3d6a244bc024356666ec8dd16055f7a89703699a0544abfb1459ae49eae2d4f8

Analysis

user interaction
yes
max time kernel
167s
max time network
169s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 06:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
releases.html
Size 460KB
Sample260822-hhaj1ssblh
SHA256 3d6a244bc024356666ec8dd16055f7a89703699a0544abfb1459ae49eae2d4f8
MD5 bdc1fd4c7fb47ecc278c79c0ca6feee4
SHA1 1a9a70f8f7c43d33abbbf2e7d9fc5e1f990d2f0a
SHA512 cc1bdeba4e2ba2cea0529c85b25f52305da243286e24ebda70d37ccad4766576a8239dc13dc986718a1e63c978c2e4009885d3603ed87ee99a9e960363189116
SSDEEP 12288:QUyOSaM72UREMj82NitCvWdpwmOJ4XP2RcrPxGxmMVIy+Qx4tgTZ39td6m/P6YTt:QUhi5
TLSH
T161A4D771B0F0A17D41AB42CAB5B1AF00D3A6E687C74615D5B02EC2F84BD3C95FA632D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
144	5784	msedge.exe

Executes dropped EXE 2 IoCs

pid	Process
2464	antimicrox-3.6.1-Windows-AMD64.exe
4220	antimicrox.exe

Loads dropped DLL 19 IoCs

pid	Process
2464	antimicrox-3.6.1-Windows-AMD64.exe
2464	antimicrox-3.6.1-Windows-AMD64.exe
2464	antimicrox-3.6.1-Windows-AMD64.exe
2464	antimicrox-3.6.1-Windows-AMD64.exe
2464	antimicrox-3.6.1-Windows-AMD64.exe
2464	antimicrox-3.6.1-Windows-AMD64.exe
2464	antimicrox-3.6.1-Windows-AMD64.exe
4220	antimicrox.exe
4220	antimicrox.exe
4220	antimicrox.exe
4220	antimicrox.exe
4220	antimicrox.exe
4220	antimicrox.exe
4220	antimicrox.exe
4220	antimicrox.exe
4220	antimicrox.exe
4220	antimicrox.exe
4220	antimicrox.exe
4220	antimicrox.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 47 IoCs

description	ioc	Process
File created	C:\Program Files\AntiMicroX\bin\libgcc_s_seh-1.dll	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\share\antimicrox\gamecontrollerdb.txt	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\share\antimicrox\translations\antimicrox_ko.qm	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\share\antimicrox\translations\antimicrox_pt.qm	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\bin\Qt6Gui.dll	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\bin\platforms\qwindows.dll	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\share\antimicrox\translations\antimicrox.qm	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\share\antimicrox\translations\antimicrox_es.qm	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\share\antimicrox\translations\antimicrox_ja.qm	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\share\antimicrox\translations\antimicrox_nl.qm	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\share\antimicrox\translations\antimicrox_ta.qm	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\bin\Qt6Core.dll	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\bin\Qt6Network.dll	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\bin\antimicrox.exe	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\share\antimicrox\translations\antimicrox_br.qm	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\share\antimicrox\translations\antimicrox_ca.qm	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\share\antimicrox\translations\antimicrox_da.qm	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\share\antimicrox\translations\antimicrox_en.qm	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\share\antimicrox\translations\antimicrox_fa.qm	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\bin\libssl-3-x64.dll	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\bin\libwinpthread-1.dll	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\share\antimicrox\translations\antimicrox_rue.qm	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\share\antimicrox\translations\antimicrox_sk.qm	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\share\antimicrox\translations\antimicrox_sr.qm	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\share\antimicrox\translations\antimicrox_tr.qm	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\Uninstall.exe	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\share\antimicrox\translations\antimicrox_de.qm	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\share\antimicrox\translations\antimicrox_fi.qm	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\share\antimicrox\translations\antimicrox_it.qm	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\share\antimicrox\translations\antimicrox_pl.qm	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\share\antimicrox\translations\antimicrox_ru.qm	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\share\antimicrox\translations\antimicrox_zh_CN.qm	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\bin\libcrypto-3-x64.dll	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\bin\libstdc++-6.dll	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\share\antimicrox\LICENSE_SDL_GameControllerDB	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\share\antimicrox\translations\antimicrox_id.qm	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\bin\Qt6Widgets.dll	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\bin\SDL2.dll	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\share\antimicrox\translations\antimicrox_cs.qm	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\share\antimicrox\translations\antimicrox_hr.qm	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\share\antimicrox\translations\antimicrox_nb_NO.qm	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\share\antimicrox\translations\antimicrox_sv.qm	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\share\antimicrox\translations\antimicrox_vi.qm	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\bin\Qt6Concurrent.dll	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\share\antimicrox\translations\antimicrox_fr.qm	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\share\antimicrox\translations\antimicrox_pt_BR.qm	antimicrox-3.6.1-Windows-AMD64.exe
File created	C:\Program Files\AntiMicroX\share\antimicrox\translations\antimicrox_uk.qm	antimicrox-3.6.1-Windows-AMD64.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5784	msedge.exe

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	antimicrox.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	antimicrox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	antimicrox.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	antimicrox.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	antimicrox.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	antimicrox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134318546393386858"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{5FD198B5-1756-42A8-B7E5-1AC3666DA5CA}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4220	antimicrox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5740	msedge.exe
5740	msedge.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4220	antimicrox.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4416	taskmgr.exe
Token: SeSystemProfilePrivilege	4416	taskmgr.exe
Token: SeCreateGlobalPrivilege	4416	taskmgr.exe
Token: 33	4416	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4416	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4220	antimicrox.exe
4220	antimicrox.exe
4220	antimicrox.exe
4220	antimicrox.exe
4220	antimicrox.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4220	antimicrox.exe
4220	antimicrox.exe
4220	antimicrox.exe
4220	antimicrox.exe
4220	antimicrox.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe
4416	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4220	antimicrox.exe
4416	taskmgr.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 2820	4252	msedge.exe	89
PID 4252 wrote to memory of 1924	4252	msedge.exe	90
PID 4252 wrote to memory of 5784	4252	msedge.exe	91
PID 4252 wrote to memory of 1924	4252	msedge.exe	90
PID 4252 wrote to memory of 1924	4252	msedge.exe	90
PID 4252 wrote to memory of 4156	4252	msedge.exe	92
PID 4252 wrote to memory of 4156	4252	msedge.exe	92
PID 4252 wrote to memory of 5520	4252	msedge.exe	94
PID 4252 wrote to memory of 3068	4252	msedge.exe	93
PID 4252 wrote to memory of 5520	4252	msedge.exe	94
PID 4252 wrote to memory of 5520	4252	msedge.exe	94
PID 4252 wrote to memory of 3068	4252	msedge.exe	93
PID 4252 wrote to memory of 3068	4252	msedge.exe	93
PID 4252 wrote to memory of 3720	4252	msedge.exe	96
PID 4252 wrote to memory of 668	4252	msedge.exe	97
PID 4252 wrote to memory of 3720	4252	msedge.exe	96
PID 4252 wrote to memory of 3720	4252	msedge.exe	96
PID 4252 wrote to memory of 668	4252	msedge.exe	97
PID 4252 wrote to memory of 668	4252	msedge.exe	97
PID 4252 wrote to memory of 5908	4252	msedge.exe	99
PID 4252 wrote to memory of 5908	4252	msedge.exe	99
PID 4252 wrote to memory of 6084	4252	msedge.exe	100
PID 4252 wrote to memory of 6084	4252	msedge.exe	100
PID 4252 wrote to memory of 1448	4252	msedge.exe	102
PID 4252 wrote to memory of 2224	4252	msedge.exe	106
PID 4252 wrote to memory of 2424	4252	msedge.exe	107
PID 4252 wrote to memory of 2852	4252	msedge.exe	108
PID 4252 wrote to memory of 3540	4252	msedge.exe	109
PID 4252 wrote to memory of 3540	4252	msedge.exe	109
PID 4252 wrote to memory of 3540	4252	msedge.exe	109
PID 4252 wrote to memory of 6076	4252	msedge.exe	110
PID 4252 wrote to memory of 6076	4252	msedge.exe	110
PID 4252 wrote to memory of 4808	4252	msedge.exe	111
PID 4252 wrote to memory of 4808	4252	msedge.exe	111
PID 4252 wrote to memory of 4808	4252	msedge.exe	111
PID 4252 wrote to memory of 2960	4252	msedge.exe	112
PID 4252 wrote to memory of 2960	4252	msedge.exe	112
PID 4252 wrote to memory of 2520	4252	msedge.exe	114
PID 4252 wrote to memory of 2520	4252	msedge.exe	114
PID 4252 wrote to memory of 2520	4252	msedge.exe	114
PID 4252 wrote to memory of 2644	4252	msedge.exe	115
PID 4252 wrote to memory of 2644	4252	msedge.exe	115
PID 4252 wrote to memory of 2644	4252	msedge.exe	115
PID 4252 wrote to memory of 1684	4252	msedge.exe	116
PID 4252 wrote to memory of 1684	4252	msedge.exe	116
PID 4252 wrote to memory of 1684	4252	msedge.exe	116
PID 4252 wrote to memory of 4460	4252	msedge.exe	117
PID 4252 wrote to memory of 4460	4252	msedge.exe	117
PID 4252 wrote to memory of 4460	4252	msedge.exe	117
PID 4252 wrote to memory of 1140	4252	msedge.exe	118
PID 4252 wrote to memory of 1140	4252	msedge.exe	118
PID 4252 wrote to memory of 5952	4252	msedge.exe	119
PID 4252 wrote to memory of 4456	4252	msedge.exe	120
PID 4252 wrote to memory of 4456	4252	msedge.exe	120
PID 4252 wrote to memory of 2464	4252	msedge.exe	121
PID 4252 wrote to memory of 5740	4252	msedge.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\releases.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ff8900fc188,0x7ff8900fc194,0x7ff8900fc1a0
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,8697202871185864170,3810461801318760480,262144 --field-trial-handle=2236,i,12444557593670894121,13341766410718349554,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,14708549352861967105,14212329715825163670,524288 --field-trial-handle=2236,i,12444557593670894121,13341766410718349554,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2308,i,11518422052910233906,11467680063284948165,524288 --field-trial-handle=2236,i,12444557593670894121,13341766410718349554,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:13
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,15972920471347084693,8322084323935690383,2097152 --field-trial-handle=2236,i,12444557593670894121,13341766410718349554,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,9654019178155946397,4962446624001731742,2097152 --field-trial-handle=2236,i,12444557593670894121,13341766410718349554,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4320,i,1204767258728975609,11427171406335657330,2097152 --field-trial-handle=2236,i,12444557593670894121,13341766410718349554,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,14917538748992105253,17702816408549199493,2097152 --field-trial-handle=2236,i,12444557593670894121,13341766410718349554,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:9
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,3840731265442201756,5436884442540550210,524288 --field-trial-handle=2236,i,12444557593670894121,13341766410718349554,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3876,i,8352825747295444442,14591236145582018445,524288 --field-trial-handle=2236,i,12444557593670894121,13341766410718349554,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,16675650987640356982,6650702254569964785,524288 --field-trial-handle=2236,i,12444557593670894121,13341766410718349554,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,16675650987640356982,6650702254569964785,524288 --field-trial-handle=2236,i,12444557593670894121,13341766410718349554,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,5993340665503614573,12826982446665725278,524288 --field-trial-handle=2236,i,12444557593670894121,13341766410718349554,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,14456610429506883462,5468515053456766747,524288 --field-trial-handle=2236,i,12444557593670894121,13341766410718349554,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,5417498755516101881,14089519341396495068,524288 --field-trial-handle=2236,i,12444557593670894121,13341766410718349554,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:14
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6516,i,1094620972303758384,17606226561227073262,2097152 --field-trial-handle=2236,i,12444557593670894121,13341766410718349554,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,1662988985382299059,8254394948965694504,524288 --field-trial-handle=2236,i,12444557593670894121,13341766410718349554,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3640,i,1734952433833036499,9954533845640333762,2097152 --field-trial-handle=2236,i,12444557593670894121,13341766410718349554,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,18193512870980026316,15525335695918553730,524288 --field-trial-handle=2236,i,12444557593670894121,13341766410718349554,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:14
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5164,i,448749278599580735,13982695575772071378,2097152 --field-trial-handle=2236,i,12444557593670894121,13341766410718349554,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6832,i,8707610726654378220,14474517530354512324,2097152 --field-trial-handle=2236,i,12444557593670894121,13341766410718349554,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6988,i,7547182349900725871,5355590030779877097,2097152 --field-trial-handle=2236,i,12444557593670894121,13341766410718349554,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6944,i,7528005195489037887,7371764692467308669,2097152 --field-trial-handle=2236,i,12444557593670894121,13341766410718349554,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,14485761914389013150,1125531156692105069,524288 --field-trial-handle=2236,i,12444557593670894121,13341766410718349554,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:14
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2852,i,1752288263519398887,2128938691104143258,524288 --field-trial-handle=2236,i,12444557593670894121,13341766410718349554,262144 --variations-seed-version --mojo-platform-channel-handle=7428 /prefetch:14
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7588,i,978517932505291277,705944976368087050,524288 --field-trial-handle=2236,i,12444557593670894121,13341766410718349554,262144 --variations-seed-version --mojo-platform-channel-handle=7596 /prefetch:14
  2⤵
  PID:4456
- C:\Users\Admin\Downloads\antimicrox-3.6.1-Windows-AMD64.exe
  "C:\Users\Admin\Downloads\antimicrox-3.6.1-Windows-AMD64.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5920,i,16833092574795876423,11615926124223450352,262144 --field-trial-handle=2236,i,12444557593670894121,13341766410718349554,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5740

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4764

C:\Program Files\AntiMicroX\bin\antimicrox.exe
"C:\Program Files\AntiMicroX\bin\antimicrox.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4220

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4416

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:3348

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Qt6Core.dll

Path C:\Program Files\AntiMicroX\bin\Qt6Core.dll
Size 10.6MB
SHA256 96e502f8245cd32b0360017a78f766193b4600db2fc9f8d2e98906f52f517692
MD5 8e11da0c662282aad590877070c3492c
SHA1 a9802894103266af5a9b688606c4e7b8a677e934
SHA512 4dc2d75327ec171e8986ab48fa7661e747a12f57896f904bb98607ea6d5bd21f7e4d9b7bf770dc64675a2f98c80925674889b5f10e4a7608ad6cf1810779ea06
SSDEEP 196608:IVFGpZQS+V31ONlhjHcfi8VxypFE2dxwuhWCAV+2wFYWEo8Qae7cM8P2F55m1Ij7:IVFGpZQS+V31OXhjHcfi8VxypFE2dxwy
TLSH
T145B65D03E6F71059F5FFD63086B762726B327C4A56346A2F0244B6341E72F60AB36726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Gui.dll

Path C:\Program Files\AntiMicroX\bin\Qt6Gui.dll
Size 10.9MB
SHA256 f538e4db3790070f14ac473a8142c9780e923333e52efb84a0cc5a2634d7898b
MD5 7318d5367aeb18251cfec3d8a78ee002
SHA1 187a7affe6266b4330613798faa3a9c78b3cdd58
SHA512 16a6372a430bf9501fd27a0270ae14e505e48f247a5c1c5e0a3841b0016e1f008d9075405bbd8d34d05d1f8f2b0d40d88d6b7da1fcded93fb8d93a851be047d6
SSDEEP 196608:Ypc8ZJ8EqYWzIzesSpAc+NcAQK8T+5jhQABjCXzc72hDKTVJqeJFOUc45SM/TL/o:YpckJ8EqpzIzeD8NcAQK8T+5jhQABjCv
TLSH
T13DB65B57E26260ECC02FC135476BA633B931785912387E6F5290DB392FA2F50637EB19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Network.dll

Path C:\Program Files\AntiMicroX\bin\Qt6Network.dll
Size 1.9MB
SHA256 a6a8d347584f7f01c733ff7b97396754aa29d166b11007eef68053c3926f338b
MD5 5c781757ad83dfd9d2dadf4a78c155fa
SHA1 c4c7cf03d409a5888cfdc6ab29f71240b6278746
SHA512 f20eac327175250d0ff337dc5eeb472af56f140f2a85b4fc69de8f3622d5738c876e382f6919bb2033f4ddb9e787e02cf851e8c5b6f1b2c9784df0693b711b9e
SSDEEP 49152:2/gviaBB8npXRXqnrxVho+bYgSohwvhaaUEJEV6YUPHhPSEq/JxmDwbmfKDIAFLX:kPaB/nrxVho+bYlohwvhaaUEJEV6YUPe
TLSH
T182951863F26224ECC46BC1398657A233F831785912787E6F1654CB362FA1E6063BE75C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Widgets.dll

Path C:\Program Files\AntiMicroX\bin\Qt6Widgets.dll
Size 6.8MB
SHA256 d2fc4c60c55612d34c0b563bdffa89f4cd59ef98e7f326103406d568bfb53d18
MD5 311450b93f3739ff27fcd708bca13848
SHA1 fe89b90a57ade28950963f59579dccf9dfe52b17
SHA512 1a7a4eda590bd75fa0f0617df4c6f9099017c4fe2a6e4f3d4cb3ede022d33029a90b8a6030313f7dd3b6d391faad41895fb04427483d00dc59c25dae1547b3d4
SSDEEP 196608:E73axGarqbOXZ2sBvHbVfRAcSIisk4IvLABHBBkI+SMHz/fA4eDSVVlIf98HicLi:1xGarq6XZ2sBvHbVfRAcSIisk4IvLABL
TLSH
T12E763953E2E224ECC06FC538475BE273B931785912347E2F5694CE362FA1EA0227E759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDL2.dll

Path C:\Program Files\AntiMicroX\bin\SDL2.dll
Size 2.3MB
SHA256 47a3b27654832d9f7e5719c88078210a3dbfd6407b559c5a3c4eb8ab7d0ebdb6
MD5 4e1049d07476ccbb0b4ea38a4b7aff29
SHA1 81ef0cebd14744e0c48295ce211d4dea395479bf
SHA512 e582c8b253bad2959a98cba40b4280e7b51706f79876ddb1fc633d892a836b2b2c64d2ce561641f9487cc3f34e49641625158523156d3c490bbab9292e9d9ca5
SSDEEP 49152:mPvZQ3FhUECtYSw6wsFp60k3IJrujvH6LBVo0VsDZCu92+edBMSevj1l:m3cycv6wj0k3IJrujvH6LBK0Vs9fsdBY
TLSH
T163B56D6EF2A365ECCB17C031825ABB72BE3178581194ADBB16D4CB301E72E50566FE34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

antimicrox.exe

Path C:\Program Files\AntiMicroX\bin\antimicrox.exe
Size 5.3MB
SHA256 0607f3d3df50b2a9b06517d36b7c5657f200acd135edd7d0e8ec9f61b8ef66a5
MD5 9be0a85a51724ea80e83f308bce841c4
SHA1 13ebf6066cbe8c401ce8759fb876ed816d7c0e25
SHA512 ec7b0fe50c573f2318bf35fc0802d63960ff3dc1b6bbe6c23fd7b7581719f2554fbb36e0a3af7da58d0f31b7cc4298ff76730a354726db12ef0ac65886abd998
SSDEEP 49152:wLcXMS/V0o0wXqpRD7z4Lbc0kbx2t/Tmfnvkh9eW566+OQFbDkYEZVUlxj7p7Io6:PMS/V0nP4LQ06Wp5DQFkYEt4iS4X
TLSH
T1C1463B92F55F64EED927D23E86979332FA707C994231FF278200EA322E51BC4664D718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgcc_s_seh-1.dll

Path C:\Program Files\AntiMicroX\bin\libgcc_s_seh-1.dll
Size 148KB
SHA256 278f1101f2371c58b6b412a3206718e22343940a5164aceb4fb75f2bf3b38ed4
MD5 7c898cec516140f6ec8bb085aa2c49d2
SHA1 d0f9c136cc518b989c34ff7e25d18e4b9db429f7
SHA512 4d75f719cd99d125bfa9bd0e910f935071be69b051ce5749fc6e40d172d8e253ce1d80c063626dbd9f34b4851b581e0a433754bd9320e880de56eb21dc9b8f5b
SSDEEP 3072:ow+y6q68B9QwURE3MYjbFBlHAYzvf1P3gJa5pYdF6:owRUHMpDT/2tdF6
TLSH
T12CE31852F59360B8C697E2709A839FB1EC33BC740320A8771799FA346CA2F819A5D751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libstdc++-6.dll

Path C:\Program Files\AntiMicroX\bin\libstdc++-6.dll
Size 2.5MB
SHA256 3529d11c422b2aaf0bbad7221bf62ba7b5a39f854e89a015bb58b6b55a677da1
MD5 897ab3e7965f64f0a8723a7d997fee42
SHA1 8a5c8d3bc8402a19e59f68a0ff72dadf32e9fb31
SHA512 ac093900df6f2be09eb00414d6490bf10601ce0ad2129a671f7017847c05a71e3ef955b98c2c267899a050a6c2f433b1f08e6fe9a13414ea09c5b9b9257e8182
SSDEEP 49152:wRFD7uoUcTdzyfohk0rnDvgoKTdHgAd7SSoAUjJQYPkiFcPrQY:wRVyibKTdHcLQMkiFcPrQY
TLSH
T183C56C03E5930CA8C9E7E7B4525B5736EA20BC1989387D7F5E9CC7306B62E40562FB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwinpthread-1.dll

Path C:\Program Files\AntiMicroX\bin\libwinpthread-1.dll
Size 63KB
SHA256 f7d57886d46b8065f8a7951c5ec8fe52d97a0f55b165c3d0c733854119b5803f
MD5 ee90617e9fe6b4d1e4d1bb533f56dd1a
SHA1 0e5f87fb8dffdc28a36b211673c3ed1339202127
SHA512 a7c08f561223c98edd02fbc1812f7b3ec802d5f716126764b56b0f97332ddaa98f226f1e22d45382cb64fcd46fae577ac0ff0ccc2e2b32139b30eb89f16365a6
SSDEEP 768:Goq1vUQRJMT6sIhMsp41S7u1cFsmGTqeqtLJPANpPPQTU6PdLw34:kbk3sRuayhTqtYPPQTU6tw34
TLSH
T15753191BB3A614FDC6A7D13885F74B71F533B8111239AF2E9764D2362F38E21892D894
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Program Files\AntiMicroX\bin\platforms\qwindows.dll
Size 1.2MB
SHA256 01b9e080285424a3d9f256115e568e5de2960b09eece08ea179cb710506caea3
MD5 b8bc01cdf4d1a888eb043343d1a2d705
SHA1 ad1fd12a6899e5bc2aa43cacc71ff05f64966fee
SHA512 8c0da26a050a51d4aefdeddadf4726ce0da25b417ab66265da5f7ffd8de61937d17f30ac1bb8c1454782edb846d84307177acd39deef0434dabfea1c99c5c979
SSDEEP 24576:5Ep4wrWCITV/l2dJqlAqizdmtBsKSJ6Ak5EWWFbx39YKZq7BN/d7mC0P9A8:6VrW3pIdJqlAqizdmtBsKSJ6Ak5EWWF9
TLSH
T157451937E26260ECC06EC27946979A737931784D02747E1B925CDA367F91FA063BE318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gamecontrollerdb.txt

Path C:\Program Files\AntiMicroX\share\antimicrox\gamecontrollerdb.txt
Size 211KB
SHA256 e5db024d0ae23d5fa157b2d17e2d5fcd40360a08507b828a67d0215daf3e3d2b
MD5 e102c0365b4bb9f0e783ca5165ad0e34
SHA1 e107fdd64c3802882c657d7737757f833fce04b5
SHA512 a5df53e214f05f22b19065f72a404aa76e4ab8ddbc22c76bca82484246e9cc516e076b1c2c08a3d5ad6bc25a08f959707e8b4b3fd5c6ae8caad519015c33c270
SSDEEP 1536:XrGl0QtOVAS6tUsTt2K14VQnF39EsTNMKZAf2rd8d/hr5uEQ4iL3M8+1yPB1sn4q:610
TLSH
T1F124292867B64A0FCF2F4573C7CFF961587BB08C39DB545C7E950CE97D25A628088A28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

antimicrox_en.qm

Path C:\Program Files\AntiMicroX\share\antimicrox\translations\antimicrox_en.qm
Size 128KB
SHA256 a886c306b4b881d6a7387efdaa9b9af93e756841a945118be9b0bf8db7799e57
MD5 32457ad8fff3cc062ea821da3f5c3f7d
SHA1 09d770f74fdc2e207e0f3f2b0b2a7e4fccb286d3
SHA512 a60089b57f761325e0e453655d415ef101d4567efb4be490e600d111d8af64da41d7b71d41fda32ad200dc77962a64facf19669ae845a147de4cf34d31989881
SSDEEP 1536:GIlBM2i/LIQ1u3qkwu6fRz/HB7QkHYi3OSoEgcrD:jM22LIQoobB7QmYieSoExD
TLSH
T189D30D8123FC121DFAF63FB86A3703118F76B865AA31D75F5254A07D0460A48CEAB767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AntiMicroX.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AntiMicroX\AntiMicroX.lnk
Size 1KB
SHA256 56c8932d1efa530b317251c0ff1f487321060d0d1379ad6621c79b9f868e399f
MD5 7e478fb94a18f2c52c414c185b00b9eb
SHA1 f2159e66bab56f6d600c07b6ab811742905069b7
SHA512 b1f0e5f65a84c62fcd3eeb61150f5d6e6d15fcda1235e094509ee362f617bb2c8a18312d602accc61d0451aabfdef638de0d1c7adb41efc9d0c35b58b41f1616
TLSH
T16A21CE1E0BA92B3FE7E2C13646911E258737FE4AF3A84B1510D5534848B0600AC59F6F
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 2bda03fa7b962952462463e2b693f0e1b52240dfb7d4c38ef8b40f4a27e576e7
MD5 d1593eae4405f1295475f12e6ebe4e59
SHA1 5b00327a16036a49c656789c0308008cfb811329
SHA512 da3c3b7c7999ab5053101e3b030bc2f0cdb7ea97b29d6355c08b38d52e59578bac20c3269fba5fe64189c2f25642f34e4edcfc7f29fd0ed77c45605c428d6029
TLSH
T139511D234332C9F1D769C4BAD0E35A5A32F8B8D946076E315C409EB06D26F25F5EC263
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 c4a0fbfdc0ae7d56effa69b907e87215b81984a8165268f48a1f7b5a89477e28
MD5 34759ac820734f00e838f87b4f451af3
SHA1 1ee121d33e19c9d796d7d11fd0fb7e27a3bfccc2
SHA512 23058df2975e17d0b275b37b7f4faa599612974417da6b79646223cd53f2f6ffd131808a5cbacdcbf0cadb499b8fd07fa588f67e16aea6d6106fdd99e9a2eab5
SSDEEP 96:vVa0oUJjURziMoKP96fvpqa9H6rL2E7pS:vVa0oUGJiM7sorCE7pS
TLSH
T104C14012523E83A0EF598CB990D28D1E32F9748D442F5E3908821F7BDD12F65A2EF253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59a57d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a57d.TMP
Size 2KB
SHA256 01f8d067c9fa98f85468629b88dde2d99fad2ef7a0f2ae24fd86547559391ac0
MD5 9a50ed277a3201c9ac2a65241eb0b869
SHA1 43e27ecd77c74a79308363b6c072d913540dfcd9
SHA512 2a69f2d595e37606f4bee2fa9fffb35af8d0e98680f4fd898aa56d8e240aa0051651f933d9c098d419c62195f50692d5d54c083b4fb0b9f66e65f29c578a3d51
TLSH
T18C511D234336C9F1D769C4BAD0E25A4B32F8B8D946076E314C005EB06D26F25F5EC263
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 03cbc9230080d97a17c215c6244d891bbd4cfcab77f8361a7fb1536b825e05dd
MD5 d821e2467cfc356d2963f349503bbc6c
SHA1 85cc9a6f4895e681dceaed828efaa1ed4d174080
SHA512 40753fa5c8091add19807e2dc7e016355a398943027866865a593869345ad644cf217d2b9024f3aff12b51365da38e9afb2a8dff88788e80ead40212d3bce1f8
SSDEEP 96:D1OWPoJmdtVaZaiVzBKPcK9x1O/vEBmrmnBw1smD0mtmO+mH:D4WgJmXVaZaiV1KPcQHO/vgmrmBAsmD7
TLSH
T10BA18EF787F5866D8A1255F0EA18AE1BCE2C0515831C7C6A88E07E17D3F2871E141B5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 2bc5b60d0fc7da70196995401e42a1c908bdd6ed6a29ea303118296c14bd25fa
MD5 4b5d998a8e6bb4277d35099cb44d38b4
SHA1 194d1eef9517941c82f77d5444baae146ee951d5
SHA512 d271fc30f91a01f215b602fbc1d37285f44ec73c424239d6d61fce5c19cd8a9ccc142dc3805e4b28e56ea04e7688b8f361934f9d350ced733ee40161af035ca9
TLSH
T15D7180F783F4866ECA1155F0EA186E1BCE2D0516831C7C5AC9E4AE1B93F2471E141B9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 353be77d3a666a3e04efc481c760c03e80e650899282bd23409ff530bbe9a886
MD5 84d34cc6f42a44905ab3a7b654d6f45f
SHA1 672f07a72d0c972749fee47ce607f5779e0e0256
SHA512 d0c3c96251f133f5e7345560d3f1842fd9e6e53591a48150b91c735e9d86e5ca8864abe7eb03a2d79139dd36cf1be5b957a5454aa831c79279c2ef85ab54a52d
TLSH
T146D0A9A31348A0B5A6EE2EA2696BE88F832700240806ADD95090A89D0521A6C1A47243
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 56a4673095e5794a6abf532e638b8576be6c63b13f8c12c1a17aebf4d9950487
MD5 ecce76ad070e5d70e4cabf5a28b6dcb6
SHA1 91a81b6884f37afddea3f9d7284933181d12ca23
SHA512 60efeb48fe2ce3000fb3ea82a6aabfbe2509a25d9a939e3ae588de8ad8389764f21f99f6700fc102e675941f19056a3aa1cf62bfa14c7b44aef0145199b39115
SSDEEP 192:sxR8RHbb/fdspVZKHm2Sm7aESzoD8p4Y/g6+WNIY3IAmGEGIgDlJ:sxR8Vb/fdsr82F5/5Ip+b
TLSH
T1E942C7156A28A97B9CCBE219BA55BF53E6FD503261D42F48ABFC861C00E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 469080011e7980704caf8666a529b9bdff65c4e1ea313dc3b5b589b6457389fc
MD5 17764f93f1c2de83955dba94c2440199
SHA1 9e74fb55681af09cf75c22b8efebd9880ec096af
SHA512 ba22b7e561eeefcf1548349d4ea45977cd7f75811738f4bc1da8dcc2d15e50f715a1fe986cd2f127797a16c90c534aa7a5b2a47aa85b9e993524805eba92334e
SSDEEP 192:sxRzRHbb/fdsRVZuHm2Sm7aESzoD8p4Y/g6+WNIY3B2OmGEGIgIJ:sxRzVb/fdszU2F5/5IAQ+s
TLSH
T1E432C7156A28A97B9CCBE21DBA257F53D6FD503261D02E48FAFC861C04E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 06700a2b900dc1f95f1601ff169afa0cb92bff8624e784026eb5d291ab80ce6e
MD5 2bec2cd70308f83fab5f8fd6ea2f9a89
SHA1 987214367862bedc48bfa7e3e40792bdf8128076
SHA512 8e999ceb279f62247abe6b9874d8ff9726f8511ff2c0805684905f875e2b6780faa14acc14a43d45ed6e4e885a6e74f128d11dc16322362126153e4e8c9321ad
SSDEEP 192:sxRIRHHcB1b/fdspVZKHm2Sm7afPFoD8pwEKyRE/g6+WNH1H8/Y3RAmGEGIgDYap:sxRIJm1b/fdsr82T4/5C/e+mnG
TLSH
T12A62D752591499BB9DCBE21ABE31BF53D7FD102295911F4CAAFCC51C00EB6ED220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ad4ab9d5a34c1e74c90717acfecd7426ebea6a488b02e7e9f6a75bb8a32aa635
MD5 67b12d95b2d81b6a95f9f9223f508832
SHA1 9352e357df59651a727669c9d3c0981570fcde7e
SHA512 906f8b7813d3e3a5028c98311a113f45f339d1cd1a71d85ef011a53b69c897d416739a0db7cd3b088347395c1268e071df57dc5b743bdbe8d0e87fcc95a2ff6b
SSDEEP 192:sxR8RHbb/fdspVZuHm2Sm7aESzoD8p4Y/g6+WNIY3B2OmGEGIgDjJ:sxR8Vb/fdsrU2F5/5IAQ+x
TLSH
T19232C7156A28A97B9CCBE21DBA65BF53D6FD503261D02E48BAFC861C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 15c0d6fa9331e0e4877e6a2354bd51917ffacc8dab11df587fe42af3ac330932
MD5 c782abfaa8437992f6ddcbfe67b7c892
SHA1 3e380a976c293bd83ad6afccb5d4d08c30f47767
SHA512 0bb923658cbdba75a24bd7ff96b0437d339b57c303c0b6c53cf728ab44581bbd39f60547a59547aac3063c7c32011375a4ab729b0502034699d3843476871733
SSDEEP 192:sxRIRHHcB4b/fdspVZKHm2Sm7afPFoD8pwEKyRE/g6+WNHndTHH8/Y3PAmGEGIgV:sxRIJm4b/fdsr82T4/5R8/g+mnG
TLSH
T16A62D852592499BB9DCBE209BE35BF53D7FD102295911F4CAAFCC51C00EA6ED220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 427fa0041773e37eb74207adc9c5fe20ab8c8407a7a93d024b03ef9671f40dc1
MD5 cc74a74f2f6833eb1b34a05b682e6d3d
SHA1 a4ffab6c67e2bfa50984659e5977e14973fc83a0
SHA512 c6af6f5e9d3545ac489691ae0b5d67c2220c5bfd86a20933fbeff9e8c1d35b7d4d01cac1bafdd58264e0b6d398902b4076b3bb061f6c7d72dc19cd8651cd4558
SSDEEP 384:GMgEbt2fCtg0+FfKsKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVKO9W+RTtroOLt:GTEbtkWg0CfKs8F1+UoAYDCx9Tuqh0Vq
TLSH
T1D2B2DA3B600DCB7E9F804AADAC59AFD76D5802C79B588D4047FE990C02C77FA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 a782163af2a8f255632d233487b68835624bda60d7d1386d264b441836774ccc
MD5 8bacf73e16d54f066479797e7a9a40cb
SHA1 f9b655cb48815e2c810d3de4dd905984c43147d3
SHA512 3618a4577fbdc9059a265184b9e28b4dc4338bb6afdada65d2c478a879103e018e165db137d98abc2c8d147f17c56546c02ec4bc9530833ff12525bd4cd646ea
TLSH
T118A002900F405081C44C43B07295134163A0B825A111438380A41146D8B95465F53440
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d3b48e19dd5aa1138b718421cefb1951e0661594637ff1b1eae084c3b628977f
MD5 48ff6f35d8b12a8d0cfaaf3911eca4a8
SHA1 aff6031694ed7b77ea88f7677be9396ca9e2c8b5
SHA512 eba2bf4ffbaf7aa411fed539690722e719f369a95a30a12d8814f4a4d2f744ad44f0c52d851177b73ed862f0f3d2b16bbc5634c302e605953c8a0091d2d7567d
SSDEEP 96:KR1i7PF/DnWrw+gXnK4mgpnct1o7zsHYp8IamqwWuzjgwwK4lgSwcgwDyYdy0AKX:C1i7PF/DWrwfX9mgpct1o7zsHYp8IamQ
TLSH
T1DB91751531BB2251787E790D91E6E85E96C234E33168F42B37D901960FEAE039DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

fac37555-58b6-44d2-9f7f-22046e1b9fe5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fac37555-58b6-44d2-9f7f-22046e1b9fe5.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a3f6c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a3f6c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 83150be06052a480072701059dc23fe975200ed3f8b1ec0246c2773a0535a321
MD5 81a449e0fa0298e6c5cfd0553997ce1c
SHA1 1f429be573cb4920db4f9d50ecb8ad04d299ae25
SHA512 8a103239caf79ccb6dc623056a2eb1e532647187343f94b68c35e3f9a699b17d636f668c8e017fc00e25706d505b3ced3a124e61cb2d4ed9daf08d161cd9fa60
SSDEEP 768:bz3huNbc+wfZOnfOidfOFvShCQRKfxlMPX:bz3huwfQfpdfivSWfT2X
TLSH
T1C3F2BFB1D8B49C735DE69248BB057B12BEA96033C9C85A44D9DD8F0C019379E271B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 e012ce42bdbdcef4c3557e8a0ec35e33d52269e482956e7096dd567d6306003c
MD5 a769a8f3bd2953506b59f9318e8131d6
SHA1 af7caade848350a739e2b1eae9fff1bc698762a2
SHA512 ce19542187f888cde9de95d8bffd8fc059dd0be301caff5a49d3936b6c876bf2e1efa0e351af77f43c0b2a8656df3cb4ebb80d9603a399d355c55d41109ecff9
SSDEEP 768:LFrL3owg1u/bXc+wfZOnfOidfOXGvShCQRKfxlMPX:ZL3EwwfQfpdfyGvSWfT2X
TLSH
T13D137DF188E79972D9ED9347A73D2E12AEBDD063B4845644B7C84A0CCC526BFD30B825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 225278b980a9859c08a7feae2d38c06669d46b41f6294b60b4d584e59fe099d0
MD5 1adf6bf7fc947a620364d6363c5ac749
SHA1 a064182c45655f6ebae63928d02bedf72d937de9
SHA512 4089dace9d4aca256f34943ba17a6ae4aee3c6ab921f31fecc99ccf1a0c02ebcdd368fcfb8ab4b997c16907fc28a078b811246cd7e7a2a481db689c7201e0958
SSDEEP 768:LFH63owg1ubbXc+wfZOnfOidfOXbvShCQRKfxlMPX:l63EUwfQfpdfybvSWfT2X
TLSH
T10F136DF188E79972D9ED9347A73D2E12AEBDD063B4845644B7C84A0CCC526BFD30B825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3d2fff0cb20b1557d7fc48617501d65f43a5061fae93401ef86acce0b44d0d45
MD5 85919ab30ad3d32d7c73ee94bf07eff6
SHA1 f16dc8132ea04489060cf25de89e5c87228222df
SHA512 0c62876f07a98c4d302a43bf2d2c8a7adbfcaacc4ed4d2f5a829113525a572ac19de1846bb84d5c15d59954c6c1cf63d71d6adba64107e5646174eecbe8e3c7e
SSDEEP 768:qrv+4UNbdM3uuHbc+wfZOnfOidfO3vShCQRKoSq:qbsbm3uuwfQfpdfyvSWol
TLSH
T1FE03BF71E878E9738EF69244B6467B53BFA86163C4C50B44DAD94F0C019369E270FC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 25f4de6cf22ef8e7087a1e4eb295d4ed2cef6fe26ffbb1d3e9047dbaf65ec13d
MD5 8338dcdfbb715e306070eebfb1b8f6ee
SHA1 85e6fcc325a8bacd3f2a67ed21c69d427b4332f4
SHA512 081a225b81014cf66c95d8b342d99b76fac41bddd60c8f7ddafe3533f359f1e47c68f57ee10cd4bac49b2b0f5cfecaf0ae3d9a06ced8a83f2bb431de86e79396
SSDEEP 768:uz3uusbc+wfZOnfOidfOFvShCQRKfxlMPX:uz3ujwfQfpdfivSWfT2X
TLSH
T1F8F2BFB1D8B49C735DF69248BB057B52BEA96033C9C85A44D9DD8F0C01937AE271BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 d2b086c850dcf43cff0cee95b068d091470b706816331eae84283d356d6c7fa9
MD5 acf9dd4c0481760254936e26a62adc44
SHA1 233f043a778f3d7a2f817bb90a7a9e0b35cbeb5e
SHA512 fb169d041eec4129bf760276ac4e38e31f0b882f84eb0e59d83b3ae61ebe62e673c2531e735e62f23a002e8c52d29d8fc8c09fde748a8d352ca5d11049dda2a5
SSDEEP 768:Jrv+4UNbd43z5c+wfZOnfOidfOmvShCQsK2bwWV:JbsbO3vwfQfpdfBvSh0wO
TLSH
T17603BE71E578A9339EE69248B64A7B53BEA96173C8C54744DACC4F0D018269F231FC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 4d5addac3e6663bb81cc76448077631d7436aae9ed6a2800b79ff3c3e46a2cf1
MD5 b385ace77f648db1a071da924d76164b
SHA1 d6e8f44e864edbf65d6fc6532d609240ab1a1c23
SHA512 2764f18f9a923bb98852233269450800953fda030a2eed6b5736e400dcbce4073daa4311a6a7980932b5d022e7ba46e6a0fdc72c4f365c66916ece9e48361e9c
SSDEEP 768:LFQ/3LwgFutbXc+wfZOnfOidfOuvShCQRKfxlMPX:e/3vmwfQfpdfxvSWfT2X
TLSH
T171136DF188E79972D9ED9347A73D2E12AEBDD063B4845544B7C84A0CCC526BFD30B825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1fe1e6b10ef5d7e7e0c44e72991ac45949804480e7f8bcc27d56be51c15140d9
MD5 0540a779b2fa1cde63844383033368d8
SHA1 080932fa801f4e6cda447c60a125f9f4b34d619f
SHA512 623da2b59d7c7832a73578ceb02aece43c89a35bb56cb9daf8e3ee75d339bc093c6b99816b725196635e61b7abd45f529e6efd19da12b3778e52c0128a7af57b
SSDEEP 768:Rrv+4UNbd43rKkc+wfZOnfOiavShCQtY2bwWV:RbsbO3r/wfQfpavS80wO
TLSH
T15E03CF32E86899339DE692487646BBA37EB86173C8C54744DACD4B0D019269F370BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 645852d9a79739c0af291f6c0522b55576f81afe0eb3213ad9e597e59f7a8a55
MD5 39907988556e2cd3248c754d3c331fb3
SHA1 802ebd43b067197b5226b53742e5276580761dd0
SHA512 988b7c72079cef1d50de0ec3fc32cca40876462a5c562304a566c9569b185793a126ce5011c8b78ddc85f66b3fb74d563b0bb4b08d87f1c1116b98f5b0a98bc9
SSDEEP 768:LFD43owg1uobXc+wfZOnfOidfOXyvShCQRKfxlMPX:543E7wfQfpdfyyvSWfT2X
TLSH
T1E7136DF188E79972D9ED9347A73D2E12AEBDD063B4845644B7C84A0CCC526BFD30B825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 28e45a0653305772f947da9a530cd923b64f583120906854ed1c2adf67d675b8
MD5 32dde1bcc7f442190cc8067de9f37e33
SHA1 df655f51d061f79f6855085192773b582e167ef9
SHA512 3f5d5649f327ae311c0285bcb384c39a6b3cc23d3ab3193e9152f6136ce7ddaccf1682c7929ab1a1911922ecc739269d4317a2fe76f5f66d26f5bc3835f1bd0d
SSDEEP 768:LF463owg1ubbXc+wfZOnfOidfOXbvShCQRKfxlMPX:K63EUwfQfpdfybvSWfT2X
TLSH
T10D137DF188E79972D9ED9347A73D2E12AEBDD063B4845544B7C84A0CCC526BFD30B825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eabbc291-7dbe-4e64-a261-29c66d7f2f9b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\eabbc291-7dbe-4e64-a261-29c66d7f2f9b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq8F13.tmp\InstallOptions.dll
Size 30KB
SHA256 a9415ec35ca005da286219bae73d4d0574efa6f0cd24bfefa6ceea5a973d3f5b
MD5 45b3bb72a15d0f7f1b44877d27239150
SHA1 d8d51cb42606d29ad3954524e8ceb9fce991d4ac
SHA512 7f7a0133b4d2cbf38f44112ec05bb261cc99efa6d94d3e09234b665e53fff83b9eaaf02c168e24717ee8562a6c5cb2998b427be556d34c7ded6e80a4cafd504c
SSDEEP 768:56NAiHShOHsh6AVVUX8yG+CQV+llEknRJ:kNAiHShH62VAGhnR
TLSH
T1CCE2F81FF7E190BDE952D27885FA8A72F971FC0600357A2E0920D27F2E34D609A3D566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NSIS.InstallOptions.ini

Path C:\Users\Admin\AppData\Local\Temp\nsq8F13.tmp\NSIS.InstallOptions.ini
Size 1KB
SHA256 ca78ccb41495547cfc8aa0419af085d407f4418df7b65aa88d138003914ac52a
MD5 a7f6c08fbacf6dd3d6b50305da47c44e
SHA1 351c3257b243e27011fe40c704e2ce6acc36b4e0
SHA512 b0398561d3b01a6e6550a491fba9a3b8d517278a6ea560e4fbd0d526bcc1fc814ed1fbfd87ad143585279168722b92a01dae7c64e68050e6070976981e94bf3d
TLSH
T1C8312A132AF90514F5BAB61DEBF5803697357805083DC61D81E24A4D89F5B808867BDB
MD5 SHA1 SHA512 TLSH

Submit Download

NSIS.InstallOptions.ini

Path C:\Users\Admin\AppData\Local\Temp\nsq8F13.tmp\NSIS.InstallOptions.ini
Size 1KB
SHA256 1b31c74cf19d8a852107d8de39ddaffd7eddf0065101f6a80256187fee54c235
MD5 209170d57f1dc0c1b5923d7735c80538
SHA1 dc7af1c9f77f2f71c8ef52be50c10d5e40ae210d
SHA512 2b96f3fbe35826af409b57fa1d60b197a37dad0cff4b6fdbd0ef760a284c0db7128649774b14ac34b626bdf4f3bb433aff808d01b2bf2836fffded3ae0135e4e
TLSH
T1AB314A132AFD0514F5BBBA1DEBF5803647357905083DC51D80E20A4D89F6B808867BDB
MD5 SHA1 SHA512 TLSH

Submit Download

NSIS.InstallOptions.ini

Path C:\Users\Admin\AppData\Local\Temp\nsq8F13.tmp\NSIS.InstallOptions.ini
Size 1KB
SHA256 46fbef59087d8348e4879d3ba70bfec00b0d3309160f4cb6413a004945e94698
MD5 9b9509f2282b993866b5880e99c0f2dd
SHA1 1e6d3dd5f4db2d999fc89f6892ef770ede606d26
SHA512 39ebdf94a2678b6c2becddcdf622edf3d69e1eae687c6d3cd17be42be3f96abd6858484804f89bd02a8d021d6bb9b306ec4f338e2dd9211aa440873478a1a6e3
TLSH
T1DA318C132EFD0514F5BBB61DEBF5807547353906083DC51D90E10A4E89F2B808867BEB
MD5 SHA1 SHA512 TLSH

Submit Download

NSIS.InstallOptions.ini

Path C:\Users\Admin\AppData\Local\Temp\nsq8F13.tmp\NSIS.InstallOptions.ini
Size 1KB
SHA256 aa1c1e7d55521ab8833a80d55dae670782aaa9a52bea57c2d888ae5481868c9e
MD5 90ef3167080e67606d1a4dc2921a123c
SHA1 17457fc00c929cd9c893ccb4d72930374cf7ab89
SHA512 5ec849ed43e6137760f9d6fc9a7d55ab6c8dd409fb32419fe870da63fd37f8bcee6baaae2892810f8f443f646008c3b86d7378c8fda7bb7f19196341f824f118
TLSH
T183317A132EFD0514F5BBB61DEBF5807547353906083DC51D90E10A4E89F2B808867BEB
MD5 SHA1 SHA512 TLSH

Submit Download

StartMenu.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq8F13.tmp\StartMenu.dll
Size 11KB
SHA256 59bdb5856ac000e657c5ee33b4ee380c215f0fab371c6e9146fb11f76563f08e
MD5 b7ea54d029e579e800d6520cf991b4f0
SHA1 ad836bf9330532398a29e6e6e60e59b80fbb3113
SHA512 b61511fc94e124e5d086e252b7186effb626c018ea30f0d6e93d4678a9f8948dd1c33ce9d60fbd56f5288e45b04102cb28a33ade87dd140744cad042d028ad15
SSDEEP 192:ow4rRSW46dSDDqtHhGQplRuKNzvuUzlRH0jVwBo5BoYbK:C9w6dADOHhPp6K5vtzluho
TLSH
T16B32C86F7ED041D9DC7AE338E0FE4A3565B2B405192A770F021882CBBE75BA15878B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq8F13.tmp\System.dll
Size 25KB
SHA256 3d24b3050546f53b9703079cb1645ba31edcb4ff5c4599223f9621ac4889269b
MD5 c5183af5481975b70110074a7f1a0001
SHA1 c2539b313dcebba9c612dd41611277532a55cb21
SHA512 cbd9f8f264b748921b9f6f310708047df45aae61815e9f27d3c014f1d96129c7aafa950db0eaf50226cb71a51e5a39d52f9fe8d46988c52acd6aff810e0fec8d
SSDEEP 384:aP6bw0YTnWLboowbqPH3avHK5vO44OIxZ3cxxxxmx6L1llllEkMZI+ma:W6bnYzOPH3ag4OITQ1llllEk7
TLSH
T112B22A0BB3D294BAC567C034D5EB8BF2F672BD1225347A2E2621F1756D71E90CB2D40A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq8F13.tmp\UserInfo.dll
Size 7KB
SHA256 b2fb11e4b46745a94490c7124f447fc2f1b3fa03d5182e61c2605f1cb8fd2433
MD5 6a6fb2c7b927e14fa5eb6e75c0d28f68
SHA1 df4ba1d6ae9efa43025d14aff4ac1a7cfcf6c95c
SHA512 e60f8e4571fc37e0872a83558d3ec15ce11be1395cdd57099940199026c247071a0c2cc17c88b770aa450acb88ec00b4765610985bd8da06b1c4e31597fe7e92
SSDEEP 96:4yubewoiLOeI/ZhuQKzM6dKNzv+ku8KjxjPS2gwmlXCGdxqrdbbtKbdj:zuC/h+l9KNzvWTylXR9
TLSH
T162E1858FB3A12696C456F278C1FA5E32BCF7BC345627621D480161263D34AA1F339B46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsq8F13.tmp\ioSpecial.ini
Size 1KB
SHA256 e979ba35d012633a2d1dd43e85da804d63af1f122f4db4cad5bc67950e812b76
MD5 e9455328e645e90e997da25a2f038e05
SHA1 c87b5cb4a6f789b08cb5eb3d5f591ec21d945754
SHA512 7db553ba57dad2cfc06dc7eea333faf788b46b05cb88fd7af6906d120ce01f90fd42787aab4e21e9b7bcf9f877726eb5d08e51d928be28d625b8d5c547c8e0a8
TLSH
T1522190037AFC1618F2FABB14FFB550758B3A7C16A839D50D81D00A0E09F5E408963BAB
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsq8F13.tmp\ioSpecial.ini
Size 1KB
SHA256 6553d5cde042229577dcaff537557bd3e483c04afeb2b4e5b6065c4a515ccab9
MD5 fe1c06a1ea650b41dd631b8b1fd5edaf
SHA1 7134c54a83addfdd2d9a47054277a465bd4308a7
SHA512 8442e54af186bc703ecd34a8b6979c54ba681bafcbc3c1abda906b215f63a31d2c64607d6ec5f0077a08dc23ae1104694fc9a91db7f2582103bc02860b1b8798
TLSH
T148119D133EFC4418E2BABA08FFF580755B3AB815982DD50E81D00A0F44E5B808933BEB
MD5 SHA1 SHA512 TLSH

Submit Download

antimicrox-3.6.1-Windows-AMD64.exe.crdownload

Path C:\Users\Admin\Downloads\antimicrox-3.6.1-Windows-AMD64.exe.crdownload
Size 15.3MB
SHA256 467648540ab4bcf83641cb22b3359669bf1b9130b87d4be0aa438221ef3eb06b
MD5 86812697451c2171f5b71cddc57ad08b
SHA1 d79a4507e5835a32dc42f5525692b5b408dbd1b3
SHA512 6db8208b6f702d8c9029e0ad64f5a5a072eb2c6d0157e7f3ef58bf4448d6e5786eafb6fb9cc7bfd89db246f460e521d506543de787973dbb5ec879627fecfcc1
SSDEEP 393216:NCmKhqcXR9gSJ3dVHQ/wYiFHz/ggtxmmvK2u+7UQyQSwK5K:NhKRrDZdVw2FHzVewDypR5K
TLSH
T1EFF633944E9F66E9F1C7C573ADB1987F0BF824A0B222EF77662D761D786044E03211B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2464-897-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/2464-742-0x00007FF8A0FC0000-0x00007FF8A0FD4000-memory.dmp

Download

memory/2464-743-0x00007FF8A7640000-0x00007FF8A764D000-memory.dmp

Download

memory/2464-741-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/4220-1032-0x00007FF88BDA0000-0x00007FF88C8A4000-memory.dmp

Download

memory/4220-1042-0x00007FF88BDA0000-0x00007FF88C8A4000-memory.dmp

Download

memory/4220-947-0x00007FF88B6C0000-0x00007FF88BD99000-memory.dmp

Download

memory/4220-948-0x00007FF88AC10000-0x00007FF88B6B2000-memory.dmp

Download

memory/4220-949-0x00007FF88AAD0000-0x00007FF88AC0E000-memory.dmp

Download

memory/4220-945-0x00007FF88BDA0000-0x00007FF88C8A4000-memory.dmp

Download

memory/4220-942-0x00007FF89A820000-0x00007FF89A84B000-memory.dmp

Download

memory/4220-943-0x00007FF88D010000-0x00007FF88D262000-memory.dmp

Download

memory/4220-944-0x00007FF88CD80000-0x00007FF88D010000-memory.dmp

Download

memory/4220-1067-0x00007FF88BDA0000-0x00007FF88C8A4000-memory.dmp

Download

memory/4220-1068-0x00007FF88CB80000-0x00007FF88CD7B000-memory.dmp

Download

memory/4220-1069-0x00007FF88B6C0000-0x00007FF88BD99000-memory.dmp

Download

memory/4220-1070-0x00007FF88AC10000-0x00007FF88B6B2000-memory.dmp

Download

memory/4220-1071-0x00007FF88AAD0000-0x00007FF88AC0E000-memory.dmp

Download

memory/4220-1065-0x00007FF88D010000-0x00007FF88D262000-memory.dmp

Download

memory/4220-1066-0x00007FF88CD80000-0x00007FF88D010000-memory.dmp

Download

memory/4220-1062-0x00007FF757FA0000-0x00007FF75837C000-memory.dmp

Download

memory/4220-993-0x00007FF757FA0000-0x00007FF75837C000-memory.dmp

Download

memory/4220-1000-0x00007FF88B6C0000-0x00007FF88BD99000-memory.dmp

Download

memory/4220-998-0x00007FF88BDA0000-0x00007FF88C8A4000-memory.dmp

Download

memory/4220-1002-0x00007FF88AAD0000-0x00007FF88AC0E000-memory.dmp

Download

memory/4220-1001-0x00007FF88AC10000-0x00007FF88B6B2000-memory.dmp

Download

memory/4220-940-0x00007FF757FA0000-0x00007FF75837C000-memory.dmp

Download

memory/4220-941-0x00007FF8A0FC0000-0x00007FF8A0FD6000-memory.dmp

Download

memory/4220-1027-0x00007FF757FA0000-0x00007FF75837C000-memory.dmp

Download

memory/4220-1034-0x00007FF88B6C0000-0x00007FF88BD99000-memory.dmp

Download

memory/4220-934-0x00007FF88AC10000-0x00007FF88B6B2000-memory.dmp

Download

memory/4220-1035-0x00007FF88AC10000-0x00007FF88B6B2000-memory.dmp

Download

memory/4220-1036-0x00007FF88AAD0000-0x00007FF88AC0E000-memory.dmp

Download

memory/4220-1038-0x00007FF8A0FC0000-0x00007FF8A0FD6000-memory.dmp

Download

memory/4220-1037-0x00007FF757FA0000-0x00007FF75837C000-memory.dmp

Download

memory/4220-946-0x00007FF88CB80000-0x00007FF88CD7B000-memory.dmp

Download

memory/4220-1047-0x00007FF757FA0000-0x00007FF75837C000-memory.dmp

Download

memory/4220-1063-0x00007FF8A0FC0000-0x00007FF8A0FD6000-memory.dmp

Download

memory/4220-1064-0x00007FF89A820000-0x00007FF89A84B000-memory.dmp

Download

memory/4416-974-0x00000226C5940000-0x00000226C5941000-memory.dmp

Download

memory/4416-975-0x00000226C5940000-0x00000226C5941000-memory.dmp

Download

memory/4416-976-0x00000226C5940000-0x00000226C5941000-memory.dmp

Download

memory/4416-978-0x00000226C5940000-0x00000226C5941000-memory.dmp

Download

memory/4416-979-0x00000226C5940000-0x00000226C5941000-memory.dmp

Download

memory/4416-977-0x00000226C5940000-0x00000226C5941000-memory.dmp

Download

memory/4416-968-0x00000226C5940000-0x00000226C5941000-memory.dmp

Download

memory/4416-970-0x00000226C5940000-0x00000226C5941000-memory.dmp

Download