c69532f53f93b910e5d488690351f1b1833aa000263c462d1cf2641446f6d218

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 14:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
Size 24.1MB
Sample260817-ry8lessdjd
SHA256 c69532f53f93b910e5d488690351f1b1833aa000263c462d1cf2641446f6d218
MD5 1a945169c183e0269a33f116d07af2e5
SHA1 b4af35eb26f1d06532e3dd2bdd47562baf75ee32
SHA512 7a4c219c014ce64d806187e2620d832164a054dbda1a12a964c76824a35490e47fa114b8c6f0a83013a26c06d6df1b55b72b7a216e28259aba3207f9fe885f68
SSDEEP 393216:g2bqxNyNrJjFkGzt53FJvxzowLnELOC7RKq0DdGD+zqY2U9SqKu9He:grxNyT59hFxVjE/wqcdUm1NUqKn
TLSH
T12F473337C9A374D8DB1D51784ECE2CEE737CAE88450446CBA76137B72B29604066BB6C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 41 IoCs

pid	Process
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_86905246\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2090918739\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_2090918739\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1112645757\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_1112645757\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_526094971\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_526094971\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_526094971\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_526094971\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5292	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314510661801683"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{2618E90E-5852-428C-BE5A-92E4276F7327}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2384	msedge.exe
2384	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5044	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 1060	4904	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe	89
PID 1060 wrote to memory of 5044	1060	DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe	90
PID 5044 wrote to memory of 4220	5044	msedge.exe	91
PID 5044 wrote to memory of 4784	5044	msedge.exe	93
PID 5044 wrote to memory of 5292	5044	msedge.exe	92
PID 5044 wrote to memory of 4784	5044	msedge.exe	93
PID 5044 wrote to memory of 4784	5044	msedge.exe	93
PID 5044 wrote to memory of 4188	5044	msedge.exe	94
PID 5044 wrote to memory of 4188	5044	msedge.exe	94
PID 5044 wrote to memory of 1168	5044	msedge.exe	95
PID 5044 wrote to memory of 1168	5044	msedge.exe	95
PID 5044 wrote to memory of 1168	5044	msedge.exe	95
PID 5044 wrote to memory of 2608	5044	msedge.exe	96
PID 5044 wrote to memory of 2608	5044	msedge.exe	96
PID 5044 wrote to memory of 2608	5044	msedge.exe	96
PID 5044 wrote to memory of 4176	5044	msedge.exe	99
PID 5044 wrote to memory of 6092	5044	msedge.exe	98
PID 5044 wrote to memory of 4176	5044	msedge.exe	99
PID 5044 wrote to memory of 4176	5044	msedge.exe	99
PID 5044 wrote to memory of 6092	5044	msedge.exe	98
PID 5044 wrote to memory of 6092	5044	msedge.exe	98
PID 5044 wrote to memory of 124	5044	msedge.exe	100
PID 5044 wrote to memory of 124	5044	msedge.exe	100
PID 5044 wrote to memory of 5376	5044	msedge.exe	102
PID 5044 wrote to memory of 5376	5044	msedge.exe	102
PID 5044 wrote to memory of 5376	5044	msedge.exe	102
PID 5044 wrote to memory of 2176	5044	msedge.exe	104
PID 5044 wrote to memory of 2176	5044	msedge.exe	104
PID 5044 wrote to memory of 5692	5044	msedge.exe	105
PID 5044 wrote to memory of 5692	5044	msedge.exe	105
PID 5044 wrote to memory of 4960	5044	msedge.exe	107
PID 5044 wrote to memory of 4820	5044	msedge.exe	108
PID 5044 wrote to memory of 4820	5044	msedge.exe	108
PID 5044 wrote to memory of 2840	5044	msedge.exe	109
PID 5044 wrote to memory of 2840	5044	msedge.exe	109
PID 5044 wrote to memory of 1124	5044	msedge.exe	113
PID 5044 wrote to memory of 2688	5044	msedge.exe	114
PID 5044 wrote to memory of 3976	5044	msedge.exe	115
PID 5044 wrote to memory of 1000	5044	msedge.exe	116
PID 5044 wrote to memory of 1000	5044	msedge.exe	116
PID 5044 wrote to memory of 2432	5044	msedge.exe	117
PID 5044 wrote to memory of 2432	5044	msedge.exe	117
PID 5044 wrote to memory of 596	5044	msedge.exe	121
PID 5044 wrote to memory of 596	5044	msedge.exe	121
PID 5044 wrote to memory of 3320	5044	msedge.exe	122
PID 5044 wrote to memory of 3320	5044	msedge.exe	122
PID 5044 wrote to memory of 1324	5044	msedge.exe	123
PID 5044 wrote to memory of 1324	5044	msedge.exe	123
PID 5044 wrote to memory of 2384	5044	msedge.exe	124
PID 5044 wrote to memory of 1320	5044	msedge.exe	125
PID 5044 wrote to memory of 1320	5044	msedge.exe	125

C:\Users\Admin\AppData\Local\Temp\DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
"C:\Users\Admin\AppData\Local\Temp\DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Users\Admin\AppData\Local\Temp\DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe
  "C:\Users\Admin\AppData\Local\Temp\DOCTOR SQL - SQL Injection Testing Suite By @DR_X_LOL.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/DOCTOR_X_LOL
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x314,0x7ffa382dc188,0x7ffa382dc194,0x7ffa382dc1a0
      4⤵
      PID:4220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1656,i,11669629846654509192,17237565232393867224,524288 --field-trial-handle=2476,i,14889759281172921094,14405309375896711476,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:11
      4⤵
      System Time Discovery
      PID:5292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,1575823010363340933,8819975368711996432,262144 --field-trial-handle=2476,i,14889759281172921094,14405309375896711476,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:2
      4⤵
      PID:4784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,3070166267390094078,254915157913957307,524288 --field-trial-handle=2476,i,14889759281172921094,14405309375896711476,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:13
      4⤵
      PID:4188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,440304071903110210,3428532758546656842,2097152 --field-trial-handle=2476,i,14889759281172921094,14405309375896711476,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:1168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3640,i,12856283880768902756,1596049090192817741,2097152 --field-trial-handle=2476,i,14889759281172921094,14405309375896711476,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
      4⤵
      PID:2608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,16401020066007907486,8981956484654017152,2097152 --field-trial-handle=2476,i,14889759281172921094,14405309375896711476,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
      4⤵
      PID:6092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,14375676380434845563,12260175194312991865,2097152 --field-trial-handle=2476,i,14889759281172921094,14405309375896711476,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:9
      4⤵
      PID:4176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,7369483025012992963,9786791803050855443,524288 --field-trial-handle=2476,i,14889759281172921094,14405309375896711476,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:14
      4⤵
      PID:124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3684,i,17962194086316288745,90659180242141514,2097152 --field-trial-handle=2476,i,14889759281172921094,14405309375896711476,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:5376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,1570359533974010474,6445945695846969470,524288 --field-trial-handle=2476,i,14889759281172921094,14405309375896711476,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
      4⤵
      PID:2176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,7898511481830848609,14176426435444816900,524288 --field-trial-handle=2476,i,14889759281172921094,14405309375896711476,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
      4⤵
      PID:5692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,1343862552894639387,127262889425633335,524288 --field-trial-handle=2476,i,14889759281172921094,14405309375896711476,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
      4⤵
      PID:1320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,1343862552894639387,127262889425633335,524288 --field-trial-handle=2476,i,14889759281172921094,14405309375896711476,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
      4⤵
      PID:4960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,13811693588848501366,14966168999346326928,524288 --field-trial-handle=2476,i,14889759281172921094,14405309375896711476,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
      4⤵
      PID:4820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,9723812610092552184,6437676853634778218,524288 --field-trial-handle=2476,i,14889759281172921094,14405309375896711476,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
      4⤵
      PID:2840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,13555731129538977635,9431026017379623589,524288 --field-trial-handle=2476,i,14889759281172921094,14405309375896711476,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
      4⤵
      PID:1124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,1630332976568567940,6826125059349836947,524288 --field-trial-handle=2476,i,14889759281172921094,14405309375896711476,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
      4⤵
      PID:2688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,8518477998996564086,15554652558489742515,524288 --field-trial-handle=2476,i,14889759281172921094,14405309375896711476,262144 --variations-seed-version --mojo-platform-channel-handle=740 /prefetch:14
      4⤵
      PID:3976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,9268266918731776685,11586224999491712941,524288 --field-trial-handle=2476,i,14889759281172921094,14405309375896711476,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:14
      4⤵
      PID:1000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,16084322331561979890,2238402657139640362,524288 --field-trial-handle=2476,i,14889759281172921094,14405309375896711476,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
      4⤵
      PID:2432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,8624596420152153226,9079838915944734739,524288 --field-trial-handle=2476,i,14889759281172921094,14405309375896711476,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:14
      4⤵
      PID:596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=912,i,1636754979237899284,14736329399219610418,524288 --field-trial-handle=2476,i,14889759281172921094,14405309375896711476,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:14
      4⤵
      PID:3320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,12985077607128852741,14687334945332316623,524288 --field-trial-handle=2476,i,14889759281172921094,14405309375896711476,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
      4⤵
      PID:1324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4880,i,7606117053510896373,4836699241394809604,262144 --field-trial-handle=2476,i,14889759281172921094,14405309375896711476,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,12434499901162343909,7966083786149623289,524288 --field-trial-handle=2476,i,14889759281172921094,14405309375896711476,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
      4⤵
      PID:1320

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3770c089-d98d-4e0a-9ce9-fd0b478141f3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3770c089-d98d-4e0a-9ce9-fd0b478141f3.tmp
Size 35KB
SHA256 d9ebfe3b30a71dcf83ce3e128a13e50207fd4fb92600855b6779d5c2dec7317e
MD5 1d6412defa14ef52b3386b861554a32f
SHA1 703615fd8338b456fba1a27539c411bc14ba5661
SHA512 9ec881dce6ad77bc65315254617491efe9fd60e781da6e25fce37cee25a9d25e7601d6724da8e0c9703d85932cac77ba86c477f154953f5e3956ae976a735f51
SSDEEP 768:m83TZdqG80D5Pt6K48dHeByERRFzjK3YrPi9P7yK:m83KG/5Pd48dHSyw/lPWyK
TLSH
T114F2BFB069A85EA35CEBE64976933757EFF04223D4D41B68D1DCEA0E448359D070BC2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 6deb91beed57d9eedcd7fa2d38b94a5b896b4ff5addb079ee1bb1f2e3a054ede
MD5 98ac2dba59e50ebbc8dd957d1b448f34
SHA1 884457ccb0a4b3889328dfadb1220c19f77efbbe
SHA512 9551c69df0d6188387310f36b1cce6d4e9be6b766195d4f99e12c1d3e13ce8b68b3da079891e7b2e9ac9f1178df9e5c488df71a560eb9af7bde1d5deead5aff2
TLSH
T12B41FCDB5FEDBAF9C331457235E1055FF3FA82AA450B6F1440432DB4A906F1910D1067
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a6b43c09f29463796bcd52f2ff3e2ae2a78490ba27418f1f6a54f8f21ef527e7
MD5 f9d95f563ba9a9e541f9ca1b2ca7245a
SHA1 f2e58a4df50927b15a821b1755001dce63a9e203
SHA512 450e147a8b4c01155913868cfff20b22aec4b544a5225bcd49d4ac620e8272b6aa679b48de431f5a03a50ae018ac88af3d3b710e85de29fcf9c130660196e18c
TLSH
T10041EFF783F4853D8A1196F0AA146E2FCE1C0525432C7C5689E0AE2B93F3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 99a43718e3cd155e9c4a77f7f465e1fd327653863330649421807de98473e1e0
MD5 715e2bbaa09852c753614955fb9dc76e
SHA1 1dfbbd33bfcb6c6fd25f2442062807fb4556e41a
SHA512 9edca8fac65ed4d83ac193a485221ce4de1c106102830bef3840ca38320475bd5b066e0bbbee752eef4742edc7aff6158ea2a8eb4cce9ddb5a45d987d4530835
SSDEEP 192:sxRERLCv/f0sVdfZo0ezoA8p8j/g6+WNm0Y/YEvluKDG8IgVpJ:sxREsv/f0sVdBxDe/5W/MiB
TLSH
T19442C7556D28993B8CC7E209BB65BF53D3F95136A1D02E08ABFC961C04E7ADD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5c9875482f88dc6701e7cc3297dc56c4e6f50e2b3fd784b2851828af710ad6c1
MD5 f1f1704e221d73ded9f63d3853568e9e
SHA1 cb8c817859bda6652b3c39090ddc08b6e23f92e3
SHA512 361150fa4105e15519a5009178bd8bab322adbee855a7ac5224061f3a90ed6bb00fa28e5d961315bed4de5ea94d17c7e038ad976191ade4729d469c74c33b484
SSDEEP 192:sxRTRLCv/f0sAdfZo0ezoA8p8j/g6+WNm0Y/YEvxuKDG8IgDrpJ:sxRTsv/f0sAdBxDe/5W/4ib
TLSH
T1A342E8556D28993B4CC7E209BB65BF53E3F95136A1902E08ABFC9A1C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3a653cb5b2a8d134c70f646a717945ea91c1da908a9f70bb2025ee319c3764ed
MD5 75e371c94e57239f64b42fbb1253cb50
SHA1 2784a5ab7254b8ccd705dab17556f73e44505910
SHA512 238eb6906681187b2b9a0af10ba4b1518298ff8c4979289f385490493c5c24be0a27037b450f76af885f0e88fd89f02fd9c9a5fddf14185f75efaa691d8a56be
SSDEEP 192:sxRTRLCv/f0sAHfZo0ezoA8p8j/g6+WNm0Y/YES5uKDG8IgD5pJ:sxRTsv/f0sAHBxDe/5W/BiJ
TLSH
T10042D85569289D3B4CC7E209BB65BF53E3F95136A1901E48ABFC9A1C04E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 8f7d59c47047a213eeb8876f729641e19059e66080a29685a1f1b2bbf84b4ef8
MD5 d3c788e240f5d8791dcbcc0c5139b134
SHA1 dc3fed0b35071f0c39fb371d0314de8b6ce4dbc2
SHA512 fbfc123965a01c9627202b9333e08c62da533879c5914b87175c473c03cf4776c57bfd3ec6630fe740fadcb7206c7e5a08922cd56559f27eb2fa0f8c8138be99
SSDEEP 768:0UQiEW7pLuL7PaWgH7feQ8F1+UoAYDCx9Tuqh0VfUC9xbog/OV2j2OVqjro5T6q:0UQiE2E7PaWgH7feQu1jahj2IqQB
TLSH
T1E6D2EB7B740DCB7F4F804ADDEC197E8A6DA802CB9698CD8047FA945C02C7BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 8383b2cce693c7daf55f7779e6dcc6233a8082119f8b6fe5a4e9d7eb8c02f2d4
MD5 1b09a26b255278d059e58646b60ba654
SHA1 da3ba12919f639ccbc53c6bd16be0453ee282afb
SHA512 6d53c495e958376560f5aced7a251e492e3dd5c5eab098f9db6a6b5d9b57353a429004df0321dfffbad45b599da01dc5ee6ebd9f769d96ff428f58a3698c0027
SSDEEP 96:KRxOf7JrvbWf8qgjbK4igtbcx50HPoH0VAE+imkWivPgMkK4BgGkckEP+Hi0K/6w:CxOf7Jrv6f8bjhigtIx50HPoH0VAE+iA
TLSH
T128B19244757F03D57C7E6A0C91A9892EE68270B77258E82F7BE904A10F67E024DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a4b14.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a4b14.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 231186b8ece4af470b4acde555aaa7f7488eb7c0096233e1bbaeec2b1f5d881a
MD5 ce515854bf4e27ed9af154488bd4598d
SHA1 5f38ea9d14f23cf68f345b0e0f151b5c805164f0
SHA512 302a914d12c7838eb42f35bc9aa59c59ab66a61c03301e471dabc417104befb0967299f23ea27faba49ceae953e18c17988959092fdd77c25d3cea7396849301
SSDEEP 768:h83TZdqG80D5Pt6K48dHeByERRFzjK3YrPi9P7yK:h83KG/5Pd48dHSyw/lPWyK
TLSH
T188F2C0B069A85EA34CEBE6497A933757EFF04223D4D41B68D1DCEA0E448359D070BC2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 1ee30eccaaa56601be786731628df77bc28ad93e914151000a8bcca664bb3cc1
MD5 7e2955cf7f1182b3a79394614cadde32
SHA1 32adb2143e1f8b12d935f3636741f91f42762571
SHA512 52c9215e0e685b8613dff09d1f985bacd9b21c081d00b6845bbe15c0d0df9381cc48e172374cfd02408ea80046d873350edcda950c28ba66ad65632b31c31527
SSDEEP 768:XFhB3FwgCZdqG5IDPtpK48dHeByERRFzjK3YrPi9P7yK:7B3HGePC48dHSyw/lPWyK
TLSH
T1061339F098D79A76D8AE9787677D2E469AFCC123B4885594B7C89D0DCC820BFC30AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d6d05b3ad9acfd32d54a911dd4dfead6693ae20242e3fff7412a1ffca23a4dcc
MD5 0a5d8ed122fed6b9bfeafc9d9bbfa2bb
SHA1 a02f36c7168e46a10b3b9738ff8b6cb0e9aafbf6
SHA512 03b8249646ef88fdc107a2d15ff9fba68f096e8b8b6a275931c9be05b95a5c339b27fe1b26890960ae7bacbf2c792ce54dfe06e21e57dbb684ccbc318e25f477
SSDEEP 768:R838ZdqG80D5Pt6K48dHeByERRFzjK3YrPi9P7yK:R83hG/5Pd48dHSyw/lPWyK
TLSH
T1E4F2BFB069A86EA34CEBE64976933757EFF04227D4D41B68D1DCEA0E448359D070BC2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f45dad95f8fab23fafbe5e982347ac7ee45a1c791743d4cd4e54d11201e74b90
MD5 e7444a8323568663881afdd473ace397
SHA1 405063968a514704a3b5134f9d1f19f3b0f4502a
SHA512 a78f08eca6b24f3d7c8bcb1c0628019c2fd7b10c2c085ef46c20066d36035ee0a9cf882cac1a11d9c5ef4c36f164190edbcbe2b8335642aae8e06d925f1d70fe
SSDEEP 768:Qrv+4UNbdf3wqGxGD5PsK48dHeByERRFzjK3YneVH1SCj:QbsbJ3RGw5P548dHSyw/5EH1Z
TLSH
T18303BE31A8A85A734CE7928D76837617BFF4411381D81BA4C1DD6F0E868B4DD030BE2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 8e9882a33e42e538fe399a6256c9104f254059d2a63ee5b35840ab5f260b0195
MD5 09d0148903455e531be68d264704e360
SHA1 40b727975735572c86bc46ab978146329745a69d
SHA512 76f19567d83442f056548c1314c80183e87bf7f3ce3ef9284e8864deb719f469fc6ce6f0ed735160485e7208dc707ee7b1c0b5a4aed2cac8da10b9bb1ccac219
SSDEEP 768:Urv+4UNbdf3HqGReD5PtrK48dHeByERRFzjK3JreVH1SCj:UbsbJ3KGY5PU48dHSyw/yEH1Z
TLSH
T16A03CF70A8A89E734CE7A28975837757BFF4412784D40BA4C5D9AF0E85870CE170BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

ebd9ac1f-7b19-4d77-b3c9-b203f68b43c0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ebd9ac1f-7b19-4d77-b3c9-b203f68b43c0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

DOCTOR SQL Premium Edition By @DR_X_LOL.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4904_122315_OzXSs-kisYA\DOCTOR SQL Premium Edition By @DR_X_LOL.dll
Size 36.2MB
SHA256 eab43cb680b2b85f0da66bdc2796d8af6f51932e0076be3228d1a02b16320238
MD5 a0a7ed2bd571718d72e85612ef4a0410
SHA1 14da874fba0ff815d33e00522abd16ffbc65005c
SHA512 0c70a69eb2df27867b8d0b5dcf34662b80959fd0f7cb4b640db45474eecbb1ce61c7ce2492f1aec33185f274b740b99b2f2c2a0da5d757f0d3108ffd9bae085e
SSDEEP 196608:jUxqEI0pcEQ3O8PtmO9jgqAQbA6oe4XEA0btVODQDa7ZyY:tELyzO8PsO9j9JbAANbNDa
TLSH
T178873B03E13220EBDA56D0B45F1AA0B39B68FC2D513079F2BBD989312757D61EE2C758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4904_122315_OzXSs-kisYA\MSVCP140.dll
Size 544KB
SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
MD5 bc88b387cafa556068b5c5d6ff3ccc8f
SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
TLSH
T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4904_122315_OzXSs-kisYA\MSVCP140_1.dll
Size 35KB
SHA256 bfad5aef4c63a669e3c140655cdfdf395b6c979b400a447bd5dcb65ed8826c3d
MD5 2a214cb2f0f9473e7765ee3b8db8651e
SHA1 9ce5c3d6c7d94b175f136f552af8771dca6147b3
SHA512 ea9a759babdec5818fa1e430d1cb453cac762cfaa8f934e01d7182100f66cae21527962696f5bd963fcb0fba2c0f38bf4028e75f89e9e599ddee008021646a33
SSDEEP 384:3jJ2J9VQH+qNy09dmFWcS5gW7YZ1gr4iSt+e92xS+R9zWd/I1IHRN7SUl8BR9zTr:d8QH+qNy0PmgogU9v2ci9zeHSn9z3
TLSH
T1C3F25D86F7248442EC674970C699EE837C3DB3D25B50969B17A5F61C0DA33C1FA34A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140_2.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4904_122315_OzXSs-kisYA\MSVCP140_2.dll
Size 273KB
SHA256 3ea06f0ee098b4823cb79599df3780e7f23cce52c19aac31d2a0d47efe33a5e9
MD5 3151333808c2c2339d5f5466df70b7dc
SHA1 e48159bb2127ec812ff679f6fabc41141009f26a
SHA512 8f1daa078e124dc89b51b84baab8d6cc2d77497be23b2ba95ef3fee54d9034e17bf5cd15a4043d025699972cae20f9c46d2e7bef48e4283f3ad9ca6b84fc64d1
SSDEEP 3072:1J51P7emwi1j+XZi7b1dbqtH0h6XV3Q0JPQo07ICl3Sg2xmygdCg2LMeDh5FD799:1JbjwvnQo/iy5L/XxTWrNM
TLSH
T1AD543912B51A2EBFC5D6E8B04939B416FC223A418775C48A57C31C8D9E2BB437FE3529
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtWidgets.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4904_122315_OzXSs-kisYA\PyQt6\QtWidgets.pyd
Size 4.8MB
SHA256 4f81361816e94e1ae05f178085b22d5b9b19e417713b1966dd481a4017aa3b21
MD5 a1a3f9d449ac15577ac07b9f7e225f5d
SHA1 9bdd0508688c642c74b772fa923a7293339e55c8
SHA512 0748df098a6e40d461e5436d86368666fb6b6ac875dea344404bd0b15813665f186a2c3bd581f004ea5c82d6c759cad75ac6f19f845a43ad0e9285782eb8d96c
SSDEEP 49152:edW8I4zpIoqkn0ZXrJZxzaOhWtbd13LrYxA/NCNNWAl5YKm3VWI3Y7l3eh5vINxB:ec8zIIYxAEe3WpKgOK
TLSH
T13436B3039B5A60C9D5EBD13ACA9B520DFAF230A0072657DF0C6A1B992F73BD0853D794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Core.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4904_122315_OzXSs-kisYA\Qt6Core.dll
Size 10.0MB
SHA256 fae4778a42e93adc82b831c879c886a05147e9cc26760808d21116be5547259b
MD5 3b5c8f8981b2cca0c4741dcf09d7a79d
SHA1 a5179fbfc72c59a5aca26ebdbb08d944ce5b864c
SHA512 4bed16fef4c00773892fb6da163134cdf7819ccb165987e5bbdcf9153d7b042490be14eae984903e84b48b61fadc6f5735671df16641b3b131c0c0ecdb5260f2
SSDEEP 98304:meAbhLTfRmoOKFdu9CwJsv6tnYNJMAA1gcV/3cNuWXelc:mhn8KFdu9CwJsv6tnuSA+/3cNuWXB
TLSH
T1A5B6390766FA0102F6FBDA34DAB75116DBB27C466B3096EF025861185D337F09E3A326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Gui.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4904_122315_OzXSs-kisYA\Qt6Gui.dll
Size 9.1MB
SHA256 8fceee959a670372aaa5763287c2ef7924cd9ecdbe2c29cf4b6c12a63079c503
MD5 5d0da93b83dc26e65d414ff04cf86e21
SHA1 b50cf7f75e9003825e1097f7ad095157b3d564fb
SHA512 cbdf076636b80c412fbdeda23593826e4cbe62b056f08d7357955b3be9719e4684c9b4db88c6b368b6783724eadc3a8826cc2da336f13d9bbfa16b6ba615aaba
SSDEEP 98304:+frUrVK+HdzDGqLVUkG/9r1hzJbgseVxDVkqtjuQQ2SI:+fABfzDnUfr1hzJb7QxvjBQXI
TLSH
T147A68D57A2A911D8C47BD13C8B9B9517EBB2701503529FDB01A5CA162F33BF12ABF321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4904_122315_OzXSs-kisYA\VCRUNTIME140.dll
Size 106KB
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
SSDEEP 1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
TLSH
T1A0B37C4A72A441F7C5AAD274C2E38A06FB71B541877093CF03B19A690F63BE15E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4904_122315_OzXSs-kisYA\VCRUNTIME140_1.dll
Size 48KB
SHA256 e4b533a94e02c574780e4b333fcf0889f65ed00d39e32c0fbbda2116f185873f
MD5 7e668ab8a78bd0118b94978d154c85bc
SHA1 dbac42a02a8d50639805174afd21d45f3c56e3a0
SHA512 72bb41db17256141b06e2eaeb8fc65ad4abdb65e4b5f604c82b9e7e7f60050734137d602e0f853f1a38201515655b6982f2761ee0fa77c531aa58591c95f0032
SSDEEP 768:YEgYXUcHJcUJSDW/tfxL1qBSHGm6Ub/I2Hi09z0XQKBcRmuU9zuKl:YvGS8fZ1esJwUpz0X3B+d8zuKl
TLSH
T1F6236CD593785082D49BA9B08197DE17BE3CFA924B50928F0BA1D15C2F637D0A73D22E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4904_122315_OzXSs-kisYA\_bz2.pyd
Size 82KB
SHA256 02d772c03704fe243c8de2672c210a5804d075c1f75e738d6130a173d08dfcde
MD5 c7ce973f261f698e3db148ccad057c96
SHA1 59809fd48e8597a73211c5df64c7292c5d120a10
SHA512 a924750b1825747a622eef93331fd764d824c954297e37e8dc93a450c11aa7ab3ad7c3b823b11656b86e64de3cd5d409fda15db472488dfaa4bb50341f0b29d1
SSDEEP 1536:FFzZz757cav+IuK66nlxX8W8LsANVIGCV87SyixL7:DzZzq6n3MhLsMVIGCV8O7
TLSH
T1F2839E93F3A055B5E41BA27699A10357E371FD4A039093EFB348835B2F13B913D6932A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4904_122315_OzXSs-kisYA\_ctypes.pyd
Size 121KB
SHA256 bc3b83d2dc9e2f0e6386ed952384c6cf48f6eed51129a50dfd5ef6cbbc0a8fb3
MD5 10fdcf63d1c3c3b7e5861fbb04d64557
SHA1 1aa153efec4f583643046618b60e495b6e03b3d7
SHA512 dc702f4100ed835e198507cd06fa5389a063d4600fc08be780690d729ab62114fd5e5b201d511b5832c14e90a5975ed574fc96edb5a9ab9eb83f607c7a712c7f
SSDEEP 3072:kuiS11BYNd+5AWdu41qOqJ/f/EX4lCPIWu1ptpIGLP+z:Pl1U+Ke/16f/ExWI
TLSH
T13CC36B0B339410AAEBA34179C5B36E07D7B1B45A175087CF12A4C69A2F637936D6F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4904_122315_OzXSs-kisYA\_hashlib.pyd
Size 63KB
SHA256 e47e76d70d508b62924fe480f30e615b12fdd7745c0aac68a2cddabd07b692ae
MD5 f495d1897a1b52a2b15c20dcecb84b47
SHA1 8cb65590a8815bda58c86613b6386b5982d9ec3f
SHA512 725d408892887bebd5bcf040a0ecc6a4e4b608815b9dea5b6f7b95c812715f82079896df33b0830c9f787ffe149b8182e529bb1f78aadd89df264cf8853ee4c4
SSDEEP 1536:CQGllrIdcGuzZc94cVM7gDX4NIGOI67Sy+xzn1:I6cvz+9IgDX4NIGOI6Sn1
TLSH
T1DA537E46A2814498D92781B5D9A34E97FAF1F1051B11A7EF0368C2CD2F337C396FAB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4904_122315_OzXSs-kisYA\_lzma.pyd
Size 155KB
SHA256 34130d8abe27586ee315262d69af4e27429b7eab1f3131ea375c2bb62cf094be
MD5 4e2239ece266230ecb231b306adde070
SHA1 e807a078b71c660db10a27315e761872ffd01443
SHA512 86e6a1eab3529e600dd5caab6103e34b0f618d67322a5ecf1b80839faa028150c492a5cf865a2292cc8584fba008955da81a50b92301583424401d249c5f1401
SSDEEP 3072:RmuEE9tZBoI+1hINrznfB9mNoNSn2Vh/VDxuVIGZ1L6E:RmuFPobkNpYONnvfuCE
TLSH
T14DF33992A394F4E5F7228C78D6624F13D7F678490310929A12CCC36D2B1FB759A2E727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4904_122315_OzXSs-kisYA\_queue.pyd
Size 31KB
SHA256 2ad02d49691a629f038f48fcdee46a07c4fcc2cb0620086e7b09ac11915ae6b7
MD5 6e00e0821bb519333ccfd4e61a83cb38
SHA1 3550a41bb2ea54f456940c4d1940acab36815949
SHA512 c3f8332c10b58f30e292676b48ecf1860c5ef9546367b87e90789f960c91eae4d462dd3ee9cb14f603b9086e81b6701aab56da5b635b22db1e758ed0a983e562
SSDEEP 768:/k+Ea6rfMkAYY0J/MpIGQUG5YiSyvHAMxkEJ5YSv:8tfHY0JEpIGQU87SyPx/Y+
TLSH
T103E28E93AA546C9AC833C57194D35E35F970BA53470087EF2318C29D1F323837ABA76A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4904_122315_OzXSs-kisYA\_socket.pyd
Size 81KB
SHA256 b38e66e6ee413e5955ef03d619cadd40fca8be035b43093d2342b6f3739e883e
MD5 899380b2d48df53414b974e11bb711e3
SHA1 f1d11f7e970a7cd476e739243f8f197fcb3ad590
SHA512 7426ca5e7a404b9628e2966dae544f3e8310c697145567b361825dc0b5c6cd87f2caf567def8cd19e73d68643f2f38c08ff4ff0bb0a459c853f241b8fdf40024
SSDEEP 1536:ZUuhzLx79flWrqcqtpjly+uCo9/s+S+pzcHQ6B48/VI9dsSbxntpIGLwIU7SyZxL:ZU6zLRNawRy+uCo9/sT+pzuXxVIbsSde
TLSH
T179834911A69050F9DBB3C17AC6635F23FB74B4C01390A39F1196C66A1F33782BE79A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4904_122315_OzXSs-kisYA\_sqlite3.pyd
Size 121KB
SHA256 ff25bdbeef34d2aa420a79d3666c2660e7e3e96259d1f450f1af5268553380ec
MD5 cee93c920951c1169b615cb6330cedda
SHA1 ef2abf9f760db2de0bd92afe8766a0b798cf8167
SHA512 999d324448bb39793e4807432c697f01f8922b0aba4519a21d5dc4f4fc8e9e4737d7e104b205b931af753eda65f61d0c744f12be84446f9c6cb3c2a5b35b773c
SSDEEP 3072:fZIPlR6TxhNO7/9CO4w5yIFGcXcpVNIGOQyl:RjFHO7kC56cXuo
TLSH
T140C34A67635400AAE9F751B9C4630A17DB75F822537083DF4290C68A1F337C7AE3AB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4904_122315_OzXSs-kisYA\_ssl.pyd
Size 173KB
SHA256 a4ce52a9e0daddbbe7a539d1a7eda787494f2173ddcc92a3faf43b7cf597452b
MD5 9b4e74fd1de0f8a197e4aa1e16749186
SHA1 833179b49eb27c9474b5189f59ed7ecf0e6dc9ea
SHA512 ae72b39cb47a859d07a1ee3e73de655678fe809c5c17ffd90797b5985924ddb47ceb5ebe896e50216fb445526c4cbb95e276e5f3810035b50e4604363eb61cd4
SSDEEP 3072:KXGEr/16/nJxNOJW5NT6X3l44K5WOSCSVRJNI7IM/cbP7RHs3J7VIGC7hN:Y/r/16/nDNPT6X3l1CMVS7i
TLSH
T1F4046C47B6942DB7D813E4BAC1230913DBF1F015331247DE49D6D6490F17B0AAEAABA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_tkinter.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4904_122315_OzXSs-kisYA\_tkinter.pyd
Size 62KB
SHA256 06ea475cbb786bd1db1c1bbd62546446e571f717303fcf868148e15612a04a65
MD5 b4d0a483f8007beabd0d4d5b41070057
SHA1 1dd6a829b9b6e66e4062d7a84e6e0187e828287c
SHA512 aa1599f480ba2825bcbcfe79513b53c8c2393b9fbee34947680b0066b9c75bd4a255fccd3a6625dcbd00e2234810777742135375b01abfa1a0f5a3b49d5f72ae
SSDEEP 768:m6WArBf6nO8Ati8yCIASpaYWT81LGXfoy9NPq1fNIGOSg5YiSyvCfPAMxkE/y:fzfiODtXz81CPT9NqfNIGOSy7SyWPxm
TLSH
T18F538C5B9B60009ACE67C179C5B36F23E6B4B9520A10938F02A4D35A1F337D367FA754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4904_122315_OzXSs-kisYA\_uuid.pyd
Size 24KB
SHA256 bb418e91e543c998d11f9e65fd2a4899b09407ff386e059a88fe2a16aed2556b
MD5 3c8737723a903b08d5d718336900fd8c
SHA1 2ad2d0d50f6b52291e59503222b665b1823b0838
SHA512 1d974ec1c96e884f30f4925cc9a03fb5af78687a267dec0d1582b5d7561d251fb733cf733e0cc00faee86f0fef6f73d36a348f3461c6d34b0238a75f69320d10
SSDEEP 384:lrfwHnEWGQiAQVIGZwJXHQIYiSy1pCQ4XAM+o/8E9VF0NyqzJSj:dQnEIHQVIGZw95YiSyv8AMxkEqw
TLSH
T1ECB27E86DA605C51EC27CAB1A4D54F1AE975FB825B9083CB330CC1591F613837AFA3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4904_122315_OzXSs-kisYA\_wmi.pyd
Size 35KB
SHA256 79adca5037d9145309d3bd19f7a26f7bb7da716ee86e01073c6f2a9681e33dad
MD5 ee33f4c8d17d17ad62925e85097b0109
SHA1 8c4a03531cf3dbfe6f378fdab9699d51e7888796
SHA512 60b0705a371ad2985db54a91f0e904eea502108663ea3c3fb18ed54671be1932f4f03e8e3fd687a857a5e3500545377b036276c69e821a7d6116b327f5b3d5c1
SSDEEP 768:PgMwnWGwMtUTA7LlVIGCilx5YiSyvzAMxkEaFy:PgMwWGJtGA7LlVIGCih7Syrx+g
TLSH
T1F5F26D66E3641845DD27C67998E64E2BF971B6569B10C3CF3314825E0F323C1B9BA3B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4904_122315_OzXSs-kisYA\libcrypto-3.dll
Size 4.9MB
SHA256 2a234b5aa20c3faecf725bbb54fb33f3d94543f78fa7045408e905593e49960a
MD5 51e8a5281c2092e45d8c97fbdbf39560
SHA1 c499c810ed83aaadce3b267807e593ec6b121211
SHA512 98b91719b0975cb38d3b3c7b6f820d184ef1b64d38ad8515be0b8b07730e2272376b9e51631fe9efd9b8a1709fea214cf3f77b34eeb9fd282eb09e395120e7cb
SSDEEP 98304:S3+FRtLtlVriXpshX179Cahd4tC9P1+1CPwDvt3uFlDCi:ASRtLtvd99Cahd4tC9w1CPwDvt3uFlDz
TLSH
T1DE367A6AA7A81189E4BAC13CC9534617E6F1F81A177097CF14A1567D0F33BDA2B3EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4904_122315_OzXSs-kisYA\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4904_122315_OzXSs-kisYA\libssl-3.dll
Size 771KB
SHA256 41ad1a04ca27a7959579e87fbbda87c93099616a64a0e66260c983381c5570d1
MD5 bfc834bb2310ddf01be9ad9cff7c2a41
SHA1 fb1d601b4fcb29ff1b13b0d2ed7119bd0472205c
SHA512 6af473c7c0997f2847ebe7cee8ef67cd682dee41720d4f268964330b449ba71398fda8954524f9a97cc4cdf9893b8bdc7a1cf40e9e45a73f4f35a37f31c6a9c3
SSDEEP 6144:7aO1lo7USZGjweMMHO4+xuVg7gCl2VdhMd1DdwMVn4TERUr3zgKpJJ/wknofFe9A:FkeMKOr97gCAE35gEGzLpwknofFe9XbE
TLSH
T188F43B9DB3B8059DE9F6D13D86534623E3B6F4152370EBDB065186390F23BD52A3A388
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4904_122315_OzXSs-kisYA\python3.dll
Size 66KB
SHA256 1e9224ba7190b6301ef47befa8e383d0c55700255d04a36f7dac88ea9573f2fb
MD5 77896345d4e1c406eeff011f7a920873
SHA1 ee8cdd531418cfd05c1a6792382d895ac347216f
SHA512 3e98b1b605d70244b42a13a219f9e124944da199a88ad4302308c801685b0c45a037a76ded319d08dbf55639591404665befe2091f0f4206a9472fee58d55c22
SSDEEP 768:3V1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/J:3DmF61JFn+/OipIGL0m7Sy0xG
TLSH
T173637112BB54F8A3DBFA66FC39D199CD542B12CC872584ECA57893D30E1A310A6E734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4904_122315_OzXSs-kisYA\python312.dll
Size 6.6MB
SHA256 e7890e38256f04ee0b55ac5276bbf3ac61392c3a3ce150bb5497b709803e17ce
MD5 5c5602cda7ab8418420f223366fff5db
SHA1 52f81ee0aef9b6906f7751fd2bbd4953e3f3b798
SHA512 51c3b4f29781bb52c137ddb356e1bc5a37f3a25f0ed7d89416b14ed994121f884cb3e40ccdbb211a8989e3bd137b8df8b28e232f98de8f35b03965cfce4b424f
SSDEEP 98304:B6vwRS7fYzmSSVlLWyJVT7OQvxHDMiEPlk:8vwRHTSVlfJVmir
TLSH
T1C3667C26B758D0A9C9669074CC23C2DAE7717C51BF10530F30EAB31E2F7779256AA788
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qt6widgets.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4904_122315_OzXSs-kisYA\qt6widgets.dll
Size 6.3MB
SHA256 4d603bff620ae0830d15c25a787f9f10ed3f972d998f1f17c9c4f83937280399
MD5 fe194f3803df1543fad6f316a50477b8
SHA1 b9433f51f6bc4c61fa0fdb79619b64861d567b1f
SHA512 74ec1e7bc22cc3814b1906a647beaeb4d080fd7f40ee786811990f597d0f1537700ab90198776f2e5f5ec6cd9cff568d9be8bf659cf37a265645b7096b6cc5de
SSDEEP 98304:vM+neySH06w0WYXVxRjYqnzIjWyHTM1R6wtO0MPS:vM+neym06wvYvRjYqnzIiyza6KqPS
TLSH
T15B666A5763EA0185C4ABD13DCB4B8A17EBB2700453629BCF0265CA592F737E22E7E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4904_122315_OzXSs-kisYA\select.pyd
Size 30KB
SHA256 bc71fbdfd1441d62dd86d33ff41b35dc3cc34875f625d885c58c8dc000064dab
MD5 bffff83a000baf559f3eb2b599a1b7e8
SHA1 7f9238bda6d0c7cc5399c6b6ab3b42d21053f467
SHA512 3c0ba0cf356a727066ae0d0d6523440a882aafb3ebdf70117993effd61395deebf179948f8c7f5222d59d1ed748c71d9d53782e16bd2f2eccc296f2f8b4fc948
SSDEEP 768:s7ENJKHq1vv38pIGQGE5YiSyvTcAMxkEMrX:s7ENJKK1vv38pIGQGO7Syb6xuX
TLSH
T13ED29E97AF601845D823C972A9E74E26ED32B6A7475083CB3368C15C1F227C277BB764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4904_122315_OzXSs-kisYA\sqlite3.dll
Size 1.4MB
SHA256 8aa8b909a39fcc33d1ec2ad51eac6714a318c6efd04f963d21b75d8f64809ad6
MD5 82ea0259009ff75bba817bd8c15c7588
SHA1 04c49687d8241b43ae61a6c59299255ef09a7b39
SHA512 1f8b3343898462e385d25e1820a3d7d971d633933e482ea9ffc596e7e1f902f5657a9f2c104cf320eeef34cce814261304e2e1c063be4c6a807adc9b75f3e670
SSDEEP 24576:95WQyUuqjJVKMXijWRwtHHofIyEcL/2m75i5zxHWc9C08lY8ore60hH:9b0yVKMyjWR6nofQm7U59HWKYY8
TLSH
T12D658D4BB2B800ADC0ABD179C61B571BEBB2740517709BDB55D4CA692F13FE216BE320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcl86t.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4904_122315_OzXSs-kisYA\tcl86t.dll
Size 1.7MB
SHA256 28b61545d3a53460f41c20dacf0e0df2ba687a5c85f9ed5c34dbfc7ed2f23e3e
MD5 b0261de5ef4879a442abdcd03dedfa3c
SHA1 7f13684ff91fcd60b4712f6cf9e46eb08e57c145
SHA512 e39a242e321e92761256b2b4bdde7f9d880b5c64d4778b87fa98bf4ac93a0248e408a332ae214b7ffd76fb9d219555dc10ab8327806d8d63309bf6d147ebbd59
SSDEEP 24576:+AZ2kQrvqkPY6i6ktWc2uMOxmWu1/0lglMkgshwlfjwtorWy2eMdPhOC9JlQ5ZDA:+A0W9jEoSy2nd9JlQjaq5vWHZ7XM2eDu
TLSH
T1A5858E1BE76410A8D8ABD1B8C527BB0BEBF178151350A7DB51B08B912F23FE1277A345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cp1252.enc

Path C:\Users\Admin\AppData\Local\Temp\onefile_4904_122315_OzXSs-kisYA\tcl\encoding\cp1252.enc
Size 1KB
SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
MD5 e9117326c06fee02c478027cb625c7d8
SHA1 2ed4092d573289925a5b71625cf43cc82b901daf
SHA512 d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52
TLSH
T13621362446A58CD8FA4F31D520ECFB70453B75F3D1DA629027B88308E789E8D0C897D9
MD5 SHA1 SHA512 TLSH

Submit Download

tk86t.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4904_122315_OzXSs-kisYA\tk86t.dll
Size 1.5MB
SHA256 23a195e1e3922215148e1e09a249b4fe017a73b3564af90b0f6fd4d9e5dda4da
MD5 ef0d7469a88afb64944e2b2d91eb3e7f
SHA1 a26fd3de8da3e4aec417cebfa2de78f9ba7cf05b
SHA512 909f0b73b64bad84b896a973b58735747d87b5133207cb3d9fa9ce0c026ee59255b7660c43bb86b1ddeef9fbb80b2250719fd379cff7afd9dbec6f6a007ed093
SSDEEP 24576:gR3uXVFKflt2zwvzPYHURwgVdF9EWyCzfdmHQnveD4CGan9nViFoHb15K3cmwdbi:SeFSpvzg0RwgVdF9EWyCzfdmHQnveD4r
TLSH
T19D754C06A261C198C66EA134C91796FADBF17C14931057DB76A0BE6D3F33BE2273A314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4904_122315_OzXSs-kisYA\zlib1.dll
Size 141KB
SHA256 c89c8a2fcf11d8191c7690027055431906aae827fc7f443f0908ad062e7e653e
MD5 b4a0b3d5abc631e95c074eee44e73f96
SHA1 c22c8baa23d731a0e08757d0449ca3dd662fd9e6
SHA512 56bafd1c6c77343f724a8430a1f496b4a3160faa9a19ea40796438ae67d6c45f8a13224dcf3d1defb97140a2e47a248dd837801a8cb4674e7890b495aeec538e
SSDEEP 3072:jqLKjJj3yg1shVjm4OvfqnKAh2mrohmR5JHDbu4cCxp/:jqGEgSefI3roCDbH/
TLSH
T124E38D9AB6A224BDC6BB817052E78B76F931B81147309DEF6188C7B41F11E406B593FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_1340513727\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1060-1249-0x00007FFA2B2C0000-0x00007FFA2D74F000-memory.dmp

Download

memory/1060-1103-0x00007FFA2B2C0000-0x00007FFA2D74F000-memory.dmp

Download

memory/1060-1102-0x00007FF75A4D0000-0x00007FF75BD27000-memory.dmp

Download

memory/1060-1104-0x00007FFA50A90000-0x00007FFA50ABA000-memory.dmp

Download

memory/1060-1050-0x00007FFA36F20000-0x00007FFA3756D000-memory.dmp

Download

memory/4904-1101-0x00007FF75A4D0000-0x00007FF75BD27000-memory.dmp

Download