.NameResolution.dll
Size 122KB
SHA256 0cf3e26e78305cd8642b09d7f6ecc879904f53cd500645fc618441a1043b8476
MD5 948f036be0dab7cf4f1f296b3e8df0f4
SHA1 4f1a2ff4b708697dfcadebd5d4989d71e909598d
SHA512 c78116c89a3d19d38bc205d990e8caf39d7d4b979bddf3493c5566ea4f8a591948b6b165f0e0f3e89303b6c5244c8efecf1ff3c4e4f88d759156d2bf62441cd4
SSDEEP 1536:Dq5fnJDyB8j7eH/ZrK1PeaBWKCb6/wB8yf3+U/RSfPYj5OvzcI:DMf5DfeRG1maQKC+/A8yGcRSloI
TLSH
T11AC36B14F3D84714DB6E4939A6538906E6B7E2922701EEFF15CC894D3FA3BE0B631621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Primitives.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Net.Primitives.dll
Size 206KB
SHA256 603da5e0255f11d466647b4b73d746e87559d4b6e9890007b170e660012972a7
MD5 7874929c0affdc69c066895ab237f772
SHA1 77829a7f70eda01fb2cf583ea87412f41ec4a65d
SHA512 c74ea2dbafdea6ac75992381b1b5918939c28d031074f13f434cb097a7fc23be02e73181ca1afc4c172b2b62547853cf25fb0cab5a08909ad7af45cacb494e27
SSDEEP 6144:NXdE2YnVti1DRGbpZAcuw5zX3KGYpjkKB8CM:NXSiRGNew5T3KGY1P8CM
TLSH
T15C247D2DA3CC4B27F76F85B88953E616E373A4634301DACB0A6499951F937C0BF31692
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Requests.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Net.Requests.dll
Size 366KB
SHA256 46aafa741962c12843e96a68eaaf20af2b12dacd574870fb830dc9b187da15ca
MD5 89773fa262e8c71af304e02eab587348
SHA1 2bbef8d19014107123de4828866fefc0cb1d1239
SHA512 2103c51c7e798f87f2a16c007343b11ac8382b486e3104312b1d0e2ddf449e04e72fef16026ecfdd74e72b7a7f756b74b820b75c99e9a845651c1f1d808293c3
SSDEEP 6144:iTzRNdq9iw/Yh2HtgPEEANdDks7pyRygcZ+hBQS:iTzTqwgGMEA3kRCZ+hSS
TLSH
T144845C2CE7E4461ADB2B96B8C2138211E173928717D1D6CF4818F9895FAF3C19BB1367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Security.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Net.Security.dll
Size 650KB
SHA256 de258a29818a70f18049b1d33d6bc7f28158d3c1836678b17516ac47a60abcb7
MD5 55befa55700e90eea94e80bfdaaf4607
SHA1 a1b23561e66899f2cc7eb21358fbb4074d1c2cf5
SHA512 fafb3166811ec636066329054f5fbc0b42361afd717c1d714c7fc5e9fd1b7edd92540273da4cd02ad729d918cd78d38bdbcb7d77637919dde5302fe53f892a89
SSDEEP 12288:comzXUygve7S7P5CxXXvf71eApALqrRs1kjBe2:coGz9wgzwgBx
TLSH
T19BE46C11A3D00B25E6FF9A3986734831E675BD877711E6CF9084C99C6F63BC29239362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Sockets.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Net.Sockets.dll
Size 518KB
SHA256 e8c79b6599f33e00ea57d7eeb05a6ac8a8378adae042f290a88a21c282936a78
MD5 4d25c5dad3fe391def3ff58f4338f2af
SHA1 0626e8150dbded807f7bf7a446103f9c6b9562a5
SHA512 8941a9e09ee40ffa87f52def59172abd7e8620b4c908fcf575caed0621c148125055c4dbd6593f36c41cd44175e68e32de5d6bf36df5de2840a4a598df66060d
SSDEEP 6144:Q6BWB5lm+G+Qg+9U3bDoTIbI7I6lUBUylXAm5XdSs4f+uoJ32f8N1T7RxRSeIEne:klm+h0UwTIpeYtyeJ32f8NXZlJrkKH6
TLSH
T116B45B2663D80B06E62ECBBCC4560182D6B2B5871742D7CB8048DD952FD3FD2EA76673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.WebClient.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Net.WebClient.dll
Size 162KB
SHA256 837d47cc0046eee0b74b009f41c1ed934dea2da2eba8a5f04c43b621e364fd09
MD5 d646cf8474d877bb1d214e5808dfe955
SHA1 4d4971fb59486d362084c8686c50639680b1a3f9
SHA512 e8ef25c01243a88515e9c8828180ca0a00901f181a24e7dc0d5df46c0aff1520b55a5ea4f7266967a35d9be8c8fd6b63deabd7ddfe97d539ef8483d2f1811603
SSDEEP 3072:4utS4GQVWPbVCBtYcY3ypJ9/i7BPmQ791:9tHG40OSzr3
TLSH
T1A1F34A2B83D8C203C61F81B8C5678246F7B3A19B4351E3CB5898D9581E97BC57EF61A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.WebHeaderCollection.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Net.WebHeaderCollection.dll
Size 62KB
SHA256 8aa72c4c376f039dd48efb25053ce9b78944b0c10bdbd7fbcb177e013799ba79
MD5 d631c07a9838a760936f5aec08c3cc53
SHA1 42cab542aab9103adab0c631c150420edb0624c2
SHA512 a22afbbfda40c3eb385682c61351c1e89e8f56b3ce9e6651d817208a5a6d76bf0c4c63e07bba277b9a01d2f80e4f1a3a026ef3f452a6acab29c0c47da7a6906b
SSDEEP 768:X5Rsj8KiueGSDfC10KGElqRQwpvVBUydtpo9zpha:X7s9iuDF5GEl/Ki2gzpU
TLSH
T1C8535B28D3D84209EE77977CC2B78049CA33FA62179285EF1885D6490FD37C19B7297A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ObjectModel.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.ObjectModel.dll
Size 78KB
SHA256 705c9b2ecb2d4a5ede420492483645bb71b53697faefe5e7165e1adbf76e3583
MD5 336928d54bf87bedd990f72e75ea67eb
SHA1 4f766b6c034282eb888e7912588610579071adf6
SHA512 673f435883b308d02904be643ef8ce3c24177ad8ac76df643a461d421e2e4a53d76f89706cb66c35afeedfe4eecd4b23439dc52be9dbe1df0e2a6b03cbcf726b
SSDEEP 768:nh7gVH5JMiXNdaAoJjJx7mkQFUUbmuGSnMjgPLuUAZ+X2y247TF1xAnfFvSgiDjJ:nh7gVHYiOBVmXaUbmJbQq47xc9vuTzeS
TLSH
T16F737A2167C84B29D6AB563DE4E35012E635F2F22722C9CF06F6E50E2F533F1863615A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.CoreLib.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Private.CoreLib.dll
Size 15.3MB
SHA256 a4d81ebc7474e4a1fccfd8d7e56abbd12d396421c4447bfce25c3526f5479c2e
MD5 4c715cf29df5c3226282110cec4eed5b
SHA1 02399209e6baeb2307f48f6dac1d91e289e73ca3
SHA512 1126ada93f234f035206d25be02b90270d2b358f6308719dca1a57f3e8c7b46b14f1f0eb9bc27c0b65b47280a8c58d0a2f12246a3adcded325892f7392a6aead
SSDEEP 196608:RHKwaZPzpVo9o0jX+Ux4kcOH0g8EDh8wbWeRR/DWcc:VKJPjo9o0b+UxqOH0g8EpXRdWV
TLSH
T124F69E10F3C8CF5AE13EC2788163C516E975F4D2E32A8AC70595DA483F23BC9663B665
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Uri.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Private.Uri.dll
Size 250KB
SHA256 e2f1fa1acba6fd328fcd213d031ef4993c69d510753254b8bb6bf4d484fd8452
MD5 00e575c74aa7b7c70e652e43e6d91091
SHA1 9c52fb29622edf9bb9361a5211e50e3efd95d7fb
SHA512 8887dedb98b20413cd41e36c262a945314121c501a3f7f9cdd848eae92b27cf268ce83f3df47d3a577aea3e344541fae4a13f3d728f6285514331bb77c049569
SSDEEP 6144:pzgoGbedOrZgnYGFr76LGZxJyjMjPhArX+AVSP3m/3tpeB9pSzF17K3O2djHMYYV:pGe8iht8pC2+HtGJ
TLSH
T147447C1BB3990D2AFE6EC3FE85C3D593D272B2965302E7CB06B494912E133C16A39553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Windows.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Private.Windows.Core.dll
Size 1.8MB
SHA256 3de05ae5d67563033ddd08b070dc0a3ca9b22e6d9065aca80e0db720407dc5d2
MD5 8774c68892177a8c9045079a88fc3e0c
SHA1 fa58d0c5f939333add9e2ecf64075f03efa18972
SHA512 f39f1dd81e897874ae00a7bac1938cdf078e7ada49ec0ac189641dd0523da40e34606996922a5096787bf3ba77fc381892bc8d60a2dc4eef2c434ab6c18f3a4f
SSDEEP 24576:B0tncl13DhoDLNSpgVF9X6KPucrhiticz15MAgpTKU2GK+4h1IuqxqDg7c:IQcZSSv9X6KPucL8cf2GK+4h1XqEF
TLSH
T12C953B14AE4A7B98F92B89745073455181716B4713E2EBE700C9F8D42932BC3DFBF1AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Windows.GdiPlus.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Private.Windows.GdiPlus.dll
Size 418KB
SHA256 2e1b8fc553a0a0de1453fd70a65eddd37ac2d4bdf6a660eacac579f25b243e8a
MD5 b38de877abeef42ae624398180bf9b87
SHA1 0a3ea4a4a90147a3580678c153ffbff4089aa995
SHA512 85219f527c32f5718ee1dbcbd02cb81de5cb6f7435a52b37a80ce798d739a98a38a3cf9643962c60cb1225e664407fc7efd1dce9897c9895e1a87168e90da8d7
SSDEEP 3072:EsArfLDeWrCCzh7I6PUIOlTcJa3E+IX88ZdITRuXo8VxIkOy86hx238aO8nT+DOf:37WJ92+kasQ6T13H8X5Et
TLSH
T1D894A62577011529FB2BCE7D868A9901C2607D26B792E9C742C14DCA7B73FC7E336682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Xml.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Private.Xml.dll
Size 7.4MB
SHA256 b1c078417751112edd7d83f0eb82947e8c849e79b44a143da6e6544734e293ff
MD5 3143fb4b59215c29b7ec9d5bbb248072
SHA1 091aa64479ac247beb00670b971337c402240e27
SHA512 c08016028deb9a50cecac961be190aed93851bd6bafade473b267e48f8efecb040ad74cf1c85d68ab8f97429528e6d62e794613e7d9996ef4dd5052312f5f1a7
SSDEEP 49152:AmrMGHsi8qjYmh5ePEPP471PBCMibrcgltwPs7eSGE9q418C5sw9UoC+nWIOGCG2:AmrMGHgfv/857s5TSJqjfOHltKOIoCgY
TLSH
T197767C14B3C40B15C32F86BD9223A612E6F9FC521356DACF0495EBC12F937C18A765AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.CompilerServices.VisualC.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Runtime.CompilerServices.VisualC.dll
Size 30KB
SHA256 670ad7dab228b4a878768ddb532b346f8bcdeaa0d987a7540b8227e358303e93
MD5 320308835e6d24ee5d1d9de3e2b78138
SHA1 c398d94fb9536f0dbd61187bfb0803eb258e16c4
SHA512 1877b924151ea91b4ece9059e84d95de6a92bda0d785ee864670b6a4f02371fb8be8f6afeea9c594824bc316286407d84bf72b165f67fe535c929dc14dc9c3c3
SSDEEP 384:IWsLLWOF2nlpvjVb/hljHRN7tP3U0R9z6Z7:iJF2rjRDjq49zs7
TLSH
T1F2D24B729BACC357EE670D709AF5E6432D39E7C16B4296DB1058E2066CA27C09B30774
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.InteropServices.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Runtime.InteropServices.dll
Size 110KB
SHA256 90070cc5124148898fa246690b1cbcd101c620bcb11f4d53b2cd6228260a6242
MD5 33b3826aabb19b81c2f908d4c14f4a23
SHA1 26e3a66d6edaeca8f2c97fbc0da0135231d234a3
SHA512 c459b92ff8e600ea5327ec4c2d3b4066498d54ff071a67d0cc902e093400d7f81c95781d4b2513d8bec4fead6515572d41ad940afaf6741e5e24e25ff22392a2
SSDEEP 3072:LQiiNQMAcKTVC2udNY42ypou92clrWEfG:YNNdLDTD+clrlG
TLSH
T1B3B34A207B98863ACA5A47389C336D448EB3FAC69352E2CF8544C49D0FD77C066757A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.Serialization.Formatters.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Runtime.Serialization.Formatters.dll
Size 122KB
SHA256 8f5ba5e81df658d62f74a8eb2cf53e08cf673bfc606ed5205430e2499a3f742f
MD5 a28af5c61176e9c2d83800d7626c8b40
SHA1 332f847d92642973a839befcae401a2422396e9f
SHA512 24c60b7b819d2fccdc425f802fe860c308e032e98912c24bfced002f877bbd125a22d286b00194670e56fd1dcbdafaa9ebc7144e47c1941f0381c2058d8c894f
SSDEEP 3072:l+dNHUeEmcvpDL/QGS76Ixpoz5pe9r6PEw4:0NHPcvpDamIcIDj
TLSH
T10AC32715B3D80682E6BE96BCD4326A02DA73B4970741D6CF1601D82F3EA7BC467B1723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Claims.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Security.Claims.dll
Size 98KB
SHA256 36285c72fc83bad58e4be8d4e76fe9a17224690a01e5fdf1d2d96b97f142e39b
MD5 e794fcc7dd4489be6de29074277bb1c7
SHA1 177eddcf29d78143a916d2f939f995fdd73d8c53
SHA512 3677ec4b9b63616c0fb6942597455c3c8f5ac1313919c308108931c8395c5c82e749255d1340d6478f63024df080987b54465131d395f2963db137f1cec0f215
SSDEEP 1536:N7dUIoADVU8GPjLLWNYcIfc/H31IErOQwQ7rzUU3q2bP6KBvjaWzaJ:NxdoqVU8GbLLaYcIfc/dZIWG
TLSH
T1F1A33A1877EC0316D6BB0E3D85F28009D5B5F9822721C6EF09799A0D5E97BC1DA31E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Cryptography.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Security.Cryptography.dll
Size 2.4MB
SHA256 b7f8e7ace9c723ea66b8787278d863880a65ea6d19d7385dd9662372c511e6b2
MD5 824cad58dddd4180f21888354d2715dd
SHA1 48ee2310be80b0c7cd64bc20019008ce2e4eb51f
SHA512 08562eeaa491c85b5a4e74fd226d48738fb5bb05f5320f6ef27d667eba55cac96d824fce49098c879a589926c499e59a797e2c27f42fbd28df1c3282e13e7638
SSDEEP 49152:50xZFvVJ1cX48xKDRPOmtx/VS3NNDxyFWtq3N69:5UZF1w3KVE9
TLSH
T194C58D04F7C58606E6AED67EC1138916E530E45193129BEF4A45CE483FA37C2E7B236E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Principal.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Security.Principal.Windows.dll
Size 174KB
SHA256 6f74f292955eae9f4d7b68cbb6d8bb54756abfa9c0a75325c3d890ccdf580d28
MD5 149f8cf9c6a8cc8ec70cdf1d2df9f2d3
SHA1 3d9fe5989aa4ccabd63b16716427be66f08abaef
SHA512 124118412983697c626e4ed1555a8dd3873bcb354388eacae642db0b251fae511709d3edb775357cb99b87b05be7f62ae623275fd65fd2c3823d89baf47df5fb
SSDEEP 3072:2p6G2mRkHtntehhzNUxmbr/3rsd1/fCXpWws9bV:q6G2l1tscmbr/w/lh
TLSH
T126045B265B880653E66F4A7C81E36645D7B3A45707819BCB14C0C9E91FA7BC3FB32227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Encodings.Web.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Text.Encodings.Web.dll
Size 122KB
SHA256 802d60772245fb8d0bf9e357f86fd64fabbd6de88d3f2a0f372372cd3fa5eb35
MD5 631de850dd2501b19c9230821eebac36
SHA1 9641c77c440f94fcf8b61e7f3a0422b678e2266e
SHA512 dbc07100f3a9bd084069bc2e4b2b64a452b44f3fc4b7a7658c38159744451accdcc0474c832e9f6142edfe16ba034c69dca8d445d71b711844e966100feb9a20
SSDEEP 1536:eF2z1QqcmM5QnuUP/LNss/5XzYEKB1ehJ98y1eknG/83JyLzJ:eFISq6kuMNsKUx1ejv1hG+Jsl
TLSH
T1C8C32811B3888A89C32E4374D6978672D9B9BFF5031297CB096835191EB23E8BF3D157
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Json.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Text.Json.dll
Size 1.8MB
SHA256 618c5e2bcd047d8bd24979c4fb0c8053a8feef4e7eaaa896a821ce0c1e9faa29
MD5 1780419e7eb258ea9d621608c464b373
SHA1 17ba9ba9cc68b5c802e8b2bc7c11983c3239a5d6
SHA512 6170b5fe1523eae57e08231a18ae2991ca4a8984ce307e45648f9909dcf1a2a17fe8c0e644b457fa5dcadf2fd93eb6ac4356bc7ed6ecb2423ce5f0fe0e03dfd7
SSDEEP 24576:olTdacgeC8s/IFus6wOQsUfOkxI9qSprRP6yqYhvCdrC4e:olBy/IWQsUGkxI9qSRNUw4e
TLSH
T18E957D35F3D44727C9AEC27A856BC112D6A0A022531287CBBC68FD852F43FD1D7725AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.RegularExpressions.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Text.RegularExpressions.dll
Size 1010KB
SHA256 1b0f95cc9c5b7ccac24a7c037ccb107efabf6eee2c7ea211dd08fbfadf24cbda
MD5 3aa0bc9aa0b6ead5269742db77dced92
SHA1 cba0d60dd8abebe4e7aa7ddf0e95dedcff830421
SHA512 ddf58711e5e85a184709b5288181ad924df768db4eb8069045e7b516a17150855d41e210ced8b8c091baa82ca79d450462947a182928e0805870c221f581f46c
SSDEEP 12288:MJ0ap3wyigceZldmsoR9uhBWg8Cvy4LpYwceHl01mK1ERvrM9eTwqf7:40+fc3R9EWg8CvzVlHCcKIvrMZqf7
TLSH
T1F5257C24D3C80351C2EFB738D46B5A01E6746E26531986CB4848F89A9FF77C6E6F6213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Threading.dll
Size 82KB
SHA256 b41305e5388ab57cd8fe4ef0aebb87eb52b673e5949594782f2384f568ad2671
MD5 fffa8b8ec6a0ae04c3fbe7ea397b5323
SHA1 8c46973849088235f38f9ff2c44b59452f814dca
SHA512 b237420e07a8a75e1da8c0866f23ae72a4b133ec0e8eb7047d7b7d6bbf22a9e2ff7112c4063a1a6ec9906146e4fac7767579f46055861ce1e8de33073c77b5d3
SSDEEP 1536:cdvlwVyH8OyQwXeisjb9Rbd5bgF9o6zionf1wz+:cdltH8OxwXdsf9RbH8F9o6GonNwy
TLSH
T1FF835B11B3E8090AF67B17B9D6B76905C171FEE22B01D5CF4069D20D2FA77C0A6B126B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Windows.Controls.Ribbon.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Windows.Controls.Ribbon.dll
Size 1.4MB
SHA256 705b9b87a041839eb06cd18aff166e4a2331dec1df8a3bbf9fe9bcba999f58ea
MD5 4c987e5390b14f7533b7edeff2540885
SHA1 4c5c265a3f920ea9540ca05bb8f6be1310388e3f
SHA512 6ad73d9585a2394a73600e1fcfdd06243c5f5cc134b71ab70c1c08c1921c156a488968496034cf70b943f6dbf210ee38de64ddefaf0e44b631f7c5485bafe776
SSDEEP 24576:qu6jllrTtLV6HmaiWMlYvMEHXapgdTQVTaF:ClPtLV6HmaizlDWZh
TLSH
T1CB655B5223948764C73A95BCD58A1208E471946313B2D9C704EAFE4A6FC7BC29377E3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Windows.Extensions.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Windows.Extensions.dll
Size 118KB
SHA256 1d14ac03cb612efe246183105cd25818486f234576a003d696602d2547bd75a7
MD5 662c2f0dcbe74bee8103a775ba4ebe3f
SHA1 2f7c4748c0bb5937e90ab7cf41f62d911cd9e8c8
SHA512 27ba12facae0cfbb822d20ffd2fc6818638da425920a5dc1652eca5c6685d65043b8e976234fc2e83cfebb8b561fc29d22b8fd2d8cca17f0026be0b005d05bcd
SSDEEP 3072:WAXxl+n9s2F0XSJY4fAzASGGD9YHUhsLiG19:89sdCJnf+ASGczhS/
TLSH
T1B8C32B6173E40205FBFB6B39AAB65421867BBC96AB31D79F0541408D4EA7BC1E670333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Windows.Forms.Primitives.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Windows.Forms.Primitives.dll
Size 3.5MB
SHA256 70a0bb27b0260017b8ca21f34548fb157b6554fc1a08f76ccea45038cd76c92a
MD5 9e121b5c9691940dfa7bb25cc16d6f3b
SHA1 29d80b0ceba37d9398275c17894e3a0783208e76
SHA512 43fe8964c170a82e8ef97d94d1b74e3b076bb0e79a72db1374f86418bee0011d8dadce2f7fe0f559435a5da9893a66872650af181c9cc53195b2dbc972426a46
SSDEEP 24576:EhE5gpPMou2hrVkkNeTqfNmt2+yzxHPxAz44j9YnTqIna+L+yb0XuGPqYo4TgdQl:Eyg62h5kPEc3yvloXuGPqYo4nHt
TLSH
T181F5081513841F1BFE2ECA3A8695854092A0BC9BB702F6C355C059A67E73FE3F27D192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Windows.Forms.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Windows.Forms.dll
Size 13.1MB
SHA256 c8115eafe12b2014e599281f256fba349f58e5e412f2057927e26a74e3b303f2
MD5 6424ba42a9d60514ae60692d0a6a5fb5
SHA1 5255f16c50c87d603b3ba7ed5dcaeb531a92be6e
SHA512 bb6bcf7fcf1271b533b6d77f3b3b42691f765a3718b7f7ac9422cbca27f8439a419057a32ec993c51efac5784facc05911a0d37486fcdb9fd3718c215248a682
SSDEEP 98304:M5Va9KkYqiK8GQ01LykVIUUuLXtoobEtzxta3cEd:f8qiK8G/1LykVIUUuLXtocax5U
TLSH
T183D6289262DCBD95D23A8278F37713F1D6ACEC228311D2CF06D0BD152A7A6837936395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Xaml.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\System.Xaml.dll
Size 1.3MB
SHA256 8b3053812324e8fa7557d7b0acfab455f3a4c4af50c8d7047a6efdf1ed3c92ff
MD5 276a6a84265a3dc4cf20c7cc3ded3315
SHA1 9a704e018a3dfa3e375ae7449e16d2dc87320ee2
SHA512 6a82097b7f11da92c52293faf3ebec33303b6220debfd238aa2821ae027c0252a315fcd9db6c9f99b7ff69b95ef4fb15db91b9867167c5e1c5a9dee50a82f9d2
SSDEEP 24576:f/gc7vpWrVYFzBzhJsHf0xOL0nsfr1ALiDvQTTmvjS+Haftw:D4CFzBzhJsGsfrhvQTT61x
TLSH
T127556B2463E88615D7BB82BFD1938122D6F590531362C6CF8405EE6D2FD77C3AB72262
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UIAutomationProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\UIAutomationProvider.dll
Size 62KB
SHA256 722de0589d1d51fe8c9da080c8594760daf78fd84b1f1d2e0b313fb70d87389e
MD5 f4e0911d9db64375f9cd99b87fbd4916
SHA1 8eeac858d70b416bd9377a2110f9b631b286fd8c
SHA512 19a16edb5fae375f7b8b23a5019f1c7348f8ffed1928803d737a0c3861aa0fb15fa0327546089fed70478e2283be13a9cbb5cb7b3dc2eea2d2dbf1a77e0b7842
SSDEEP 384:SWMqJhzpIjHZ4DG2ZNGKQVWRldln8/amxhjEnuayOXLlLzWI2lIZ/EZGTQIjDZBw:RDNIjZ4ZZl8ymUl5zxs/Vto5459zgo
TLSH
T10653C63C1FD85233D9B7C678E9F64A87ED34B54336125C8E00C657994DA3F82ADA221E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UIAutomationTypes.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\UIAutomationTypes.dll
Size 290KB
SHA256 a98f2e3f5068fb993bccfa3fb7b9a041699fc6b6571003593430b04ade5ba080
MD5 396b286952734176924b40206fc87eba
SHA1 8fd477880a0993365ea90db71a239edf7cd947bf
SHA512 644c0a9e9547fe0e4f302af9bc2ccf9aaa4a83ce928b63fb237e4f44f7651afe940df1d50d4de101357a763b5e8b37d43b0518d09747ddcaa62d09a7be696251
SSDEEP 6144:Hdj9pKCn5KLOhHifdFvm9GhqfzLT79iLdNZ7iq:9j9pKC5KLYqdFOE0HPoLdyq
TLSH
T10354592533E40E15D4BFA7BCA9F29A0394B5B91A2BA0D7CF0062464E5D7FBC29430767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Viper.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\Viper.dll
Size 8.1MB
SHA256 9e64b6ba5b77accd56cab305f9d340919c50ffa5f3d4670cfb45e1902338523c
MD5 e22e1dd11c574dbbe41fdf82a32cd8c5
SHA1 81dfe8a112039c7fc5c09aa777360aef5f1303cb
SHA512 cbaf974a621580340373ee4ba57309edb2910f2e9786f0bdf6bddabb3a42bc9c362626b1eac66e68602657a533ccdeec91f346a3650ab19c2ba2b18a09543849
SSDEEP 98304:4p4Go90Fps7a/YHPGuwyv1YPTsLzguwyEyasvuwyJzqwSwy:U470sa/YvGJyv1ysLUJyEvsvJyJ2wFy
TLSH
T159868C8A67ECF935C7AA0A3446BD931F013AAD39ED01CA6967C03A5E2F71F855CC1163
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsBase.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\WindowsBase.dll
Size 2.1MB
SHA256 6137f1600d3598ceb9f72b57b514924c2b2e2fd5ecd95497d1d6b8d9c95486a2
MD5 e3e4afa8154505ba4c22a2359a506f36
SHA1 7c99ba411a85c40509aa49bf2be39c3ef78b1c4d
SHA512 7dbf345cbd581c27ea72f64bf39db2ee7e938e72d04faa9f21c85817e3cbd435b8b077b1c1a2fc96c8a0e2de935bdba14ab86a7281e9d908002e9655e61fc8ba
SSDEEP 24576:oefXfcvpCb8ZvoX9OPIA9wxc/rYd1/Yph4R+uyvaDRSvME:oYf+CAeOPIowxMWmh1uyIcX
TLSH
T1B9A55A2473D84726CE7A82B9A6739112E577F457031ACBCF1809C62D2F97BC087762B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsFormsIntegration.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\WindowsFormsIntegration.dll
Size 210KB
SHA256 dd9aea47747f8f9efc0641c48cabaf5d7777f17507e6ecf03dcc334b26219969
MD5 b7a43af9446656a40e8bee9815cdaa7c
SHA1 77e8df27062f610bc8ad12732b75b24170f86988
SHA512 a1c29c16eead347acd3d59f8e5e0821fda51eea6465e1571feb56edb55401150a90257348b164056e04270a9fa04cc95ca51253aba2a68836374bef6a2160ffd
SSDEEP 3072:USEib6S7XeiqXqetd1HOAJiDIC/66Ui+i0SWKtOrRp+aGRHQcdNeVJgxt5kolvqc:VcAnqZnMAg5RUi68OvTGR1k1vx+i0Eid
TLSH
T17824E62A17C44913E6BBC17896E78653E67266033311BDCB099297045F87BD17EF32CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpfgfx_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Viper\_lXaIfgG_9rB\wpfgfx_cor3.dll
Size 1.9MB
SHA256 ba56cf777a370395c385ecba19129efbc6673d5ef5f18c23f8d90d23b140a6f1
MD5 c0364436841e2b0f4ec096a12662702e
SHA1 49a4865deb8cdb6b91a6894e164559672d3e251f
SHA512 3a54ab1165b321d78a3b24967567ced00d2c6d64d51688e3e3016167cbbaced73cd5d1703bf69fcb25923a95c75e916ad0fe5c03a0403dbeab18a35f38a52314
SSDEEP 24576:kIxIZGnThquyQ2wv/JYIjXeIn/9FD3xBfveqZD1Eycg3wKXnaERvkNg4P:ywTUuyQ2wZYIbNFjvfGMEycowKX92g4
TLSH
T149955A46B6AC40EAD47AE23CDAD7461FF27178102761A7CF23A0479D6F27BD0497A360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

764729ac-c203-47a0-bea7-70e141c7d0e7.tmp

Path C:\Users\Admin\AppData\Local\Temp\764729ac-c203-47a0-bea7-70e141c7d0e7.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c675076e-845a-46d6-8e23-0ed39e315c2b.tmp

Path C:\Users\Admin\AppData\Local\Temp\c675076e-845a-46d6-8e23-0ed39e315c2b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

85c90553-4717-4e15-a07c-69f2709312a0.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3816_488020419\85c90553-4717-4e15-a07c-69f2709312a0.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3816_692319307\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppSettings.json

Path C:\Users\Admin\AppData\Local\Viper\AppSettings.json
Size 3KB
SHA256 11072417506dfcaaa0822913d82321ce006bb7a15ae90f1b5984a0e4c51aee0f
MD5 fdb637b21ad89e4ec0c28d1c08b0e58a
SHA1 334967e844842ba293226bb61c8313093dede7f4
SHA512 d915dafe1983fc0f7637ee45f1d55de2bc78f140d1ee63c5722850895b63cc07b1c7c5029815ffa5738c43582fa2d6787564d9197e5e78e66ed2145c338429ca
TLSH
T13C71C032E81054FE59BA956DD068D647AB600F6B22300CAFF9FF190E657BA323141FD6
MD5 SHA1 SHA512 TLSH

Submit Download

ClientAppSettings.json

Path C:\Users\Admin\AppData\Local\Viper\RblxVersions\version-d584fb6c717a43d9\ClientSettings\ClientAppSettings.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

sky512_rt.tex

Path C:\Users\Admin\AppData\Local\Viper\SkyboxPack\ChromaKey\sky512_rt.tex
Size 2KB
SHA256 eeac6dbe921a9841190645bdf545dfa58d5d63b8cb225dc5dd674ad90e9fba9b
MD5 fcadb250780ccb53a0f15d821391d063
SHA1 24d53a65711940bd85f24df96e6fe792cf2569ae
SHA512 f6e222344d5cc6571959830c6a7cd63ebbe04dd989aef49a72f0daaa03290439b8fc7004e6ba26ed91aca733f6d80257c457ead45b66477b519cea4a3879549d
TLSH
T19F41276195A00FA39675C81183834CB1C7F30FE00FA9A3A6C38D5158A24AFA8A88E9C0
MD5 SHA1 SHA512 TLSH

Submit Download

State.json

Path C:\Users\Admin\AppData\Local\Viper\State.json
Size 977B
SHA256 d66410be14aa683159d744511bfc3b28d6b1962452a335323d904b3b838d60fe
MD5 bb3ffe68b970a07e4aa8ee7b64a40bf4
SHA1 34a0ea0546e3aff1095abd84597d80e583f1cd36
SHA512 729b7fa143e9580bc81191b3442ea28efaa506def6358afd6bdeadcca3981c1fc413bbc2d7a4bc5d02b95876ea250253cb00287d00f07b210a87849fbdd815cf
TLSH
T14A110826CD58CEB987798664A0BBF210D3080BC72093DD4B72B9652C8BF217716F46B5
MD5 SHA1 SHA512 TLSH

Submit Download

sky512_bk.tex

Path C:\Users\Admin\AppData\Local\Viper\ViperMods\PlatformContent\pc\textures\sky\sky512_bk.tex
Size 682KB
SHA256 eae298532fcc04ac380d78d7cf64a26d37984b8e8af56f34ae6c18cfb2439418
MD5 4ce299ee102e97588c9ce7aace046cab
SHA1 931f0e08bf641ecbab53b080f3ae9bbd8f620cce
SHA512 14e97b2c0449cda57280140ab7737c58d79de7f405d576672bad1ddc413a207cb3def3903ee62b7b4904cf4c6b7abf451863a87479cbeba0fbc873e51c5b883b
SSDEEP 6144:QZcAjXUwfXUQcaujBQ1OYoD/6N76c3uGN9hIFbqQ5xUcB:yct68auBQExDw6c3uG1Ij5ucB
TLSH
T11AE4098E767550CE3F3723DAAA15B4B2E306E21DB26335F61B2F5188367742DC9B1920
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sky512_dn.tex

Path C:\Users\Admin\AppData\Local\Viper\ViperMods\PlatformContent\pc\textures\sky\sky512_dn.tex
Size 682KB
SHA256 97b98273a4261e4d36829a4aae4892837ca27c70bd22251bd7799c50516d605e
MD5 383fe0258cda26e908ea4a9bd2522b14
SHA1 18fc467f81197db8532e4784d72e9e32e122a810
SHA512 7ef6fdadb1e7e27468bf80ebe95059e6a2857f360d8dc1f4b0ca4a86fc5eb8c6156b6c38a1a17aa45f0d5fac3e247d838f27412c83f095f2c1052b0b54659f56
SSDEEP 3072:DS7zPPGKhNAXYIX/w1xMhryRBi1NjB7C6ZQUDPkWF0SU/r5eJiWwUeWd8qF:eGhYyRhryRBi1NjB7C6lk3Si5CCW6qF
TLSH
T15EE4EECCA27565C6851B57E0E920EDA1E30A726EF950306E177FE1AC743B82DDE26C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sky512_ft.tex

Path C:\Users\Admin\AppData\Local\Viper\ViperMods\PlatformContent\pc\textures\sky\sky512_ft.tex
Size 682KB
SHA256 714c08b0dde8049a501eb81dc2f5e720ef785770970929934e58a575548f92d8
MD5 5a466b46a2e25c0f26c595ac6adcf9fb
SHA1 cb1ea78d4dd31f88e32946005f43115bf94b27a4
SHA512 20b7c9c164b089859490019338c2e9b73351f29cfd38db97063e12485ffb6d6eb79ffcbe6c64750886e755c5753f4e201e51d4ed07f358e5a9bdce484ccbebde
SSDEEP 6144:Sag6EnqqMMgKdVcoCSUR2R2LxfDx+Ofyz+vvBVftTmM:fgRnMMpV67R2R2Njfyz2
TLSH
T1C3E4A64EB67640CA5E3727E55A24B465D31AB32EF1B139FA167FA088347F43DC8B1812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sky512_lf.tex

Path C:\Users\Admin\AppData\Local\Viper\ViperMods\PlatformContent\pc\textures\sky\sky512_lf.tex
Size 682KB
SHA256 46dd4ba796c65d23ca6b4cc4d8ae48f6535f2f888a3bcfbc581d5f767a3b747f
MD5 eeddf22de1228bc4ea67f1128cdfaad4
SHA1 676cdd7a49b8d5d18b20d1beb8a43555f3d96553
SHA512 a614c0d2bb4320c70fc96e4c02b79d60b16992475f60254d5d3cc55b5aa939e116cf3724422dc7129b426e031f3176469c7b4e482a3469050b480c7361d07a28
SSDEEP 6144:aHuGtOkr2lfrKunWhy+0tjYz9UOYuszCBdZNEMX/V+VbhbVPzNH:aO5kCEunaojHAszY1XN+Vbh9zNH
TLSH
T14CE40ACD7A7550C97B2323D6AE15B4B1E20BF26EB16234FA1B1FA0443277428D9F5D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sky512_rt.tex

Path C:\Users\Admin\AppData\Local\Viper\ViperMods\PlatformContent\pc\textures\sky\sky512_rt.tex
Size 682KB
SHA256 8719aac7d496b20e4198b5407b64c5571e3f241309edc9480a41806efb046560
MD5 1991a94396b8f0ed2b28805cfc17d2e8
SHA1 4c2b313b4c542bc4e007c7f47c3d3ece6dc3f6e9
SHA512 ca13c926f238351acb5a8209c1596f917c0fe91dd91f8012a34950d0d99bbaac57de6a40c8c05522da8c74b0f3dbd0b492f09b87a142badb5b15b1c21a44f678
SSDEEP 6144:tlKydRE1sZ/pRzQNakQaMaOgIqUXb5b0hJjpr0JCxpsaTC5t:tQydRosZ/TzQqgZUXd0hJjpr5xpfTkt
TLSH
T196E4550EE23790CA9E6B17E55A246861E30EF22DB1B135FF1BAB509974BF03DD8B5011
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sky512_up.tex

Path C:\Users\Admin\AppData\Local\Viper\ViperMods\PlatformContent\pc\textures\sky\sky512_up.tex
Size 682KB
SHA256 672375765f9c10387d204bc319dc98537a0e077a8ef395824f0f2dcde6de0f0e
MD5 f89f7a41395b548fa07bd0d295840e99
SHA1 8b61b2244fc9a505539b066da38cb0385b76bec8
SHA512 65345167dfe1ed1f141f3a939ca1f252539553e656f50e911c81dbba145d815d4243893e285756d7c9f8f703f41db1d50dc428c6425833a690744f1b410cb93f
SSDEEP 12288:4cHF30Onio8y6DUgD7YQ7MDOYwBoY01Lo:4cHD38ygFPYQoDOYwBoY01Lo
TLSH
T138E42D2AD86969C78733EB10A07494E1FC9640EE3C43862D497799ACB4B3EE53B1F543
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1856-515-0x000002E54F670000-0x000002E54F852000-memory.dmp

Download

memory/1856-684-0x000002E54F670000-0x000002E54F852000-memory.dmp

Download

memory/1856-442-0x000002E54F670000-0x000002E54F852000-memory.dmp

Download

memory/1856-516-0x000002E54F670000-0x000002E54F852000-memory.dmp

Download

memory/1856-491-0x000002E54F670000-0x000002E54F852000-memory.dmp

Download