Analysis

  • user interaction
    yes
  • max time kernel
    86s
  • max time network
    87s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    13/10/2026, 23:08

General

  • Target
    https://github.com/15trr/Wave-FAKE-executor/releases/tag/exp
  • Sample261013-24v8dsdf68
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 9 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of FindShellTrayWindow 50 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/15trr/Wave-FAKE-executor/releases/tag/exp
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4536
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffb406bc728,0x7ffb406bc734,0x7ffb406bc740
      2⤵
        PID:4668
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,11003726897531693862,17989252099846911967,262144 --field-trial-handle=1804,i,1584197296459962503,14950643910259340819,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1816 /prefetch:2
        2⤵
          PID:6032
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,8126319167017445727,14331582588482978959,524288 --field-trial-handle=1804,i,1584197296459962503,14950643910259340819,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2096 /prefetch:3
          2⤵
          • System Time Discovery
          PID:3440
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,1952067971789652470,1384768848426676634,524288 --field-trial-handle=1804,i,1584197296459962503,14950643910259340819,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2380 /prefetch:8
          2⤵
            PID:2176
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3176,i,5836000973058084785,6521398232484664329,2097152 --field-trial-handle=1804,i,1584197296459962503,14950643910259340819,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3200 /prefetch:1
            2⤵
              PID:1140
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3184,i,12743873073394719778,15527941810915555376,2097152 --field-trial-handle=1804,i,1584197296459962503,14950643910259340819,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3228 /prefetch:1
              2⤵
                PID:4016
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4436,i,3973394176466578868,2707620360991501760,2097152 --field-trial-handle=1804,i,1584197296459962503,14950643910259340819,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4468 /prefetch:2
                2⤵
                  PID:3688
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,2464906330137785726,11579745313462016699,524288 --field-trial-handle=1804,i,1584197296459962503,14950643910259340819,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5752 /prefetch:8
                  2⤵
                    PID:2616
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4868,i,18317902295716093057,2462690316821084860,524288 --field-trial-handle=1804,i,1584197296459962503,14950643910259340819,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4944 /prefetch:8
                    2⤵
                      PID:1076
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5752,i,8798264518818669832,741297071650343260,524288 --field-trial-handle=1804,i,1584197296459962503,14950643910259340819,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6196 /prefetch:8
                      2⤵
                        PID:3064
                    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                      1⤵
                        PID:5364
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                        1⤵
                          PID:2580
                        • C:\Windows\System32\rundll32.exe
                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                          1⤵
                            PID:1028
                          • C:\Windows\system32\NOTEPAD.EXE
                            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\source.txt
                            1⤵
                            • Opens file in notepad (likely ransom note)
                            PID:952
                          • C:\Users\Admin\Downloads\WAVE.EXECUTER\WAVE EXECUTER\API\dist\WAVE.exe
                            "C:\Users\Admin\Downloads\WAVE.EXECUTER\WAVE EXECUTER\API\dist\WAVE.exe"
                            1⤵
                            • Suspicious use of WriteProcessMemory
                            PID:4092
                            • C:\Users\Admin\Downloads\WAVE.EXECUTER\WAVE EXECUTER\API\dist\WAVE.exe
                              "C:\Users\Admin\Downloads\WAVE.EXECUTER\WAVE EXECUTER\API\dist\WAVE.exe"
                              2⤵
                              • Loads dropped DLL
                              • Suspicious use of FindShellTrayWindow
                              PID:1124

                          Network

                                MITRE ATT&CK Enterprise v16

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                34c0dc09-d43b-4485-895f-f93e2a63a3b4.tmp

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\34c0dc09-d43b-4485-895f-f93e2a63a3b4.tmp
                                • Size 131KB
                                • SHA256 72cb6596acc0ef399dd77d44fc1cd9649a1b773bd1cc71b74a07e809b3eeca62
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                58226925-d14a-4bb4-8e59-ccd6b67df54c.tmp

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\58226925-d14a-4bb4-8e59-ccd6b67df54c.tmp
                                • Size 131KB
                                • SHA256 8bb46519d754a5dbc66b2970203428dbc3dfcfb90f384e9c0fd7295693af9a28
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                settings.dat

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                • Size 40B
                                • SHA256 baee53444a53ae41439e5e4e8c3120eb246a04a4deef889942c0c6f656892b12
                                • MD5 SHA1 SHA512

                                4fd93b91-294c-46a2-9c72-becef4951161.tmp

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4fd93b91-294c-46a2-9c72-becef4951161.tmp
                                • Size 414B
                                • SHA256 a265aa92089d71e677d16463fcaf15d122cc0f5432bb7abe2b6c2434af9cede4
                                • MD5 SHA1 SHA512 TLSH

                                855e6f2c-a453-4744-9e83-3e044f3602ba.tmp

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\855e6f2c-a453-4744-9e83-3e044f3602ba.tmp
                                • Size 12KB
                                • SHA256 a902f14de7cec31d6f0bfd086a0bb44eb79355ed290067faf0a14d01cdb24d5d
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                temp-index

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
                                • Size 2KB
                                • SHA256 c9c1a723e29d7d5320212203581d133cf1aa1c1a3731bf2f4f845148b64e0e29
                                • MD5 SHA1 SHA512 TLSH

                                CURRENT

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\CURRENT
                                • Size 16B
                                • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                • MD5 SHA1 SHA512

                                13280c85-a518-414b-af1c-b41671c61338.tmp

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\13280c85-a518-414b-af1c-b41671c61338.tmp
                                • Size 1KB
                                • SHA256 6b180065954b8e38e4a5773c62733b500827ce2137acb9e279617e3e69a089da
                                • MD5 SHA1 SHA512 TLSH

                                5bfc972b-966c-4057-8a8e-29447b1947a1.tmp

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\5bfc972b-966c-4057-8a8e-29447b1947a1.tmp
                                • Size 3KB
                                • SHA256 24179e965100ddaf69d8335f0470e20a3c27766203a0ef50892503f4a50968e5
                                • MD5 SHA1 SHA512 TLSH

                                96a722c5-ba84-413a-84e4-3cda5bac380d.tmp

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\96a722c5-ba84-413a-84e4-3cda5bac380d.tmp
                                • Size 2B
                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                • MD5 SHA1 SHA512

                                dcefc5eb-2cd7-4315-a4ec-0c4ea506d261.tmp

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\dcefc5eb-2cd7-4315-a4ec-0c4ea506d261.tmp
                                • Size 1KB
                                • SHA256 3cdfeeb07d41f50a022a0bea24b16d82744081f4591bb04c718dc28f9d423519
                                • MD5 SHA1 SHA512 TLSH

                                Secure Preferences

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                • Size 17KB
                                • SHA256 a55c9d9bfbff27f4080d00af8282862be9cc6b021b0d1cf3b654e6d1857a1705
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                temp-index

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
                                • Size 120B
                                • SHA256 575557a0bf4ca8d5a366c5c2b1caae53a7553aa2930732a62ee9160dca96299d
                                • MD5 SHA1 SHA512 TLSH

                                the-real-index

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                • Size 96B
                                • SHA256 a26ad116dbb72e3ebbbbdf470b7731ec6d9177d3283e52a766143e1b6623ca0d
                                • MD5 SHA1 SHA512 TLSH

                                d60c4e2b-41ed-4330-af0e-0a7a5458adb7.tmp

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d60c4e2b-41ed-4330-af0e-0a7a5458adb7.tmp
                                • Size 6B
                                • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                • MD5 SHA1 SHA512

                                data_1

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1
                                • Size 264KB
                                • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                • MD5 SHA1 SHA512 SSDEEP

                                f0878f4e-3714-4cc0-a20d-c299cc07b155.tmp

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f0878f4e-3714-4cc0-a20d-c299cc07b155.tmp
                                • Size 130KB
                                • SHA256 a377a3ca20ed48ecd7e3c19280e99d1f04499889a99636177f4fd760088e04da
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                VCRUNTIME140.dll

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\VCRUNTIME140.dll
                                • Size 117KB
                                • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                _bz2.pyd

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_bz2.pyd
                                • Size 85KB
                                • SHA256 f0643f805a011efc704df472bb431ba231e6ae31fb7ba71328df1b6f1a9e1aa2
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                _decimal.pyd

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_decimal.pyd
                                • Size 280KB
                                • SHA256 a33b1562acc8201411971f54444bd9c648f2d194d9914f0eb734904882213828
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                _hashlib.pyd

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_hashlib.pyd
                                • Size 67KB
                                • SHA256 052f824d5e3a046aa401efef86307c0c7746a0d8ff85c855d4225d6fe565bb07
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                _lzma.pyd

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_lzma.pyd
                                • Size 157KB
                                • SHA256 3a0c632ba1b9bef724e87e42011942ba90b0dee1b47bcd563728899e95dcb723
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                _socket.pyd

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_socket.pyd
                                • Size 85KB
                                • SHA256 6a016011e78e2476eb19dbe7330b373b9e2c66ff6c0be9bd64ff008ee53647ef
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                _ssl.pyd

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_ssl.pyd
                                • Size 179KB
                                • SHA256 1edd9575243ae8322f6a21e9eecc933701c5820f05e7b0ebc0b51cb80592da77
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                auto.tcl

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_tcl_data\auto.tcl
                                • Size 21KB
                                • SHA256 08113823951619d659eb03a1f6acd2f9500e1264795219125a5df7b83cabcb99
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                cp1252.enc

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_tcl_data\encoding\cp1252.enc
                                • Size 1KB
                                • SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
                                • MD5 SHA1 SHA512 TLSH

                                pkgIndex.tcl

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_tcl_data\http1.0\pkgIndex.tcl
                                • Size 746B
                                • SHA256 77265723959c092897c2449c5b7768ca72d0efcd8c505bddbb7a84f6aa401339
                                • MD5 SHA1 SHA512 TLSH

                                init.tcl

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_tcl_data\init.tcl
                                • Size 25KB
                                • SHA256 acacce15658dd7ce8f69b1e3d3a94770a22972a8e906eb3b61cd06f0ecd5db59
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                pkgIndex.tcl

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_tcl_data\opt0.4\pkgIndex.tcl
                                • Size 636B
                                • SHA256 68accee3eb8d0f134f9472c95425190ec08e7793df20a58d7d35325f42804695
                                • MD5 SHA1 SHA512 TLSH

                                package.tcl

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_tcl_data\package.tcl
                                • Size 23KB
                                • SHA256 b471cec9056b62d562020b14d69d4bd1f92dfe158afc8ba81c6341836211ca46
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                tclIndex

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_tcl_data\tclIndex
                                • Size 7KB
                                • SHA256 577f042bbe640e2739606a1f76098abdb8bd1d1f31526402fb82b21091644f65
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                tm.tcl

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_tcl_data\tm.tcl
                                • Size 11KB
                                • SHA256 f0cc13daca21fee538cca757aa09e88a969a85174eda26e61e573dda6c7ba413
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                button.tcl

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_tk_data\button.tcl
                                • Size 21KB
                                • SHA256 1f5dd8d81b26f16e772e92fd2a22accb785004d0ed3447e54f87005d9c6a07a5
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                entry.tcl

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_tk_data\entry.tcl
                                • Size 18KB
                                • SHA256 6ac78f764434f932d37e8183aa6db5d04eb1848b774c92f7abc243ecb7d4a59b
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                icons.tcl

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_tk_data\icons.tcl
                                • Size 10KB
                                • SHA256 1264940e62b9a37967925418e9d0dc0befd369e8c181b9bab3d1607e3cc14b85
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                listbox.tcl

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_tk_data\listbox.tcl
                                • Size 14KB
                                • SHA256 47c75f9f8348bf8f2c086c57b97b73741218100ca38d10b8abdf2051c95b9801
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                menu.tcl

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_tk_data\menu.tcl
                                • Size 39KB
                                • SHA256 ae4ee8400174c798337b9c60867cbc94f811b249ebe6dea21ec6f960bcf5f8cb
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                panedwindow.tcl

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_tk_data\panedwindow.tcl
                                • Size 5KB
                                • SHA256 aa4f87e41ac8297f51150f2a9f787607690d01793456b93f0939c54d394731f9
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                pkgIndex.tcl

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_tk_data\pkgIndex.tcl
                                • Size 376B
                                • SHA256 6127926b94db2992ab450fc6cc2ec3d071f7bbc856656d0ae20cc3fd4036f547
                                • MD5 SHA1 SHA512 TLSH

                                scale.tcl

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_tk_data\scale.tcl
                                • Size 8KB
                                • SHA256 0747a387fdd1b2c7135eceae7b392ed52e1d1ebf3ffa90febe886dbc0981eb74
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                scrlbar.tcl

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_tk_data\scrlbar.tcl
                                • Size 12KB
                                • SHA256 eec90404f702d3cfbfaec0f13bf5ed1ebeb736bee12d7e69770181a25401c61f
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                spinbox.tcl

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_tk_data\spinbox.tcl
                                • Size 16KB
                                • SHA256 747889c3086c917a34554a9dc495bc0c08a03fd3a5828353ed2a64b97f376835
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                text.tcl

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_tk_data\text.tcl
                                • Size 34KB
                                • SHA256 f7ecc5ae6eb297c79aad5cfc200b29c4e72409641fa369c5cdbba30ae41e982a
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                tk.tcl

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_tk_data\tk.tcl
                                • Size 23KB
                                • SHA256 b7fd24177b17f67da2ca671f711309c65cf246be1fd0cf4f1ab8f3ea9ca2c3f1
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                button.tcl

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_tk_data\ttk\button.tcl
                                • Size 2KB
                                • SHA256 e38a9d1f437981aa6bf0bdd074d57b769a4140c0f7d9aff51743fe4ecc6dfddf
                                • MD5 SHA1 SHA512 TLSH

                                cursors.tcl

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_tk_data\ttk\cursors.tcl
                                • Size 4KB
                                • SHA256 5b33f32b0139663347d6cf70a5a838f8e4554e0e881e97c8478b77733162ea73
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                fonts.tcl

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_tk_data\ttk\fonts.tcl
                                • Size 5KB
                                • SHA256 6574067a91858506460ac44ddf8cf9270e81d67b2feff2a43b4d5f774568a5ec
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                menubutton.tcl

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_tk_data\ttk\menubutton.tcl
                                • Size 6KB
                                • SHA256 0935fb97b6628f055baeb2e2babbf2a6c8905260e1107972b0e7a1df0752e180
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ttk.tcl

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_tk_data\ttk\ttk.tcl
                                • Size 5KB
                                • SHA256 685398e8db93aebbabfed795e91a42a87aa0e2a2cf23bfcffd70fea085a7ad5e
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                utils.tcl

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_tk_data\ttk\utils.tcl
                                • Size 8KB
                                • SHA256 b9b73e5bcd85c8fe00628332f0ab0c4a0ffbb59f7b4e9d6cdc92762a5bcd8d76
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                _tkinter.pyd

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_tkinter.pyd
                                • Size 67KB
                                • SHA256 4795b085668e6c37f4ffa281a89aeacff871288b1a2a88365d633b37576722c7
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                _zstd.pyd

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_zstd.pyd
                                • Size 491KB
                                • SHA256 74f64a5d724cad1c10ca9ba579b6af198178406b0a4f061685326e79cffa3eea
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                base_library.zip

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\base_library.zip
                                • Size 1.3MB
                                • SHA256 85f0be41442b365508d6e9ee6ca4fd57973e6c22e740809ce7cbc7ed93d3530f
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                libcrypto-3.dll

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\libcrypto-3.dll
                                • Size 5.0MB
                                • SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                libssl-3.dll

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\libssl-3.dll
                                • Size 776KB
                                • SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                python314.dll

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\python314.dll
                                • Size 6.4MB
                                • SHA256 f1722bd369d79fecbc85f3ed2790c30c330b9413fd74332f95b086e60dfacc2a
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                select.pyd

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\select.pyd
                                • Size 32KB
                                • SHA256 5c4103eef14aebd195425d42196895ffb87bf6a25ab4651242bebf0a6b25cf1d
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                tcl86t.dll

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\tcl86t.dll
                                • Size 1.8MB
                                • SHA256 a308beae8555cff5ac2aff7eaf0aef40b5fe173f047e246dc49da9a4d3ef62f9
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                msgcat-1.6.1.tm

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\tcl8\8.5\msgcat-1.6.1.tm
                                • Size 34KB
                                • SHA256 adca186be560f2236265f538d4cb6df1171bed91192118796988bb9c08a4bc7c
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                tk86t.dll

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\tk86t.dll
                                • Size 1.5MB
                                • SHA256 20f4876506bce7f89e53570e64fd1dce30a64548326b45f372871c7019560df4
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                unicodedata.pyd

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\unicodedata.pyd
                                • Size 740KB
                                • SHA256 552317719cb70d92b73d9cd0d54c314ebab2f4dd1c468221e49c3190f24a4e7e
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                zlib1.dll

                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\zlib1.dll
                                • Size 142KB
                                • SHA256 1dd27f0411ebb31bd148a61589cee254410915f1e6c37aa3ffa52fac71a5426c
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                85df83b0-c58c-4b00-9c16-4adf35cbaedf.tmp

                                • Path C:\Users\Admin\Downloads\85df83b0-c58c-4b00-9c16-4adf35cbaedf.tmp
                                • Size 16KB
                                • SHA256 36be6af82fd35c7adb1af8a21de510a1825eb923fa41d5dbd011d647f56386ac
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                a8e65af7-ee95-427d-8902-6e0a0cebd5ea.tmp

                                • Path C:\Users\Admin\Downloads\a8e65af7-ee95-427d-8902-6e0a0cebd5ea.tmp
                                • Size 4KB
                                • SHA256 da0a95c94bbc12fe84150635e54d4ba234ab9a020c05fd8d4630ca121bf5377c
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                memory/1124-1344-0x00007FFB32850000-0x00007FFB32879000-memory.dmp