hxxps://www[.]mediafire[.]com/file/4q1zqjkum78kwz5/QueueSniper[.]zip/file

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/07/2026, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/4q1zqjkum78kwz5/QueueSniper.zip/file
Sample260712-datkpsb17j

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1736	QueueSniper.exe
760	QueueSniper.exe
764	QueueSniperHeadless.exe

Loads dropped DLL 64 IoCs

pid	Process
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
1736	QueueSniper.exe
760	QueueSniper.exe
760	QueueSniper.exe
760	QueueSniper.exe
760	QueueSniper.exe
760	QueueSniper.exe
760	QueueSniper.exe
760	QueueSniper.exe
760	QueueSniper.exe
760	QueueSniper.exe
760	QueueSniper.exe
760	QueueSniper.exe
760	QueueSniper.exe
760	QueueSniper.exe
760	QueueSniper.exe
760	QueueSniper.exe
760	QueueSniper.exe
760	QueueSniper.exe
760	QueueSniper.exe
760	QueueSniper.exe
760	QueueSniper.exe
760	QueueSniper.exe
760	QueueSniper.exe
760	QueueSniper.exe
760	QueueSniper.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2600	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134282981405323511"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{D736C957-6C67-4F25-8E1C-F179BE38F405}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1108	msedge.exe
1108	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
1736	QueueSniper.exe
1736	QueueSniper.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
1736	QueueSniper.exe
1736	QueueSniper.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 5020	4740	msedge.exe	86
PID 4740 wrote to memory of 2600	4740	msedge.exe	87
PID 4740 wrote to memory of 2624	4740	msedge.exe	88
PID 4740 wrote to memory of 3536	4740	msedge.exe	89
PID 4740 wrote to memory of 2624	4740	msedge.exe	88
PID 4740 wrote to memory of 2624	4740	msedge.exe	88
PID 4740 wrote to memory of 3536	4740	msedge.exe	89
PID 4740 wrote to memory of 2360	4740	msedge.exe	90
PID 4740 wrote to memory of 2360	4740	msedge.exe	90
PID 4740 wrote to memory of 2360	4740	msedge.exe	90
PID 4740 wrote to memory of 4764	4740	msedge.exe	91
PID 4740 wrote to memory of 4764	4740	msedge.exe	91
PID 4740 wrote to memory of 4764	4740	msedge.exe	91
PID 4740 wrote to memory of 5072	4740	msedge.exe	92
PID 4740 wrote to memory of 1884	4740	msedge.exe	93
PID 4740 wrote to memory of 5072	4740	msedge.exe	92
PID 4740 wrote to memory of 5072	4740	msedge.exe	92
PID 4740 wrote to memory of 1884	4740	msedge.exe	93
PID 4740 wrote to memory of 1884	4740	msedge.exe	93
PID 4740 wrote to memory of 4356	4740	msedge.exe	98
PID 4740 wrote to memory of 4356	4740	msedge.exe	98
PID 4740 wrote to memory of 4356	4740	msedge.exe	98
PID 4740 wrote to memory of 3144	4740	msedge.exe	99
PID 4740 wrote to memory of 3144	4740	msedge.exe	99
PID 4740 wrote to memory of 3144	4740	msedge.exe	99
PID 4740 wrote to memory of 3740	4740	msedge.exe	100
PID 4740 wrote to memory of 3308	4740	msedge.exe	101
PID 4740 wrote to memory of 3740	4740	msedge.exe	100
PID 4740 wrote to memory of 3308	4740	msedge.exe	101
PID 4740 wrote to memory of 3392	4740	msedge.exe	102
PID 4740 wrote to memory of 3392	4740	msedge.exe	102
PID 4740 wrote to memory of 3392	4740	msedge.exe	102
PID 4740 wrote to memory of 3192	4740	msedge.exe	104
PID 4740 wrote to memory of 3196	4740	msedge.exe	105
PID 4740 wrote to memory of 3196	4740	msedge.exe	105
PID 4740 wrote to memory of 3196	4740	msedge.exe	105
PID 4740 wrote to memory of 4804	4740	msedge.exe	106
PID 4740 wrote to memory of 4804	4740	msedge.exe	106
PID 4740 wrote to memory of 4804	4740	msedge.exe	106
PID 4740 wrote to memory of 4944	4740	msedge.exe	107
PID 4740 wrote to memory of 4944	4740	msedge.exe	107
PID 4740 wrote to memory of 4944	4740	msedge.exe	107
PID 4740 wrote to memory of 800	4740	msedge.exe	108
PID 4740 wrote to memory of 800	4740	msedge.exe	108
PID 4740 wrote to memory of 800	4740	msedge.exe	108
PID 4740 wrote to memory of 2572	4740	msedge.exe	109
PID 4740 wrote to memory of 2572	4740	msedge.exe	109
PID 4740 wrote to memory of 2572	4740	msedge.exe	109
PID 4740 wrote to memory of 1608	4740	msedge.exe	110
PID 4740 wrote to memory of 1608	4740	msedge.exe	110
PID 4740 wrote to memory of 1608	4740	msedge.exe	110
PID 4740 wrote to memory of 3800	4740	msedge.exe	111
PID 4740 wrote to memory of 3800	4740	msedge.exe	111
PID 4740 wrote to memory of 3800	4740	msedge.exe	111
PID 4740 wrote to memory of 1276	4740	msedge.exe	113
PID 4740 wrote to memory of 1276	4740	msedge.exe	113
PID 4740 wrote to memory of 1988	4740	msedge.exe	114
PID 4740 wrote to memory of 1988	4740	msedge.exe	114
PID 4740 wrote to memory of 1988	4740	msedge.exe	114
PID 4740 wrote to memory of 3960	4740	msedge.exe	115
PID 4740 wrote to memory of 3960	4740	msedge.exe	115
PID 4740 wrote to memory of 3960	4740	msedge.exe	115
PID 4740 wrote to memory of 5432	4740	msedge.exe	117
PID 4740 wrote to memory of 4760	4740	msedge.exe	138

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/4q1zqjkum78kwz5/QueueSniper.zip/file
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7fff4ed6c188,0x7fff4ed6c194,0x7fff4ed6c1a0
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,2530270187087471418,12888154591441169502,524288 --field-trial-handle=2724,i,2814028060826679853,13293651333397401280,262144 --variations-seed-version --mojo-platform-channel-handle=2808 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,2327720786235844564,13509024792666497645,262144 --field-trial-handle=2724,i,2814028060826679853,13293651333397401280,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:2
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2084,i,15965718549893794217,3750319691637026485,524288 --field-trial-handle=2724,i,2814028060826679853,13293651333397401280,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3388,i,13386690033259466724,1445019224104391939,2097152 --field-trial-handle=2724,i,2814028060826679853,13293651333397401280,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3392,i,15001903730537369533,7078069923582220057,2097152 --field-trial-handle=2724,i,2814028060826679853,13293651333397401280,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,5584123000630097547,3777124118852376643,2097152 --field-trial-handle=2724,i,2814028060826679853,13293651333397401280,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,17076681414881550949,15887338923194456027,2097152 --field-trial-handle=2724,i,2814028060826679853,13293651333397401280,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3736,i,1707982632190162733,6939414034211106736,2097152 --field-trial-handle=2724,i,2814028060826679853,13293651333397401280,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5268,i,14384860307492548484,14883503479539983785,2097152 --field-trial-handle=2724,i,2814028060826679853,13293651333397401280,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,17430362278620676398,8089012716208141137,524288 --field-trial-handle=2724,i,2814028060826679853,13293651333397401280,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,11730517912558752929,17353451920604286586,524288 --field-trial-handle=2724,i,2814028060826679853,13293651333397401280,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5972,i,1822713073474788434,10876335879726129772,2097152 --field-trial-handle=2724,i,2814028060826679853,13293651333397401280,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,11060809288420831923,11438623399289793732,524288 --field-trial-handle=2724,i,2814028060826679853,13293651333397401280,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,11060809288420831923,11438623399289793732,524288 --field-trial-handle=2724,i,2814028060826679853,13293651333397401280,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5312,i,8232615064761374124,14900663961955140264,2097152 --field-trial-handle=2724,i,2814028060826679853,13293651333397401280,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5072,i,8123154479970875308,14394501634334485469,2097152 --field-trial-handle=2724,i,2814028060826679853,13293651333397401280,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6600,i,16463409042316354106,13993872026858105626,2097152 --field-trial-handle=2724,i,2814028060826679853,13293651333397401280,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7004,i,16570273847527384352,15653619531450173299,2097152 --field-trial-handle=2724,i,2814028060826679853,13293651333397401280,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:1
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7128,i,15220505340559086384,863411180126610146,2097152 --field-trial-handle=2724,i,2814028060826679853,13293651333397401280,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7400,i,12754402950341237335,2589142995604680512,2097152 --field-trial-handle=2724,i,2814028060826679853,13293651333397401280,262144 --variations-seed-version --mojo-platform-channel-handle=7392 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7524,i,1307348663658928206,15612472392914975346,2097152 --field-trial-handle=2724,i,2814028060826679853,13293651333397401280,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7740,i,13595983574674163580,6431470446308327034,524288 --field-trial-handle=2724,i,2814028060826679853,13293651333397401280,262144 --variations-seed-version --mojo-platform-channel-handle=7752 /prefetch:8
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7652,i,9120977918646055092,7017703844135563302,2097152 --field-trial-handle=2724,i,2814028060826679853,13293651333397401280,262144 --variations-seed-version --mojo-platform-channel-handle=7812 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=8120,i,15023239268301892778,10179002059593138068,2097152 --field-trial-handle=2724,i,2814028060826679853,13293651333397401280,262144 --variations-seed-version --mojo-platform-channel-handle=8124 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7652,i,16478356311586560253,1198985608785046322,524288 --field-trial-handle=2724,i,2814028060826679853,13293651333397401280,262144 --variations-seed-version --mojo-platform-channel-handle=7676 /prefetch:8
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,16575950224102157899,18166253483650326582,524288 --field-trial-handle=2724,i,2814028060826679853,13293651333397401280,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,17137767684108354493,2087064033917553598,524288 --field-trial-handle=2724,i,2814028060826679853,13293651333397401280,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:8
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,15884725034389623426,1116447021765176314,524288 --field-trial-handle=2724,i,2814028060826679853,13293651333397401280,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:8
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,4336852151383154098,11814152824489807343,524288 --field-trial-handle=2724,i,2814028060826679853,13293651333397401280,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=748,i,977735711218375758,10318975485513994122,262144 --field-trial-handle=2724,i,2814028060826679853,13293651333397401280,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1108

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1112

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5752

C:\Users\Admin\Downloads\QueueSniper\QueueSniper.exe
"C:\Users\Admin\Downloads\QueueSniper\QueueSniper.exe"
1⤵
PID:2200
- C:\Users\Admin\AppData\Local\QueueSniper\2.4.1\QueueSniper.exe
  C:\Users\Admin\Downloads\QueueSniper\QueueSniper.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:2376

C:\Users\Admin\Downloads\QueueSniper\QueueSniper.exe
"C:\Users\Admin\Downloads\QueueSniper\QueueSniper.exe"
1⤵
PID:920
- C:\Users\Admin\AppData\Local\QueueSniper\2.4.1\QueueSniper.exe
  C:\Users\Admin\Downloads\QueueSniper\QueueSniper.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:4024

C:\Users\Admin\Downloads\QueueSniper\QueueSniperHeadless.exe
"C:\Users\Admin\Downloads\QueueSniper\QueueSniperHeadless.exe"
1⤵
PID:5504
- C:\Users\Admin\AppData\Local\QueueSniperHeadless\2.4.1\QueueSniperHeadless.exe
  C:\Users\Admin\Downloads\QueueSniper\QueueSniperHeadless.exe
  2⤵
  - Executes dropped EXE
  PID:764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:6052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8b98c8b6b381e81c2bbf54b9caa68f2c18c9e88f35c3a0ec4606ce6913bec6fb
MD5 63bf6d0df9b19fddac83abae873ac109
SHA1 5dd25151b771fd9586d645e48a09c3c90206c6bb
SHA512 e66a1dca651cf59894f7ab0cd8a741d4d6514106675ff2869a2da724d152ec5ba25cd4d2730c51475df230cad415588165a556047cfbef5d2717e3e00337d474
TLSH
T11ED0A720773978C2D2291071E4224B4076AD54B6215A82466254840D5C7A4C696CB682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 19630f7def82d30ca5a57abe4556b97cf7e94671e94f010d3687ef5f58599632
MD5 16bffe0514c2d5238fe3d5345577fb61
SHA1 87b98faf629cf2cb0c4f7aeac7c54784b44cf3ff
SHA512 d83f8cebcb44c52f057d58e43cb4a3fafc1db5521a6c80a6f312a796b7623652d4c4b164f374c4718bc4e6a74a7a0cea7d5a4d403b690fa0e8e56a44ab728491
SSDEEP 96:njrqKN/yRM+CkenEFz+VVLSHE+b/9rbzoezEn:njumICBnlZOrbzL4n
TLSH
T139A1D830839104D4CB620DBC62D14A07F6F1D6E8F8B72E5199EC96B99947BCC63CD536
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 21KB
SHA256 13b4628998ff4a12c71d5b9d3708ac2d0ce7ffdf55a1958538848339734b4c37
MD5 fd9171123122458119f32a1bf9ad6c5a
SHA1 5e635bd9ee5a843e291873810dd2e84011dbadc7
SHA512 fb22d0fd712722176de7d590dcf1d73b1d55522bd2ad761c4bae06d7cc1f87681b753ef275b57c4dac3c6a33ad41d346b2d317332fe75a3394ac60acd03eff29
SSDEEP 384:DRBGF5WTwyeYezj3pVxkewJB1h+EE0OJQxyj4VYm4fYwrEkY/INSAUJmL3hQzAGP:hiy+xQLm8RmZkzuPJWYO
TLSH
T10DA289F383E5D52E890117F85A14AE1BCF1D1729432C3C2589D5EE87E3E2472E16AA1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 600b9b604611c68e4873fe886dd09d7d7c39584ef4ae4ac50103e3f0e86a345c
MD5 122a89fc742aba725e905719e24d0435
SHA1 241fe6ae9591bf49ffe86ae29d010fa257d29dc7
SHA512 bf947e900f71028221670dee3c746cde3914aa4f3df8aeccb5cca7377c30cb667a06cba26e78e682f330df11fe05d0d09a9e02e3f74fdb3f3b19292f2498a532
SSDEEP 192:sxZRRVyM/jK1Ml8Mf6v/fqs1yQWIdpVpquHW6+WNmf0/YzLcJrIgrJ:sxZR736v/fqs1y8dHb5/F9
TLSH
T1CD52D7126B3459778CCBD209FA41BB93D6F9147292954D48AAFCDA0C04F6AED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3189fc20982aadb5b01ca31841b160a7a1a6c2f7c23049327ec012e80011d5cb
MD5 dbf8fcedd7275754ec471449afaaab2a
SHA1 e5ef8fd1421beda0ac143cd5cdafeb7b344ecefe
SHA512 be089d7235e4043aa3910bc324576f5383449c55295b79c202d1d38a63c35598fd34f5297774e4dabcafc4051f0fb373d115143fbdaf5a6ccbdfcf9c7566183b
SSDEEP 192:sxZRRVyM/jK1Ml8UQwlv/fqsNYQWIdpbpqLywHW6+WNaGiyf0/YzV3erIg5cJ:sxZR7qQv/fqsNY8IHbO/x2
TLSH
T1F262D753AA345977DCDBD219F941BB93D6F5147292914E84BAFCCA0C00E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1f84b7e1c2e4d71fd131471d0d8e1c482970299a671272806929f556bf7e7462
MD5 74237d8af4050c11f10c70fb2afb2b51
SHA1 f52dd2f96317ec62c0a4c2e4ae86deac456cefeb
SHA512 77c6acb33b41c66779726be3cd6cf2554ac0f60fc229563d437c8bc57b728931ff6a7f0e56b2f9461352104dfe1075adbfe8b6dec4108ee6342b2bbb86e39527
SSDEEP 192:sxZRRVyM/jK1Ml8Mlv/fqsNyQWIdpVpqLywHW6+WNaGiyf0/YzLUJrIg52J:sxZR79v/fqsNy82HbO/98
TLSH
T10852D712AA34597BCCDBD219F941BB93D6F5147292914D84AAFCDA0C04E6BED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c30a1fd1d33e5c2f0683fff0ea21b311f89453c488899c64cd7103bd115d5042
MD5 acb6f0f56688716248f548fcc0d885c1
SHA1 50a2d6c4996ec269bbe461577e0807ce4dc3e3d6
SHA512 428578ee3768c4fde1b1256d80a931e842aaa5ea1c681d6dbb230fa2d905aadd0d573a415cc482345f2250cd07b994e5aec4e11ead81ba52deb8a66901f35e1a
SSDEEP 768:/6W7kf0Wvqina8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjEroIp0tYQ:/6W7kf0Wvqinau1jaa5LA3jPuQ
TLSH
T1F2E2FA3B684CCB7E4F840E5CEC266F966ED801CB66988D5487FA884C03CB6EB51165DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6149b107851c55d4_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\6149b107851c55d4_0
Size 63KB
SHA256 aed8c40fa03092fdb6bc8df1174661852aa5457e1ab07419b79915bb503223aa
MD5 c3538a6bb1f65e543bbcd426f05fea57
SHA1 3567ff471fde4fae1babca40c78d452e6d35a518
SHA512 56c8bdcff59af7d3589c4833b0c69df102b86b7534d0d861372d6f829095d62685caac696cdd2834b8303cbbe39d48e83451af67079211d0cafcdad3d91274df
SSDEEP 768:VeJDcwZ9olHJrD05l7eEFfgoAxWhrJTV9/5oZ+UyA2xGu/5374WAiEAXnR8c6BVy:VDJ0VPVR5yyJxGSV4V1C6c0VVEO
TLSH
T1A9535CA633707477827BA1F1905F130B713AE167F40494E8B194EEE54A44BAA42B7F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 2598b80d469e34918e5d18c8fc90b6aed93e4f917c19dd3ef48e6dc8dba7a637
MD5 cd60a184353a4f2e8f4c3fc14da03e4f
SHA1 239918668a02773829dd5178be3db7ca01b40d6c
SHA512 dbebbc480feeb2799692f5fac20b6dceb0b8c55a9260c3eb37602a7180098949e92726664e50051b30a072211f9946c8de17893f88a1d37a172dc5caeda91099
TLSH
T1ABA0021071902401E444827492929781731B7C1209059642B4D41CC6C85C6504502810
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 265e8743041a77594827461304741eead955117a96f5eeae0370b9a8173f6b83
MD5 87e77add5457e385100fb0515dc49cff
SHA1 d2057ed4a887b84b14c7661125a162cf0ebabeeb
SHA512 df3190a90310dcb47712c3b5052bb70284ce826d1cbac50928c3c59c0263657ab137aacfe4fc4488baacb9fab424cc7e89557d0be4b420ee7158741f89fdc0a6
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTfrIRKsY8HydfIFKEcAQCIfKf5:KIbCKcfruKsY+WfmKEcHCEKf5
TLSH
T150911196313B4A52387F29449696963BDE8231A33414F86F7BB910A11F2BE120DFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a12a6dcefeb4372838dc78473230f8879dd8b817a7783839bfc07bded39cd602
MD5 5c9c671f9151820b59d0b19dd937f66b
SHA1 72dc20b310ae52e328a8317927db8c93be65ee11
SHA512 9814ce0925ae7483840c09383ae06c15d030679ceeff77bb22b2a6029bf1313f116e0e9a21e8c4cdc756d7ab6d79a938ad4082935be6c4b830bcae27a4baee7b
SSDEEP 384:oiF5tNn/s3n9Sa8sN/8TUNTUlIlzq1tvbBN++irtdMbr20ZOObjI9G6w7AQ:zF5j+9eawgU1tvr++ipkr2629MAQ
TLSH
T1B7C229F24CD78936D95E4B47F37E2E068EBCC067B5816A40B3D89A0CCD962BFC206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 d9bd1b0edcd1b0f7ebaff3b53f2295fd374e41ca5c5aa1e72f0594d13db537c5
MD5 f1905255ebbdffb67ff638aea284bdb2
SHA1 b027c628d789fee903dd212080536dbc153bf6cb
SHA512 68683f967fbf63cac3b68a65bc29f6209794940311be7376c4a90f09d7edcae52c3adefae7f692f27a0869b7966d9464888fa398c8abaa739987ea8caa88db53
SSDEEP 384:UtNn/s3n9SYsNlAq1tvbBxrtdMbQ20ZOObjI9G6w7AQ:Uj+9LG1tvjpkQ2629MAQ
TLSH
T146929C325C295E775D929555F08B3A079FF8517B97C42F80E2EDAF0C06DA6EC530282A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 fb4e794e3790c136a17edd586d3f8ea7459fb06ef680475343a0ddb1d5d95c57
MD5 02914be6df275455d6d75355e2f1e97c
SHA1 d694e46c62ee8c90011bbbde49871095c4683ed1
SHA512 ae0b5c2e79ab631b89bca6977ca0dcab077afb39176e4934163882bd22ee2424cb3460a788a643fec6beb0a4bb37407c76005fb824c1074a0b3e239eca40a895
SSDEEP 384:+tNn/s3n9SYsNlzq1tvbBxrtdMbQ20ZOObjI9G6w7AQ:+j+9Lz1tvjpkQ2629MAQ
TLSH
T1C8929C325C295E775D929556F18B3A079FF8507B97C42F80E2EDAF0C06DA7AC530282A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2b42eed10ffb5db464af5118bbc83d480982ed3353cb62b40b7fdd4c76559166
MD5 51556fa3c7df6387c34f01e433bea838
SHA1 586abd7054b820ea59210de60a48f0f47019a33c
SHA512 dae95483f1518ddba518b125a215f2cf1c22e3e686c4e70c1ac7cb62b8f8dae3dde7c9d42732517d5ea2e48f2dd2cc6260dc8310c2a1a02075f8617c5ed7748b
SSDEEP 192:sONQ64B4QmiUyQ0f5GBPKm2+FdGr5VkEBWw2kq6ZU6:sONQ6eYCfidMbl20ZU6
TLSH
T176121B366C786C6B5EA2B541F08736075EA4523BEB857F84F6ED6B0C01EF6AC2306417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 80522542da1e121190ad2c3ec3e6ad93449d4c696fd0be5bc5effee410121662
MD5 e25dbf4ead5fedc7e52855e3f5514556
SHA1 0d98d60b2c066021293cfe34878ad7704eeba371
SHA512 4274ab5c66c713ef85ac6f74a123f4bd8413a7ea923ec7d4c2db4a4334e7b82f7cf32c1177b5584104fa74fc8bd7ba325239a5cd257705304db5f24571bac959
SSDEEP 384:KtNn/s3n9SQsNlEq1tvbIurtdMbQ20ZOObjI9G6w7AQ:Kj+9Tm1tv/pkQ2629MAQ
TLSH
T1F9929C325C385E775E929555F0873A079FF8517B97C42F84E6EDAF0C06DA6AC130282A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a6181f6e5328cb92575bce07d39d61f2cc6b16d82da55bab58e83fef893b638b
MD5 f13483222d493b2d909ed88403dde106
SHA1 c8eec3e652811da904e50cdf16b2f695f01e1059
SHA512 2f77f03b9f3055a93a3cc99bee755f296fa475c2cc3610d451a35a458386dd5399d6b369b5965f831bd5ef51904c5d5153f313f350a36d40ba9cdf633d28354e
SSDEEP 192:MONG64BAQmiUyV10W5GBPKm2+FdGr55aD2hZU6:MONG6eA2GWidMc2HU6
TLSH
T1B102FA396C796C6B9EB2AE45F48737175FA8113BE6956B44EAE85B0C00D725C2303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77c01ff5-75c6-4a51-93ba-50993590b7e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\77c01ff5-75c6-4a51-93ba-50993590b7e3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1fa19da80f4901f13315f853c60e0925135974e35f10aa2e4b93eaf507e5eab6
MD5 4432ce05b764b6ff0348554480216d83
SHA1 0dcebe63ebff5d7226af1f246f9f2e19b8648447
SHA512 33fb07f608206ab051fac3bf45995e9ec443b671d3e6ebf14b25355f366b188feec655def3ba25ec32d44d858b773f6ba304632cd925c1d804dc7717e8bfbcd7
TLSH
T1D9411458B7F9114873B36E56ABF3A86D483AB9372E06D49E00110E4E0A22B40C972B37
MD5 SHA1 SHA512 TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\QUEUES~1\2415C3~1.1\_socket.pyd
Size 77KB
SHA256 a19e3c7c03ef1b5625790b1c9c42594909311ab6df540fbf43c6aa93300ab166
MD5 b77017baa2004833ef3847a3a3141280
SHA1 39666f74bd076015b376fc81250dff89dff4b0a6
SHA512 6b24d0e038c433b995bd05de7c8fe7dd7b0a11152937c189b8854c95780b0220a9435de0db7ac796a7de11a59c61d56b1aef9a8dbaba62d02325122ceb8b003d
SSDEEP 1536:kHan8OG4wAM/Hh2JO9/s+S+pzpTzVs/tiTFVf77neJIYLw47Syt6xr:8an8OAF2JO9/sT+pzVVs/tYFVT7neJIh
TLSH
T1BE736B11A69011AAD2B3C07AC5634F23F774F4C1179597CF1264CA6E5F23782EE7AB82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\QUEUES~1\2415C3~1.1\libcrypto-3.dll
Size 5.0MB
SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
MD5 e547cf6d296a88f5b1c352c116df7c0c
SHA1 cafa14e0367f7c13ad140fd556f10f320a039783
SHA512 9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d
SSDEEP 98304:n3+pefu6fSar+SJ8aqfPomg1CPwDvt3uFlDCE:3G+u6fb+SJ8aqfwmg1CPwDvt3uFlDCE
TLSH
T1E6366A6AA7A80188E5BAC13CCA534617D6B1F816577097CF19A1967C0F33FDA2B3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\QUEUES~1\2415C3~1.1\libssl-3.dll
Size 768KB
SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
MD5 19a2aba25456181d5fb572d88ac0e73e
SHA1 656ca8cdfc9c3a6379536e2027e93408851483db
SHA512 df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337
SSDEEP 12288:ytPc2nnGoNg4kSHoxX09yO5EavUFe9Xb12:y9jnnpTHoxXUsFe9XbM
TLSH
T1CBF44B9DB3B8059CE9F6D13D86934623E3B6F4152370EBDB065186790F23BD52A3A348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\QUEUES~1\2415C3~1.1\select.pyd
Size 29KB
SHA256 bae0974390945520eb99ab32486c6a964691f8f4a028ac408d98fa8fb0db7d90
MD5 e4ab524f78a4cf31099b43b35d2faec3
SHA1 a9702669ef49b3a043ca5550383826d075167291
SHA512 5fccfb3523c87ad5ab2cde4b9c104649c613388bc35b6561517ae573d3324f9191dd53c0f118b9808ba2907440cbc92aecfc77d0512ef81534e970118294cdee
SSDEEP 384:oG0ICxeeLn0XHqYK/57AvB0KJIYQGFHQIYiSy1pCQuRWAM+o/8E9VF0NyMl+:tieOGHqlGxJIYQGp5YiSyvHAMxkEN
TLSH
T15ED28F57AF646845D923C9B2ACE28E1ADE31B6924710C2CB3368C15D1F317C27BB77A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\QueueSniper\2.4.1\_asyncio.pyd
Size 63KB
SHA256 746bc8fa88282afe19dc60e426cc0a75bea3bd137cca06a0b57a30bd31459403
MD5 07a6e6dcc30e1c4c7e0cdc41a457a887
SHA1 53bc820b63d88cbe889944e242b50662b4b2cb42
SHA512 837f1e40db9bdf1bc73b2a700df6086a3acdb7d52afc903239410b2d226ffd1dd5e8b5f317401bcf58dd042bd56787af6cdc49af96fcb588bcf0127d536b6c6d
SSDEEP 1536:/0f8MOytWQazE6XWpkJONIYOnsO7SyLzx1z:cf8X2sE6XWpkJONIYOndx
TLSH
T174538D83E2808595D957A074D8B30F56E771F6500B0403DE62A8D29E2F733229BFFB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\QueueSniper\2.4.1\_bz2.pyd
Size 82KB
SHA256 00b8ca9a338d2b47285c9e56d6d893db2a999b47216756f18439997fb80a56e3
MD5 aa1083bde6d21cabfc630a18f51b1926
SHA1 e40e61dba19301817a48fd66ceeaade79a934389
SHA512 2df0d07065170fee50e0cd6208b0cc7baa3a295813f4ad02bec5315aa2a14b7345da4cdf7cac893da2c7fc21b201062271f655a85ceb51940f0acb99bb6a1d4c
SSDEEP 1536:CX8z7RFgpNVu5eYu00NI5OhgYNxx8bhm+uVIYCVH7Symxs:CszlF+uyIkNxebhEVIYCVHL
TLSH
T190839E93E3605AF5E45B92B9A6A04357E331BE49035093EFF75883162F13F813D6836A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\QueueSniper\2.4.1\_hashlib.pyd
Size 63KB
SHA256 87dd0c858620287454fd6d31d52b6a48eddbb2a08e09e8b2d9fdb0b92200d766
MD5 b4ff25b1aca23d48897fc616e102e9b6
SHA1 8295ee478191eb5f741a5f6a3f4ab4576ceec8d2
SHA512 a7adcf652bc88f8878dae2742a37af75599936d80223e62fe74755d6bafaafd985678595872fb696c715f69a1f963f12e3d52cd3d7e7a83747983b2ee244e8a2
SSDEEP 1536:r5m8HQNUbaxjTvKzl9mjNLOjxNHeuNIYOIa7Syuxrm:r5m8H79mJOjPHeuNIYOIaum
TLSH
T174538E46A69544A4D96781B9CDA34F57E9F2F1001710ABDF0368C18D2F233C3ABFA766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\QueueSniper\2.4.1\_lzma.pyd
Size 155KB
SHA256 f5e01b516c2c23035f7703e23569dec26c5616c05a929b2580ae474a5c6722c5
MD5 b86b9f292af12006187ebe6c606a377d
SHA1 604224e12514c21ab6db4c285365b0996c7f2139
SHA512 d4e97f554d57048b488bf6515c35fddadeb9d101133ee27a449381ebe75ac3556930b05e218473eba5254f3c441436e12f3d0166fb1b1e3cd7b0946d5efab312
SSDEEP 3072:esdh8kZbsOb0Mt4zorT81qjznf09mNoqCPAaQVIYZ1Ncf:esdhBZbsm0hi78YOqtX6
TLSH
T122F33A92A394F4D5F7628C78D6624F17DBF678090310929A02CCC36D2B1FB759A2E727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\QueueSniper\2.4.1\_overlapped.pyd
Size 50KB
SHA256 ca106e4dfdeafeabf9e98956d3d8d0cb73e109f1a96f1a7e35bc47dbd7c7e164
MD5 78e8049e26df6fd3a4011562ff8e74a0
SHA1 d5a91c720e4672c40e1dd6d54b3197b4a1f8b633
SHA512 ea7a54d38cefed870cee65dd9460b6c51131ae5219933ddc998a86d12bb093784242cb5471c77bc324ccf59fa42c2914865dcf582f74c440fa52b7d15d9faeac
SSDEEP 768:OiqKtLpqCvqlB1QIb1D1N+gpOUpEkCZ9hIYXth5YiSyveAMxkEs:+KzqC/A1hNekCZ9hIYXtP7SyExA
TLSH
T193337B02670404DADD67C2BDD8735F16EA71B4D2470183AF52A8CA4A0F737C16BEEB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\QueueSniper\2.4.1\_ssl.pyd
Size 174KB
SHA256 ba5388d6a6557d431e086734a3323621dc447f63ba299b0a815e5837cf869678
MD5 0f02eccd7933b7a7c2bdedca2a72aab6
SHA1 0b4c551d8fe34d8128e5cf97daa19eb4c97db06e
SHA512 90a64082dab51380e05c76047ee40e259c719d7170fb4acb247b68a03b710461b350da3821b426fd13167895ded32f9c5ec0e07587ad4125683a18a3495f5ed5
SSDEEP 3072:mn5VVb4iZpIy+vgSf36XK7DapGB4JQELqOlh59YL48WKqgVl5pVIYC7Nb0CY:m5Vp4EaDD36XK7r4JkQY
TLSH
T10E047C47B59469B7E817E4FEC1230802EBB5F005331157CE49D6DA8A0F07746AEAAB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_http_parser.pyd

Path C:\Users\Admin\AppData\Local\QueueSniper\2.4.1\aiohttp\_http_parser.pyd
Size 246KB
SHA256 334cb4eedf73dbe9ab7660724054b09f96addf481d3ca618aa2b1325cb5c9548
MD5 b33a0135bc7e8b78a55aefcf1be6cb6e
SHA1 c2687c4cca51a7383261a180b2ea31568775f682
SHA512 0dad77f7295ab7f4105b8d6949b538d6c518649ee042a2961934930b1a4de80c5c836b2de56ef96efe3414f5abc4e89917509c5a375cf3818fbb9f98448e724a
SSDEEP 3072:0Bgyrvr3i6PcOiNQo/2v5DikMq1/eSyx8NAfSRcHjfIVtr+fJnjFRSbDojmrugud:SlcZ/cik2Syx8NO8cHjfct0B1jmrugu
TLSH
T187341B0692D54898F82B517C8C379502D7F3B4252B21EBCF1A60C557AF83AB277BC726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_http_writer.pyd

Path C:\Users\Admin\AppData\Local\QueueSniper\2.4.1\aiohttp\_http_writer.pyd
Size 44KB
SHA256 e874239a672641eb31797e14640ded883aa99c61c967e35918a2d7d22af53613
MD5 658acac0570f12d6e3fee5266f370f97
SHA1 250f6248603044ba04bd6c1ff9b594106568cf94
SHA512 b8babdb276ca710bad84e63a293576f784c4ea2aef06c185e0ae23a09b8e0c786afe1c9cd19888913e209801b888d621539987f49ff7cc4327e9d6d83196a658
SSDEEP 768:RYm0JBtmwIljTujm330Ylyz+72vQtElos5u1rtB6omQl:RF0JBtrIFTuq00yq79q2T6omQl
TLSH
T1B3234A56B29840A4E5978278C4336E07E2B1F0612B1517CF4764C2AE2FE37D67B7E362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multidict.pyd

Path C:\Users\Admin\AppData\Local\QueueSniper\2.4.1\multidict\_multidict.pyd
Size 77KB
SHA256 f92555975df808e8f4ba64e60af52ba32ccdebc69aa4dcca23d54d098dcb5d74
MD5 cc3dd3c7496aa3c67ca8d701ece89fcd
SHA1 7a4aea787ba1c81befcbc64b5697d217c6fb9703
SHA512 de6edecb2ffb6eb9fbffbe37696a7fcb2b37499df35afd66602ed0cd54fc9241912733ec7697ff0f9963424fe2d363bb88118d2c7668c2420b26bc20a681afcc
SSDEEP 1536:hdRRh3I8wFO410ijrA/rDow8OC/5RVBIOVukxyZ89oL8K:hdRH3Et1zrE/MOARVBIOVukxyGyr
TLSH
T153731756D1A810A4CAA780788C33AE12DBB6F04327152BCF0270DAAD1F57AE75FF9701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_helpers_c.pyd

Path C:\Users\Admin\AppData\Local\QueueSniper\2.4.1\propcache\_helpers_c.pyd
Size 62KB
SHA256 3947d0188c405d0425dfe4363a00f180eed28eb8839e518418c7eed96afee82d
MD5 13d55cd1c29a2f2443ec4fc69ac9edc9
SHA1 ac64b68935df11cefc6bb70138c347fc9d75200b
SHA512 5c2adfd299692cb8d37949aec49eba5868b36fc149bca2596249f3b175bcb7cc695319f720659774ef9b14bff5458c8a71df40685cff16d7352df78b63b617ec
SSDEEP 768:rOzxkGqxQdKrY6xTABxnfnPa7yV3+RuW5XV5g6tz4YQLTPsFjqg5m0k0:fGHdKZBsxnfnV8RHXL7ig5m0D
TLSH
T17A533A56A3984098D997913CC8336E53F7B1F411272066CF5360C69E1F62BE7A6BEB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\QueueSniper\2.4.1\python311.dll
Size 5.5MB
SHA256 0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364
MD5 387bb2c1e40bde1517f06b46313766be
SHA1 601f83ef61c7699652dec17edd5a45d6c20786c4
SHA512 521cde6eaa5d4a2e0ef6bbfdea50b00750ae022c1c7bd66b20654c035552b49c9d2fac18ef503bbd136a7a307bdeb97f759d45c25228a0bf0c37739b6e897bad
SSDEEP 49152:4kkzsT7AzjUaeLdj6UTSGKzuePQaOviRvYD4Kus0GYr3jDKPpWjrM06biCnCIS7E:wsgreBltVe1EsJ5CrSQHyMAwdp09U
TLSH
T146467C22B2609460C9BB4172DB2F865ACB71BC505F10CF0B51A4B7AA2F73B531AEF745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\QueueSniper\2.4.1\unicodedata.pyd
Size 1.1MB
SHA256 37c68617fa02a2cadced17ef724e2d450ef12a8a37215da789a4679fde1c5c02
MD5 fd9132f966ee6d214e0076bf0492fb30
SHA1 89b95957f002bf382435d015e26962a42032cb97
SHA512 e35729abc45e5561aae1fb9e0e7c711dd7d3c1491520aa5c44fcc50c955f549f81d90897959327e930d02a5356afe08d6195adf002c87801a7a11235670639b5
SSDEEP 12288:bdYbfjwR6nbYonRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eD85U:RYbM10IDJcjEwPgPOG6Xyd4685U
TLSH
T195355BC9BB828D66D87B31B944D2212F1361C273476B133BB65513285C8B3B74EE69EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\QueueSniper\2.4.1\vcruntime140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
TLSH
T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_quoting_c.pyd

Path C:\Users\Admin\AppData\Local\QueueSniper\2.4.1\yarl\_quoting_c.pyd
Size 79KB
SHA256 e76fbdd98dbaed77baaccd32299c7b86394a6caf6255505d468421803e31faa2
MD5 42a5e41621bddd5c65eb8f160acaaae8
SHA1 4cf1f84eb347d37ee0a6398eb6e21dda3aeeb817
SHA512 5b0cd2e323bea509f40ac2cd0cd90d81f6cc418c864244aa0f25fde95275f8c6f99a9b9b6775b91d39ac33fa1cf926b42d8ce23b7e5fa6cff4ea02ead48db754
SSDEEP 1536:rJAeIqSZFumByL5L3R8GRB7mrlH2x0229H933qx4A6jE6wmtp88gn:rJAeDSLBkaGbo0xWlqxA4hmtp88gn
TLSH
T10B835C1A62D400A9EAA791BCCC335913EB71B4512B046BCF4360C6952F63BE67FBE741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/760-1483-0x00007FF7BE5F0000-0x00007FF7C1ADD000-memory.dmp

Download

memory/764-1559-0x00007FF6EE450000-0x00007FF6F0473000-memory.dmp

Download

memory/920-1484-0x00007FF73DBD0000-0x00007FF73F2BE000-memory.dmp

Download

memory/1736-1601-0x00007FF7BE5F0000-0x00007FF7C1ADD000-memory.dmp

Download

memory/1736-1565-0x00007FF7BE5F0000-0x00007FF7C1ADD000-memory.dmp

Download

memory/1736-1558-0x00007FF7BE5F0000-0x00007FF7C1ADD000-memory.dmp

Download

memory/1736-1591-0x00007FF7BE5F0000-0x00007FF7C1ADD000-memory.dmp

Download

memory/1736-1486-0x00007FF7BE5F0000-0x00007FF7C1ADD000-memory.dmp

Download

memory/1736-1612-0x00007FF7BE5F0000-0x00007FF7C1ADD000-memory.dmp

Download

memory/1736-1614-0x00007FF7BE5F0000-0x00007FF7C1ADD000-memory.dmp

Download

memory/1736-1616-0x00007FF7BE5F0000-0x00007FF7C1ADD000-memory.dmp

Download

memory/1736-1621-0x00007FF7BE5F0000-0x00007FF7C1ADD000-memory.dmp

Download

memory/1736-1639-0x00007FF7BE5F0000-0x00007FF7C1ADD000-memory.dmp

Download

memory/1736-1641-0x00007FF7BE5F0000-0x00007FF7C1ADD000-memory.dmp

Download

memory/2200-1485-0x00007FF73DBD0000-0x00007FF73F2BE000-memory.dmp

Download

memory/5504-1560-0x00007FF74BE30000-0x00007FF74D02B000-memory.dmp

Download