b25bc15f4c2489582a2345c438a09722b41a6c8806675a3f5e5c5661b96909ab

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 00:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mytweak_pc_optimizer.exe
Size 12.0MB
Sample260825-apavcs1tht
SHA256 b25bc15f4c2489582a2345c438a09722b41a6c8806675a3f5e5c5661b96909ab
MD5 a6b25c8bb52ddf602c779c622fd6a0c0
SHA1 52a6aab0acba7e366f8be1b0008c05b0b54cce58
SHA512 31b9f9282f794772604f40bd8834a611469bfe555064371153963c0f9ba58394b731e72c3fa2a5a5a25d9e7c3b316516efbc6e59a20f1cc9cf141a287c263587
SSDEEP 196608:G+I/RYKXEpXnH2ph1iutexSiLCw10+u41ZPcUNS/gbeHV5PTmCY+g7tysvonYpP2:rI/rXEAphVtk510MjNSoiHVBSC7AysvT
TLSH
T18EC63368BB6051FAE9BB403E8CA79451A6E332160752E3DF2B9005653F271F08D7CBB5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution impact ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	cmd.exe

Loads dropped DLL 12 IoCs

pid	Process
4068	mytweak_pc_optimizer.exe
4068	mytweak_pc_optimizer.exe
4068	mytweak_pc_optimizer.exe
4068	mytweak_pc_optimizer.exe
4068	mytweak_pc_optimizer.exe
4068	mytweak_pc_optimizer.exe
4068	mytweak_pc_optimizer.exe
4068	mytweak_pc_optimizer.exe
4068	mytweak_pc_optimizer.exe
4068	mytweak_pc_optimizer.exe
4068	mytweak_pc_optimizer.exe
4068	mytweak_pc_optimizer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4940	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
288	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3220	vssadmin.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Mouse\MouseSensitivity = "12"	mytweak_pc_optimizer.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320910823179351"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{C1A6CCCE-4270-413C-A162-FDB221540BBB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4068	mytweak_pc_optimizer.exe
4068	mytweak_pc_optimizer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeBackupPrivilege	3212	vssvc.exe
Token: SeRestorePrivilege	3212	vssvc.exe
Token: SeAuditPrivilege	3212	vssvc.exe
Token: SeIncreaseQuotaPrivilege	3548	wmic.exe
Token: SeSecurityPrivilege	3548	wmic.exe
Token: SeTakeOwnershipPrivilege	3548	wmic.exe
Token: SeLoadDriverPrivilege	3548	wmic.exe
Token: SeSystemProfilePrivilege	3548	wmic.exe
Token: SeSystemtimePrivilege	3548	wmic.exe
Token: SeProfSingleProcessPrivilege	3548	wmic.exe
Token: SeIncBasePriorityPrivilege	3548	wmic.exe
Token: SeCreatePagefilePrivilege	3548	wmic.exe
Token: SeBackupPrivilege	3548	wmic.exe
Token: SeRestorePrivilege	3548	wmic.exe
Token: SeShutdownPrivilege	3548	wmic.exe
Token: SeDebugPrivilege	3548	wmic.exe
Token: SeSystemEnvironmentPrivilege	3548	wmic.exe
Token: SeRemoteShutdownPrivilege	3548	wmic.exe
Token: SeUndockPrivilege	3548	wmic.exe
Token: SeManageVolumePrivilege	3548	wmic.exe
Token: 33	3548	wmic.exe
Token: 34	3548	wmic.exe
Token: 35	3548	wmic.exe
Token: 36	3548	wmic.exe
Token: SeIncreaseQuotaPrivilege	3548	wmic.exe
Token: SeSecurityPrivilege	3548	wmic.exe
Token: SeTakeOwnershipPrivilege	3548	wmic.exe
Token: SeLoadDriverPrivilege	3548	wmic.exe
Token: SeSystemProfilePrivilege	3548	wmic.exe
Token: SeSystemtimePrivilege	3548	wmic.exe
Token: SeProfSingleProcessPrivilege	3548	wmic.exe
Token: SeIncBasePriorityPrivilege	3548	wmic.exe
Token: SeCreatePagefilePrivilege	3548	wmic.exe
Token: SeBackupPrivilege	3548	wmic.exe
Token: SeRestorePrivilege	3548	wmic.exe
Token: SeShutdownPrivilege	3548	wmic.exe
Token: SeDebugPrivilege	3548	wmic.exe
Token: SeSystemEnvironmentPrivilege	3548	wmic.exe
Token: SeRemoteShutdownPrivilege	3548	wmic.exe
Token: SeUndockPrivilege	3548	wmic.exe
Token: SeManageVolumePrivilege	3548	wmic.exe
Token: 33	3548	wmic.exe
Token: 34	3548	wmic.exe
Token: 35	3548	wmic.exe
Token: 36	3548	wmic.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
996	msedge.exe
996	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4068	mytweak_pc_optimizer.exe
4068	mytweak_pc_optimizer.exe
4068	mytweak_pc_optimizer.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 3804 wrote to memory of 4068	3804	mytweak_pc_optimizer.exe	84
PID 4068 wrote to memory of 3220	4068	mytweak_pc_optimizer.exe	98
PID 4068 wrote to memory of 3548	4068	mytweak_pc_optimizer.exe	102
PID 4068 wrote to memory of 4940	4068	mytweak_pc_optimizer.exe	104
PID 4068 wrote to memory of 1228	4068	mytweak_pc_optimizer.exe	112
PID 1924 wrote to memory of 996	1924	msedge.exe	115
PID 996 wrote to memory of 4548	996	msedge.exe	116
PID 996 wrote to memory of 288	996	msedge.exe	118
PID 996 wrote to memory of 1680	996	msedge.exe	119
PID 996 wrote to memory of 1680	996	msedge.exe	119
PID 996 wrote to memory of 1680	996	msedge.exe	119
PID 996 wrote to memory of 5004	996	msedge.exe	120
PID 996 wrote to memory of 5004	996	msedge.exe	120
PID 996 wrote to memory of 4940	996	msedge.exe	121
PID 996 wrote to memory of 4940	996	msedge.exe	121
PID 996 wrote to memory of 4940	996	msedge.exe	121
PID 996 wrote to memory of 2420	996	msedge.exe	122
PID 996 wrote to memory of 2420	996	msedge.exe	122
PID 996 wrote to memory of 2420	996	msedge.exe	122
PID 996 wrote to memory of 5112	996	msedge.exe	123
PID 996 wrote to memory of 5112	996	msedge.exe	123
PID 996 wrote to memory of 5112	996	msedge.exe	123
PID 996 wrote to memory of 636	996	msedge.exe	124
PID 996 wrote to memory of 636	996	msedge.exe	124
PID 996 wrote to memory of 636	996	msedge.exe	124
PID 996 wrote to memory of 2196	996	msedge.exe	127
PID 996 wrote to memory of 2196	996	msedge.exe	127
PID 996 wrote to memory of 3116	996	msedge.exe	137
PID 996 wrote to memory of 3116	996	msedge.exe	137
PID 996 wrote to memory of 4872	996	msedge.exe	131
PID 996 wrote to memory of 656	996	msedge.exe	132
PID 996 wrote to memory of 4872	996	msedge.exe	131
PID 996 wrote to memory of 656	996	msedge.exe	132
PID 996 wrote to memory of 4648	996	msedge.exe	134
PID 996 wrote to memory of 1212	996	msedge.exe	135
PID 996 wrote to memory of 1212	996	msedge.exe	135
PID 996 wrote to memory of 1504	996	msedge.exe	136
PID 996 wrote to memory of 1504	996	msedge.exe	136
PID 996 wrote to memory of 3116	996	msedge.exe	137
PID 996 wrote to memory of 3116	996	msedge.exe	137
PID 996 wrote to memory of 4200	996	msedge.exe	138
PID 996 wrote to memory of 4200	996	msedge.exe	138
PID 996 wrote to memory of 3160	996	msedge.exe	139
PID 996 wrote to memory of 3160	996	msedge.exe	139
PID 996 wrote to memory of 1072	996	msedge.exe	140
PID 996 wrote to memory of 1072	996	msedge.exe	140
PID 996 wrote to memory of 1072	996	msedge.exe	140
PID 996 wrote to memory of 5440	996	msedge.exe	142
PID 996 wrote to memory of 5440	996	msedge.exe	142
PID 996 wrote to memory of 5028	996	msedge.exe	143
PID 996 wrote to memory of 5028	996	msedge.exe	143
PID 996 wrote to memory of 5028	996	msedge.exe	143
PID 996 wrote to memory of 6132	996	msedge.exe	144
PID 996 wrote to memory of 6132	996	msedge.exe	144
PID 996 wrote to memory of 6132	996	msedge.exe	144
PID 996 wrote to memory of 5252	996	msedge.exe	145
PID 996 wrote to memory of 5252	996	msedge.exe	145
PID 996 wrote to memory of 5480	996	msedge.exe	146
PID 996 wrote to memory of 5484	996	msedge.exe	147
PID 996 wrote to memory of 5508	996	msedge.exe	148
PID 996 wrote to memory of 5676	996	msedge.exe	149
PID 996 wrote to memory of 5676	996	msedge.exe	149

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\mytweak_pc_optimizer.exe
"C:\Users\Admin\AppData\Local\Temp\mytweak_pc_optimizer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3804
- C:\Users\Admin\AppData\Local\Temp\mytweak_pc_optimizer.exe
  "C:\Users\Admin\AppData\Local\Temp\mytweak_pc_optimizer.exe"
  2⤵
  - Loads dropped DLL
  - Modifies Control Panel
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4068
- - C:\Windows\SYSTEM32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:3220
- - C:\Windows\System32\Wbem\wmic.exe
    wmic shadowcopy delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "start ms-settings:storagesense"
    3⤵
    - Checks computer location settings
    - Executes a command shell one-liner
    PID:4940
- - C:\Windows\SYSTEM32\rundll32.exe
    rundll32.exe user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:1228

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RequestApprove.html
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Users\Admin\Desktop\RequestApprove.html
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7ffc5d14c188,0x7ffc5d14c194,0x7ffc5d14c1a0
    3⤵
    PID:4548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,13836555732528491498,3958758982364869614,524288 --field-trial-handle=2364,i,14430256514326116637,4404393832160531925,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:3
    3⤵
    - System Time Discovery
    PID:288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,16930519963928539598,17386882695900265961,262144 --field-trial-handle=2364,i,14430256514326116637,4404393832160531925,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
    3⤵
    PID:1680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,11619492092923365920,17379927207443456858,524288 --field-trial-handle=2364,i,14430256514326116637,4404393832160531925,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:8
    3⤵
    PID:5004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,13035059132755223438,9250577866147174126,2097152 --field-trial-handle=2364,i,14430256514326116637,4404393832160531925,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:4940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,17157263611161824689,17461529423287038975,2097152 --field-trial-handle=2364,i,14430256514326116637,4404393832160531925,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
    3⤵
    PID:2420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,5947116798277406113,18010662629799396588,2097152 --field-trial-handle=2364,i,14430256514326116637,4404393832160531925,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
    3⤵
    PID:5112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,5738533426798139433,5036646597549878545,2097152 --field-trial-handle=2364,i,14430256514326116637,4404393832160531925,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:2
    3⤵
    PID:636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,9995749174185059440,10813480345297132293,524288 --field-trial-handle=2364,i,14430256514326116637,4404393832160531925,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
    3⤵
    PID:2196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,16363953235304214664,6891132043263108685,524288 --field-trial-handle=2364,i,14430256514326116637,4404393832160531925,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
    3⤵
    PID:3116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,10545801488102853583,5055664931146240125,524288 --field-trial-handle=2364,i,14430256514326116637,4404393832160531925,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
    3⤵
    PID:4872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,6631141509927834984,3788129858479454276,524288 --field-trial-handle=2364,i,14430256514326116637,4404393832160531925,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
    3⤵
    PID:656
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,1617584539590230757,14573773099712545482,524288 --field-trial-handle=2364,i,14430256514326116637,4404393832160531925,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
    3⤵
    PID:3116
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,1617584539590230757,14573773099712545482,524288 --field-trial-handle=2364,i,14430256514326116637,4404393832160531925,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
    3⤵
    PID:4648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,4396139353390719473,13562132803800105284,524288 --field-trial-handle=2364,i,14430256514326116637,4404393832160531925,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
    3⤵
    PID:1212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,4370367926812360188,14307434740118371741,524288 --field-trial-handle=2364,i,14430256514326116637,4404393832160531925,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
    3⤵
    PID:1504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,5044349814297094496,2017544039618381542,524288 --field-trial-handle=2364,i,14430256514326116637,4404393832160531925,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
    3⤵
    PID:3116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,6617130880829842108,1655686865058562846,524288 --field-trial-handle=2364,i,14430256514326116637,4404393832160531925,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
    3⤵
    PID:4200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,12551409745984017835,15519447271529604493,524288 --field-trial-handle=2364,i,14430256514326116637,4404393832160531925,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:8
    3⤵
    PID:3160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6544,i,7054285655512629649,18207395309500834095,2097152 --field-trial-handle=2364,i,14430256514326116637,4404393832160531925,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
    3⤵
    PID:1072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,18354615043676222316,2528155846567347990,524288 --field-trial-handle=2364,i,14430256514326116637,4404393832160531925,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
    3⤵
    PID:5440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6700,i,7830802414160881575,13204463424178504464,2097152 --field-trial-handle=2364,i,14430256514326116637,4404393832160531925,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:1
    3⤵
    PID:5028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7076,i,1793549953432152682,14262945001512566163,2097152 --field-trial-handle=2364,i,14430256514326116637,4404393832160531925,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:1
    3⤵
    PID:6132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,12054686440242762375,8346210255035944634,524288 --field-trial-handle=2364,i,14430256514326116637,4404393832160531925,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
    3⤵
    PID:5252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7236,i,12879354466129269779,5948208798666379284,524288 --field-trial-handle=2364,i,14430256514326116637,4404393832160531925,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:8
    3⤵
    PID:5480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7252,i,2900720510140199523,3214628858534571902,524288 --field-trial-handle=2364,i,14430256514326116637,4404393832160531925,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:8
    3⤵
    PID:5484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,16544863582832012731,8602918212047511399,524288 --field-trial-handle=2364,i,14430256514326116637,4404393832160531925,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:8
    3⤵
    PID:5508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2788,i,6645573432083994375,14936377178130500943,524288 --field-trial-handle=2364,i,14430256514326116637,4404393832160531925,262144 --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:8
    3⤵
    PID:5676

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

6dfa4a11-7ac0-4ddb-a7e0-d52d3312a13a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6dfa4a11-7ac0-4ddb-a7e0-d52d3312a13a.tmp
Size 8KB
SHA256 9450452be32532f83cda15d44300d9609567f859260d6df5255e03fbab12bfe9
MD5 d1a298753ba83f7e9222220a28fcf67d
SHA1 b56e5a541d5241d76dffd2c8749a142b6abd5a98
SHA512 aab0c89732f6a1c87a61b5ef876b5e6e11010a0e99154cde565813cf0c1f5255bd90f26ce3f176164867e3a057bd01c7db55433d5b2ea7d278180faebc62b922
SSDEEP 192:lONP6vMtPQmiUyGjQThTH7+FdLJxf847eLU/u:lONP6UtRlQTmd9xHkU/u
TLSH
T18A020835AC786C7BEAB3BD4AF48A37171FA4116FA9901B54EAE82F1C00D764C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 117ab9def97162f90eefde5424760216757b3330a4906060b2b20729f929f5ae
MD5 9bac0151a1b2150cae83717971717355
SHA1 4f698a37b757a89b024bda6c447df0bcdd3f5546
SHA512 0fb259a689b1efca70eae453fdb3711c13c39cdf943bc36c336cae3b25bf1927698f019f43422eb8f3cbf72528d78fefbd0b5a84bb895d1fea4f7d70b1f529c5
SSDEEP 96:kLgjz1ZjVr1sZpmCDNzc7WndlhUcPZK43VOl4TloiFuPdvm+eU1:kkPjN1sZsCZ9nnhVPrOlioOadeXM
TLSH
T168E1C772028D30D2DB269DF0ACCE4AC935755CF8F22B6E322028DF71DD66BB115E8995
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a5ce6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a5ce6.TMP
Size 3KB
SHA256 6a71372c46f0a84cca8b5a10c4efa0ab803f2d3f3dff6c7b767354a5348f32e0
MD5 3813217d3487f118746d6319b24d99ee
SHA1 6864d130444a29193676591439eeec95755755c8
SHA512 82765a1e588d82a22a777addfa582ee1a35ac7ec567c4324278bb714ebfc504d98a5632a54014d16c068f294438598f1d56f7d85a5866ec3423cc7fd0666f945
TLSH
T1AF714CB7034D18E3EB631C32ACC10AC678BA91ECF6377E9A1060CB35C62633101E9658
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 781e7884c6a637ff686ea8257f10202eb32d793e7290134838e218fca712d9f2
MD5 d12efa4cbff611cccf0a1b5bf996d845
SHA1 7a1f580ca8b7a2a1d1d8ae54d6fc5d688bd85e74
SHA512 ac7bb5bc76fd953c90e88ecff30b0287f2e2742dd0516732597e2c4f05d825cf7c61428e5158a3aadb540c7ea732da17299bef4b04cb958031a8c538d9ebe99d
TLSH
T1B2D023A3664130B5559D7ED1446DEC8FC72710615C43DED915D06458153549C0757184
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe5a2730.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5a2730.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 92aad7d21cab145df4b0fcddffc652d98b0e34b1ba31f13ef75bed6d932996f6
MD5 1cb6761fb675f41c5647e66775e1ed1f
SHA1 c43b080dc3c3bc5cf902fae2731aa992ada2db63
SHA512 8d1dc8bda62c8664dc83c16bb0dc8232fae2d3eae1e9debffcc8d575a59a56c8eec8cd3afcdfecdc097f7ef66188f1c97fd0fa58950989fdd1633c855235f769
SSDEEP 384:sxZN7qmzx/fes3JvDRTgdCvYHb5l/nRnbx0I:sFWmzx/fNJvDHYHbLnRN0I
TLSH
T11982E7426A209977CCC7C519F935BF57D7F8086399504D8CAAFCCA1C04EAAFD221782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 c5a422c993d7a1f892bee2c0dd14e30229828915d5f56b675edc71ce94720da2
MD5 3ec7aeb43b404bb531ec9e2e7ff15761
SHA1 f6a4b06d993a2235e08e2937c420573ae88b87bc
SHA512 5c7d11b30529665a50f5109e8e58fedee2e222b2123e27f97ced5b5fb52539c1b9610874b9a0910221e713d2d6a3bd10063d7c17e46782b0c48ddb61f923bfda
SSDEEP 384:sxZN7qmWx/fesCJvD5+FgyuHb5l/nRnFx0I:sFWmWx/fUJvDEYHbLnRj0I
TLSH
T10182E71266209977CCC7C519FA35BF57D7F8086399904D8C99FCDA1C04EAAFD221782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 36ef9b653cf5ed9da0f62c84f09e86ce64214c9c01c061f5fc1aa331609eaf0b
MD5 24e726274a253b1247d2d61e596a28bf
SHA1 8e36c9ef0071260f8ef8671912b375781af9a5ea
SHA512 92540ef9b854370350700e6a600eda9de7684a2239aa6cd2d33adb11cc8b9b538c93dc5504bbe9efcc1cc0750272ecca35608872c7a5c028dbbab64b9b917c99
SSDEEP 768:fnseJ8y7pLuLzhxWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjbVcLly0ppgroC:fnseJ8KEzhxWvhfynu1ja2bVcL88prC
TLSH
T1E0F2FC3B680CCB7E4F804E9CED2A7E9A6EE8018F56D8895447F9840C03C76EB15175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\070fc69b-28b6-45cc-8a56-75c8dc728b82\index-dir\the-real-index
Size 72B
SHA256 4557a3165c31e9fd511f7464d685e5dd6c0cebf50cbef16dffa76222c04896a7
MD5 83341069210ff0ad4b0778fa6ade1929
SHA1 e61bb15a53393a81ea6247d32d3dc598b2a5a710
SHA512 0d3ac4a1ba2ff0a638c3e2e1ee2161a4232bf861b333becc24ef60b1afa1d4555843131982ceb028fca05b5e41463c5dacf6e4eb70707ddffef3d3271d339dba
TLSH
T11BA0021456C42121C00A13FE659641416710CD214211131752984364DD60D494D8531F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\070fc69b-28b6-45cc-8a56-75c8dc728b82\index-dir\the-real-index
Size 72B
SHA256 b3fd6ef83bf0e11b1526a57676fae35a13a54135e9b96f4a9c49fc6577254f1e
MD5 8866d2abe2c38483c7c77669b346adb7
SHA1 b42f22726d2d72d72771a35f3f8841db341b5a96
SHA512 c34ab4532b10c5c8821fed8d789c17525c1843194910de132a5d596d81b643edd537705db925160f4f5459ff37f270d622d1a805a52a9982ea2e5e75c9e4901e
TLSH
T1F4A0021003804019C95311B2699742965384CE502104D70740E10054CC53AC05F5110C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\45dcec6f-aa01-4d60-b08c-c87ce78d75a5\index-dir\the-real-index
Size 72B
SHA256 643fd35c877620f395fae2b09e984f26dadc60ca14d3f9422ae38d5b77c6111d
MD5 8b6b5e905385c9029d7c636bc17dbb5a
SHA1 7c8fba119dd1ac071b59072da01b5fd3278431e8
SHA512 9d8aebe6b93eedb65323999392a919c87f9977f52d9e249e38e444cb806ceb4514314bce06537536c69d55a2aa5cfceeae5b70c1a87e472b02a7aa9a4f418bb5
TLSH
T1A2A002201B561042D14007F0754121702327ED175115474740E248D6CFF325DCE12044
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5a36203a-218f-4e25-af42-a3bed745cbd5\index-dir\the-real-index
Size 96B
SHA256 93e16dd0a6b23921cc781ede8007c67427d00cbd5c08d417ac3232833c356a2c
MD5 e5cbff5b31c6188f78d2e6652af39535
SHA1 6e1c618c9b6fcfb0e9f6fa42a31068ac71063f90
SHA512 50058b6abea14a4dfdd40027b5d3e16eb349002f3c21e28ca3993c1a0a6aac7b44abc63bcf3ddc64c908fd93677715a2fa53ae083938ee888732e2735901d129
TLSH
T112B0110A32822A0BE8238AFA208082202230CC0C03023322A080083AAA8838002022A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a5593.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5a36203a-218f-4e25-af42-a3bed745cbd5\index-dir\the-real-index~RFe5a5593.TMP
Size 48B
SHA256 be1359c003792fd468d1f28d1a04de73b7cb94e23480b0e3741439140135e762
MD5 d22b26dfa23d37f325db1ae0d0187610
SHA1 f3f2956ba6c90f7eb6c5d600f549db8b1c8a7293
SHA512 1ae2fe8977fb01ff9b6884edfacbcfe7ef3cd8c1038374de0099bd37bcd3db587812cc5c7a884695ef769082e3658e9d06131f1738de806d09bf938fad80a7c6
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\92f64841-7c8a-4ae1-988b-63eaf15bde20\index-dir\the-real-index
Size 72B
SHA256 14bd0bdf3e1a41e31308529f0d3c6e2f30323aaab0ce721e598d83c1e3e4eb49
MD5 7ed146f6f9a4da39bc7ffe95987b360a
SHA1 5f16044e4b127279d4a61224e23b85268948c627
SHA512 03c7d8d4dccf80eb362b62c740d5d70d5d3472b118eef227de2ac9375b2f11add99564486f62b4e948ce30deb3894d39331afec1e360d85daa62aa759413080b
TLSH
T1E5A0021D56845222C2214FB52A868E93626C6E51E241564AC0B784D5C8909D4811786D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a5593.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\92f64841-7c8a-4ae1-988b-63eaf15bde20\index-dir\the-real-index~RFe5a5593.TMP
Size 48B
SHA256 443eaf41fa2193246d6dd6e0b263dc0b10e4f1856c3a5776458d85130c35b03e
MD5 f2dea4a3d7eca04217d6f89f0e74b139
SHA1 d3b3982f35c4f4e32db8dd9d75fe138bbfcfb5b3
SHA512 d2b30e20d35abc6e721e266372635495ee52c86d608bfecdad895bff0406835f465802404d5e0e88367e76eb16192e877886cf1b2dd36d2e7332de33b0ccd57e
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 1KB
SHA256 4e1836d8d9fadc4660c5d97ff5006413d1da220c070257708632c87024d3d9c5
MD5 40649870b5b2de93736d371a4e18978e
SHA1 0949ac6fba05bdd4cac896c2f4e7b56f11faeae0
SHA512 876ecc30701870e98eec1593660751524a452d3c10045956efc95e39de3ba61d7d6e6aa011cf373fd6d75d29de8a8486efe79a054f24204bf5f6683bb11d0560
TLSH
T11C31418E8E41D99BE9A844B214B620F833F0C9DC0B1162634C3C263A7C6B79A294B19C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 3KB
SHA256 d30c30590a17c435e2c7835446e9f328cf2d3745d26acd5ddb387b29bca42323
MD5 e385682553368db6036edf227d4e2aaf
SHA1 78a78db3a4fae0951bfd46ec3706f4cc035045df
SHA512 7c458413ffe768704382926673a1b8903b8750426e12dcf9f28c0f23ddbb7281505aace327b601abd72e539e4919120058982aa040461a8cfc490baf5cd9bff2
TLSH
T11A51D84F8E4A2D5AC5AD02F229FA115137795CFE4760CA9B3A9CB131B8D337A1D0C61A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d306.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe59d306.TMP
Size 1KB
SHA256 fdc1ee8424c2595dccd842b4270bffd27c3579d816bd1166a9c7bd19eabfce19
MD5 88b9722ad69939bfb45d8d83e7993927
SHA1 6602ae20959f134129fc95b646cfcf60fb720bc8
SHA512 16968159abfa3151dccc205c92ad621040c604ea55a03a5ef6714a0df040317b23b093db75c3e387698899ade8af86416bc51f5d4e64b788a79ab01d44eb6cff
TLSH
T1B431468B4B419A1FE8D440B20956A4B83376C9405322B783987D623DBC757AD5E5F0C8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 519B
SHA256 4ff703a5f454941c591050341ffed97ffd9a52fc4be096c55aee9cdfba63727c
MD5 e0b0c76672a1dbf8a1df512c4bff751d
SHA1 2bac0f3aa39e89a9238f2189264976a4b0b25f39
SHA512 eb26082334f3373e8060ef4b58e424929a8047137c3ac576ae34a11100e52d77b43570f414fc940f2891d493efbc021abd6dccc818c4877ee1159d8becca6f77
TLSH
T115F052B62EE32800BA6EC3E520308494410A7D5CD805BC0E9957F683147335670AAC72
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 624B
SHA256 a057d6b74c2f7812e01ffafb3866a28822320466f4b0dd043c65051816e75fcc
MD5 46c7d8f562909a3725fbda2030afd442
SHA1 d93f75ff9df0bdba42c87cd46d9e0c513afa3eb7
SHA512 7553cc84307101cfad22d09780bf9f2a9553886fbc14375fff19ad67ef1da952006bd43ab4f6d1ae0abdf4f85190817f37a9f8f88abdd90d6d6e0e6d332225bc
TLSH
T110F022B37EE32810BAAAC3EA207040A4061A7D5CD416AD4E9667F587507336A60ADC73
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 619B
SHA256 116d6a5ab3ec936b718720bfba0e64d89f715ce6546e04d094fcbcdd4f8b2db3
MD5 5956174721a2dcdf268219bde40c2198
SHA1 24ff8b3228ced3b1e15b63a1d57f3f2a4c5c4a47
SHA512 2063d430dc463997f835d2c82e9d7136829c5e825f18e5d011d491f697645eae8240decd3f9072fa540435d30289066c2a0b1a371469b11f74f889dd1b161437
TLSH
T123F022B27EE32810BAAAD3EA207044A4160A795CD525EC4E9567F587507335A20AEC72
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 1ec4521ee93bc36709a1165d67ba17546d05c88a06e6b9bc10babec398dc2be9
MD5 e0481df2e3164df4a5d5853131fcaf98
SHA1 fe20df8935a786037c9c48be38ea3d594957d20d
SHA512 af417b7fb7765d6a35c46a791dd271298d278dc9673b647ad047d39a9e01529d9f366beb90847cc86761742243be128889c62efc360b65aa1a6618bf8c5727e8
TLSH
T1CFA00261C964A141E46202B2E06101DDA3589CE8861A233145EC04B8CCA814095D2148
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a2685.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a2685.TMP
Size 48B
SHA256 fac811074e236a7ff7b8b439c6a4c63eae411e84b250ff5880ead912f3d475f2
MD5 b649f869a59f0c595fa9ee7091437925
SHA1 720520a367c8d079cbcd82e66891678f90da7950
SHA512 168ec2b86bc16afcf887906e0253e479ad84dc7bca340a6fa79706472321021ff0fc98f6939a7b1624a7c44fd74c16c9923fb6c5e1891cf880a9fce2e5f0ece2
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 cddf436359c1bb2801cf7fdc37a0bd82f4ddfa7257d1abb2fefbb83d50150440
MD5 3a9089d77f57c4b1484d7d38eaf42496
SHA1 6f213e4ed2411c52ed31078bf5e801dce1f76132
SHA512 a2ca72d9dfe7b06e387d8ae9cc70cdf207ddfb1338809946d3cb2c274ee9343de14fcb10d2ef6dcb9e66a07a5239eb9a21a88408e072d9b283d47c1b0749bd71
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1Ei:KYHIhKggkXyVDIdKYMAPyJiI/KXq04
TLSH
T18B910306747A12023C3D2998B2E1D6360F4539A3746D64EFBFB844958E67E210EFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 fd341cfda48dc908d9a50e9fab54a5f88fc5438b2fc9435ee3aec1dd39200209
MD5 33a15123f650557287039dbd924558a4
SHA1 b8e8788cb308504d6d0ae3a525e48f858df17791
SHA512 04ae44a2ca7cc3550df4ab84a4b08801db5a113fc14ce6a29edb5a54f84f5382796cd3776e7b9b8f220650e9b6f22c215d250aaf0a1bd8facd7e54303e8ce3ca
SSDEEP 192:uuxm+xasuheOwQxMGsNDUXTguEM7pwp3/miU1YjbO8BMTH7+FdLJxtQ+2P8z11qJ:nSZcIhsNDUXTX97S4AbO29d9xW+2U36P
TLSH
T14E725C716C34AC3BE9A3B145F48B36074FF8912BA6C45B94F5FDAF1D01DA6B8130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 5ec08f725d6c3f1c1c551a1fd4d9dba45d54b8ac705869b7c133f5e38d2e9e79
MD5 74c3b8569dcfe8474da3be51fec805df
SHA1 3d95f001b340a926eda5b00113263ecc0cb1b62c
SHA512 28ecdad39519b10af0279ed1d2662236d49c285d479d0a96c4259198ecc2e72c8be3239301c3ec4e088e7befc06801e52755649a765d956d74edb27fe23e7f9a
SSDEEP 384:nRDZcIhsNDUGTX97S4PbO29d9xW+2U36P:RbheBbO8ElU36P
TLSH
T158725B716C34AC3BA8A3B145F44A36074FF8912BA6C45F94F5FDAF1D01DAAA8130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 40530042514d9c4be0078c7cc857a80505e1983ae84a3b321cdce9359b1a5b36
MD5 9b2be90ddb79bd18ecfa5b3d7f6dbaaa
SHA1 128ae46325b6a0907c5bf5715f091ebe3afeaad1
SHA512 1fe8e1248d08400ea114673f76f015588ede884136a525047ee176762239bcf796a6d0ae8715c47f52b8a2f6d82c58bc3b2b553fd9efc9b44a2eec214eaaa304
SSDEEP 192:8ONh6vMKPQmiUyxjQXhTH7+FdLJxtQ+2980I1qGU/u:8ONh6UKR6QXmd9xW+2C3U/u
TLSH
T1CC121B35A8749C2BADA3B545F48B36070FE1826BDAC45B50F6EC3F1C01DE66C130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8536aaab-72e7-48e7-b420-b2a407799314.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8536aaab-72e7-48e7-b420-b2a407799314.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6badd06c61e8c67d9cf6da1a547729ab12c537a26b5bc8e47bdc49eaa53e5bff
MD5 049d4de6330b87c5288739284d161408
SHA1 141b47a92d8d89fc1efb1d01bba75ff9d34debe6
SHA512 545e22e1dd3d697a308d2fdf917d622665921e64f32986bd594fd5f90a3482017b144b70b0bc8367167223eb0a2f017ca17c5397ddd0d4056726f5ee11a853a1
TLSH
T1CF410D58B7E91148B3B72F56AFF6A8AE487FBD772E0A945E10110E4F0666A40CC61733
MD5 SHA1 SHA512 TLSH

Submit Download

91888aa6-646d-4cdc-a186-a3bbd4e6615e.tmp

Path C:\Users\Admin\AppData\Local\Temp\91888aa6-646d-4cdc-a186-a3bbd4e6615e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

9e17dd51-773d-462f-a79e-a7fb129d9e3b.tmp

Path C:\Users\Admin\AppData\Local\Temp\9e17dd51-773d-462f-a79e-a7fb129d9e3b.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MyTweak_PC_Optimizer.spec

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\MyTweak_PC_Optimizer.spec
Size 966B
SHA256 3334a5e118597a5dbb9d659c5ba857c6b83b67849ce09de72d620e2b71b271d3
MD5 1d6a98891624952c13235f749c5a21ca
SHA1 32c32c491a9d2166a0091cabaa779b72fb6528d2
SHA512 f4ed9f515baaa708d10d6ee348076d07eb336e9a42190543bf7354b8e46b2b8c5274c12afd43bc06e58d00cb1022053f1e47661e8eb2cf9e6d018638cae812d9
TLSH
T1E011CC5388545A468235A60CD12B4804D3C9678F5C0334A37AF8633B2F71E45E1C2D3D
MD5 SHA1 SHA512 TLSH

Submit Download

README.md

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\README.md
Size 1KB
SHA256 e6945dcb8149f996ea5627f144c1151527785a06b504e0fafe7d684b4304f9b2
MD5 e5bab47a6d2cca0f5d49c64eb6e58c96
SHA1 270ddc5e4e168e27113d416d872c0b0762d91ef5
SHA512 54292e5d2baead6343541abdb70639eddfed132c42b5e1a5e6c2565d05a07129de3eaa3e92132f02a233378b56085df3aa28287bd385f9de1ede6608cc82dc07
TLSH
T132216366EECAF3B201705467557C62E2E66A4234B30154A4B5BC02783634730C33C8DE
MD5 SHA1 SHA512 TLSH

Submit Download

Run_MyTweak_As_Admin.bat

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\Run_MyTweak_As_Admin.bat
Size 150B
SHA256 5e039f10d5b9d08339218a6ef1ab2ffc795b78711660334c187ae61822b9d254
MD5 60e797e350ae65ba2d5276ee0f86c5ed
SHA1 7199ae14c6d6fd05a39130eb5e809f5f6e91dfd4
SHA512 6de5894d1b4f443e32d9adc1cf9ec0d7ee7e477769b31f1fad9dda8125bc787682b9ee578b42330e1a657f7ae26602904b782689025a7e25d44522f24c67b8fe
TLSH
T1C2C02B11A37C352382E5CBA9C85E45523D8C218E461EC847217CB2352B4409CD3F8079
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\VCRUNTIME140.dll
Size 174KB
SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
TLSH
T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\_bz2.pyd
Size 86KB
SHA256 b938073c85cf6b9fe80556d7899ed1901e5e60b7adea2832442376239fb36b36
MD5 4cc74cced07914bd71dc9c4d2a3f127a
SHA1 77bda774eff7c8afc94892d2d5d63dd3c80f9ea4
SHA512 8f81a5287bc5f59eeb6bb6703c00495cf761816e6eb20b6cb401af20040464fffc5b5e95d21b49d6260debb9cfac4031cf87b5248c0077fa8edd0d390cc1910b
SSDEEP 1536:+/BvOKz7hvAKyRXzgwnZpfzyONpGX/4TjW8hSlUbrjvUIp3VJyPs5i9EfIY+8i:YBvLztGRXHyONpE/ajhwYXUIp3VGV
TLSH
T185838E87E3A463F6F6AB81B4D6810753E730BB460750A3AFB24482853F23F91AE59355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\_ctypes.pyd
Size 139KB
SHA256 408cc4e7a22ffa418ca52f5e13fe9268a3c50a2bc9de02b0530b555ef591bc5a
MD5 659510afbc97992af071a0e2a75545ef
SHA1 ec7dba6821ccc0e6b9f851d39812e0de3627130b
SHA512 76a243fb96129041bccf92c2e231efdb53aba519bb26d919dc8b213e949fc0534448bf75400702c03850abb7cd24b1cbd37e0d0c76615a34248615aa44cde4d1
SSDEEP 3072:e/n1qQ8rqSN56EBZSQ4ED1O/IxswJQW2DfrFAIpGPMS:on1Jb86JE0/IxfSvF6
TLSH
T149D38F4B736840E6DA678138C6739E47EBB1F4511A1087CF02A4C99B1F637A2AE3F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\_decimal.pyd
Size 284KB
SHA256 bc3a61685825ae37a4cd2b2b87fa27af12e01575c4f920788ea806e6781a2c79
MD5 c75e9f59ed7df7cc913dc966c8caea2e
SHA1 7b3a83474270b5fecea3c4f9864cf3cf056da695
SHA512 284e0acf04cee094dc953c88d8311ab69b8ea25a844077e70d3a5d9e8531dc69ef0313ee8c2e82af6e7785dd266f565cc21306d5dac36be188c8d1be01365b5c
SSDEEP 6144:PgR0o97cPAEIiIKG5iGqqM43fIWeA5euMt7uq/X:PgR0o97cPdIiI7NO/b/X
TLSH
T1C4547D56A3490CA4EF738074CA479A57F7B2B8414360D78F43A48AA72F933A3677E744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\_hashlib.pyd
Size 67KB
SHA256 5933ef5eda7c0bca0b3874a6e2c5f13b91b8f2cfc29bc46160df3212a1dbee79
MD5 3fbad145af85337e0c05dbc5ae6c0b4c
SHA1 fff5ebc3b2f044fbf024605f02a37554fded3b17
SHA512 aeaf32f2c73da687bb847bb89daf80119d5f2927b439330cb92158180b2fb48013be449228ff40d0be5833cfba3b599265cf9ee84b066f6bff9443bb9005bd65
SSDEEP 1536:OXwAzOYBQc17JKRQ+C5cIpDILyPs5i9nfIbHHnM:AJ/tJKRQ+IcIpDIJTs
TLSH
T11C635A86A6984092DA2382B5C9E34F43F974F2522B0197DF6678C18E2F233C3577B756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\_lzma.pyd
Size 157KB
SHA256 d2abf8db7fb0cf6285663b177991691a41b37e215c3d71fd087a98d8ec1bee63
MD5 e882005d06af06ef17b2338342b3f41e
SHA1 96dfac53ce267a9dd4d094bf5c5a665bc1cedfe9
SHA512 1e53c3501796da814f75ba8fc683720e968c5944fbeb2b9836c48a6656df0da120c075bc6c17ea788efa14be11f29172e80c64febe72e43502a02f707a5928dd
SSDEEP 3072:NJ66g4T5QW7JfyjEqkSkA51b4rznfJ9mNoVUIsbUIpI1yUx1:NUR4Tp4QPZ8N4nxYOIbHy
TLSH
T1FDF34C86B794F0E6F7328C78D2614F57E6F5781A0320929A01CC976D2B1FB759A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\_socket.pyd
Size 85KB
SHA256 02265dd0d0287f3ffd287ea5d8e3c918a5a056e8ef2c4529857f5e84ec9e2519
MD5 8e833fd16c777682dd1bb099d06390d9
SHA1 3f455b62cd6bae8f74266d371959298d70412016
SHA512 1e7d20c0ff2964f718e8387b9a74df0dd89569e2b5a817503a85e3828ddfd29d90bd6bccd7021ef574467ed72dcb8d957d13bb3039ce44ad5a06f17142643866
SSDEEP 1536:2cVuncT0XH3XAJtZypxQ7XP+66wSzj/jAjI/Lb6UaQecs8PgMrAIpGwfyPs5i9zs:vEny2+jypxQ7XPz6wSzj/jAjQLaQnsV2
TLSH
T1E3835B01A66040FAEB72C172C2639E63FBB4B5C012D4A75F1466D55A1F333D2BE3AB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\_ssl.pyd
Size 186KB
SHA256 4cfb154c7cc525d57020c0e64f2dd876a78b46cd38419446392478de6b7b13b8
MD5 35cadc41cfff6464baf8d07c87daf4ec
SHA1 c497ccd0d26491530eb91bd4c671d74a4fcc936b
SHA512 3d714563a2b5cf20f7cab6f9095dfaf845cdbafc0ddd29332005a9a20136e3602c6bcc0f3eb36945afe60327acf7351168168f6e15f875ee083e63edf33ed0e6
SSDEEP 3072:MVpZeIk2MZ7IifjvQtY7qr66Xrgp8VuMG4eJ9i1zktdsQ/3Omca45gMqTVBOrUIe:2xk2MZZjvQttX4457qTVMr6
TLSH
T139147C47B5442AF7DC02E8BAC6234543FBB4F045731197DE48D6EA620F03746AE6A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_tkinter.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\_tkinter.pyd
Size 69KB
SHA256 ee3eb2cdac591821cf71cda8035a6bc9b148d92996dd45b24e3ae3715613315d
MD5 3fa21737ba104b04ad3cc69d96885d47
SHA1 06eb875339b8f1bb6f1d1fa429d4374ed1a5d210
SHA512 b7a30ed377247ac32c84253b2f46052c0177e5d5e7c9156a5c89d8ebd02a6e1967bb3b73a76dfe44e7ebe7c307eedbc64cd108f6875fc552f575b7adeb2a6f83
SSDEEP 1536:a3rQ5jzPC333f/x6pY33mZgZ0+jcIpDSJyPs5i9ENfIbHfnUn:a3sJD233syGZgLcIpDSNOTw
TLSH
T120636D9B6764008AFDA3D139C6729F53E5B5F9521A20824F40A4C39A0F373F3A7BA751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\_zstd.pyd
Size 491KB
SHA256 33c6eca99470c3eb9d776b617c550ad41b002a668336f062a9ab7be677a7409a
MD5 fee9e34fa16e0ff378c281202a78d003
SHA1 d8681b1ecf3776d1f095ecb738210423bcfec287
SHA512 766fa08c57cb9e000237a5690e6bae8fbe2d2fb79fdf39f1a2f07ec668ee225df9675c9041d4b26410cbb4fb341693454dbcad722bcff3e78321412e0bfcf4ae
SSDEEP 6144:HoRvcMPHwrJqB2l1eUVcXmgqCBdBwzKhThruVxzeeVUL2LzMYZpzBYQFE95+SClu:IRFcemgqKP2eeVC2Lz9kQe95BCl9Vmxp
TLSH
T1C2B48D43F29943EDE53BC4B8CF465A13FBB1780B1214965B97A5CB993F07B309A69308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

about.py

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\about.py
Size 4KB
SHA256 db6a5539b3504747a6ddcd560ab49582ac393c467621ebb66827858415c992a1
MD5 c4768d44e459a8f00ebd11dd9eeb9974
SHA1 20859de07a867209fe7550ab663feafe7fd56a0e
SHA512 938391eac7de92eec95f5f571f6ce11c39aa53bf3af3bd94a6164bc308a51a26e1ea38d5c3dbaa10fbd5dd7ff2fe07d00d341900ff97f5137ab8a98714661231
SSDEEP 48:fr2yWqtzMGRIZXZPWB0stPwpJP94PmkxP37CqHhTRBPp/bPhnsirCoP7q3sNP7y6:frJjGHtYBkJCpLCqB9mirCc1h0DA4pM
TLSH
T1559150531900891AA473C26D73333D54D0B607172AFBEE1E356E82022FB7023DE4175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\base_library.zip
Size 1.3MB
SHA256 e5186b33d96bf630799eb4af53aec570360cb930cffaf0a14a25c17f0c4d4677
MD5 89a813ce2a7d16f93d455b3b63169bf0
SHA1 8565671c1b06247cd2955db3fea9d8dc15fd07db
SHA512 470ad0a70a8b0b9f2ae9650c856fe47bde48bee664b74108e5e49dbd057cc119767cb143fabff5aa8255c17da088ecf41c5d05f9f681830d2c3f390e52c8bc2f
SSDEEP 24576:auUFFdeDZMXiLxfRZCYdalbSQeOdP2m2df2X:auUFFdeBRQYh/0
TLSH
T15E552B91B9917967FEC9F37A35B75A0CA715C0109B20D303B4A88DAC6FDF260AE558CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

build_app.bat

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\build_app.bat
Size 678B
SHA256 8cbea2434b2aec1320936ddfb01b1d4150cdbccaaa56db49be07c2c51a57ed38
MD5 b258c7f6c8bca78f37352bcedfdcab13
SHA1 41b438b0b7469783bd33a680983a3cf66fc369fa
SHA512 56ad873ab5c7428e0c16b38cdf795e935f0bfa56b1c8214b8d4846cc0e494cf2e46891401da8a60a89a28c202b40e0484ef28c66521026b91733490bb4059e52
TLSH
T18F017612780A2A3606F58AA0867C13C1FB8D256B476848A5B4A6C2742F246F4E7FD0F6
MD5 SHA1 SHA512 TLSH

Submit Download

build_exe.py

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\build_exe.py
Size 8KB
SHA256 8a7df8bd2eb343c693d0709d38a172e4748e906ba25a9f88c417db69ae50241c
MD5 1d652bd315a8b29f7f7167e6eaa48fd4
SHA1 314dec7129e1e69203911681daab31744274feb9
SHA512 84983652df5e4b5cfcaef857c1fb25f6a06f45927886bb08e9d1f4a32a33db2ddf86e52d4effa5d77ac265d38eb576f710332f324a55a17b66fd9fb2b7c68bb5
SSDEEP 96:hcFS0HqQ8uz743iG3G0avZDNL+VdOKtJnwqr8JaGug4pm8zRN8rEHAI1kx8+:habqa03iJJvLIdFPnwqIKrt10B
TLSH
T1EBF194634C441435D1B3C70C9E93C8E5F71743B36B72283930EC9A942F725A1C775AAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_version_info.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\file_version_info.txt
Size 854B
SHA256 7326e1c51151ee0f892a28bd17dd831f47884b86604a5679c258d81dda9cbb62
MD5 b8753abcae12ac9b1b14479ce2b65444
SHA1 8788530d2118529daac21db0cde81ab5821c6759
SHA512 f59f7c8db234c0aa5cfe99c041b3405465f7e347df7c42194111b96a690d55229092f27f836bbbb4ec3e3a86fab3ce43286032cc9d155dd1a5834d09b44c2b07
TLSH
T1A401456B9E05B26540F4673D96660800E2980733617FBAF3B8BD3468CF36316523636C
MD5 SHA1 SHA512 TLSH

Submit Download

fix_and_run.bat

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\fix_and_run.bat
Size 1KB
SHA256 a2ff510f7825d370aa5427b7f2e83862d9b026c16daac1b084781f9435d51ce7
MD5 5217640d299c5c131b9368032917c604
SHA1 4a5ffc44c0d92d50f6bf4e14375eeb003d8d4eac
SHA512 38fbf3487ed4b989cd632d5a120c3609f7296579c276697d753993c16f5bd6519f259462b3123a0803c0b740171d8f53337d59c77026aa33a9dec76d735f0c8d
TLSH
T12821E13ABD57233142F4DDA998391252FF0B5143A6164D62B436E1B80E041E5F2BE65E
MD5 SHA1 SHA512 TLSH

Submit Download

full_build.bat

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\full_build.bat
Size 4KB
SHA256 bb3f0f6aea811eb06ce678b37a280d041f83df1a575f058531186bfda5ba1480
MD5 0ad7d6ebaf24bb2bba63d8e89c5247a4
SHA1 97b2202787346a441a834141e068e730270e37b7
SHA512 48127dfdbf6cc3af71cc0fe92b6f0eb1e1f88cdf61b0a3d772312fcacff69defcf32a4941d281cd4c0be296481716f886f52cdc9ee292de39c949858ff13df7d
SSDEEP 48:Ov8cldvyAtZlcA9x3jfsXr92tf8cQ14S49SSRYfULFKKZMnS9OgnuqsxDbiW2Z10:NcDvywZ2kjZ8Z14xdRZK1lCkBHp
TLSH
T1E3814133B4856134A1F4879A993D844AFB425597E7122C38F07B407C1B69BF0B6FEA94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\libcrypto-3.dll
Size 6.0MB
SHA256 53c529145339fb042a3dcd3a09c2d7753204f8b4fc79d99e0d31e69a33985958
MD5 4191d4288230515c5098cc07f699a604
SHA1 bd8b4d48b2f4513dc378bc5a4cf4a3abbc6998d8
SHA512 c110a89ebb5b58126d556ffea1bf01efb4a6dd295f7387665223741a171d9353315de4d361d3d02a186c1c659aee20f46c579efc51b4c41f7282e1b5b4d6d040
SSDEEP 98304:ybM11p6ZVTRwlFh7V6v73WyXTf0W+JJe1CPwDvt3uFA0CaI:ybM1T6ZlalfV6v7GyXbnEJe1CPwDvt3T
TLSH
T1E6566B5EA7A80188E4BAD13CC6534627D2F1F85A5BB097CF05A196790F33BDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\libssl-3.dll
Size 1.3MB
SHA256 b17a87979862d19241edc4318f967e24c3ec356ed6c2368f561179fab2311001
MD5 d99207e7e513f87ad7571c4c2450771b
SHA1 b904eb3989c9a1ad77e3a541e40d84ae890e3df7
SHA512 bccd034e633b96c2c7dff6ca96c2bb8a8c0f90a872f256e8467e470ed57fc4b442c74da488b258b5a255feba26767a5c95293a636c94c754e2644ed91c5be7ac
SSDEEP 24576:gk2RrDo2iVOF8hXN1hyeWsoSvSZlRg5aYsC:gRFDo2uOKJ8sIRg5aYsC
TLSH
T11F556D5AA7B8016DD5B6C17CC6938B23D2B2F41623709BEF06658A790F23BD6273D344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libtommath.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\libtommath.dll
Size 79KB
SHA256 2d760fefb452665b6af8c8d9d29f3a8378f10fc0847cdd9938ea0cb5edf1d573
MD5 d905551350a3d711a5e72a284a07997b
SHA1 4eb1261e90e19d241893e486aba6747a74d8b97f
SHA512 35c92d493efe9a2296ba94a4e6851132ad826dfc749bce3fa9bdc9352855aae9bc57521e79ce7f49cfbf486bc15d5c767ed50ee70d966d568d639176350b689d
SSDEEP 1536:03RaimSoWEBrh2as3iwaOasKuWoSvMD9NN:KqWEBkL3iwvrD9NN
TLSH
T184833907F6C620FEC05AD1B6C70A5322A6A2B8239B267BDF23016E255D55FD06F3F251
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mytweak.py

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\mytweak.py
Size 136KB
SHA256 b51524b1d303d4e17e4dd72f2e6a031b56d338edf6858cb48248a349bcb94094
MD5 6bf1879454762216372e80fcf0a5bbac
SHA1 6a0dec81bf9e6782f096a1c8beb645a1767ec5af
SHA512 b02b8c3291dff92efeeb59661b4284bb38c5b6cd474929d1e24706d0d30d2f276b1173eca930bc897f227a9b16a548fd3ebb90aa93a6f2804e101473850b276e
SSDEEP 1536:Iy9H9H8eMANEUTCe0DvIMx1/CspV/XIPjI:IyFEUTCe0DvRpCspV/X0jI
TLSH
T10AD3B413CD18251A51B3D62DA043A405EB164727632A5E2BF9FC91D40F79063CAEEEEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mytweak_config.json

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\mytweak_config.json
Size 41B
SHA256 d113194e08d8fc4fe9efccd9e0020f754cff55ca3deaa795b1c5d1b935fef778
MD5 f32a4d46d12ac58c3cd25cadf168dd5b
SHA1 0a0ef3a7a9fa1232da803768631118c3c7af083f
SHA512 fe99be803f8b5869cab94d1e0f065415f965147cd115b6b35f9a78010dd697ad595d33fb6648302a24506f264546ea40d6639e074883f4142a8ed26562413a60
MD5 SHA1 SHA512

Submit Download

mytweak_icon.ico

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\mytweak_icon.ico
Size 13KB
SHA256 e81e08a23a6bba3cd9301251166c58290fc8912a374573e2320ba9777a23ee76
MD5 d0d321021d5e2394f00fe56eb37bbb5e
SHA1 dc66159af50f2264c17c4d969603ae3e0d3432b2
SHA512 b66d894b3db364bda009c698b5f5f5921d4fda40c86dd5fbfac3eddc15d2d2173afd561bd7ef9c23bc8c494f84fb21e1ca261bcf4f15133891b7e949d7140523
SSDEEP 384:52+VQ9bAJ6d3MHEpf4LkM4uLXWaBMMHzwf:ou8bAe3oErAW2HA
TLSH
T1E352DF8F70F85DBECAA05E78E5590210F33B65A74924C06C5313F572AF4A67899AEB02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mytweak_icon.png

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\mytweak_icon.png
Size 1KB
SHA256 01cb3426fd20051968baa4b87684af911b0d82cb7a67132d174231decb120b51
MD5 2972e63af0940c5e1e034d644379089b
SHA1 08817382cd0a06acb4f619f584dd506aae88255e
SHA512 9c79f6f74badf970774f030ba42be2dac079cf37a19146158b22f88b23dd0facb87a33a4236e4a5f18c40e52668038251e05c3bc1d67612439df77e6677d2609
TLSH
T17A41D94D32B8599BD9400FB14E02DDCEB316A2BFA455D4F84A2378698F2CB346927D91
MD5 SHA1 SHA512 TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\python314.dll
Size 6.5MB
SHA256 0f9857ffdfe010fe6b99328d58c2e3c7472ce75f336bf9c2ad9bd5bca3bce700
MD5 689a9724a63fb3b4f209c771c31d8a05
SHA1 2f88e8e16a9086e7974da71914fe4e89cd2eff9a
SHA512 0c96ec1b9ef6e56f29202681272c1062ea49867757c966ebdd050c513d4988cfab7cd6c31e1d94f438c1412b38f7b446af1629b2776c41d712051ab70054ac9f
SSDEEP 98304:xEQucV/qdDSSmJBA3ICXmRaJtv3vyHDMiE4rofB:xEQucVygSmJBA3InSiFG
TLSH
T19F668D26737515A4D8BB8035C9034647DBB1BC00AB30D34B49A4B6DA3F733635BAEB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resource_path.py

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\resource_path.py
Size 405B
SHA256 2fcdcf6622485101e869fd9ee835c1edd18bebc282d9a850664587a6441935ac
MD5 c609ac63cd51b1bb717f480b13b818e1
SHA1 356973e633aa3184efdfea6ee0c079473e4b8e7c
SHA512 81cdb9203769c8135fb9ad020e1a7fdefee5a0390bb1403aa46ef560072ca23dc9838efe45d3ee60d1dbce5f410f9e0661d9fefdb6291d5740f006e7c455cb24
TLSH
T10DE06886C6C009A0C6A183601F601CE0D29480FABB070C24F8CC0E182B70CB1077F982
MD5 SHA1 SHA512 TLSH

Submit Download

run_admin.bat

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\run_admin.bat
Size 655B
SHA256 945f60e9c32ac68c09a2d68ffe18eede051ed50974578aa5f30be7808147510f
MD5 d48242ca623251e6c1d06763b5596aad
SHA1 7283be2c7a79a72df0875fe85d954ef9e9e075dd
SHA512 ef4091e97d0a706a6892d8a4d3732a1aa367fb333ea2316a091302188d6289d097ea091a2d5e20924ba0f40faed521f9735c280dfe3b51e88ec8712c99969f38
TLSH
T178F02631B64E237292F4D896D92D2181FB48111B564B4E7A3035E2309F151A0D7F92EA
MD5 SHA1 SHA512 TLSH

Submit Download

run_as_admin.bat

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\run_as_admin.bat
Size 363B
SHA256 7c9e9e2e084c5d15ae76d948d18205e4c84eca812600c4a0164e2ddc1aa767c1
MD5 25292d1405d2c28593d1aac62c040eea
SHA1 49101e17d50d232e09c5461af1405e4b2ecffdc0
SHA512 a2a68ebc8989f8de392861373c2a42b0cd30a7c08fe090c293ed9f2a41c77e6bfc44519aa49b9faf1e5f1edd4dc114eb1e9f3cd9713c0a03ccf50c29518a4a59
TLSH
T132E06831E90E272393B49862D02E2182FA48000B161E8E3B7030F2309F14AE2CAF508E
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\select.pyd
Size 32KB
SHA256 722328e7fad8048057fc966474ba73966d2ceebaa32e7344cce09640ab4dc9bd
MD5 72dd071ef25e5e8f5dbff53efde54825
SHA1 bbd11e454983ca8b764e32f3e5998d5d80cc94da
SHA512 d0bb4354c8c3a26b21932d26dd2d4db6e325dafec218680d333cd7507611776e32d8baf9d82d5a88f0ac2f0cdd772054399e0898c9195a07b81720bdec65e677
SSDEEP 768:SB7YTZnJrqFAIpRGayPsSvPuBL2Ip4j5Txf1mlRaX16m:SB7y5JrqFAIpRGayPs5i9jLfIY1N
TLSH
T152E28DCA6B348047EA62C571C6B2DE43FA39B7A3561186DF31B9919A0E173C1E737318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcl90.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\tcl90.dll
Size 3.2MB
SHA256 a1fb45f963b05cb083a97df1449c2023b484eb921d40a463da7501b0f60e0f70
MD5 9bba592e4cf79745bad7d5ea9fd3c347
SHA1 b9c21bde58be54333529c49d91c6a419e55abc6c
SHA512 cb3f99cf47e7fa9a1bc124d5ee1b061bf3f13d9afd575a49040d3d4f03775b702d8a2e08b33e4ecfebceeebe334958b89d7ad0e6378f37768b142adebe4d0d75
SSDEEP 49152:JLtprceZwI8raQOc9GEVDUCjTCFva4v5XjqAoFRqux9umJSw+wnxq3BfXAqUcugz:NWrPOVNFFvsJnNKfXAqRGYYM
TLSH
T1F2F5AE46EBA40068D5B7C27CC61ACD5BDFB274581364AADB14E05B612F73FD2237A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcl9tk90.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\tcl9tk90.dll
Size 2.0MB
SHA256 31f625c52e65d29d126e710ed8bab2ec964cb770e4fc59bc329dfff02cb6ddcf
MD5 f07870b32f577cf36256def49d360787
SHA1 c6311ef53589dc7937b4b2cf70782a785ab00f92
SHA512 0e2ba98202d3610601298bde13de16dbc80d894c5b3d6f415f7d477b676d317eaa706d005b84e4884e1811dfb2366dec080857853f7fb52ad0e1244efa04c467
SSDEEP 49152:q/DN5QCQ7T3hJ00UYaut3HZbJTzdMltYxGaN+VH/GMU6y:os7+8JToVH+MQ
TLSH
T11FA55B06E2A88098C067967CCE2761AFEBF13C04975956DF6191BE9D7F73BE1073A210
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\unicodedata.pyd
Size 741KB
SHA256 280b09bd97b598d18c0ed9542dc18ed35fa57a16e84f8e65fd9c6e96516c28d6
MD5 71e6240fbd8f3fca694c12d8a5e3f404
SHA1 b7d66c937638526ef1a90f4dbc00ebb8a018778d
SHA512 d3a3221b28844e9801e1b6f7d6abb88ed65e8b2de8133c925f35fc12f29cc0a7e182697deead47aa4650fb00c34083cb5ca1b45f53317ffc5d22162208dbdc19
SSDEEP 12288:5IwY/APtrZmDtBPcH+dEYJ5EYub+z70lDJPT36mwtygF:5IwYI5ZmDPqO54lDJPTMygF
TLSH
T132F4E5F5BB838C16E69B767A48D3210F4E50C2B35F1A8637B2182355D8EB3B44DD582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windows_tweaker.py

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\windows_tweaker.py
Size 4KB
SHA256 994fb041895074e793a7457638e7b58dbb4d59e2e984af3df262a28d4ce5c593
MD5 61af200be10c8b0c361e252b7f39cd71
SHA1 3ef13d39b4db051295c6b6c5e5c40f1175da7459
SHA512 46ac0d3b1dfcd83e4e154cf4e908df9938e01a0aef2f2ccedbae064214746a4ff7b9e80d84d7dbe96df4fc469ba928644bccd48356859a89755068bf8e76f1c7
SSDEEP 48:xtZ6dDTfo/1ywMvYhgSg8ANk/XBHN7Pk/0ND+qB0Wp/XcXuHG2dN/0rNnBlQo6Fr:xtQdDMtfcYnv/Q/aOy/OuHbr/ytPS/6O
TLSH
T174B11012EC5A38129271C69C4506D080EA4947679A2A2C7BB7FC86343FB5069C3F84FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000edc2\zlib1.dll
Size 100KB
SHA256 f07195206534ebb1fe75093d4ec6c54a7a9227281b0c09d2113465b71da9e900
MD5 1377669a18e22b364fb390504e49260a
SHA1 e42eb7900b11f952ce0cd808fb6e1662fe25c373
SHA512 80538f4c1a64d3b8b0329610c44a2c61d696f4e880a61b935047e2291edcea29ab4bbb0c0a9af9247051690823d7699728ebb4474ac1639317af0c70e830f124
SSDEEP 1536:zeKwGDT0PvmR462JPHiW3beTnaYMSy6W2geD2onVs4iC+5VVRn6dhjIOXws+fB:aNGH+X34najvon8PVh2FXws+Z
TLSH
T195A37D47799620ADC1BBC231D6E61B21E6B638400B2D1BE74284E7752F02FD06F797E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fef62a56-b326-4edc-b2f8-bc1f7dd00758.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir996_1229667994\fef62a56-b326-4edc-b2f8-bc1f7dd00758.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir996_1987285788\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download