41077bdd7a0c3c119985e5a1591ddf0fb5b641fcbd2b8d3cfa05e1c520a54da7

Analysis

user interaction
yes
max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 23:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cough.exe
Size 9.9MB
Sample261017-222bmaxx5p
SHA256 41077bdd7a0c3c119985e5a1591ddf0fb5b641fcbd2b8d3cfa05e1c520a54da7
MD5 02fb065e38a24242df5c1443b73277dd
SHA1 b809bf9a7aa15c51e068d84c1284bd6096c74256
SHA512 fe805791444ac9ba30ae7fde66e4f830bed9dd789d10984a18d6eea79f693ce945e599d54a092278f1f3ff51eb9c9087f806edc6b8dc3ab0ba67d9317dfb2b65
SSDEEP 196608:XBVZ0W8/Laxen8aLMA7h5kSZvxig/lVJIJ7hW:REW8/8CMICU5h/lV6R
TLSH
T12FA63398B7A608F5EC6F5335D4E082B79A61382607B5C2DB62F50A222E731E5FF34351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Loads dropped DLL 9 IoCs

pid	Process
5104	cough.exe
5104	cough.exe
5104	cough.exe
5104	cough.exe
5104	cough.exe
5104	cough.exe
5104	cough.exe
5104	cough.exe
5104	cough.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6520_1621223453\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6520_1101808692\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6520_1101808692\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3268	cmd.exe
2364	cmd.exe
5792	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1328	msedge.exe
6792	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
2604	taskkill.exe
3108	taskkill.exe
4812	taskkill.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-53044966-3830981193-2402648431-1000\{4C2081DE-21B7-4A39-8D57-EB189625E38B}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-53044966-3830981193-2402648431-1000\{C4C7B146-93E1-41AB-A0B3-3979E8D90290}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 35 IoCs

pid	Process
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2604	taskkill.exe
Token: SeDebugPrivilege	3108	taskkill.exe
Token: SeDebugPrivilege	4812	taskkill.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4200	msedge.exe
4200	msedge.exe
6520	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 5104	4728	cough.exe	90
PID 5104 wrote to memory of 3268	5104	cough.exe	91
PID 3268 wrote to memory of 2604	3268	cmd.exe	92
PID 5104 wrote to memory of 4200	5104	cough.exe	94
PID 4200 wrote to memory of 1620	4200	msedge.exe	95
PID 4200 wrote to memory of 3616	4200	msedge.exe	97
PID 4200 wrote to memory of 1328	4200	msedge.exe	99
PID 4200 wrote to memory of 3616	4200	msedge.exe	97
PID 4200 wrote to memory of 3616	4200	msedge.exe	97
PID 4200 wrote to memory of 5964	4200	msedge.exe	100
PID 4200 wrote to memory of 5964	4200	msedge.exe	100
PID 4200 wrote to memory of 3316	4200	msedge.exe	117
PID 4200 wrote to memory of 2700	4200	msedge.exe	102
PID 4200 wrote to memory of 3316	4200	msedge.exe	117
PID 4200 wrote to memory of 3316	4200	msedge.exe	117
PID 4200 wrote to memory of 2700	4200	msedge.exe	102
PID 4200 wrote to memory of 2700	4200	msedge.exe	102
PID 4200 wrote to memory of 4936	4200	msedge.exe	103
PID 4200 wrote to memory of 3372	4200	msedge.exe	104
PID 4200 wrote to memory of 4936	4200	msedge.exe	103
PID 4200 wrote to memory of 4936	4200	msedge.exe	103
PID 4200 wrote to memory of 3372	4200	msedge.exe	104
PID 4200 wrote to memory of 3372	4200	msedge.exe	104
PID 5104 wrote to memory of 2364	5104	cough.exe	105
PID 2364 wrote to memory of 3108	2364	cmd.exe	106
PID 4200 wrote to memory of 5472	4200	msedge.exe	107
PID 4200 wrote to memory of 5472	4200	msedge.exe	107
PID 5104 wrote to memory of 5792	5104	cough.exe	108
PID 5792 wrote to memory of 4812	5792	cmd.exe	109
PID 4200 wrote to memory of 2728	4200	msedge.exe	111
PID 4200 wrote to memory of 3596	4200	msedge.exe	110
PID 4200 wrote to memory of 2728	4200	msedge.exe	111
PID 4200 wrote to memory of 3596	4200	msedge.exe	110
PID 4200 wrote to memory of 4868	4200	msedge.exe	113
PID 4200 wrote to memory of 5016	4200	msedge.exe	114
PID 4200 wrote to memory of 5016	4200	msedge.exe	114
PID 4200 wrote to memory of 1992	4200	msedge.exe	115
PID 4200 wrote to memory of 1992	4200	msedge.exe	115
PID 5104 wrote to memory of 2468	5104	cough.exe	116
PID 4200 wrote to memory of 3316	4200	msedge.exe	117
PID 4200 wrote to memory of 3316	4200	msedge.exe	117
PID 4200 wrote to memory of 3316	4200	msedge.exe	117
PID 5104 wrote to memory of 2744	5104	cough.exe	118
PID 4200 wrote to memory of 5488	4200	msedge.exe	119
PID 4200 wrote to memory of 5488	4200	msedge.exe	119
PID 4200 wrote to memory of 5488	4200	msedge.exe	119
PID 5104 wrote to memory of 5744	5104	cough.exe	120
PID 4200 wrote to memory of 2704	4200	msedge.exe	121
PID 4200 wrote to memory of 2704	4200	msedge.exe	121
PID 4200 wrote to memory of 2704	4200	msedge.exe	121
PID 5104 wrote to memory of 5944	5104	cough.exe	122
PID 4200 wrote to memory of 4116	4200	msedge.exe	123
PID 4200 wrote to memory of 4116	4200	msedge.exe	123
PID 4200 wrote to memory of 4116	4200	msedge.exe	123
PID 5104 wrote to memory of 4608	5104	cough.exe	124
PID 4200 wrote to memory of 4232	4200	msedge.exe	125
PID 4200 wrote to memory of 4232	4200	msedge.exe	125
PID 4200 wrote to memory of 4232	4200	msedge.exe	125
PID 5104 wrote to memory of 896	5104	cough.exe	127
PID 4200 wrote to memory of 5648	4200	msedge.exe	128
PID 4200 wrote to memory of 5648	4200	msedge.exe	128
PID 4200 wrote to memory of 5648	4200	msedge.exe	128
PID 4200 wrote to memory of 3488	4200	msedge.exe	129
PID 4200 wrote to memory of 3200	4200	msedge.exe	130

C:\Users\Admin\AppData\Local\Temp\cough.exe
"C:\Users\Admin\AppData\Local\Temp\cough.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Users\Admin\AppData\Local\Temp\cough.exe
  "C:\Users\Admin\AppData\Local\Temp\cough.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ApplicationFrameHost.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3268
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ApplicationFrameHost.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Cough.html
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x370,0x7ff9cb67c188,0x7ff9cb67c194,0x7ff9cb67c1a0
      4⤵
      PID:1620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,13473713853578383201,453864475553498334,262144 --field-trial-handle=2280,i,4438147198710036706,13993377403966509927,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
      4⤵
      PID:3616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,1321922343366936274,14468934322442761993,524288 --field-trial-handle=2280,i,4438147198710036706,13993377403966509927,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:11
      4⤵
      System Time Discovery
      PID:1328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,2120774996419255229,9626000089851777550,524288 --field-trial-handle=2280,i,4438147198710036706,13993377403966509927,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:13
      4⤵
      PID:5964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,13709697751470472735,11644503433473568468,2097152 --field-trial-handle=2280,i,4438147198710036706,13993377403966509927,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
      4⤵
      PID:3316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,12588256690478656928,11329805152125490684,2097152 --field-trial-handle=2280,i,4438147198710036706,13993377403966509927,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:2700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,5828881436657738592,17790524445185638636,2097152 --field-trial-handle=2280,i,4438147198710036706,13993377403966509927,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
      4⤵
      PID:4936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,5356322792534773923,14036582874386452283,2097152 --field-trial-handle=2280,i,4438147198710036706,13993377403966509927,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:9
      4⤵
      PID:3372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,8341864398669091091,13000820659247273342,524288 --field-trial-handle=2280,i,4438147198710036706,13993377403966509927,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
      4⤵
      PID:5472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,256773484674758474,13176197107629890920,524288 --field-trial-handle=2280,i,4438147198710036706,13993377403966509927,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
      4⤵
      PID:3596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,13418401179661434180,15712662168306893230,524288 --field-trial-handle=2280,i,4438147198710036706,13993377403966509927,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
      4⤵
      PID:2728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,13386032148426066696,7321761631083391934,524288 --field-trial-handle=2280,i,4438147198710036706,13993377403966509927,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
      4⤵
      PID:4376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,13386032148426066696,7321761631083391934,524288 --field-trial-handle=2280,i,4438147198710036706,13993377403966509927,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
      4⤵
      PID:4868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,13523055780894296849,16156544934914872293,524288 --field-trial-handle=2280,i,4438147198710036706,13993377403966509927,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
      4⤵
      PID:5016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,18284084923288219806,13194313558460789247,524288 --field-trial-handle=2280,i,4438147198710036706,13993377403966509927,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
      4⤵
      PID:1992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6424,i,3441008053734186809,10395426811938979411,2097152 --field-trial-handle=2280,i,4438147198710036706,13993377403966509927,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:1
      4⤵
      PID:3316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6648,i,14560949125443510999,11404494436959390704,2097152 --field-trial-handle=2280,i,4438147198710036706,13993377403966509927,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:1
      4⤵
      PID:5488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6304,i,10209833128913066455,3447912928824301369,2097152 --field-trial-handle=2280,i,4438147198710036706,13993377403966509927,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:1
      4⤵
      PID:2704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4484,i,12970352349956569294,2869898314176875535,2097152 --field-trial-handle=2280,i,4438147198710036706,13993377403966509927,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:4116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4980,i,10676085418040382802,16387675612615882983,2097152 --field-trial-handle=2280,i,4438147198710036706,13993377403966509927,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:1
      4⤵
      PID:4232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4952,i,17309481969100217821,4412946196675116568,2097152 --field-trial-handle=2280,i,4438147198710036706,13993377403966509927,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:1
      4⤵
      PID:5648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7480,i,6011675937849633932,6812731819425157420,524288 --field-trial-handle=2280,i,4438147198710036706,13993377403966509927,262144 --variations-seed-version --mojo-platform-channel-handle=7496 /prefetch:14
      4⤵
      PID:3488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7352,i,12027365974839993101,14585362004685062417,524288 --field-trial-handle=2280,i,4438147198710036706,13993377403966509927,262144 --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:14
      4⤵
      PID:3200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7552,i,16743617945731681936,16439042801424470074,524288 --field-trial-handle=2280,i,4438147198710036706,13993377403966509927,262144 --variations-seed-version --mojo-platform-channel-handle=7564 /prefetch:14
      4⤵
      PID:3940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6772,i,14124030704964427730,11807115136832353074,2097152 --field-trial-handle=2280,i,4438147198710036706,13993377403966509927,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:1
      4⤵
      PID:1272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7564,i,9157603431627789434,17023612141684062062,2097152 --field-trial-handle=2280,i,4438147198710036706,13993377403966509927,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:1
      4⤵
      PID:4500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=2736,i,15168096255371192068,4532452345094480043,2097152 --field-trial-handle=2280,i,4438147198710036706,13993377403966509927,262144 --variations-seed-version --mojo-platform-channel-handle=7556 /prefetch:1
      4⤵
      PID:2924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7708,i,12703229591162169825,10079813438462612132,2097152 --field-trial-handle=2280,i,4438147198710036706,13993377403966509927,262144 --variations-seed-version --mojo-platform-channel-handle=7740 /prefetch:1
      4⤵
      PID:4896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7984,i,8751776268878490394,1128039094338887193,2097152 --field-trial-handle=2280,i,4438147198710036706,13993377403966509927,262144 --variations-seed-version --mojo-platform-channel-handle=7916 /prefetch:1
      4⤵
      PID:4820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8140,i,8022929445713606171,12089497588719102411,2097152 --field-trial-handle=2280,i,4438147198710036706,13993377403966509927,262144 --variations-seed-version --mojo-platform-channel-handle=8092 /prefetch:1
      4⤵
      PID:5932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8332,i,7737200105555954140,10609280048055426646,524288 --field-trial-handle=2280,i,4438147198710036706,13993377403966509927,262144 --variations-seed-version --mojo-platform-channel-handle=8336 /prefetch:14
      4⤵
      PID:2140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:6520
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ff9cb67c188,0x7ff9cb67c194,0x7ff9cb67c1a0
        5⤵
        
        PID:6552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,3709584901477201038,4354585371017166233,262144 --field-trial-handle=2332,i,1631494064042986644,15747396025451060973,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
        5⤵
        
        PID:6784
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,12149886405930108783,15587308528165106394,524288 --field-trial-handle=2332,i,1631494064042986644,15747396025451060973,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:6792
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,11460179759230650566,1822880678878266720,524288 --field-trial-handle=2332,i,1631494064042986644,15747396025451060973,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:13
        5⤵
        
        PID:6836
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4612,i,11417477201687533883,14853841224711404989,524288 --field-trial-handle=2332,i,1631494064042986644,15747396025451060973,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:14
        5⤵
        
        PID:6232
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4612,i,11417477201687533883,14853841224711404989,524288 --field-trial-handle=2332,i,1631494064042986644,15747396025451060973,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:14
        5⤵
        
        PID:6260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5304,i,10853243799161551476,9462190962800745616,2097152 --field-trial-handle=2332,i,1631494064042986644,15747396025451060973,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
        5⤵
        
        PID:6508
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=5320,i,6165184782826140028,4055789680738577175,2097152 --field-trial-handle=2332,i,1631494064042986644,15747396025451060973,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:1
        5⤵
        
        PID:5684
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,237774655524469117,4901099384238260623,524288 --field-trial-handle=2332,i,1631494064042986644,15747396025451060973,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
        5⤵
        
        PID:4584
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,892970858142927971,14403263424856574117,524288 --field-trial-handle=2332,i,1631494064042986644,15747396025451060973,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
        5⤵
        
        PID:5852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6484,i,13591779899289683237,10779018036005149536,2097152 --field-trial-handle=2332,i,1631494064042986644,15747396025451060973,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:1
        5⤵
        
        PID:5616
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4700,i,15444763225062555795,2019694194621071522,2097152 --field-trial-handle=2332,i,1631494064042986644,15747396025451060973,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:1
        5⤵
        
        PID:4592
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6848,i,2556965881407339451,2025194990925187133,2097152 --field-trial-handle=2332,i,1631494064042986644,15747396025451060973,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:1
        5⤵
        
        PID:2120
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=7128,i,15796648877794090689,6510941731289808281,2097152 --field-trial-handle=2332,i,1631494064042986644,15747396025451060973,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:1
        5⤵
        
        PID:6848
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=7216,i,719575293157453522,1238134529046579825,2097152 --field-trial-handle=2332,i,1631494064042986644,15747396025451060973,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:1
        5⤵
        
        PID:6232
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7432,i,2061605599080957250,6063939056352244382,524288 --field-trial-handle=2332,i,1631494064042986644,15747396025451060973,262144 --variations-seed-version --mojo-platform-channel-handle=7444 /prefetch:14
        5⤵
        
        PID:6536
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7436,i,6548867795497726237,6966374975919597496,524288 --field-trial-handle=2332,i,1631494064042986644,15747396025451060973,262144 --variations-seed-version --mojo-platform-channel-handle=7472 /prefetch:14
        5⤵
        
        PID:6348
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7440,i,14908334529769996273,397315041986067222,524288 --field-trial-handle=2332,i,1631494064042986644,15747396025451060973,262144 --variations-seed-version --mojo-platform-channel-handle=7384 /prefetch:14
        5⤵
        
        PID:5780
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5940,i,3214532876220766344,328793834426194050,2097152 --field-trial-handle=2332,i,1631494064042986644,15747396025451060973,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:1
        5⤵
        
        PID:2464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6128,i,6664253489494673967,6169326959541889204,2097152 --field-trial-handle=2332,i,1631494064042986644,15747396025451060973,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:1
        5⤵
        
        PID:4000
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7720,i,11435891829612885379,7049336001768567168,2097152 --field-trial-handle=2332,i,1631494064042986644,15747396025451060973,262144 --variations-seed-version --mojo-platform-channel-handle=7800 /prefetch:1
        5⤵
        
        PID:4372
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7908,i,10232485651611690330,11624385777048380577,2097152 --field-trial-handle=2332,i,1631494064042986644,15747396025451060973,262144 --variations-seed-version --mojo-platform-channel-handle=7936 /prefetch:1
        5⤵
        
        PID:5940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7728,i,10508636216143644833,13051067830174690985,2097152 --field-trial-handle=2332,i,1631494064042986644,15747396025451060973,262144 --variations-seed-version --mojo-platform-channel-handle=7920 /prefetch:1
        5⤵
        
        PID:2796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7924,i,9349469080164519542,6668096714989025026,2097152 --field-trial-handle=2332,i,1631494064042986644,15747396025451060973,262144 --variations-seed-version --mojo-platform-channel-handle=8132 /prefetch:1
        5⤵
        
        PID:5928
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7436,i,15897264536612577248,17915390602290369794,524288 --field-trial-handle=2332,i,1631494064042986644,15747396025451060973,262144 --variations-seed-version --mojo-platform-channel-handle=7500 /prefetch:14
        5⤵
        
        PID:4568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7376,i,17473624250425636312,8688576374691267945,2097152 --field-trial-handle=2332,i,1631494064042986644,15747396025451060973,262144 --variations-seed-version --mojo-platform-channel-handle=8460 /prefetch:1
        5⤵
        
        PID:1524
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=8744,i,186915936905600214,4107786254772820477,2097152 --field-trial-handle=2332,i,1631494064042986644,15747396025451060973,262144 --variations-seed-version --mojo-platform-channel-handle=8644 /prefetch:1
        5⤵
        
        PID:4788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8580,i,5846463297412632840,5961098022939686290,524288 --field-trial-handle=2332,i,1631494064042986644,15747396025451060973,262144 --variations-seed-version --mojo-platform-channel-handle=8616 /prefetch:14
        5⤵
        
        PID:2744
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8656,i,10753787178884677319,4581859614488118143,2097152 --field-trial-handle=2332,i,1631494064042986644,15747396025451060973,262144 --variations-seed-version --mojo-platform-channel-handle=8684 /prefetch:1
        5⤵
        
        PID:4252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8600,i,6390075363130628799,7277080011085759282,2097152 --field-trial-handle=2332,i,1631494064042986644,15747396025451060973,262144 --variations-seed-version --mojo-platform-channel-handle=8972 /prefetch:1
        5⤵
        
        PID:1404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8652,i,14056441931791818150,7312493161213098794,524288 --field-trial-handle=2332,i,1631494064042986644,15747396025451060973,262144 --variations-seed-version --mojo-platform-channel-handle=9156 /prefetch:14
        5⤵
        
        PID:3824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SystemSettings.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5792
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SystemSettings.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Cough.html
    3⤵
    PID:2468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Cough.html
    3⤵
    PID:2744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Cough.html
    3⤵
    PID:5744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Cough.html
    3⤵
    PID:5944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Cough.html
    3⤵
    PID:4608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Cough.html
    3⤵
    PID:896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Cough.html
    3⤵
    PID:5000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Cough.html
    3⤵
    PID:3344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Cough.html
    3⤵
    PID:5836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Cough.html
    3⤵
    PID:4464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Cough.html
    3⤵
    PID:2552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Cough.html
    3⤵
    PID:4448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Cough.html
    3⤵
    PID:2452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Cough.html
    3⤵
    PID:3024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Cough.html
    3⤵
    PID:5172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Cough.html
    3⤵
    PID:1168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Cough.html
    3⤵
    PID:6752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Cough.html
    3⤵
    PID:6240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Cough.html
    3⤵
    PID:6432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Cough.html
    3⤵
    PID:5648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Cough.html
    3⤵
    PID:2700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Cough.html
    3⤵
    PID:2596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Cough.html
    3⤵
    PID:6468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Cough.html
    3⤵
    PID:6888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Cough.html
    3⤵
    PID:6420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Cough.html
    3⤵
    PID:5960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Cough.html
    3⤵
    PID:2932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Cough.html
    3⤵
    PID:2844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2032

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

300bf70c-8eba-4311-b36e-58ce81a12d60.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\300bf70c-8eba-4311-b36e-58ce81a12d60.tmp
Size 37KB
SHA256 537ba0c4847543940241d41723265e2c9e393d1afff725c2dddb55f6484cfd27
MD5 328d1d09560d55d532703a70e7648101
SHA1 be2f90cdf85589154011fcc426e5cf96902e90fd
SHA512 fc5af8ab2d67c99a0492ea9ca0a0a28ea8516ac344eb72c3209eb2c13d42ffa34afde22247b3a5a99b5bf16b47f216919884ea0d7b24b25ab2eb3fb6f9fc3fe8
SSDEEP 768:+FWT3QwgXOKROfHfotLfptSW1JYe1ELsAvC8/YXexZUf+LR:HT3PfHfKfucYe1EQujYOxZdd
TLSH
T10D036C71DCA4CE3B6EF69785B3893687EEF44163C9DC9998D6C92D4800C32DD274B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

43a640f1-c38b-4777-b363-ad8b5dcab9cf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\43a640f1-c38b-4777-b363-ad8b5dcab9cf.tmp
Size 37KB
SHA256 726b3bb59a00b8d59dd0512788c3b2905f01b036ab86029ceb6e0ec34fd797dc
MD5 8e0e81ece154d99cb7d80045fb61878c
SHA1 a4a06850d223a6917dc77895ba649061686f20e1
SHA512 18888af1c7e647661a35906b6aab893b278eac449f64217b0f49aad1dc822c2488e498fd652c123a45448a41cee97d2392468c0df7b107afcd366a9bcde58754
SSDEEP 768:y7FWu3QwgXrKROfHfotLfpteXJYe1ELsAvC8/YXexZUf+LR:y8u3IfHfKfeYe1EQujYOxZdd
TLSH
T1FB036C71DC64CE3B6EF69785B3893687EEF04163C9DC9998D6C92D4800C32DD274B819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

84603f46-894c-445e-8bf1-28a494369d15.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\84603f46-894c-445e-8bf1-28a494369d15.tmp
Size 37KB
SHA256 788663cd2a18b8224311e1f0be88cf311fcf0a76271809907169f94ef219e8a6
MD5 62f1064353cc94972e1dfed64cef34c6
SHA1 72d20cc1562d8efa6b41201a31d8b49f2a8e970c
SHA512 47628ab1ef5f641df14b202dc16b8b2b650cb6b83647d9c56c8a0b1ee201d31bd6c9f873060984e8777a8515772fe1ceac15ecc36d1ffd464b29e8e4026d8cec
SSDEEP 768:h/UxvxjgC+i3dv9TOfHfotwKJYe1ELsAvC8/YMxkSHrkw:0Zj3+i3WfHfCYe1EQujY3S4w
TLSH
T11C03C036EC648C375DF2A388774A5717FEF4812395C45AA886DD2B0D15C73AC630F85A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95768391-f500-4223-9da1-1f4e65bb702c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\95768391-f500-4223-9da1-1f4e65bb702c.tmp
Size 38KB
SHA256 052109fde7b40a397a9aeb064b471eabd0673b9050e3e02dd7cee3b3cbfddd15
MD5 e31293949a72a06d5b71861f0bb16f42
SHA1 5b2a96ed8d486ab370d2d1d59885fd55e358359a
SHA512 93d12645c0d9b87fc4f1a3b715854590c311fc600624a810ab0396a3f43c1aa820ae0daed1dd680d90305e0869b3e8762879982860bb9913857510064f01afbc
SSDEEP 768:z/UxvxjgC+i3YO9TOfHfotLfptsyJYe1ELsAvC8/YNOSHrkw:GZj3+i3+fHfKfxYe1EQujYwS4w
TLSH
T14103C031DC65DC331EF2A298728A5797EEF8416394C45A6896DD2B0D05C37AC270F85A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a9db3b181fe23d2da858b764c2d3bc2baae4a7e217d8cc5885ed34c7b21166b7
MD5 c2e18a2143bb27e5b37e2d5b65c09643
SHA1 43bb7d235630acc17d81e04e37f3cd25e299ecc7
SHA512 08f1e7fa966122b22bea5e316c89298987fac4c53be675ad48a1c1c8a784dc7b1d8789be8d1abdb8cdb59c14d6757e0f1934d0a56d919c8fb08e311621fe4d9c
TLSH
T109D02BB0B77DCCD3D00310FE0015AE0421A370159E0402802302885844001041101358
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2664448b8ab4f4edce89a8c875c31ed1e748ff3060fa1567c434149210bb4fc5
MD5 35b0bc3bbbf168c9b6c74d3bc119d3eb
SHA1 3dde0e79982d9dbcf2dbd3045bae0a5bc63e14cd
SHA512 9c5f83f731b8e4bf7f7e64c2e51191192b13fa5260950a1fcade843318dbf7d5b99057f3ca893e35cb6c19942f5b5852e7124ed01f7c46e7de9bcea70152fc0d
TLSH
T173D02BB4B76DCDD3D00310FE0014AE0421B37015EE040280230248484400104110236C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 86eb651b4e7a062962815e18ffd6e488154ded5a6671b7f77262e1c641487373
MD5 ee4d7da9151ef817612dc4647134908b
SHA1 7330696754e82ef6bbb1a83e34e3165f48c4b83c
SHA512 4347ceff93ad25cef991b223026583b386b7c2eb265f571a036fe7425c22d1172b37661454e2fd2f8edabb15740f49d7ae68cda5b63666ae2269e364758c5e73
TLSH
T177D08065752F7FEAD12F61BE0514DE445554CA23DE11021517034D2985501412851FFC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9f7d7baad2c8a57f3010240aa12b08267e85be7b38b67db29488b0283656d534
MD5 0127eab191c7a1a90d827bb56cce6e40
SHA1 abe9fb3d2fe1a8a94dcad5c17265ad590980f0ff
SHA512 dfa4274ce6e2517782fb41eef6931a29ba5a3f3c0dbeb49a56ec51018c407eb17434c097cad661b813f636df5fb6913b558479776663b40aa436bd5b5d6f3c5b
TLSH
T1E1D080D5B61F7D5DD60F55F5070DEF485251D426A91201355617591D51006043441BFC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2709c278e189c182d5b2c84f5a6b83543c4dfbe672aa560c3270383b0b6f2edc
MD5 6cba3fe9b180c511c2a9a5b64ff2e487
SHA1 7bbf9d57728cd3f200d78d4cc5152b6ff557bedf
SHA512 7c14e87343bb7ec924738a475c9d46d9be8b759a2605585581a160ebd10d898489ef4d57c624da12efde4e9ad8ecd01338f7bd4a982a918781b2a66b41dc7f24
TLSH
T145D080D5B61F7C5DD61F55F5070DEF485241D426551201355617491D51006043540BFC
MD5 SHA1 SHA512 TLSH

Submit Download

0c5bf667-ae2b-4878-aa60-74cef9f6cbd9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0c5bf667-ae2b-4878-aa60-74cef9f6cbd9.tmp
Size 29KB
SHA256 58fe280c226c5fa957737b6f87e9616db56fc5cc29e56377c0653c56b984ebbf
MD5 2ace807478738df9817eaa1aa6704411
SHA1 3d84345ec8c91f75aac536afbff2ce074a2f9043
SHA512 1668887bbdd1d4588b96a56efc17591ab6f7b9a27c88954ee50b88935627ad8bf609b221b00b6950dbcbe7001e65a2a41bbad66d52ad80bc96fbbd93d4a2b588
SSDEEP 768:zBDn2x7pLuLbYFWgbjfkW8F1+UoAYDCx9Tuqh0VfUC9xbog/OVx/ZBK32roFdTK:zBDn2nEbYFWgbjfkWu1jau/Z03NFxK
TLSH
T1BAD2D87B684CCB7F4F800A9D9C197E9E6DA802CB9A98CD4047FE945C02C77EE511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1890b0e5-441c-4724-a66e-d874e6bbc5e7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1890b0e5-441c-4724-a66e-d874e6bbc5e7.tmp
Size 414B
SHA256 b05dc0c678efd422371477b1bd3cda6d75f8fb082073efd427d73715db44f679
MD5 a4a5706a1524969cad4498cb484e396c
SHA1 93c402f01c093bb9b94f546cfa94ee3d1e7d2b90
SHA512 ab9988bd8c6fc42cd11b4c0ed90accb21576e7c705a77020fcdc3203205876ad8618c9f577e0aab1e913c12ae8bd4cbd2ba8acca423d05f1bc1c47dfebabe2ec
TLSH
T16FE02BA9D931ED6B18FE175854901646F75013573640894F373FA5188FF273A099EC1C
MD5 SHA1 SHA512 TLSH

Submit Download

4c073f83-574f-4a35-a9ee-841ba36a78ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4c073f83-574f-4a35-a9ee-841ba36a78ac.tmp
Size 11KB
SHA256 71ffc61a3023b12c3056bf935de44d853c50ce15bb61c8300269e9f08583ffec
MD5 f0901e377813f788765832c928cdf477
SHA1 36416c13139d8690ee56f752ffba20b20ee62105
SHA512 186433dfcf6b0e75203e09ed8e8ccf50f1ce2c96c1d7d3d69661833ad260f9100c733da5e83505a53cfdee3b69c89d4f05b15e2cd865025fd50717cfee9c79f6
SSDEEP 192:sxRURZCf/few+sJ+Z/GzhzoA8p4T/g6+WNIYx6ksUcGoIgVEJ:sxRUif/fCsJ4+zcu/5IDUsa
TLSH
T11132B815AD28AD3B8CCBD21DBB55BF53D2F91032A1955E58A6FCCA1C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75f445c4-e70b-4d6b-89c5-1f7dab42058d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\75f445c4-e70b-4d6b-89c5-1f7dab42058d.tmp
Size 11KB
SHA256 89ba6881698f7eec5f170ded75f475bab73aaa931c88a7552066ac0540d2fc86
MD5 8c2ab16df2fd22bc6e15c8f398b9e5a8
SHA1 db34064168f185243263f4c555bfb289aa15cb74
SHA512 87462eb7f1279a22c5046a0e78b8c488b624c1fc7e7050e12254e685b939f161aea25f5b794ce683f5e79b3549393d9f5348561e6225e8ff2920e8cd8713f010
SSDEEP 192:sxR/RZCf/few+sl+Z/GzhzoA8p49/g6+WNIYx6ksUcGoIgDaEJ:sxR/if/fCsl4+zcY/5IDUsP
TLSH
T1C942B819AD28AD3B8CCBD21DBB55BF53D2F91032A1955E48A6FC9A1C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

994e94ba-d0d7-4a5d-8528-91c4b3f0fdfc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\994e94ba-d0d7-4a5d-8528-91c4b3f0fdfc.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 24f4503532950792df71b5726f6c9a7ad2eb8dc408541e0eb887389c7450d248
MD5 f1fe3cc11b9a1bf57ab4bbdce564ae62
SHA1 ecf0d031dd69afcc54809cc378d83d93a56224ca
SHA512 a28cdef80aa513a9307c0fe3fd4f47f360e90aa50a8f5651069ddb271d74f9692ce706ee90a213c085e8a61991eed8c840acb55fb7fe511a9504759697b4f988
TLSH
T1F2615E80B091801EF79A02B2F2ED4C833B749EBB5E833E9205C7D577DA467A8C1C08C6
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 05b45e531eebe2d9c29eae10684a29465a814613507418656b2bff1312195b89
MD5 820f5268409babbea376f8c8db2cf0be
SHA1 98bce34a81b34b46b48e088e08fa879c811cca20
SHA512 a6aaf3ae65fdf859330b3f833a446f31b0aa657e5a2f5cb0152c52e9275f4c0509faee943302d3eb82f93f4dc9d60be26865c3b6acb281cae872905384daaedc
SSDEEP 3:MsEllllkEthXllkl2zE/lEe:/M/xT02zVe
TLSH
T1574404047FC11C0FC54411344051C3505770D4100F13D74734D35433DCDF7411C00400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

40351327-e9ad-4471-824f-a993883a2767.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\40351327-e9ad-4471-824f-a993883a2767.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

2b406f6d-a275-4615-86c2-d62b8f16ef47.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2b406f6d-a275-4615-86c2-d62b8f16ef47.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

8dcff7ce-a131-4159-b65b-d1becc56caac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8dcff7ce-a131-4159-b65b-d1becc56caac.tmp
Size 1KB
SHA256 b3e1195da9679c5a2a078dd74ce8b2a81452af24097d155a3978fe3795fa3569
MD5 960310589f063b6c64a095e375e3785e
SHA1 939e9e6df5898e3012a476997abad6318513d973
SHA512 c93fc006804df6aebbefbf53d4978d75ea106a5ddaab5b0bdef9f51e8f5e161e6ca3ea8cb96a845df24feafb246be17138c7384863b5ca9e1401f4aa7d007d0e
TLSH
T14841ADF783F4966E890196F0AA186F1BCE2C0551432C7D5AC5E4AE2B93E3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 551fb13fbca04bc999417664dfb52c0a799b01e9d0fa5f652344784796c7f358
MD5 bedb4577d8399a9a0053003a1690e049
SHA1 67ed92402853d5c55ca51ba9af9b68b5ee2942f5
SHA512 b61fb708d4c77f3f0024f9a395926437d2666388e2159fa5fa3888bf4bc243eeb20e2158248a4b2f42866f01f1a13fdbe88983f79595e56a0ca07efaaf3981be
TLSH
T19141ADF783F4956ECA0196F0AA18AF1FCE2D0515431C7D5AC5E0AE2793E3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

d4f71adc-2111-49ac-8ca6-52107835ae40.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d4f71adc-2111-49ac-8ca6-52107835ae40.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d8a66b376d47cd45d27390ed873ef0c20f4371243f2bb0fda7ec4571ae3baaf1
MD5 a7fa12a7bcae3df159c630a45d86b53f
SHA1 42b8ef395ee9517a3857b95f7e3fb2b96c217440
SHA512 d38577f7bf0fe021d67e4e37a428962c472e9a7dde6c53ce72ce08dda62b98e0a8ef8279bf0de8f343ef03f1817b1193671939ca2fd78e9ff0b2d183b149ef44
SSDEEP 48:KYa3EgaU0x5ApsIKYxKH4f6x7yhMBY0SyNfIlKoU4oFIZK2kUTyO:KQLyKYYKufqKoUTFaK2kiB
TLSH
T18291F07176BB0241397E2A1E50D8E71B5A5232A33168E52F3BED41668E7BE044DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a0cb5dbf-d1ca-4031-9a5e-63801db43b9b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a0cb5dbf-d1ca-4031-9a5e-63801db43b9b.tmp
Size 12KB
SHA256 f5d92560c713a8b90749f146637bc15b75b6d8c3fa62244f0c0f2b1e7974818f
MD5 7627257807d0c94b148d15499b54028c
SHA1 b9d97a8b4fb22b2a569d614188b3a4d92a843ac0
SHA512 af1b07296359682596dc335c51e4e9b0466184f28c47ba77b2d63611c9fd445ce5d99522e7469ca92f3f693cdc1f4bdbb7aa83ab23a774be28b6debedb830d28
SSDEEP 192:sxR/RfgCf/few+sqWpVi+Z/GzhzoA8pez/g6+WNIY118sUhUgoIgDAEJ:sxR/Ff/fCsqWvi4+zc8/5IyUhup
TLSH
T193429719AD28AD3B8CC7D21DFB65BF53D2F91032A1955E48A6FC8A1C05E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a4db4738-1f8f-4f85-8526-bd5c8c225143.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a4db4738-1f8f-4f85-8526-bd5c8c225143.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

bd7fc893-531e-4158-8641-858c2999c7a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bd7fc893-531e-4158-8641-858c2999c7a4.tmp
Size 11KB
SHA256 7e658f4525a441425725f4b20495be6414052391e80875a853fb1f2b91f8d0b4
MD5 9b90eca91400fcdb14af396547b38411
SHA1 6ed1e7695bdd3011a5c5207271f21ddc6d904f66
SHA512 05301c425b92bf906e1fbb79b7a4bb6f027a1ddb25a9e53376f69e77d5626cad3cb8c37411ff772665bf9f0138c7bb4a00c5000923f3bf5c6e1fe18e80f21330
SSDEEP 192:sxR/RZCf/few+sS+Z/GzhzoA8p4+/g6+WNIYx32sUcGoIgDAEJ:sxR/if/fCsS4+zcP/5IOUsp
TLSH
T1C242B719AD28AD3B8CCBD21DBB55BF53D2F95032A1951E48A6FCCA1C05E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e047a83a-f56a-4ef7-a1f1-005f3e405e26.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e047a83a-f56a-4ef7-a1f1-005f3e405e26.tmp
Size 13KB
SHA256 fb6ad41352d7a6d16d5d509cd51b91e44b1551376cf4370c379ff6b1d6bd499d
MD5 a207d9cdb4c6ea84ff3be9633e4db886
SHA1 cb9279fdc2fab53517cfa6c856dc407ddc4d0fbf
SHA512 a30b62fc12dfb34e453796006073d540def976bf79ddfcabd911a022c704ef09ceb9d910810e2f647cdd4e4acacaff9c2346a4d31d444042dc04df6bea31a52a
SSDEEP 192:sxR/RfgCf/few+srWpVu+Z/GzB2Zf7zoA8peu/g6+WNIY1YosUhTGoIgDAEJ:sxR/Ff/fCsrWvu4+zB2Al/5ItUh5p
TLSH
T13E52A519AD28AD3B8CCBD21DFB557F53D2F91032A1955E48A6FCCA1C04EB6DD220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

38b8813b-220b-4863-9a19-4b7aa86feb65.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\38b8813b-220b-4863-9a19-4b7aa86feb65.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 ab525a5deec1a16039cd023dfad1ebc9dfe51d1bf0c42c1facd37f79f56a1ebe
MD5 ba0245f20b6ed96beb4bbf8be40c58fa
SHA1 25a56067d3642e50915305312283d5c9f60bd91d
SHA512 4723696e3e4bfc9e46e5a709fb82d5e8d707d84c22cb8764f6bd3e89171f76dc27977dffa9313ac9c3099a8dee97ae4031cee1585bf290289204fb5ee80d84a6
SSDEEP 768:ZFWT33wg7tKROfHfotLfptSWuJYe1ELsAvC8/YEDnl9WrWUfPLA:OT3bfHfKfuXYe1EQujYsn26wU
TLSH
T11F136B39CC60CA3F99EAB785B34D2A16ADE44233C5B85998D7C91F4C80B319DF34B855
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2219e4ff-d5da-4b19-969c-4cdea21269a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\2219e4ff-d5da-4b19-969c-4cdea21269a5.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

d428ce67-597b-4792-8e2b-8ea4de3a5d79.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d428ce67-597b-4792-8e2b-8ea4de3a5d79.tmp
Size 33KB
SHA256 e2f736839f285a2cfec986a531fca56e5a9c6e8e0ec4450e82c771020d3d4a1e
MD5 f58b30a4556225b3e9cdc682eee5f8e1
SHA1 9e6f4cd8425ec8bb2c420b0e253c56645b35f33c
SHA512 fa56eca2f47eebb1a4c8afaa25926e6932c67a5fff5df04cca4e17c4ca50e5bd6dffab3fa73ffd8a0659fb951085f1458ce47e5865eb9c29d9db014c45f89577
SSDEEP 768:jG3D/c9TOfHfotLfptsyJYe1ELsAvC8/YEOUfPLA:jG3XfHfKfxYe1EQujYnwU
TLSH
T114F29E70AC65DD335EF6A295B38A2783FEF44123D9D84A58D6CA264D40C32DD374F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5bc47873-43ca-44db-8cba-ccec29d336b6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5bc47873-43ca-44db-8cba-ccec29d336b6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f2b6acb8-e49a-47cd-9a63-6be429e7fdc5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f2b6acb8-e49a-47cd-9a63-6be429e7fdc5.tmp
Size 33KB
SHA256 0135a00347ac6a15c0fc26d5d4013d3120c822de26fe4eca08532bd5ecb778c4
MD5 830f4929faab964c41d700a08b12b68c
SHA1 df70a71cafc64f837f135cee40e1456aebc1e87c
SHA512 8fa381ac6f85d4fbacef85d1765a0c3d446a0b9b0b83c4e8541d32018486df89cf286ee24bc013e40a293bd5bc6ad97ad5bbe4dd5c114273ac56dbf92a134428
SSDEEP 768:jY3DyY9TOfHfotLfptsyJYe1ELsAvC8/YEOUfPLA:jY3SfHfKfxYe1EQujYnwU
TLSH
T12CF29E70AC65DD335EF6A295B38A2783FEF44123D9D84A58D6CA264D40C32DD374F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f4ca40c2-c0b9-433a-9b05-6f9972e9512e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f4ca40c2-c0b9-433a-9b05-6f9972e9512e.tmp
Size 33KB
SHA256 0761554a980eb2fa5b40f74b27e8e5d86ca291d5937667613ea67dd56f517600
MD5 22750a990cf7da926646068ced79a882
SHA1 3343257efbb26c8b8ea9c201104d5afc66b761bd
SHA512 09607dbb8df88a802e05e4c8fef55abfb4f87a0010221876b0bad5968ef9a65a92dc509f101926de5b1669a34fe0913cc6264ca0f611c6154de51cabf95f6fc9
SSDEEP 768:HG3Wsg9TOfHfotLfptsyJYe1ELsAvC8/YEOUfPLA:HG3rfHfKfxYe1EQujYnwU
TLSH
T194F29E709C65DD334EF6A295B38A2783FEB44123D9D84A58D6CA264D40C32DD374F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

232294a5-61bc-4f50-877e-f097d0085214.tmp

Path C:\Users\Admin\AppData\Local\Temp\232294a5-61bc-4f50-877e-f097d0085214.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

9767d514-927e-4aa0-b572-5c442043ea94.tmp

Path C:\Users\Admin\AppData\Local\Temp\9767d514-927e-4aa0-b572-5c442043ea94.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cough.html

Path C:\Users\Admin\AppData\Local\Temp\Cough.html
Size 8KB
SHA256 88c7eb7054c0fac5acf84ff26eb6ab05cbedc1c04a7161ed20ccf5b610e5d1b1
MD5 bd5af8ea524ddb2b08d9d3faff63fcc0
SHA1 4f986da6632087f2af04c072cc0e30dd04aa7b9d
SHA512 6b43d69e15ed008f78db2eaa52ac82715255366aac29c43aa70abf761cff85f371612cc940ff200deb59708c6e2284564cac0e049765bcacc71645df20252e29
SSDEEP 6:qzc6OfUhuoEpZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZu:kcgooEO
TLSH
T1F7128CE070401105F003096020530F0F7F0C818444424EDB1CB8103342480F10E1ED9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\VCRUNTIME140.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_bz2.pyd
Size 71KB
SHA256 c46b2979e25b66827d0361a559e12879b8a250cf5c8771a54db94e4808e00685
MD5 8d28cd65e4ce6ca79c326f9daf2e0a67
SHA1 286b4fab4996a2d90e85664bd4dca3230dfd3ea6
SHA512 8f5cd8c289be8ef87a94ed8314796f4e2be9d3f08c89dbca81452784723a4912142a58bb4d7565744c1a5691403b9d1084050f58bafe48b8ea3f902b800d3fd2
SSDEEP 1536:AENENz793YK4ZnPnomCNsD+Zr/E/8dDCIaR0IKIECV:NENzxoKiomjKpEkdWIa2fIECV
TLSH
T11D634B56B7B666F4F46F90BD8A410323E330BA55036063AFF148829A3F13BD1AD78356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_ctypes.pyd
Size 116KB
SHA256 c10b0b0f800c1327cb627a342b9afc5960d436e9e08b02f5d6971da69e4722c5
MD5 a3f5a43eb7c25cdd95b7de6a3daee87a
SHA1 85e7bb74d35a08b9b8057beb4e1dc4581d754ec0
SHA512 698af97a5b9ae1bc28b844e2bf38b518d428ea864dcf8f90fc134439ff8cbd816a9eb8d24a80c44859892655115271bab3da07ae04c29bba25980a7ef9395fbf
SSDEEP 3072:vsSf7AbHKu8eeT3SthgFbqLfMIHzzyKs1p1trIELP:vs3KcoygifMIHj0l
TLSH
T1C6C36A0B33980099EBA7517CC5735E47DBB1B859472097CF0290CA992F63BE26E7EB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_decimal.pyd
Size 237KB
SHA256 5566518542e3ee6dd8cbecbae76e40a30015e82cc04ee4ea768a3cc9fb53f4ce
MD5 a80ed1383173049f9b26ea01b27fa058
SHA1 0e0c9361f18c4df41a8d13cea3c34c66367989ad
SHA512 a8f60aff4123565e5aa2a4977e71e6de386deddf267f9cc3d1d8caa170d66fdf8b5518f54a1c9aee18fe8108cd99bb687ace83c524e05738c31a6621f4dc5856
SSDEEP 6144:HXOksyljLGY7iCIH1VA2Bk9qWM53pLW1At/Idtz:HeTEjiY4H1VA6ln/IHz
TLSH
T1E6345B5AA2490DA4EE778074D8579F47E7B278940360C3CF43A48AA73F576A323BE744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_hashlib.pyd
Size 52KB
SHA256 5f17438d0e3091e6006048c873ce43e7e33d842a2a736500815a56aa8be4bf01
MD5 1a99593df5483910489b9c16cce25b18
SHA1 ef4f8488301577e7a53c2ae354acef37f24ea649
SHA512 3033b22ff61ce6d7ebcaee1ebebd68811e07c5ad5c25a9def226e6982b04fa5ddfce55e6213a2db5c5e1f8a271aca26797c4fcf8b1a8d20fe7b560512bf566e5
SSDEEP 768:lKyUPw0PnfpXx+TSRN24ENp+nfEZWKM0IyIEOIv:lKTY0Pnfph+2YzNafEZtM0IyIEOI
TLSH
T19F33490AF29100E8D56781B9C9A31E87E6F2F15417107BDF4368C28D2F237E396B6B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_lzma.pyd
Size 149KB
SHA256 0369454200d4b8deb3959415aae9bb9926e681b14bcb4427e432381fe57ecb27
MD5 38315a763b4266ad431762f51960bfc4
SHA1 f0770073b92879bbd3dd4bcfc254cb233e30ec79
SHA512 bfc3d1144078925d2a5f37c555d6deec3a85ce150e6a357cd2c146e19360f630b08bb504e1b77a30b6fa035c6e157fcb904be021e771ae813e3172e545ba3187
SSDEEP 3072:ohyN1RbBHQrnoe6r5NJuAJKlo/CznfD9mNoKFz2QhskfIEZ1:eQvbBwcVN0FR7YOKFlsk
TLSH
T10FE31891B254F4D6F2228C34C9274F27E7F978495310A29E01DC837D6B2FBB56A6A313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_socket.pyd
Size 66KB
SHA256 9bc8b64506c21e94457da274573e85777a06b67d4d6b98dddeab4b97172fcef1
MD5 3a13308b8f79efd613fd25f8a092e84f
SHA1 a8a09c96de0e37c117b7ace8adc3150cef1b4e23
SHA512 5c300391a5155a50ca1f81cb1667072cd139f4a4a0ad926446040fbb20603151ece5c7bee3f5d49afdc231fa744742180937cb9d6a4c0fee9d669d963202141f
SSDEEP 1536:3/mbt022h0Y9/s+S+pzMEnrIDOMQLF/0I+IELw:PytbxY9/sT+pzMEEDOtLqrIELw
TLSH
T150633A10A3A051B9D2B3D17AC6335F62F774F4811399A38F4564CA6E5F23782DE3AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

auto.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tcl_data\auto.tcl
Size 21KB
SHA256 517204ee436d08efc287abc97433c3bffcaf42ec6592a3009b9fd3b985ad772c
MD5 08edf746b4a088cb4185c165177bd604
SHA1 395cda114f23e513eef4618da39bb86d034124bf
SHA512 c1727e265a6b0b54773c886a1bce73512e799ba81a4fceeeb84cdc33f5505a5e0984e96326a78c46bf142bc4652a80e213886f60eb54adf92e4dffe953c87f6b
SSDEEP 384:UqT9XC9VZv9QXCTxsCTHI7672ORgS0mzBvxFRTX7Xvt3wBTnFXhCUvuyqz:LT9XC9VZviXCVsCLI7JlmzBvTxvt3gTW
TLSH
T199A2C7635F9542A630B1C22B553DB9A4EF2F81B70675801D38FC912C37F1815C6BEAEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cp1252.enc

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tcl_data\encoding\cp1252.enc
Size 1KB
SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
MD5 e9117326c06fee02c478027cb625c7d8
SHA1 2ed4092d573289925a5b71625cf43cc82b901daf
SHA512 d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52
TLSH
T13621362446A58CD8FA4F31D520ECFB70453B75F3D1DA629027B88308E789E8D0C897D9
MD5 SHA1 SHA512 TLSH

Submit Download

pkgIndex.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tcl_data\http1.0\pkgIndex.tcl
Size 746B
SHA256 77265723959c092897c2449c5b7768ca72d0efcd8c505bddbb7a84f6aa401339
MD5 a387908e2fe9d84704c2e47a7f6e9bc5
SHA1 f3c08b3540033a54a59cb3b207e351303c9e29c6
SHA512 7ac804d23e72e40e7b5532332b4a8d8446c6447bb79b4fe32402b13836079d348998ea0659802ab0065896d4f3c06f5866c6b0d90bf448f53e803d8c243bbc63
TLSH
T1720110C7AEF563A02C318B82364BE791DF1DE218F37256FA7450541C80A3866AB4A934
MD5 SHA1 SHA512 TLSH

Submit Download

init.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tcl_data\init.tcl
Size 25KB
SHA256 331bcf0f9f635bd57c3384f2237260d074708b0975c700cfcbdb285f5f59ab1f
MD5 982eae7a49263817d83f744ffcd00c0e
SHA1 81723dfea5576a0916abeff639debe04ce1d2c83
SHA512 31370d8390c4608e7a727eed9ee7f4c568ecb913ae50184b6f105da9c030f3b9f4b5f17968d8975b2f60df1b0c5e278512e74267c935fe4ec28f689ac6a97129
SSDEEP 768:rXugPHudKlExBG+Xg3Qonlm6ofRRECLSQDjr5vkhzx/i:ygGdKli4eonlm6offLzehNi
TLSH
T1C3B2A7112384917932B343368AB9B598ED7EC1F715AD41BCB8CC825C777150A4AFDBD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkgIndex.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tcl_data\opt0.4\pkgIndex.tcl
Size 620B
SHA256 6a4abd2c519a745325c26fb23be7bbf95252d653a24806eb37fd4aa6a6479afe
MD5 07532085501876dcc6882567e014944c
SHA1 6bc7a122429373eb8f039b413ad81c408a96cb80
SHA512 0d604e862f3a1a19833ead99aaf15a9f142178029ab64c71d193cee4901a0196c1eeddc2bce715b7fa958ac45c194e63c77a71e4be4f9aedfd5b44cf2a726e76
TLSH
T1A4F00CA6AFE183A468A18CC33584F751AF2EF078726010F63414E49CE2A00A65F8F8B0
MD5 SHA1 SHA512 TLSH

Submit Download

package.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tcl_data\package.tcl
Size 23KB
SHA256 f46ab61cdebe3aa45fa7e61a48930d64a0d0e7e94d04d6bf244f48c36cafe948
MD5 ddb0ab9842b64114138a8c83c4322027
SHA1 eccacdc2ccd86a452b21f3cf0933fd41125de790
SHA512 c0cf718258b4d59675c088551060b34ce2bc8638958722583ac2313dc354223bfef793b02f1316e522a14c7ba9bed219531d505de94dc3c417fc99d216a01463
SSDEEP 384:8xgjLNILEHsdAW2UfnImRqXqux6XmihmCchzPLrXJjJh6PLfzdklG:8xgjLNImsdnvIm86uGLhLchzDzJ9h6Dn
TLSH
T174B2C9217389925A34B153639B352C8CCF3EC0FB51A951BC78D882BC77709190ADEBE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tclIndex

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tcl_data\tclIndex
Size 5KB
SHA256 ddf7e42def37888ad0a564aa4f8ca95f4eec942cebebfca851d35515104d5c89
MD5 c62fb22f4c9a3eff286c18421397aaf4
SHA1 4a49b8768cff68f2effaf21264343b7c632a51b2
SHA512 558d401cb6af8ce3641af55caebc9c5005ab843ee84f60c6d55afbbc7f7129da9c58c2f55c887c3159107546fa6bc13ffc4cca63ea8841d7160b8aa99161a185
SSDEEP 96:eOaVhNUMUuUQU2UsUIUbUEUEeUkgU6UWSO0DT5RTdcvsilrvs+jscMK57ehXowrz:ejVHRRLP3LWDXewTbSO0DT5RTdcvsilg
TLSH
T14FC1301AA756C72803F481074999FE283ADED1E4D33DC93E99A491CD10B30076FEE9E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tm.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tcl_data\tm.tcl
Size 11KB
SHA256 4b7ed9fd2363d6876092db3f720cbddf97e72b86b519403539ba96e1c815ed8f
MD5 215262a286e7f0a14f22db1aa7875f05
SHA1 66b942ba6d3120ef8d5840fcdeb06242a47491ff
SHA512 6ecd745d7da9d826240c0ab59023c703c94b158ae48c1410faa961a8edb512976a4f15ae8def099b58719adf0d2a9c37e6f29f54d39c1ab7ee81fa333a60f39b
SSDEEP 192:55CjnlRfMKqaOH5bE2KjNkkpgpCmqkkuowUh9PTYMsvSO+xy8h/vuKisM68E:5q3MKYH5bE1jNkkpgomq/uCPTYMC+k83
TLSH
T1EC42B512B38A536A62B313254EBAF294DB2DD1FE57E5506C744D81A837208284B7F7CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

button.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tk_data\button.tcl
Size 21KB
SHA256 1f5dd8d81b26f16e772e92fd2a22accb785004d0ed3447e54f87005d9c6a07a5
MD5 aeb53f7f1506cdfdfe557f54a76060ce
SHA1 ebb3666ee444b91a0d335da19c8333f73b71933b
SHA512 acdad4df988df6b2290fc9622e8eaccc31787fecdc98dcca38519cb762339d4d3fb344ae504b8c7918d6f414f4ad05d15e828df7f7f68f363bec54b11c9b7c43
SSDEEP 384:Tv7cBCAsj9oqlFFSsB3VfRt+lMpWaNwJgzCHarc6gAsj9oqlFFSsB3VlRtYlMpBz:TvweHBBTfIZxHBnZWqbJPBFIaVlCj26+
TLSH
T19DA2CED1CA01437667738226957FA260EF5050FA86AB5418B45E80FC3FFF86A466E3C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

entry.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tk_data\entry.tcl
Size 17KB
SHA256 af1de90270693273b52fc735da6b5cd5ca794f5afd4cf03ffd95147161098048
MD5 f109865c52d1fd602e2d53e559e56c22
SHA1 5884a3bb701c27ba1bf35c6add7852e84d73d81f
SHA512 b2f92b0ac03351cdb785d3f7ef107b61252398540b5f05f0cc9802b4d28b882ba6795601a68e88d3abc53f216b38f07fcc03660ab6404cf6685f6d80cc4357fc
SSDEEP 384:mDfyRIlBk3yrt8qLjtpa+qh+rA4rsWRWrrMUtCPnkKYNlPp64ZnCD:mDfyRIlBk3yJ8mtpaplcp6o
TLSH
T15A8231D62D05577562B7C373E3BBF600EE36907726934026759693A02FB6022036EFDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icons.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tk_data\icons.tcl
Size 10KB
SHA256 1264940e62b9a37967925418e9d0dc0befd369e8c181b9bab3d1607e3cc14b85
MD5 995a0a8f7d0861c268aead5fc95a42ea
SHA1 21e121cf85e1c4984454237a646e58ec3c725a72
SHA512 db7f5e0bc7d5c5f750e396e645f50a3e0cde61c9e687add0a40d0c1aa304ddfbceeb9f33ad201560c6e2b051f2eded07b41c43d00f14ee435cdeee73b56b93c7
SSDEEP 192:0nEPytJLl1S47T3YqN5/vkJpnhXqBB4aw2rqZiygTtYTpOq/pc75Mk:xqLz7F5KTqBBLuZ1gTSsqhk
TLSH
T182329E33554065820BF7CDED7B9BE289FD5004AB260D2885B48A832A7FB5550EF317A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

listbox.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tk_data\listbox.tcl
Size 14KB
SHA256 47c75f9f8348bf8f2c086c57b97b73741218100ca38d10b8abdf2051c95b9801
MD5 804e6dce549b2e541986c0ce9e75e2d1
SHA1 c44ee09421f127cf7f4070a9508f22709d06d043
SHA512 029426c4f659848772e6bb1d8182eb03d2b43adf68fcfcc1ea1c2cc7c883685deda3fffda7e071912b9bda616ad7af2e1cb48ce359700c1a22e1e53e81cae34b
SSDEEP 384:apDYV5Yupn5OcckwBv3HCpg2J8JvJBfWeZhXkz+WkHGowv:aPPkevB2JuvJ9D3XmSc
TLSH
T1246242C42C34637171FFD22746FABB81FF6990A70595504438ACD0A4BF758B246ADACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

menu.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tk_data\menu.tcl
Size 38KB
SHA256 d1283f67e435aab0bdbe9fdaa540a162043f8d652c02fe79f3843a451f123d89
MD5 078782cd05209012a84817ac6ef11450
SHA1 dba04f7a6cf34c54a961f25e024b6a772c2b751d
SHA512 79a031f7732aee6e284cd41991049f1bb715233e011562061cd3405e5988197f6a7fb5c2bbddd1fb9b7024047f6003a2bf161fc0ec04876eff5335c3710d9562
SSDEEP 768:NKJsO5OhIzOQjJwxzire5pKVjriecYyq4Cp5Zn2:NKJsO5LOQizire54lriecYf4V
TLSH
T1530396906F09E3375233D3A583BB9094FF3A82F31346609C745592AC37B58260AFEAD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

panedwindow.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tk_data\panedwindow.tcl
Size 5KB
SHA256 aa4f87e41ac8297f51150f2a9f787607690d01793456b93f0939c54d394731f9
MD5 286c01a1b12261bc47f5659fd1627abd
SHA1 4ca36795cab6dfe0bbba30bb88a2ab71a0896642
SHA512 d54d5a89b7408a9724a1ca1387f6473bdad33885194b2ec5a524c7853a297fd65ce2a57f571c51db718f6a00dce845de8cf5f51698f926e54ed72cdc81bcfe54
SSDEEP 96:ssAXzkTQ9w5fLQYkJLZkRXKUXfwyZTq2sz8j2Em3YKhrYK:jAXgE0DQpJLGR6UXfpqnzG3m3YKhrYK
TLSH
T139B137F6D34895AA7071530552BFF39AC672B07B515F81283806C0A03FB698BE7B57E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkgIndex.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tk_data\pkgIndex.tcl
Size 376B
SHA256 3f2539e85e2a9017913e61fe2600b499315e1a6f249a4ff90e0b530a1eeb8898
MD5 3367ce12a4ba9baaf7c5127d7412aa6a
SHA1 865c775bb8f56c3c5dfc8c71bfaf9ef58386161d
SHA512 f5d858f17fe358762e8fdbbf3d78108dba49be5c5ed84b964143c0adce76c140d904cd353646ec0831ff57cd0a0af864d1833f3946a235725fff7a45c96872eb
TLSH
T149E068880321AB1A4AA26543A890EE4C3FEE90BFE94CC19E301521DCEF12080ADDD8F5
MD5 SHA1 SHA512 TLSH

Submit Download

scale.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tk_data\scale.tcl
Size 7KB
SHA256 0da2dc955ffd71062a21c3b747d9d59d66a5b09a907b9ed220be1b2342205a05
MD5 857add6060a986063b0ed594f6b0cd26
SHA1 b1981d33ddea81cfffa838e5ac80e592d9062e43
SHA512 7d9829565efc8cdbf9249913da95b02d8dadfdb3f455fd3c10c5952b5454fe6e54d95c07c94c1e0d7568c9742caa56182b3656e234452aec555f0fcb76a59fb1
SSDEEP 96:GSusE8YOdpO4aDtao+QYa6t2jooB6ajpaqa5xQz9MUKOC9dLrVx:KsbYQO48t+QYa+NkFjpaQz5KX9dLrVx
TLSH
T149F161D16E82A22D9133C27A52A6D580FD55B0F31A875C48785A40E93FFE87542FEFC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scrlbar.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tk_data\scrlbar.tcl
Size 12KB
SHA256 eec90404f702d3cfbfaec0f13bf5ed1ebeb736bee12d7e69770181a25401c61f
MD5 5249cd1e97e48e3d6dec15e70b9d7792
SHA1 612e021ba25b5e512a0dfd48b6e77fc72894a6b9
SHA512 e4e0ab15eb9b3118c30cd2ff8e5af87c549eaa9b640ffd809a928d96b4addefb9d25efdd1090fbd0019129cdf355bb2f277bc7194001ba1d2ed4a581110ceafc
SSDEEP 192:Gf7RV8ei32PHKT8H2wwucyRlXn+kl1nBKp4nu5FCyK:2mei3qHKT8WPurnXn+I1nBg4nu5MyK
TLSH
T1004284E20D4241FA51FFE2B4FBA7C258E565A0F78B4AE0803415BDE81F2657503BDAC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spinbox.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tk_data\spinbox.tcl
Size 16KB
SHA256 2ff791a44406dc8339c7da6116e6ec92289bee5fc1367d378f48094f4abea277
MD5 77dfe1baccd165a0c7b35cdeaa2d1a8c
SHA1 426ba77fc568d4d3a6e928532e5beb95388f36a0
SHA512 e56db85296c8661ab2ea0a56d9810f1a4631a9f9b41337560cbe38ccdf7dd590a3e65c22b435ce315eff55ee5b8e49317d4e1b7577e25fc3619558015dd758eb
SSDEEP 384:IMpfy/Ku9TzD0E8+9T1wqBaQKpiqQr7E32fnzXfWJU:IMpfy/Ku9Tx8WODTp2zPP
TLSH
T1EB7222DA2D14632D6573C33792BBE305FA2690B7569F40603469C1943F7AA210ABFBC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

text.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tk_data\text.tcl
Size 34KB
SHA256 4a42ad370e0cd93d4133b49788c0b0e1c7cd78383e88bacb51cb751e8bfda15e
MD5 7c2ac370de0b941ae13572152419c642
SHA1 7598cc20952fa590e32da063bf5c0f46b0e89b15
SHA512 8325a33bfd99f0fce4f14ed5dc6e03302f6ffabce9d1abfefc24d16a09ab3439a4b753cbf06b28d8c95e4ddabfb9082c9b030619e8955a7e656bd6c61b9256c3
SSDEEP 768:Rp4LaQDlJrqquMwIMyv4Et8avJLgmTGXs1bYMeNnnZl8n6KRD:R/K8aymTGs1b0xncn6KR
TLSH
T125F2869918095B7AE533D372A37AF101FE72517B06C28019749CD0903FBE46A877EBE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tk.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tk_data\tk.tcl
Size 23KB
SHA256 0f617d96cbf213296d7a5f7fcffbb4ae1149840d7d045211ef932e8dd66683e9
MD5 338184e46bd23e508daedbb11a4f0950
SHA1 437db31d487c352472212e8791c8252a1412cb0e
SHA512 8fb8a353eecd0d19638943f0a9068dccebf3fb66d495ea845a99a89229d61a77c85b530f597fd214411202055c1faa9229b6571c591c9f4630490e1eb30b9cd3
SSDEEP 384:Nuyxt+WaB9USY15gSgC3DbTbXLXKr3cIXyDAbK2LMGgtewT+3oFQRyH5bAy59Hmc:NuItNe9USZblXysm7GgteoFQRYMSySL
TLSH
T1DEB2D7195DC062B3513BC13F53BB2A00E87558FB2776644978DC48B92F6883B06FE9E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

button.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tk_data\ttk\button.tcl
Size 2KB
SHA256 e38a9d1f437981aa6bf0bdd074d57b769a4140c0f7d9aff51743fe4ecc6dfddf
MD5 d4bf1af5dcdd85e3bd11dbf52eb2c146
SHA1 b1691578041319e671d31473a1dd404855d2038b
SHA512 25834b4b231f4ff1a88eef67e1a102d1d0546ec3b0d46856258a6be6bbc4b381389c28e2eb60a01ff895df24d6450cd16ca449c71f82ba53ba438a4867a47dcd
TLSH
T132512FE2414533796FA26A26C50FC0B0FF06C4FA92A6B4D1350D8ADC07E7A6945BE7C7
MD5 SHA1 SHA512 TLSH

Submit Download

classicTheme.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tk_data\ttk\classicTheme.tcl
Size 3KB
SHA256 424bba4fb6836feebe34f6c176ed666dce51d2fba9a8d7aa756abcbbad3fc1e3
MD5 0205663142775f4ef2eb104661d30979
SHA1 452a0d613288a1cc8a1181c3cc1167e02aa69a73
SHA512 fb4d212a73a6f5a8d2774f43d310328b029b52b35bee133584d8326363b385ab7aa4ae25e98126324cc716962888321e0006e5f6ef8563919a1d719019b2d117
TLSH
T12781B013DA8F19533E331A7B8DBA839CED2491224B5B1FA9F27B503C267A1505053E7B
MD5 SHA1 SHA512 TLSH

Submit Download

combobox.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tk_data\ttk\combobox.tcl
Size 12KB
SHA256 68eed4af6d2ec5b3ea24b1122a704b040366cbe2f458103137479352ffa1475a
MD5 f7065d345a4bfb3127c3689bf1947c30
SHA1 9631c05365b0f5a36e4ca5cba83628ccd7fcbde1
SHA512 74b99b9e326680150dd5ec7263192691bcd8a71b2a4ee7f3177deddd43e924a7925085c6d372731a70570f96b3924450255b2f54ca3b9c44d1160ca37e715b00
SSDEEP 192:otLzBJ9SfinaXUBLPYXlk7fKiLH+AzIoJdJwGknmyLsxoVEQGITse8g5sarkT32e:wB5aXmLPYXmrKxLL7A
TLSH
T1054283656112207258F1C223A9FA42A4EEB742F63707D0ACB86DC5ED3FF0164C65B6DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cursors.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tk_data\ttk\cursors.tcl
Size 4KB
SHA256 7a2ed9d78fabcafff16694f2f4a2e36ff5aa313f912d6e93484f3bcd0466ad91
MD5 18ec3e60b8dd199697a41887be6ce8c2
SHA1 13ff8ce95289b802a5247b1fd9dea90d2875cb5d
SHA512 4848044442efe75bcf1f89d8450c8ecbd441f38a83949a3cd2a56d9000cacaa2ea440ca1b32c856ab79358ace9c7e3f70ddf0ec54aa93866223d8fef76930b19
SSDEEP 96:DRYEqfLDxGmxGUz4GUtaPT6t6brv0q3O4Uu0:DWEqTDbxdWaPqe5PUr
TLSH
T12FA1631F3B8B00A77F71012699F5D44BEA16F377C92AC108F68F49587FB82810491A7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

defaults.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tk_data\ttk\defaults.tcl
Size 4KB
SHA256 49ae8faf169165bddaf01d50b52943ebab3656e9468292b7890be143d0fcbc91
MD5 fc79f42761d63172163c08f0f5c94436
SHA1 aabab4061597d0d6dc371f46d14aaa1a859096df
SHA512 f619834a95c9deb93f8184bcc437d701a961c77e24a831adbd5c145556d26986bfda2a6acb9e8784f8b2380e122d12ac893eb1b6acf03098922889497e1ff9ea
SSDEEP 96:lNl3u3lCFUeuMGN3xbVJU+N3xbVJh3IwxkxlBqatUrtY:zl3ZUe9GN3NVC+N3NVjqntUZY
TLSH
T17791C122DA8F29573D32267A8CB6C24DEA34D1710B8F2FA5F27B903C653A1415157D3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

entry.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tk_data\ttk\entry.tcl
Size 17KB
SHA256 830cc3009a735e92db70d53210c4928dd35caab5051ed14dec67e06ae25cbe28
MD5 89089172393c551cd1668b9c19b88290
SHA1 0b8667217a4a14289e9f6c1b384def5479bca089
SHA512 abbbe6aa937aab392bc7dcb8bbfbbec9ee5ed2c9f10ed982d77258bd98f27ee95ac47fd7cb6761b814885ef0878e1f1557d034c9f4163d9d85b388f2b837683f
SSDEEP 384:sca9JzOyzf6yzwO+v+iPT3vKof8q3YIuR13a:sT9JzOy76wiV3YNa
TLSH
T1CC8294E726122771A5F34737EEDBA045EE1A98BB3B8281153449E3503FF4111069FAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fonts.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tk_data\ttk\fonts.tcl
Size 5KB
SHA256 b94c319e5a557a5665b1676d602b6495c0887c5bacf7fa5b776200112978bb7b
MD5 80331fcbe4c049ff1a0d0b879cb208de
SHA1 4eb3efdfe3731bd1ae9fd52ce32b1359241f13cf
SHA512 a4bd2d91801c121a880225f1f3d0c4e30bf127190cf375f6f7a49eb4239a35c49c44f453d6d3610df0d6a7b3cb15f4e79bd9c129025cc496ceb856fcc4b6de87
SSDEEP 96:NzEh94ntnVU8Z/1LkAKgW22SeLMQR8hzcksejmOF4ytZm:Sh9ahV3ZWAKgWDfktm
TLSH
T1C2C12347214EF0233AA11903F3A599126D3576682DB7F51838BF9E1C3FD3A174462BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

menubutton.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tk_data\ttk\menubutton.tcl
Size 6KB
SHA256 972b13854d0e9b84de338d6753f0f11f3a8534e7d0e51838796dae5a1e2e3085
MD5 4c8d90257d073f263b258f00b2a518c2
SHA1 7b58859e9b70fb37f53809cd3ffd7cf69ab310d8
SHA512 ed67f41578ee834ee8db1fded8aa069c0045e7058e338c451fa8e1ade52907bed0c95631c21b8e88461571903b3da2698a29e47f990b7a0f0dd3073e7a1bcadc
SSDEEP 192:toMcJQkmcE6fNuLyiCpYSmFSRwgppdT3kXdpK3dpKkNf2tOTjvAG:tRc6kFbcz2pyXz+zZ2y
TLSH
T1EAD136512704B327A522A37683FFB058ED2FD175774AE49C3446429877E142A4AFCAE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notebook.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tk_data\ttk\notebook.tcl
Size 5KB
SHA256 22264d8d138e2c0e9a950305b4f08557c5a73f054f8215c0d8ce03854042be76
MD5 f811f3e46a4efa73292f40d1cddd265d
SHA1 7fc70a1984555672653a0840499954b854f27920
SHA512 4424b7c687eb9b1804ed3b1c685f19d4d349753b374d9046240f937785c9713e8a760ada46cb628c15f9c7983ce4a7987691c968330478c9c1a9b74e953e40ac
SSDEEP 96:RErUhyi5JeUQBWdz6eP8ClR6/u6AsBmPNNiREUkheLY1EVL23sN2JJjQdD:6uyiyDQBP8q6/u6AUREUsNEVq3y2jkdD
TLSH
T148C163997205A333A231C237EAFD7868EE560C6346935199344DD63977A0089C6BE3EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

panedwindow.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tk_data\ttk\panedwindow.tcl
Size 2KB
SHA256 4d08a7e29eef731876951ef01dfa51654b6275fa3daadb1f48ff4bbeac238eb5
MD5 619d8f54ee73ad8a373ab272fbdb94a6
SHA1 973626b5396b7e786dedd8159d10e66b4465f9e0
SHA512 0d913c7dc9daee2b4a2a46663a07b3139d6b8f30d2f942642817504535e85616835eaa7d468851a83723a3dd711b65761376f3df96a59a933a74ef096e13ace9
TLSH
T1A741BEB76C0611C2EC31423A9A9E6313ED05E06B6647C0653509C4662FF4543BDD8CFB
MD5 SHA1 SHA512 TLSH

Submit Download

progress.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tk_data\ttk\progress.tcl
Size 1KB
SHA256 697cc0a75ae31fe9c2d85fb25dca0afa5d0df9c523a2dfad2e4a36893be75fba
MD5 dbf3bf0e8f04e9435e9561f740dfc700
SHA1 c7619a05a834efb901c57dcfec2c9e625f42428f
SHA512 d3b323dfb3eac4a78da2381405925c131a99c6806af6fd8041102162a44e48bf166982a4ae4aa142a14601736716f1a628d9587e292fa8e4842be984374cc192
TLSH
T1FC218E5DE91160086DB1C12F57E031E8F7485276762E523DBC93D09EFBB0655C429FC2
MD5 SHA1 SHA512 TLSH

Submit Download

scale.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tk_data\ttk\scale.tcl
Size 2KB
SHA256 b909add0b87fa8ee08fd731041907212a8a0939d37d2ff9b2f600cd67dabd4bb
MD5 f1c33cc2d47115bbecd2e7c2fcb631a7
SHA1 0123a961242ed8049b37c77c726db8dbd94c1023
SHA512 96587a8c3555da1d810010c10c516ce5ccab071557a3c8d9bd65c647c7d4ad0e35cbed0788f1d72bafac8c84c7e2703fc747f70d9c95f720745a1fc4a701c544
TLSH
T1EF518DE6CD97702CFD175235B916C042EF09A47736C7A866381F84E11BE89701BD5A94
MD5 SHA1 SHA512 TLSH

Submit Download

scrollbar.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tk_data\ttk\scrollbar.tcl
Size 3KB
SHA256 6eaa336b13815a7fc18bcd6b9adf722e794da2888d053c229044784c8c8e9de8
MD5 3fb31a225cec64b720b8e579582f2749
SHA1 9c0151d9e2543c217cf8699ff5d4299a72e8f13c
SHA512 e6865655585e3d2d6839b56811f3fd86b454e8cd44e258bb1ac576ad245ff8a4d49fbb7f43458ba8a6c9daac8dfa923a176f0dd8a9976a11bea09e6e2d17bf45
TLSH
T1396121A6050110F2ADFBB23ADD7A8205CF2181B7674BD0C5385D9E7D6BE46B10B9CDC5
MD5 SHA1 SHA512 TLSH

Submit Download

sizegrip.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tk_data\ttk\sizegrip.tcl
Size 2KB
SHA256 e92d77b5cdca2206376db2129e87e3d744b3d5e31fde6c0bbd44a494a6845ce1
MD5 dd6a1737b14d3f7b2a0b4f8be99c30af
SHA1 e6b06895317e73cd3dc78234dd74c74f3db8c105
SHA512 b74ae92edd53652f8a3db0d84c18f9ce9069805bcab0d3c2dbb537d7c241aa2681da69b699d88a10029798d7b5bc015682f64699ba475ae6a379eef23b48daaf
TLSH
T17851CE67090271C4FD329A3EACAD9245DE2702E762D1854C7449E2557FB10632EECAEB
MD5 SHA1 SHA512 TLSH

Submit Download

spinbox.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tk_data\ttk\spinbox.tcl
Size 4KB
SHA256 df286bb59f471aa1e19df39af0ef7aa84df9f04dc4a439a747dd8ba43c300150
MD5 9c2833faa9248f09bc2e6ab1ba326d59
SHA1 f13cf048fd706bbb1581dc80e33d1aad910d93e8
SHA512 5ff3be1e3d651c145950c3fc5b8c2e842211c937d1042173964383d4d59ecf5dd0ec39ff7771d029716f2d895f0b1a72591ef3bf7947fe64d4d6db5f0b8abffb
SSDEEP 96:1qg/+yrjqA/K5ytxm1J1Ve6J1yQLUAzz/S76hrwxGGe2F:N/+yr2Gk1J1Ve6fxUAzDS76hrwxs2F
TLSH
T16BA17269A5C1E369F916822BDBDA8340EE2508F3AAC68099781344407FF0F045A7EBD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

treeview.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tk_data\ttk\treeview.tcl
Size 9KB
SHA256 c88b60ffb0f72e095f6fc9786930add7f9ed049eabc713f889f9a7da516e188c
MD5 f705b3a292d02061da0abb4a8dd24077
SHA1 fd75c2250f6f66435444f7deef383c6397ed2368
SHA512 09817638dd3d3d5c57fa630c7edf2f19c3956c9bd264dbf07627fa14a03aecd22d5a5319806e49ef1030204fadef17c57ce8eae4378a319ad2093321d9151c8f
SSDEEP 96:FoTvMxHZZ1u2xj7+ZBHxjiXJv9IfwW+vr3UxjXEJDTF/MyLF3JcMzlsra2tYGa5P:mImAkRKYXMH59o4UbS30LWb
TLSH
T186221FAAA5816271DA767632FEF80166FC1271AB93C6C48D344DD4643FB006188FE9F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ttk.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tk_data\ttk\ttk.tcl
Size 4KB
SHA256 2c48343b1a47f472d1a6b9ee8d670ce7fb428db0db7244dc323ff4c7a8b4f64b
MD5 af45b2c8b43596d1bdeca5233126bd14
SHA1 a99e75d299c4579e10fcdd59389b98c662281a26
SHA512 c8a8d01c61774321778ab149f6ca8dda68db69133cb5ba7c91938e4fd564160ecdcec473222affb241304a9acc73a36b134b3a602fd3587c711f2adbb64afa80
SSDEEP 96:lfxukTy5jPTq8LIgF2diyNTNR6nkrn4ijSSvNigyJ5612HtZG835MSvWOTRsHWU:BM+y5jrq8G/2nkEijSSvNigyJ5612Htw
TLSH
T1ADA154399B0EC0555EF142224B78C168E6DE7AB253510C08F8BC81BD27751774EE9BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

utils.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tk_data\ttk\utils.tcl
Size 8KB
SHA256 d58610a34301bb6e61a60bec69a7cecf4c45c6a034a9fc123977174b586278be
MD5 d98edc491da631510f124cd3934f535f
SHA1 33037a966067c9f5c9074ae5532ff3b51b4082d4
SHA512 23faed8298e561f490997fe44ab61cd8ccb9f1f63d48bb4cf51fc9e591e463ff9297973622180d6a599cabb541c82b8fe33bf38a82c5d5905bbfa52ca0341399
SSDEEP 192:e0ebpSp+IZwnmTmpx8xzaHfw8K7LVJWQl8p7M+R5:rw0+WmpWxa/w9nVJHu
TLSH
T14702A6622905B2A71AF2E222E7E7E194FF17C4731B5390147D1D449C3FB0633C6A6DAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_tkinter.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\_tkinter.pyd
Size 52KB
SHA256 2cc987f71fe6a28e8ca5fc1f14c26bd6efa59b36e91d52901c17a5e57c4f0b2d
MD5 034f018a889142741393a68907cbbdb7
SHA1 1b907346845f73a947ee74c89af02a34badc8844
SHA512 4062c4b7ce7c9b309d87b9b322575d88a974be75a3d6e3fb2e80af7235808073490ec23c0d47eb09d4990ca959bb7d63ba26a8db124ad46f9c887351a6f3ae2c
SSDEEP 1536:hg8xkWmNCc8sLuQL81CY+s9zmjZ0IyIEOS:AWmNSUuKpY+s9zmjeHIEOS
TLSH
T1C8335C5AA765009ADEA7C07CC9734B13D2B5B8610B14A38F0294D25E2F337E393FAB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\base_library.zip
Size 1.4MB
SHA256 c81c6318ed28eb21a06ab8161cfa9cf92b687f90116b7f5ca21fe24c21ea3dec
MD5 2a87875c4e79a62a24b11671b82cb52f
SHA1 c154b3e4c10f06331630e6bb8a205c0db54fd1e8
SHA512 40d4f95fdb91e149afd569b6157aade466d704d71a309827f976bbb039d5597fc925d02b7ca126a6e343e5d1d5724ef1fcefeb061dcc37f3e2e1b7d5ddef414f
SSDEEP 24576:ifRM3z3cnz/bucEvUFina5Pydmz7nQTGHH3QR5prQjwh9o:ifRM4TQR5puUo
TLSH
T1266509817982B5F7F804F3BB4026090DB328C5B4BB44C75739ABC1A69F9E6A47E518DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3-x64.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\libcrypto-3-x64.dll
Size 7.6MB
SHA256 4ef4f59ddc79f232a76e7eee7a7fd91792974ba885011b00acada8debfc14173
MD5 ea124141d5b123353e0141568c373c18
SHA1 db302d86966ca87a30859654a86801cd12ca3519
SHA512 b1befe38003b82c35da945f68f116af9a1f9be447618db88b36b89e2e87a70b8706bfce143fbd6f7c7e9efdf840f65ef0cab1062a727cfa22b8f7b62ad7fa5e4
SSDEEP 98304:I1fp/3ffd/Mjy36hTn4pE7Qvy+b1CPwDvt3uF90CZW:SfpuHEaC1CPwDvt3uF90C
TLSH
T182862857F6BA10D5D8FAC1398293323BB970B86543B457D3A60095AA0F33BF8A93D744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\libffi-8.dll
Size 27KB
SHA256 d56b5e5aa064e35f9ae5d11d2f0833a591d946bc04b85e1772ddfa7c84eb33a3
MD5 3544abe52bd2cc086bb40be378c0b6a0
SHA1 e0a1a2bdb577ecb3882b704b2c3d6105f36f18ee
SHA512 7bd64ace9c59bb991edde75ddf3978905de8634c865bdd70da244ffec00e90ff55a23d0ac48e4b5628106a3a6f8916b4f5ee5eb8f6634c1e1221a2fc7ea8e286
SSDEEP 384:FZI/wgEI7ztptZKrOdS9LNdPlm05iq97HeE6H1rvMPVRCXv30vG:8Q5lN7m0QqkN0w0+
TLSH
T121C23947A59415A4E2A7C03D86339D5AC23578351B60F6CF03E192BE2E5BAF9DB3C308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\python311.dll
Size 5.6MB
SHA256 06cb189016f6d5a593aba0e4c53ae972f2b7a257373c502e7da80f35f37dc1c0
MD5 0101e392844bad69ff3d24fecd3df2b9
SHA1 1094e6a4a91bbce91d29a0e00fe1ada22fa43be2
SHA512 a27d35bae06d16e35b8e92812ef731274ded6c464634d91382b916a8ef774b4ace936ce3e0294f891db5f67a1375aa24b97b404d796e980eb3617fd1023937e5
SSDEEP 98304:M1T5+PMGxsz72Jbor8fhZUFHnMPHVjrK:M1T0xxS2JbowZPZ
TLSH
T17E466C21B26489A4C8BB8536EE6B435AC7717C106B11DB4B5164B3EE2F337530AEF349
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\select.pyd
Size 18KB
SHA256 ab91970ff8458849e59711e323dc49f09bafe7a650ddcf797fd7242343ebc49d
MD5 c381e282961528e818c15688ee643dea
SHA1 46e782d807af3b725c96be2acf51c09c2e929e6b
SHA512 eded4e4554d9e29f49e0d94b2a6f88240f9ac0bb98520ad4f0e9adadf1adb24846d20641dce78477b720f58adba5018610ed0bc362f9116eee5742a5d11ba00b
SSDEEP 384:Uar1fP1/pqOLlxHqP0smv7AzN57Elna0sj+IEQG:vh1Y4xHqiWOla0I+IEQG
TLSH
T107824C46BBB090E9E1A2C1B3C9770F11D936B631472543CF23A4866D2F27BC2A736B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcl86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\tcl86t.dll
Size 1.8MB
SHA256 59488f67a8e75a5d51c7cb865436b5581fbb16014e9233b34db0c22bea6d4765
MD5 b1f6a8a870f9f3f1cd34e45b1fc52cdc
SHA1 087b2f7a430c97ce6d4bb24931bc37d367c76ad4
SHA512 03ac3343fd4af127a9e82b698ff29d4c7e308b8aac2b10b388239316c0176678bfbf6d0caff9343b44e8d81ded7f004e093e138bc4249242c4aac7250ba12bd4
SSDEEP 24576:lNJSAyrJZwdI3xpXxBX4Crw9yilqy+uVUD5Wbsr+Qt682zhPlkPkGqTvI92jHBHo:lNgjid2LD5W4ac6xdLvIkhHP4ATdeD
TLSH
T14985AF1BE76411E8D4ABD1BCC227EA0BDBF1B4191350A6DB51A08F522F23FE1277A345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msgcat-1.6.1.tm

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\tcl8\8.5\msgcat-1.6.1.tm
Size 34KB
SHA256 6774519f179872ec5292523f2788b77b2b839e15665037e097a0d4edddd1c6fb
MD5 bd4ff2a1f742d9e6e699eeee5e678ad1
SHA1 811ad83aff80131ba73abc546c6bd78453bf3eb9
SHA512 b77e4a68017ba57c06876b21b8110c636f9ba1dd0ba9d7a0c50096f3f6391508cf3562dd94aceaf673113dbd336109da958044aefac0afb0f833a652e4438f43
SSDEEP 768:m3xQvCzasI/rHPG2yfkZ0Kbh91iQ3Lnq5MIVYB8mbgijsPIWtw4qvUm:4xQvCzasIDHPG2yW0kJ32imXmUij6JjG
TLSH
T1EEF2D624334741AB36B2526799B9A2A4CE3CE23F10AB959FB89A801C7731F5D43F74D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tk86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\tk86t.dll
Size 1.5MB
SHA256 e9a5815ad39619e22d581b7124bbaa4192e701229956a2edbaffc0c420864561
MD5 4d1f4ab541f3304158a9b0069a4db658
SHA1 c6115536dcf2628d581a7f10bc82ed2e8f1a964e
SHA512 b28be87bad42d0dceb42f574579f598bb805e620b31177da6e1838ab8b6e60f7b85f834c428ec4fc877041d5035b7571358481daf4b76b11aea540b369da5ea3
SSDEEP 24576:k1Bvnu8AyQD9FLi543GLUKuPO6EinYTVAiueFoC+vMvE58KOp0wd98ydeyRP/ec3:kIyQD9FU43GLUKuPO6EinYTVAFSvESK8
TLSH
T1BF654B06B2A1C198C26EA134C91796B6EBF17C04931457DB76A0BE6D3F33BD2277A314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000012782\unicodedata.pyd
Size 1.1MB
SHA256 aa489115a8139de6aa0db51e2c8771c78df430fd7c3c65b714f385833ccc91fe
MD5 6b6a5ea52f84c51f18279d668e620ee4
SHA1 0d474d67a95fa0aef37671a8bc8d96c19b820c36
SHA512 a1e2de1dc529b5b36ee69eef29c3378dfccc396cff53ae8933a1460ffb05414c31a83796fb55fb564cd07b146862bb86352dcf0fbc67b3872715405d2c52adb5
SSDEEP 12288:VdlYbfjwR6nbeonRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eDH3:1YbMT0IDJcjEwPgPOG6Xyd46H3
TLSH
T1DA354AC9BB828D66D87B317944D2212F1361C272476B233BB65513285C8B3B74EE6DEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4200_1359123682\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExportExpand.html

Path C:\Users\Admin\Downloads\ExportExpand.html
Size 11KB
SHA256 36529b80e9d69af514d2cdd8129cb24e9291d4eb1f843742125fff00a3a6e1d2
MD5 a7978b378ab9a19ae386881fd532eeb0
SHA1 5fe053a6a4d097f97abf1da15e5e22a7a9985080
SHA512 b15d47c43d41db734c87b8068cea38739c912b5abd23f54e50f6655c43b409425fb388b0958ab4d33b6c1d996cdcc95ed660b50c33aae464a1eaacc7d5cba6ec
SSDEEP 24:Ittttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttq:n
MD5 SHA1 SHA512 SSDEEP

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6520_1101808692\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6520_1621223453\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads