a34385bfc6f954cd09407241164dee54c7049e2572a7d3c8acf961a5917b955e

Analysis

user interaction
yes
max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Itch_Login_Fixer.exe
Size 33.7MB
Sample260819-jgb7wszare
SHA256 a34385bfc6f954cd09407241164dee54c7049e2572a7d3c8acf961a5917b955e
MD5 83615bc66836c954bdda10141c5779ec
SHA1 79930ce18383561602ab85764d58663eafd4bf2e
SHA512 c867001b2ee6c3b3fe992d69cc2eb14091b074cc3856b3fddb8cba4663d2cfaab399d8f7cf9154358d33e8c4079de9050f66e993295d8f08578d7379ebdbfbc7
SSDEEP 786432:FPas/xJ2heCcW8ULUTLJk0PCELLsKMMo5ovsVuNwZHjOVChFRcPvcj9U7RWPL:FPas/X2heCcWDUTdnPCnoeSqj/FWcU7E
TLSH
T18077336C73A510A9F5C8C73E60E185264BD971D71BA1C3AB83F4529218E31D2FF7AB42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 27 IoCs

pid	Process
2272	Itch_Login_Fixer.exe
2272	Itch_Login_Fixer.exe
2272	Itch_Login_Fixer.exe
2272	Itch_Login_Fixer.exe
2272	Itch_Login_Fixer.exe
2272	Itch_Login_Fixer.exe
2272	Itch_Login_Fixer.exe
2272	Itch_Login_Fixer.exe
2272	Itch_Login_Fixer.exe
2272	Itch_Login_Fixer.exe
2272	Itch_Login_Fixer.exe
2272	Itch_Login_Fixer.exe
2272	Itch_Login_Fixer.exe
2272	Itch_Login_Fixer.exe
2272	Itch_Login_Fixer.exe
2272	Itch_Login_Fixer.exe
2272	Itch_Login_Fixer.exe
2272	Itch_Login_Fixer.exe
2272	Itch_Login_Fixer.exe
2272	Itch_Login_Fixer.exe
2272	Itch_Login_Fixer.exe
2272	Itch_Login_Fixer.exe
2272	Itch_Login_Fixer.exe
2272	Itch_Login_Fixer.exe
2272	Itch_Login_Fixer.exe
2272	Itch_Login_Fixer.exe
2272	Itch_Login_Fixer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4268	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315990682954205"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{0408FD41-1158-455B-8370-2DEB8FF32585}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe

Suspicious use of FindShellTrayWindow 29 IoCs

pid	Process
2272	Itch_Login_Fixer.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2272	2392	Itch_Login_Fixer.exe	86
PID 2272 wrote to memory of 4692	2272	Itch_Login_Fixer.exe	98
PID 4692 wrote to memory of 1196	4692	msedge.exe	99
PID 4692 wrote to memory of 4268	4692	msedge.exe	100
PID 4692 wrote to memory of 4800	4692	msedge.exe	101
PID 4692 wrote to memory of 4800	4692	msedge.exe	101
PID 4692 wrote to memory of 4800	4692	msedge.exe	101
PID 4692 wrote to memory of 644	4692	msedge.exe	102
PID 4692 wrote to memory of 644	4692	msedge.exe	102
PID 4692 wrote to memory of 4372	4692	msedge.exe	104
PID 4692 wrote to memory of 4372	4692	msedge.exe	104
PID 4692 wrote to memory of 4372	4692	msedge.exe	104
PID 4692 wrote to memory of 1844	4692	msedge.exe	105
PID 4692 wrote to memory of 1844	4692	msedge.exe	105
PID 4692 wrote to memory of 1844	4692	msedge.exe	105
PID 4692 wrote to memory of 2344	4692	msedge.exe	106
PID 4692 wrote to memory of 2344	4692	msedge.exe	106
PID 4692 wrote to memory of 2344	4692	msedge.exe	106
PID 4692 wrote to memory of 3412	4692	msedge.exe	107
PID 4692 wrote to memory of 3412	4692	msedge.exe	107
PID 4692 wrote to memory of 3412	4692	msedge.exe	107
PID 4692 wrote to memory of 3060	4692	msedge.exe	110
PID 4692 wrote to memory of 3060	4692	msedge.exe	110
PID 4692 wrote to memory of 860	4692	msedge.exe	111
PID 4692 wrote to memory of 860	4692	msedge.exe	111
PID 4692 wrote to memory of 3528	4692	msedge.exe	113
PID 4692 wrote to memory of 3528	4692	msedge.exe	113
PID 4692 wrote to memory of 3528	4692	msedge.exe	113
PID 4692 wrote to memory of 5044	4692	msedge.exe	114
PID 4692 wrote to memory of 5044	4692	msedge.exe	114
PID 4692 wrote to memory of 5044	4692	msedge.exe	114
PID 4692 wrote to memory of 220	4692	msedge.exe	115
PID 4692 wrote to memory of 220	4692	msedge.exe	115
PID 4692 wrote to memory of 220	4692	msedge.exe	115
PID 4692 wrote to memory of 1684	4692	msedge.exe	116
PID 4692 wrote to memory of 3512	4692	msedge.exe	117
PID 4692 wrote to memory of 1684	4692	msedge.exe	116
PID 4692 wrote to memory of 3512	4692	msedge.exe	117
PID 4692 wrote to memory of 2864	4692	msedge.exe	119
PID 4692 wrote to memory of 3324	4692	msedge.exe	120
PID 4692 wrote to memory of 3324	4692	msedge.exe	120
PID 4692 wrote to memory of 1056	4692	msedge.exe	121
PID 4692 wrote to memory of 1056	4692	msedge.exe	121
PID 4692 wrote to memory of 4856	4692	msedge.exe	122
PID 4692 wrote to memory of 4856	4692	msedge.exe	122
PID 4692 wrote to memory of 4912	4692	msedge.exe	123
PID 4692 wrote to memory of 4912	4692	msedge.exe	123
PID 4692 wrote to memory of 5412	4692	msedge.exe	124
PID 4692 wrote to memory of 5412	4692	msedge.exe	124
PID 4692 wrote to memory of 5008	4692	msedge.exe	125
PID 4692 wrote to memory of 5008	4692	msedge.exe	125
PID 4692 wrote to memory of 5008	4692	msedge.exe	125
PID 4692 wrote to memory of 5560	4692	msedge.exe	126
PID 4692 wrote to memory of 5568	4692	msedge.exe	127
PID 4692 wrote to memory of 5572	4692	msedge.exe	128

C:\Users\Admin\AppData\Local\Temp\Itch_Login_Fixer.exe
"C:\Users\Admin\AppData\Local\Temp\Itch_Login_Fixer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Users\Admin\AppData\Local\Temp\Itch_Login_Fixer.exe
  "C:\Users\Admin\AppData\Local\Temp\Itch_Login_Fixer.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://itch.io/user/oauth?client_id=1ba9b4bfa1ac7759e8420eed4ec863ba&scope=profile:me&redirect_uri=http://127.0.0.1:7890&response_type=token
    3⤵
    - Checks SCSI registry key(s)
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x29c,0x2e8,0x7ffe6b44c188,0x7ffe6b44c194,0x7ffe6b44c1a0
      4⤵
      PID:1196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,13982387406849083766,10112945587844714914,524288 --field-trial-handle=2240,i,9068689693828476515,18015554445833170877,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:3
      4⤵
      System Time Discovery
      PID:4268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,11269307599621690778,14275063153657126755,262144 --field-trial-handle=2240,i,9068689693828476515,18015554445833170877,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
      4⤵
      PID:4800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,5245102952957048332,16246707674663760208,524288 --field-trial-handle=2240,i,9068689693828476515,18015554445833170877,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
      4⤵
      PID:644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,1096739342019156757,189184110074354088,2097152 --field-trial-handle=2240,i,9068689693828476515,18015554445833170877,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
      4⤵
      PID:4372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,11889803819357897292,2388826788565806170,2097152 --field-trial-handle=2240,i,9068689693828476515,18015554445833170877,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
      4⤵
      PID:1844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,7898277811573345080,8429675435999152823,2097152 --field-trial-handle=2240,i,9068689693828476515,18015554445833170877,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
      4⤵
      PID:2344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,12723567711547413940,5189074840129599986,2097152 --field-trial-handle=2240,i,9068689693828476515,18015554445833170877,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
      4⤵
      PID:3412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,17347360233792256479,17657851003615481679,524288 --field-trial-handle=2240,i,9068689693828476515,18015554445833170877,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
      4⤵
      PID:3060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,4820261879708596124,363734736731449370,524288 --field-trial-handle=2240,i,9068689693828476515,18015554445833170877,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
      4⤵
      PID:860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5468,i,5297327064173369101,3625818784136507654,2097152 --field-trial-handle=2240,i,9068689693828476515,18015554445833170877,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:1
      4⤵
      PID:3528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5728,i,16150610500882938453,15925427776045295470,2097152 --field-trial-handle=2240,i,9068689693828476515,18015554445833170877,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:1
      4⤵
      PID:5044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5476,i,3005747913846241495,9008107437024653370,2097152 --field-trial-handle=2240,i,9068689693828476515,18015554445833170877,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:1
      4⤵
      PID:220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,5714534305536527240,364203944662923969,524288 --field-trial-handle=2240,i,9068689693828476515,18015554445833170877,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8
      4⤵
      PID:1684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,3333830728086638954,15088551554038319207,524288 --field-trial-handle=2240,i,9068689693828476515,18015554445833170877,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
      4⤵
      PID:3512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,15489120592980920227,10267843964991678098,524288 --field-trial-handle=2240,i,9068689693828476515,18015554445833170877,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:8
      4⤵
      PID:3820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,15489120592980920227,10267843964991678098,524288 --field-trial-handle=2240,i,9068689693828476515,18015554445833170877,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:8
      4⤵
      PID:2864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,968032494936754140,14937161160000008899,524288 --field-trial-handle=2240,i,9068689693828476515,18015554445833170877,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:8
      4⤵
      PID:3324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,16009017016688024639,7228479912950891641,524288 --field-trial-handle=2240,i,9068689693828476515,18015554445833170877,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
      4⤵
      PID:1056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,6241437403843213124,16711036539896137747,524288 --field-trial-handle=2240,i,9068689693828476515,18015554445833170877,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:8
      4⤵
      PID:4856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,9296802602998551448,2028887426586171127,524288 --field-trial-handle=2240,i,9068689693828476515,18015554445833170877,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:8
      4⤵
      PID:4912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,16076154479768398228,7859612717128543921,524288 --field-trial-handle=2240,i,9068689693828476515,18015554445833170877,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
      4⤵
      PID:5412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5340,i,13853890144595896566,11263772618534757637,2097152 --field-trial-handle=2240,i,9068689693828476515,18015554445833170877,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
      4⤵
      PID:5008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,15142512158032250525,5577335206828951142,524288 --field-trial-handle=2240,i,9068689693828476515,18015554445833170877,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
      4⤵
      PID:5560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,3075871030058872935,67715197774104222,524288 --field-trial-handle=2240,i,9068689693828476515,18015554445833170877,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
      4⤵
      PID:5568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,185103673894834496,12115118631558622909,524288 --field-trial-handle=2240,i,9068689693828476515,18015554445833170877,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:8
      4⤵
      PID:5572

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3052

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c756e7f0173c2e46dad26d72efbfb0a42b35deefa8d8ed2308e4410b46b600ee
MD5 509bff51589c8be5e43f296423d20aac
SHA1 bd50ef22bf1362528eb591a13feb31f3231bdc04
SHA512 0a6364f7f6dcf2e0b00fd8e5b79f4583839b1b3e47f62102d14f4cf4f19c507ca7d7aa64e2f107b5f954db5341186688dd1fa2c0c0a1fc1e46de166184e5949d
TLSH
T1ACD02370B53577D2D21F007D44706B015515817772B7B7517166680DDF70085F1DF9E5
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 cbae176242670646bd395de212635457cd17f22e48bd867a579284ee14a4d0ec
MD5 3f44ac1a52acb3014e5cc0eb263b3839
SHA1 f8361a13d59941909223dcee04fbdb8626d168dc
SHA512 d0556ec0d5c47466478bb8222e62ac0dee71a89071cf294602e851c90181ae644d3cecdec034f30c1ac50d30b089591b621782e322c43f6bcb0cffb8c4f2a530
TLSH
T15D716D302202C06DD3B3C33274E22EF3B17240EAF8AFAE7551A06D743442B91AC1E9D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bd4b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59bd4b.TMP
Size 3KB
SHA256 7f68609757f219b12ec877402fc82ada18dff6119430d0d18249c4c000890dd7
MD5 7bf06948dfe43d8a64a47baa06d0fd1d
SHA1 1ed6e7fbea0cc84f33d3752196c59fae9c056538
SHA512 8f0e666884d27cf5bc45a995f9b4fef1d541277e3d529d3712695ba3a54c8c5eb248c240a3effd62c7d1587c131c6190e9cd0807f182bd9b711b6e914ba4f0d3
TLSH
T1C0714C302206C46DD3B3C23374E22EF3B07540CAF9AFAE7550A4AD783481B91AC1E9D9
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 61fb0906ae002e0a844882eb1b9fa23e89974b4c991982ecf224c8d1682a2e36
MD5 6809368af9318415aa7d823379a16145
SHA1 c9b21203965a732cbfd04bfcf910d1df6e713a5e
SHA512 1b8bb6c90be02c851ac8a38089ec698e9ba891bbecc3e1e032ad61761da8cbfa4e70e2fc3fe74d33475ae22495b2bf54f4c9e57edea53f61fb2d531731587c77
SSDEEP 96:DnOjpjBEA0zUijuj8xE2OjhzjTBjpqjlwajFA:DOjpjBEA0Iijuj8xE2Ojhzj9jpqjl7ja
TLSH
T15381C0F2C3F8866DC90196F06A142F2BDE2D0955436C3C5A8DE4EF1F93E24B1E24194E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b8b89fb21c45e7b23eb62e33ef13da6b71a7af0fadaa1de14719a0b108847a39
MD5 a3753e0c21647c8fb2b7cb787bb9dac1
SHA1 1d7bc7fbf9e09b17b1739aed9d35162dab6b5474
SHA512 fb319205e3c788b726b324179d7682284d71b70b544485cc491a6384997851715bc5e7fe7a14f14680972dc191f0a512fb0c4d9e081b229b70edbeed23415e7a
SSDEEP 192:sxZSROyM/jK1Ml8Miv/ffsuvCdUwvUIdprZlaHW6+WNE7Q/zbI7E4NIg4J:sxZS4qv/ffsuvOjvNKHbf/Ac
TLSH
T16B52E812AA34A977CCCBE319BA45BB53D6F5557291800D58AEFCC91C04E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ced07c227a597a07fea3515a23e16c56c3a2fdea68e0e0b3747b82e161b1d5db
MD5 eef40f6a30dbbd79330c4c7bbbd02a22
SHA1 60564a7abac11e1b44057ee8658b764a2615dfc8
SHA512 4b02b1b22f5dbfc8e157725319a810d853ce32a7192e617661a8648c4e56624abb71f1f13c00c9d55f4effef9697b7257eec54bdf2f4a5c6109d27f44eae44ab
SSDEEP 192:sxZyROyM/jK1Ml8Miv/ffshvCdUwvjIdpHEZlUHW6+WNE7Q/zmQI7E4NIg53J:sxZy4qv/ffshvOjv8JHbf/mz
TLSH
T17B62E816AA3499778CCBD319B945BB53D7F55572A1800E58AEFCC91C00E7BEC620782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7f2cf7541a360ef41e8b4130733559518930f7fc9da4dc7f42c5c5e0286a2bbc
MD5 59de99a56f565c55211d4a465fb38940
SHA1 1afc6ce8b8c4f97a0cc5c2f0f54730bdf1057e65
SHA512 0302fab518565289dc1b3f45b6abb34aebc53359f28a2b2c47f323db694eed79d98fef700fe32068b1bc787feb0b9b03a978cf06430449d3802cd2878a023f00
SSDEEP 192:sxZyROyM/jK1Ml8Mkv/ffshvvdUwvjIdpHEZlUHW6+WNE7Q/zmQIrs4NIg5xJ:sxZy4Mv/ffshvVjv8JHbf/SJ
TLSH
T13362E816AA3499778CCBE319B945BB53D7F5547291900E54AEFCCA1C00E3BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8448382a6363f5204ba408e5a412daf663b34f17ac3bddbeabc966e83e01cba3
MD5 6f402c20b901a0bf3464b4df03450865
SHA1 3cb51513a018495fc558f6a8c296acffe6cfcf2d
SHA512 e3aa07e3e1bde995afcc30bd80ec9ba6b4b26e65236eafbf76cc81dc14e8a8d6b7fc1ca0fec805a9b51aadde5258d63c5bc8bf0a3e29e34be28c638aca9e7076
SSDEEP 192:sxZyROyM/jK1Ml86kv/ffshZWpVovdUwvoIIdpHEZlUHW6+WNTQY7Q/zmQABJtH4:sxZy4kv/ffshZWvoVjvcJHbsr/24
TLSH
T1E272D611A934997BCCD7E319FA45BF53D7F9642291904E54AEFC891C00E7BED620381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 fa32e55d19fbe4ae3390a9c15334b172beaa391cbbd79e310be2f432284983ce
MD5 63e3974db652e9b7dfcaf206f01737f5
SHA1 75423cd95148ade1aa58f99be00c9dae265af142
SHA512 291bae6259ff1275ddb3390b5581a67b677b1910f2824927ec47155d2c77809cd0f339fe3d12aef06945eff3209d95e18c59421410c2ad5ff6f2749242f8846c
SSDEEP 768:YesqxVs7pLuLzJlWvJD0T8F1+UoAYDCx9Tuqh0VfUC9xbog/OV5J54Ll6AR9broP:YesqxVQEzJlWvJD0Tu1ja0J54LAs9or7
TLSH
T1D8F2FC3B690CCB7E4F844E9CED2A7ECA6DE8018B56D8C95447FA881C03C76EB11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 69c89b9834ea1c1840dd2912df37fb7b33bc276ba1930930f12687181962367d
MD5 0e092d8ddc627fff3546c58449aab197
SHA1 939b3975c106600250c8360fed73340d14e87398
SHA512 431db35f23cf8a7c2283eb626b29f2d510fb7ffa2c78da3a89f31b9b88bfac3172c83376fab86472312772424249abb402e80b11dc50afbc5decbd6382fcccae
SSDEEP 96:KYbaKYIKGG0Kra2qyQKXqgPSKA0uSMAKhmmz:ExTjHOJzl
TLSH
T144E188163136465239BE28A8B3A686775F4231633008B46F3FB840B54E6FE225DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 de96a76e1330ee78773ebcb0ab426847e1aa69e3a32f4f01ef99e5b7b31dbad6
MD5 bae50279609893320e3cae0397f4d998
SHA1 98d148877abe0437658691498c13b38289e3741b
SHA512 f00be74ca317eeb5903d122bbbd6505d93bb25fcce030cef010b8c3f610f316e798492d682c41f67f50a5ac5d7452bbb79d37145fb328cf5ee37eedb12ce4498
SSDEEP 3:MsEllllkEthXllkl2zEkld+l/l:/M/xT02znd+l/l
TLSH
T1A54404147FC01407D70410345413C7D40374F4500515D74334D70C377CC55440C00003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 606a036d775aa858d2a0604399d6cb6079249b7add8a6963693ad6571484720f
MD5 3eb89c127968de622ee2aba92c2978f0
SHA1 0218fc3a6d4e43f647cde8933ccf236eeb271392
SHA512 5a2a469f3c8bffc0580b008592e78b994039709f144d6f21135301334144fe21eef0c95574eed69e9dedfa73c403df4705081c3cf915eb7f406ffe42e33550e2
SSDEEP 384:nhZcIhsNVLMVgbWA5VRNEOz/9aPEivZ+ab:phZVufHEOj9aPEiBlb
TLSH
T193828D316D389C335AF6E105F987321B5FB860B7A9C92F94D5E98F2D00DA69C170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 543064af168f56514407453a096087d78bd3ef285ada8a4d5b52cf439369be5a
MD5 1223ab482fa97ac1595313627cfb4d92
SHA1 345d2a01e659304b3ceaf4cb2a66b4c1530ad6d6
SHA512 c885cbf211b7e2b702a62dc42dc3cd2668855d246c04f6dffc63a808f57c7ed850e01d88a32a10d70a759aeac412d00c7b03f3b792f04e612e6c9024e4b2c483
SSDEEP 384:n1ZcIhsNViMVgbWA5VRNEOz/9aPEivZ+ab:NhGVufHEOj9aPEiBlb
TLSH
T16F828D316D389C335AF6E105FA86321B5FB86077A9C91F94D5E98F2D00DAA8C170B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 f15a7b8309ad2526133b6ddf60cdf95cb0e8d83807e2960eb1aecd5bf62cdce8
MD5 a10522bb1bb1cb2d42b834347fdfe0a3
SHA1 da3d6fd64d106e39eab6c42f72d74abdc5f58d2e
SHA512 381c70439cac98512247e5b7aa8d2d85be7e4ee8f125d5af130cb0b9ea7cb39ca75236d10a421ab349eb16ccca27137f38d0a9c2a734e9645f7ba28cced55cb6
SSDEEP 384:nVZcIKsNYeMVgb6v5VRNEOz/9aHo17StaH/sr9HkcMivZ+ab:tKDVjfHEOj9aH4SBr9BMiBlb
TLSH
T146C27CB0E9648CE704E5E5C5B686F1172EB81037C98D5E5CE2F9BA3D309F8B81717826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d9b27a42bd68fa0663d69ae311d6c3a36afb7bf3b7a5666c23b2f81540bdeb94
MD5 15cc5d076733446807568a4206a2afd1
SHA1 58f573cd015c387af99b67f0aed0df6681e4049c
SHA512 2013da7234431097e19e74205c466ec07b1fdc0a1736039ab841da18476471ccba7eda76a21f6e4ba3a98d865425b9cae3c9ad6a2321a0bd74bc3ca08405a30f
SSDEEP 192:tONnd6JkRtQmiUyyeW+RNEOmAeR1h3MRAU6:tONd6UrMW+RNEOzozU6
TLSH
T1C002E835AD386C7B9EF3AE0AB58B27175FE4206BA9856F80DAD81F0C01D765C1346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a90b3fecba332090f202fb3f6d9e0c225dac0b07db4631ebc3ceb07a765b339d
MD5 13f1abad4c42b55a3376e17d9c60592d
SHA1 50f9c8c3868b4f2a44a996f9af1af2f0d102bf08
SHA512 d3625db549a0e0156d498a31d6f3b37deeccc9a21847d2981b4c65c94ead6ee7ecb18b46a7eba42b4afdce7b8480cf4e73167efe10c8f0dbd4cfdb1fbcc267be
SSDEEP 384:ncZcIKsNVeMVgb6A5VRNEOz/9aHEivZ+ab:KKWVcfHEOj9aHEiBlb
TLSH
T138927D316D389C3359F6E105F98632175FB86077A9C91F94D5E98F2D00DA68C170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 693478c134b020de541342558a53b2098df541d3a0ebfa3c26aa758dfe86edba
MD5 835e07cf77adf361ba532ba8380d590d
SHA1 0c9d6ed49876eb18257f0e5b8aa6c669655106a5
SHA512 350973e584f312b4d8accc3e084c474bab8ce474c9bc339c4fb5fb0393a2f7fa4fd04ebd3f5b49bf20a88605c6c5352084d682c2bc1f9e5545ab2d5821acb802
SSDEEP 192:TONQ6JkRsQmiUyCe7+RNEOmAeRi99aiVcnDqquU6:TONQ6U8O7+RNEOz/9aFEU6
TLSH
T11A120835B9389C775EE2B505F58732975EA820B7ED856F80E5D44E1C00DBA9C270E83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

acade719-cd3d-4b86-a096-790308af829a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\acade719-cd3d-4b86-a096-790308af829a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d8cd2884c1b3ff233a34d5b010fb307aea0461071b173a578774bad7842f3862
MD5 9fcbcf4f300cef5add6b0374faf8cb7a
SHA1 5efceb9d92ad1fceb16c1d064e71adc548c7a0bb
SHA512 6d37593828796afafcac94b0a44093b529e3cff762fe12cfd8f902d5af365a4d56a9ba54f9ca9fd17d8eef6364b54eff2b4ff469bdc16d9322e870474b5980d1
TLSH
T14141179DA6F91148B3B76F5AABF6A86E487EBC772F06D55D00010E4F0626A40C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

377f2bd6-9b44-43f1-9300-0ccd5632cc3b.tmp

Path C:\Users\Admin\AppData\Local\Temp\377f2bd6-9b44-43f1-9300-0ccd5632cc3b.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8989a950-8a36-4ee8-b108-f29362693b1d.tmp

Path C:\Users\Admin\AppData\Local\Temp\8989a950-8a36-4ee8-b108-f29362693b1d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

_imaging.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\PIL\_imaging.cp313-win_amd64.pyd
Size 2.4MB
SHA256 010808cd1eb564aeaee8ba65ab2e20ae07f9bd9cbab8dba1d88931bc6842de0f
MD5 6c227dff02748ad4784796c89303c1b8
SHA1 33e73da9e1a38e0a155fc15bf48d9b006f2b033d
SHA512 f73d8a8fca3285166d9598d28ded2a49691ff08fef4c3cd890f37b12fe99ab5a9e2f38662ecbd8b0458ec07a27cba6795bca91fe4ee951e59176870f90ad36c1
SSDEEP 49152:62GlLA1j37EYR49gJxm5g6VABEUlLLPMoW0vJx:u2IKmZAXlLLG2
TLSH
T116B55B06E9E19499C6B68034CDA79112E3B1B80D17F186F77684A6F93F23BD0353B396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\_asyncio.pyd
Size 70KB
SHA256 a5341a74bbec1ddc807c0236fcb6bfaceaf3b957eb69cdd9bca00657eb5e42b6
MD5 56f958eebbc62305b4bf690d61c78e28
SHA1 68d1a227f8bef856469523364e37ae76b968162a
SHA512 91b2a31835a5a0610856df1851c7bb1dea48a6740c63bd037971473706197e81e9904eaa6042a84fc15aa6aa74ac226463b67e2fa8370cbb8b0c987fed777169
SSDEEP 1536:BCY0h2ZouTqMrvHQH7dIgvn6gytH/9tA0fI38VM3:BCD2rWMrvHG7dIgvn6MIo
TLSH
T11A638E87A2A4424BDA93B274C5736F52FBB1F6521901574FA1E8C18E2F1379183FE722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_brotli.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\_brotli.cp313-win_amd64.pyd
Size 804KB
SHA256 67dfa82dcaed04ed3f358d84b18d1375d59126161de92e00164d36087b179d4d
MD5 5ed46a7126dbdb70f3c60530e35ba035
SHA1 b5c0dcbe3ee42e258cadd54ac46f70f1f903ae1b
SHA512 7f5d2b52c310a239182eedd60833951d46cdd18ca2edd828fcabed4299b2ab5df506a2b271e33f129d0256d6db90f9c902ee4d18a7e41ca61f65365504451de0
SSDEEP 12288:XO85hNmCUoltfSNAHhlyp8aXTw05nmZfR:XTT6AzRAmZfR
TLSH
T16C059D0BD9A25739CC27C4398D6B1236EB357168931089A7B25CE5353B83A2417FF3AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\_bz2.pyd
Size 83KB
SHA256 449058efc99fccb9e24d640084d845c78f3f86dd34c5c126cf69e523d6320d75
MD5 684d656aada9f7d74f5a5bdcf16d0edb
SHA1 f7586da90d101b5ee3fa24f131ee93ab89606919
SHA512 27fb2eca382675316fb96d18a1aa6b2792077481bf899cbcc658d71f787876045c05c98abf129c9670b6a1d2654d57f59e17580139fa7f482ec27234e44d4235
SSDEEP 1536:Q5qJ1z7AwZG1xIdYxMpC76ROURNf/86bskFIgLVaytH/9bfIivj:iqTzwqdYrmrfk6wkFIgLVyGj
TLSH
T13E839E82E39857F6F45B81B986C00797F770BA91075053AFF298C2962F03F916E5C36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\_cffi_backend.cp313-win_amd64.pyd
Size 175KB
SHA256 0e3d149b91fc7dc3367ab94620a5e13af6e419f423b31d4800c381468cb8ad85
MD5 5cba92e7c00d09a55f5cbadc8d16cd26
SHA1 0300c6b62cd9db98562fdd3de32096ab194da4c8
SHA512 7ab432c8774a10f04ddd061b57d07eba96481b5bb8c663c6ade500d224c6061bc15d17c74da20a7c3cec8bbf6453404d553ebab22d37d67f9b163d7a15cf1ded
SSDEEP 3072:X3LjFuaTzDGA3GrJwUdoSPhpRv9JUizQWS7LkSTLkKWgFIPXD0:X3QaT3GA3NSPhDsizTikSTLLWgF0z0
TLSH
T178045B56329C11B2D692517889275B57E3B3B47013419BCF01A4C3B62F2BBE2BA7FB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\_ctypes.pyd
Size 130KB
SHA256 5c0d5082fba1a2a3eb8d5e23073be25164c19f21304b09cecaab340dc7198815
MD5 29873384e13b0a78ee9857604161514b
SHA1 110f60f74b06b3972acd5908937a40e078636479
SHA512 ca826ff5403700e6d8822634e364e43b14ef829095d8fe365b49731236f696fe86ffa3853cd1801dc3b7800d005a032fe23bbc25befe3952ef37790d56dee3c5
SSDEEP 3072:k/QCY6XPLj8N4qvAQBhNf/FTmITIJ+B8sZ75IgyPUW4I3U:uQCXPLjNENBPf/FTXTy+B82l
TLSH
T169D37E0B736800AADAA79178C573AF47EBB1B453121147CF02E4C59A2F637E26E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\_decimal.pyd
Size 273KB
SHA256 4e27c06b84401039d10f800a0f06446b58508784ee366c7c8324d8fe9794e1a5
MD5 21fcb8e3d4310346a5dc1a216e7e23ca
SHA1 aab11aef9075715733e0fcde9668c6a51654b9e1
SHA512 c064550d1723e92512a42ce367ecef9331a81121305d66199abce6e0977152d927f7223f475e22c67e3f64b0f612c5553f112d8ce653c666a98d1980d200a599
SSDEEP 6144:HNTyEEsdiuz6KOGifir9qWM53pLW1Asz34+M6lLao:HNIuz8GQiOxgLd
TLSH
T19D546B57A2490CA8EA7380749957DF07F7B278960361C78F43A48AA73F93393676E344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_elementtree.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\_elementtree.pyd
Size 132KB
SHA256 fe09d0408aab3a6faa71467f78433df4c7f3ad0b033bb72ec43bde85abf6dcfb
MD5 ac10151b412bfb22ba9725bc9613c49e
SHA1 4152c799c6faa2a1606d40e1b9089e67efaec951
SHA512 bf0641606c45285c3f18454e8f855d12963f51d910f20419b76405cc80530c38e17a791c580a9db6d171a5e1b9999a6dea661e22a62360d804183f9c0210a107
SSDEEP 3072:X2fZen9TojTvTs+al3m7kLa3LZyOO0brNILnOJKQbi1Igzfz+IL:X2f69TojzTal3m7UQbJdJKQGBL
TLSH
T191D34A8B7265C06BE0A25038D2678F46D7F6F9A20E0087DF2284F29D9F373913E69715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\_hashlib.pyd
Size 63KB
SHA256 52f29aebe9886e830dedc363cd64eb53b6830d84b26e14f1b6faa655a0900b5d
MD5 3e540ef568215561590df215801b0f59
SHA1 3b6db31a97115c10c33266cce8ff80463763c7e6
SHA512 21497a4d1d999a420ed0e146544f4149c72ad4aca4b869a0ee83267d92afa07609ece76a4e95ec706a21580d6544146d0a58c0baa01aa2c242474a4816108527
SSDEEP 1536:GzQGcrVBtIMh2AZvgLbKwps4RdIgvIMytH/918fI38VM1:CSrVBtuWyWos4RdIgvIdlIW
TLSH
T129539E49A2844096CA6752B8CAD39E87F6B5F2525340ABDF0354C0CE2F237C3D77A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\_lzma.pyd
Size 155KB
SHA256 48f16b587c6faa44a9e073365b19599200b0f0a0ccb70121e76c2dac4ed53281
MD5 d63e2e743ea103626d33b3c1d882f419
SHA1 af8a162b43f99b943d1c87c9a9e8088816263373
SHA512 d3f1450b5def3c21f47c5133073e76d2ec05787eb6ae88bb70d3a34be84f6025540ac017e9415bb22ef36c2ffbfcea38a28842eefe366325f3d3cf2cca1a3cb1
SSDEEP 3072:D0Vfr5vC9v2J2dE2AomznfB9mNoVhDLaztJLFIg01twW:DSr5YBo5YOVEpJLEh
TLSH
T10EF35B86B794F0D6F7728C38D6624F57E7F5781A0320929A01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\_multiprocessing.pyd
Size 37KB
SHA256 82253e2d6ec717b317e26ed7dd141aadaea6cb55a9d0fee022a67d52b404fd06
MD5 807dd90be59ea971dac06f3aab4f2a7e
SHA1 c4bea9db94127ef30e929b395d38175dc74e4dc0
SHA512 61b9cf8ac06506002d273b59e2fb66ad96751b10d10faff9128749538867d45d561c1cf8dcb8e787ca6afdc8a1d504cb7012135dfe3a1f3d1fc0b107e4e1a8f9
SSDEEP 768:bqhu80ZnR2PczmDgddNIgntaOytxJEKrLy2Ip4CMTxf1mlDeI6jKa:uhu80WQmDgddNIgntVytH/9RfIUj9
TLSH
T106039D86A6680053E963D631CAA3DF8BF535FB971B11865F3191D2CE1E333C1A36931A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\_overlapped.pyd
Size 55KB
SHA256 7983f811ccd9c99c6db34b653339605ea45eb384f5e88a8b23ccf9fa5f0170d9
MD5 363409fbacb1867f2ce45e3c6922ddb4
SHA1 045b1b90886f4b25d326ea3409a5f79570eae4b2
SHA512 c89288dd76821a18e18ce3e67f01b1a9f6a55751832aa1a4b44882f2115474ca131f95f3545adb9c2d8ecaf3269837126135395c719581a7493affaa96ea0dfe
SSDEEP 1536:fMm7HdS/l5Mt5UvLdE+DRIgWtLytH/9/fIi+9:RHXUDdEeRIgWtBJ
TLSH
T175437C4A67A400CAED63C1B9C5638E57FB74B3D24601531F61A8D28E1F73792A72F389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\_queue.pyd
Size 34KB
SHA256 af8ac8ab8b39f53b5dc192fbf58ad704a709db34e69753b97b83d087202e3a36
MD5 cc0f4a77ccfe39efc8019fa8b74c06d0
SHA1 77a713cd5880d5254dd0d1cbfe0d6a45dfc869ce
SHA512 ffea0bd7f73b6c02df6ff37ef39b8e54e480a4cc734fb149adc5c7410f445effd1fdd4f24e4619f7158913a50c28cc73629524d1a7389101a75257d5652c7823
SSDEEP 768:gFJpl1K6rdzuds5Ig9Uz1OytxJEKrLy2Ip4ETxf1mlWZG8vzcrDZ1:gDrddzuds5Ig9UcytH/9YfIW44zcrD
TLSH
T133F28ECAAA584487EA53CA70C2E7EE52F835B7D35611479F3055D28D2E273C1F32A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\_socket.pyd
Size 83KB
SHA256 bced17d6f081d81ea7cd92f1e071e38f8840e61ee0fe1524221b776bcfa78650
MD5 566cb4d39b700c19dbd7175bd4f2b649
SHA1 bede896259b6d52d538c2182aef87c334fc9c73c
SHA512 6a26fd59e2c2ec34b673ef257a00d5577f52286d78525d05efc8a88760fb575be65c3e94e83396f4978c8734b513afe7f09d3c49474169144f98add406530367
SSDEEP 1536:2xl/h+6SDo3OkB+ecI4xyJwAQlyJ+9+nzhjTm96tsJ4O05IgywpytH/9ofIbw:2xko35X4yJwAQlyJs+nzNq96yw5Igyw3
TLSH
T17C837C00A6A041FAEB63D0B5C2679E63FB74B5C11391A35F0066C55A1F337C2AF7AB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\_ssl.pyd
Size 177KB
SHA256 3301ff340d26495c95108199b67fdf3402742d13070af8b6bf4eb2e0c5e13781
MD5 689f1abac772c9e4c2d3bad3758cb398
SHA1 fe829e05d9f7838d1426f6d4a2f97165c09fd0f7
SHA512 949404a76c731a92074b37ec0bba88d873e56327b335b6c300eff68c2b142e194b58df59158b9bb92a5984c768b474f5db5f80f6b610f6cca78763604041bd82
SSDEEP 3072:HTzN6X1nguzjfU6C3JEMyn6osf87vOifHZHmzisFIgL7RYt:HTzgX5gIU6C39yn+2sQt
TLSH
T1D5047C47B5842AFBD813E4B9C2234903EBB1F155331257DE48D6E6490F03B46AE6AB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cp1252.enc

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\_tcl_data\encoding\cp1252.enc
Size 1KB
SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
MD5 e9117326c06fee02c478027cb625c7d8
SHA1 2ed4092d573289925a5b71625cf43cc82b901daf
SHA512 d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52
TLSH
T13621362446A58CD8FA4F31D520ECFB70453B75F3D1DA629027B88308E789E8D0C897D9
MD5 SHA1 SHA512 TLSH

Submit Download

_tkinter.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\_tkinter.pyd
Size 67KB
SHA256 7d163581822bdcdb94cee24115c37a511cb6bd880b007fc7e5cc5099fac58506
MD5 c7ff6d22c46a2c9ca5f9f76ceaac1bf1
SHA1 4c72cf5cb745c3f14d342b6143b66e1603a2d886
SHA512 7b52884f7c2360c1c1995d4a3ffac87f53324d3fc36b4246804a45f744a33912fbb93648cbe63e166029c1882fa790fc4718c486e7f356e36ce3b392e9497f47
SSDEEP 1536:YxIxVo3bb7sOOkQ48jV3jNEFlU9ow9ylEfd2TkRdIgvSBytH/9ZfIW44zHrR:YaerFQfclPjlEF/dIgvSrW4ILR
TLSH
T189637E9BA768008BEEA3D539C4739B13E575B6924A14934F01E4D3492F333E3A7BA714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\_wmi.pyd
Size 38KB
SHA256 ebd252d21af9c84128fca04c994093a5bd6ee857f1581f06f4026fdd6a2c40e0
MD5 47e6fd132f44a4feb595bd0fda3c4e1c
SHA1 37c6c2c1ff309db7273afc9324a37b716c5cbfdb
SHA512 69c031d4ff2dac70739f9c188fca3c6969304f22782adf5a9c0ca303a3a712630541bda888ef25d3252b46d43df56f6e7e03c83d331840088c4224d1a1a512c4
SSDEEP 768:nEkKVVUWO0X1ctqDFIgLi6OytxJEKrLy2Ip4RsCxf1mljr8VMOj:nE9v3JctqDFIgLi1ytH/9R1fI38VMi
TLSH
T1AC037D8AE2640046E663DAB5C9A6CE53F571B7C36B11D38F365582990F233C0E73A336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\base_library.zip
Size 1.3MB
SHA256 1726d480981d91736871413eb9875a3650087f10a961bdfe19bc56707a3b4f52
MD5 4b720a7abd9b26badb35cca6cd2fa1c6
SHA1 49edc0aa805bd9c70345423a56f0a557944ba370
SHA512 ddfbcf25617a3edebcaa845c81b53d4b0fdda6b1b2c74996824a5c4c3b1924280690948bc34f304fbdf15fab873cd1d51f5072ed95ef771285f7d166a6b3244a
SSDEEP 12288:MW7Wpti2cPPdxhYPL+DciSyCXWfpQuOBa80201jwCVRDVoioSYBw0tYzGNcT1IRr:t7Wpt5cPPdxhYxzcSeT1onQn2dZ/t
TLSH
T18E551992B9527953FF54F37B80B7484CF31E86A2EF00C207355A426A1FFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\certifi\cacert.pem
Size 284KB
SHA256 2089fc5a25836401faee99f722460b01b393999746a0fb817943666d6ecc0458
MD5 790e8548a026429dfac4075a4aca08d1
SHA1 d67e027314db2a729c21650d7ab129114802a13c
SHA512 2efeeceeabe0583196bbaaa86ae302fb2f5ff68ae350d885b7d14c57b163c5b76fe41fd0c0346ab8a99f050b7fb0fae524cea964a50e4fa44f8660d99da69e06
SSDEEP 6144:3nB8fRRiplkXURrVADwYCuCCgT/QRSRqNb7d84u5NahrF:XiRiLWURrIdRWavdX087
TLSH
T1E9546C964F2A5C052C9FE1C1CA9B1357DD3A027B99FEF0F1394A2448D24622A17FCD9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\charset_normalizer\md.cp313-win_amd64.pyd
Size 10KB
SHA256 76c8700ffc983bbec07468e354039b21e25e49e7c19f43d7343994c90d4bb7bf
MD5 52f4d871306079913ecd8d53eb9ecd05
SHA1 fca56e0ea208691082a04198b3b517739669f001
SHA512 4bb9d4161675b6f66c1eadf996de57ba916497c92e6ed42d0a09dbfe97b243d5b3e9772f942c2b03fa75c2f305ca1584bd9b36d5ec226dcdb2efc3261809dea1
SSDEEP 192:Yxl1qJ2Y1L9K2l/ijGaAXbiuUoccgta96:YxPqJ22KMKTuicgoc
TLSH
T10A22071DFA6598E6E9064134C6374E4BB075BB11070277CF83B0D5692FA23E7BA38742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md__mypyc.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\charset_normalizer\md__mypyc.cp313-win_amd64.pyd
Size 122KB
SHA256 e9c308245fe01d33ef92c7026115a0a930fd865fbe1bfcefa91e76c6aa32a0b3
MD5 21e82ad181c636e1cf6c24610e2af08f
SHA1 64f73187472d99632c8579aac30fa03b20ba232b
SHA512 8b87a5ecd21a299a3a9a9a06e2c2aa94942b44280c8eecfdc2b92fbd660344f78a48d41df7859a2f733243a0bfce59cfcd16d25fdd6dc16279b17ee19ebd4484
SSDEEP 3072:K4tSDm8F9XBLHekD43XSlT1/04bbvb71Gn:uu3XSk27
TLSH
T1CCC32917629500B7C96352B9CCB36817D7E1B4510B3213CF05A4C7AA6F03BEABEBE611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blue.json

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\customtkinter\assets\themes\blue.json
Size 4KB
SHA256 c9417470c16ced7a43d6c4a8e027afa6edc62c24d5aee7c4c2dcd11385964d3b
MD5 05eb3947ce9a8c3bef66c14d0f938671
SHA1 06ffc811ee51609809d88894022e222b339aefee
SHA512 4db7c14fba78185edf6459016608cb8fa0a250dfb48432c552bb4e0466cf49622b34d847e17c254bb1c8d15bf365e91bce3ede552ba8733fde9d21779f7f1c13
SSDEEP 96:KupscLUBH2cEyzmGvtu/XaNgdacgWu/Bwg+Y51hlk2cEdVJFvLpwZdIunacEkGgC:KupNUtMiPQ/XXIRp/v+Y51hT/vlggf+4
TLSH
T167912814C5280EA723FB9B2A1607EA043C9C95D36FA8FE54385881DD0F4F43EC6B5BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\libcrypto-3.dll
Size 5.0MB
SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
MD5 ae5b2e9a3410839b31938f24b6fc5cd8
SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
TLSH
T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\libssl-3.dll
Size 776KB
SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
MD5 8d4805f0651186046c48d3e2356623db
SHA1 18c27c000384418abcf9c88a72f3d55d83beda91
SHA512 1c4895d912f7085d6e46f6776034c9e3d8d7bf934be858683bf6dedb13abca360ba816d8a5528ec7a3ac6e33010fdb6fc89b2699b5cfeedaabfdd5df143dffd1
SSDEEP 12288:SLN1sk7YJkC4IAXjdA372WWLmyhTs2bmFe9Xb:SLglJkC4IAhA372WWL3YBFe9Xb
TLSH
T1D8F44BAD73B8059CD8B6C17D86934623E3B6F4563330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\pyexpat.pyd
Size 200KB
SHA256 554bbc65bfe8c19ba9bbd94f18977a8131109c6a4d64306778bd12250c2c5c56
MD5 4e6de7116d8c1c418080580c9795ac15
SHA1 ba948a3c17e12f113477639702a82e96298d1938
SHA512 853e5cd9f753145cce9dd22f6e6a6e404fec7f0db322d2db4d7b18e9cfc065503ba4fab4adc33cbf7d1c2dc0d884413f73cbc28c290d5a41ce7f3f610dad99bc
SSDEEP 6144:YS1Ecle1b26XFdTW4yxB+LjrKWP5XTLumr:scla26wy5XPumr
TLSH
T139146D4BB1A6C0EBD8538038E6978B07DAB1B965039097DF22D4E77D9F2B7413B28315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\python3.DLL
Size 69KB
SHA256 fdd54b6c495e9278e73d68203fff0c300e416e704852908cf5b06666cffead51
MD5 d6dfb6a9518a57e180980f7a07098d7d
SHA1 6026120461f5cbcd9255670b6a906fd8f5329073
SHA512 2a0195a5038d7530b64a506a70de3a6b9cb64ca9206006e03f726b4420304e3a76c10fdda12c8a51f4dbd63e7112fd7e7727a4ab94e7a111587e4248a6b26a62
SSDEEP 768:lQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxi1:jotssyKcunV8P65Igy0lytH/9QfIiAW
TLSH
T17E633BC25B5BF8A2D6F665FC78DDD9CD242B02CC57268D9FA47893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\python313.dll
Size 5.8MB
SHA256 69fd86ea29370697c203f7e12830084f920f490766a8e3045af52c036a9ad529
MD5 7387fe038ea75eb9a57b054fccfe37bf
SHA1 5c532cbdfd718b5e80afb2ee8dea991e84757712
SHA512 c46c982b04079ed0b13617b81168598632d6c58d29e23fcbfa064b08e5836866b74880e1a9c01c12670531f13521a21177aafb10be0abb329a79291d7bff08bd
SSDEEP 98304:+nN+czHO42c7SZerAItxv7HDMiExa0RB2d:Fc7O45mwCiP0RB2d
TLSH
T1E1568D16739D51ACC97B8078CA03864BFBB27C053E60934B61E6BB5D2F733624A6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\select.pyd
Size 31KB
SHA256 6393121130a3e85d0f6562948024d8614c4c144b84ab102af711c638344d1599
MD5 715a098175d3ca1c1da2dc5756b31860
SHA1 6b3ec06d679c48bfe4391535a822b58a02d79026
SHA512 e92edb98427f594badec592493469d45deab3b71e4598d544d0b9a1acffd5327a19c09029fb79d70971cb0ed0dba56056bef8455534d3f16ec35eac723062f3c
SSDEEP 768:kCOBHfjKe5Ig9GWOytxJEKrLy2Ip4gj6Cxf1mlY6Csr:kCOB/jKe5Ig9GJytH/9+fIii
TLSH
T1BCE27D8BAB745047FA63C671C6A6CE03F939B7A3971142CF30A5D1891E137C1A73A365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\INSTALLER
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

tcl86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\tcl86t.dll
Size 1.8MB
SHA256 137972bf582984df7ffe8983fa66d92dba6cc5887fe6784ffe1165bab57304b0
MD5 3fba04c93cc59c04321970d123fd009c
SHA1 e39ef4bb5b9d795e33793523447cad9cc476c362
SHA512 67b2ae06c3610ade78a7f470113acdb787010cfc2628d9b3fcb487761c6b4533883cdb46f16223ea943a5410df4a79ce96b047bce17aa8fb67bb3fa779b86072
SSDEEP 49152:U0W4UbmMRbf0TIWn5SDf/qxF+PJJHmkY7C4wJreAJGQ:5BUqMR7i6x9T+Q
TLSH
T121859F1BE76410ACD8ABD1BCC227E60BDFF1B559136066DB51A08B912F23FE1277A305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tk86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\tk86t.dll
Size 1.5MB
SHA256 ddc6b69c3897ddf3ea9fdfb4b4a6b9c3a667958d4dbf6b4bbcc50c93eb341370
MD5 c644577350785b9a8e56c83bc7fe4a5a
SHA1 5fa4e6ec3b0d156c620971e14da30d1633263cf2
SHA512 f96f9fa3673d5cbf1ed64092ef8d2433d47c1d48cb24c9087e5fd796c37a1546a61c8ed6760dc5e6739038e4336077544c522d00dd2c3fcf4f16205b6fc1d3b8
SSDEEP 49152:076DXYkBMhchLNqaJvARxr9DrTwylL1y62BEqkEH0CF2MT2JTBKa8SERGezf6:ZQchLNqaJvARxr9DrTwylL1y5BEq8JT1
TLSH
T19F754A06B261C198C66FA134C91796BAE7F17C05931057DB72A0BE697F33BE2673A304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\unicodedata.pyd
Size 695KB
SHA256 071494856fdad0042964769aa2fb1de4ea95c2cfcbe27cc7132293c68d13d710
MD5 503b3ffa6a5bf45ab34d6d74352f206b
SHA1 cc13b85281e5d52413784e0b65a61b1d037c60cc
SHA512 d20b860974161caa60a62268968af353ad8063589f57d71f57c91855eb83da78f40bae7aa745cc7a945d92ebe08cf244c9560ae93449de45b20a8b8fff9f5010
SSDEEP 12288:9YLdLI/X77mvfldCKGihH32W3cnPSqrUguJS:9YLW7qNxr3cnPXuJS
TLSH
T1FDE4F6D5BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23922\zlib1.dll
Size 144KB
SHA256 f687e5dd99faab1023d036f09ef8ba3c09bd3464c8ced523341780e301bdf6a8
MD5 ef398b5b1b901ce824c16c0af5b1d6f9
SHA1 ee6ab2f7f8aef41c3886a818418f86bca764c4d6
SHA512 7ed4666a21153adb44d3f34f868d590f66ab0d917746b31684c84a600c48fcafdc69d7bd6535b4c9e4400e614ee6e2e9e3ee59021dcef5e7340b73f3ae2ac831
SSDEEP 3072:1vEO6FnGGVV1m4dkRR5Th2UgvGxbOUJCTYp:1sVD+RrFgvi7Jbp
TLSH
T127E37D9BB6A215BDC677817042E6CB76F932B8214B309DEF5088D7741A12F806B197FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4692_1139943729\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6020641e-069d-43fc-aa41-83e8c4cc47cb.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4692_377536441\6020641e-069d-43fc-aa41-83e8c4cc47cb.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2272-1133-0x00007FFE792F0000-0x00007FFE79319000-memory.dmp

Download

memory/2272-1822-0x00007FFE792F0000-0x00007FFE79319000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads