3120182f03d3eb284d8df06a289211da3e03e2649c5c31c1e3489ec8f29d034a

Analysis

user interaction
yes
max time kernel
153s
max time network
161s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ZqousPerm.exe
Size 11.5MB
Sample260825-sdctpahf33
SHA256 3120182f03d3eb284d8df06a289211da3e03e2649c5c31c1e3489ec8f29d034a
MD5 ce423491e631ee64b4d7ff5da95c80af
SHA1 7f7fbb7d31a951a9abc4b670d4314c335ff7954b
SHA512 ea283cf017fd91732a6bf824215d4b3d66cc8e6b83efd73300f2c0fb910d5a1d7b3b26153e345dda3efa8af03ee07a3c2a8098bb3de75a26a5aa4564d5f36be0
SSDEEP 196608:0v0XvckyzTAhV0I3UMhD0hpMXfpVAmLaRuBsKLRL:035u+I3qspVAmsu2K
TLSH
T1CBC68D16EBA649E5D0B3923489669667F3B2BC500FB4C7DF3298160A1F737E04D39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	ZqousPerm.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	ZqousPerm.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	ZqousPerm.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	ZqousPerm.exe

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3020	netsh.exe
920	netsh.exe
2092	netsh.exe

Executes dropped EXE 42 IoCs

pid	Process
472	winxsrcsv64.exe
3556	winxsrcsv64.sys
5520	winxsrcsv64.exe
5820	winxsrcsv64.exe
3100	winxsrcsv64.exe
5456	winxsrcsv64.exe
2632	winxsrcsv64.exe
3960	winxsrcsv64.exe
920	winxsrcsv64.exe
5160	winxsrcsv64.exe
2092	winxsrcsv64.exe
3252	winxsrcsv64.exe
5968	winxsrcsv64.exe
4784	winxsrcsv64.exe
2244	winxsrcsv64.exe
4944	winxsrcsv64.exe
5304	winxsrcsv64.exe
3100	winxsrcsv64.exe
3176	winxsrcsv64.exe
2056	winxsrcsv64.exe
4324	winxsrcsv64.exe
4768	winxsrcsv64.exe
3032	winxsrcsv64.exe
4756	winxsrcsv64.exe
5496	winxsrcsv64.exe
2180	winxsrcsv64.exe
1672	winxsrcsv64.exe
3680	winxsrcsv64.exe
4308	winxsrcsv64.exe
4796	winxsrcsv64.exe
436	winxsrcsv64.exe
1472	winxsrcsv64.exe
3060	winxsrcsv64.exe
2144	winxsrcsv64.exe
4768	winxsrcsv64.exe
5824	winxsrcsv64.exe
1244	winxsrcsv64.exe
2440	winxsrcsv64.exe
440	winxsrcsv64.exe
2180	winxsrcsv64.exe
3516	winxsrcsv64.exe
936	winxsrcsv64.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System32\0409\volid.exe	ZqousPerm.exe
File created	C:\Windows\System32\0409\winxsrcsv64.exe	ZqousPerm.exe
File created	C:\Windows\System32\0409\winxsrcsv64.sys	ZqousPerm.exe
File created	C:\Windows\System32\0409\arp.bat	ZqousPerm.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_736435472\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4916_1312016751\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1718325688\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_174277403\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5080_2048171804\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_2123319721\_locales\gl\messages.json	msedge.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5668	sc.exe
5496	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5952	cmd.exe
5820	cmd.exe
5288	cmd.exe
5656	cmd.exe
6124	cmd.exe
4360	cmd.exe
1184	cmd.exe
1032	cmd.exe
4648	cmd.exe
1664	cmd.exe
3256	cmd.exe
3172	cmd.exe
4724	cmd.exe
5828	cmd.exe
2352	cmd.exe
1724	cmd.exe
1620	cmd.exe
1092	cmd.exe
4348	cmd.exe
4484	cmd.exe
2268	cmd.exe
5680	cmd.exe
4220	cmd.exe
3704	cmd.exe
1284	cmd.exe
4584	cmd.exe
2864	cmd.exe
4636	cmd.exe
5212	cmd.exe
6004	cmd.exe
4412	cmd.exe
5008	cmd.exe
5072	cmd.exe
5684	cmd.exe
5724	cmd.exe
3236	cmd.exe
4024	cmd.exe
3480	cmd.exe
1104	cmd.exe
5524	cmd.exe
5736	cmd.exe
2180	cmd.exe
5520	cmd.exe
4448	cmd.exe
3096	cmd.exe
4892	cmd.exe
4048	cmd.exe
5704	cmd.exe
4996	cmd.exe
5968	cmd.exe
2348	cmd.exe
4508	cmd.exe
3664	cmd.exe
2880	cmd.exe
3912	cmd.exe
2560	cmd.exe
5436	cmd.exe
1232	cmd.exe
5020	cmd.exe
1440	cmd.exe
996	cmd.exe
1168	cmd.exe
3608	cmd.exe
3200	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3836	msedge.exe
2520	msedge.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	ZqousPerm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	ZqousPerm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	ZqousPerm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	ZqousPerm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2432	ipconfig.exe
2144	ipconfig.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321436458426211"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{3D280A81-94C1-4C3B-AE99-7A9358C45CF6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4436	WMIC.exe
4436	WMIC.exe
4436	WMIC.exe
4436	WMIC.exe
4912	WMIC.exe
4912	WMIC.exe
4912	WMIC.exe
4912	WMIC.exe
4624	WMIC.exe
4624	WMIC.exe
4624	WMIC.exe
4624	WMIC.exe
4060	WMIC.exe
4060	WMIC.exe
4060	WMIC.exe
4060	WMIC.exe
4780	WMIC.exe
4780	WMIC.exe
4780	WMIC.exe
4780	WMIC.exe
444	WMIC.exe
444	WMIC.exe
444	WMIC.exe
444	WMIC.exe
3436	WMIC.exe
3436	WMIC.exe
3436	WMIC.exe
3436	WMIC.exe
4420	WMIC.exe
4420	WMIC.exe
4420	WMIC.exe
4420	WMIC.exe
3340	WMIC.exe
3340	WMIC.exe
3340	WMIC.exe
3340	WMIC.exe
3984	WMIC.exe
3984	WMIC.exe
3984	WMIC.exe
3984	WMIC.exe
2604	WMIC.exe
2604	WMIC.exe
2604	WMIC.exe
2604	WMIC.exe
5056	WMIC.exe
5056	WMIC.exe
5056	WMIC.exe
5056	WMIC.exe
1772	WMIC.exe
1772	WMIC.exe
1772	WMIC.exe
1772	WMIC.exe
4788	WMIC.exe
4788	WMIC.exe
4788	WMIC.exe
4788	WMIC.exe
4584	WMIC.exe
4584	WMIC.exe
4584	WMIC.exe
4584	WMIC.exe
2108	WMIC.exe
2108	WMIC.exe
2108	WMIC.exe
2108	WMIC.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
6012	ZqousPerm.exe
2532	ZqousPerm.exe

Suspicious behavior: LoadsDriver 41 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4436	WMIC.exe
Token: SeSecurityPrivilege	4436	WMIC.exe
Token: SeTakeOwnershipPrivilege	4436	WMIC.exe
Token: SeLoadDriverPrivilege	4436	WMIC.exe
Token: SeSystemProfilePrivilege	4436	WMIC.exe
Token: SeSystemtimePrivilege	4436	WMIC.exe
Token: SeProfSingleProcessPrivilege	4436	WMIC.exe
Token: SeIncBasePriorityPrivilege	4436	WMIC.exe
Token: SeCreatePagefilePrivilege	4436	WMIC.exe
Token: SeBackupPrivilege	4436	WMIC.exe
Token: SeRestorePrivilege	4436	WMIC.exe
Token: SeShutdownPrivilege	4436	WMIC.exe
Token: SeDebugPrivilege	4436	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4436	WMIC.exe
Token: SeRemoteShutdownPrivilege	4436	WMIC.exe
Token: SeUndockPrivilege	4436	WMIC.exe
Token: SeManageVolumePrivilege	4436	WMIC.exe
Token: 33	4436	WMIC.exe
Token: 34	4436	WMIC.exe
Token: 35	4436	WMIC.exe
Token: 36	4436	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4436	WMIC.exe
Token: SeSecurityPrivilege	4436	WMIC.exe
Token: SeTakeOwnershipPrivilege	4436	WMIC.exe
Token: SeLoadDriverPrivilege	4436	WMIC.exe
Token: SeSystemProfilePrivilege	4436	WMIC.exe
Token: SeSystemtimePrivilege	4436	WMIC.exe
Token: SeProfSingleProcessPrivilege	4436	WMIC.exe
Token: SeIncBasePriorityPrivilege	4436	WMIC.exe
Token: SeCreatePagefilePrivilege	4436	WMIC.exe
Token: SeBackupPrivilege	4436	WMIC.exe
Token: SeRestorePrivilege	4436	WMIC.exe
Token: SeShutdownPrivilege	4436	WMIC.exe
Token: SeDebugPrivilege	4436	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4436	WMIC.exe
Token: SeRemoteShutdownPrivilege	4436	WMIC.exe
Token: SeUndockPrivilege	4436	WMIC.exe
Token: SeManageVolumePrivilege	4436	WMIC.exe
Token: 33	4436	WMIC.exe
Token: 34	4436	WMIC.exe
Token: 35	4436	WMIC.exe
Token: 36	4436	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4912	WMIC.exe
Token: SeSecurityPrivilege	4912	WMIC.exe
Token: SeTakeOwnershipPrivilege	4912	WMIC.exe
Token: SeLoadDriverPrivilege	4912	WMIC.exe
Token: SeSystemProfilePrivilege	4912	WMIC.exe
Token: SeSystemtimePrivilege	4912	WMIC.exe
Token: SeProfSingleProcessPrivilege	4912	WMIC.exe
Token: SeIncBasePriorityPrivilege	4912	WMIC.exe
Token: SeCreatePagefilePrivilege	4912	WMIC.exe
Token: SeBackupPrivilege	4912	WMIC.exe
Token: SeRestorePrivilege	4912	WMIC.exe
Token: SeShutdownPrivilege	4912	WMIC.exe
Token: SeDebugPrivilege	4912	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4912	WMIC.exe
Token: SeRemoteShutdownPrivilege	4912	WMIC.exe
Token: SeUndockPrivilege	4912	WMIC.exe
Token: SeManageVolumePrivilege	4912	WMIC.exe
Token: 33	4912	WMIC.exe
Token: 34	4912	WMIC.exe
Token: 35	4912	WMIC.exe
Token: 36	4912	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4912	WMIC.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6012	ZqousPerm.exe
2532	ZqousPerm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6012 wrote to memory of 3236	6012	ZqousPerm.exe	89
PID 3236 wrote to memory of 4436	3236	cmd.exe	90
PID 6012 wrote to memory of 4348	6012	ZqousPerm.exe	92
PID 4348 wrote to memory of 4912	4348	cmd.exe	93
PID 6012 wrote to memory of 3832	6012	ZqousPerm.exe	94
PID 3832 wrote to memory of 4624	3832	cmd.exe	95
PID 6012 wrote to memory of 4024	6012	ZqousPerm.exe	96
PID 4024 wrote to memory of 4060	4024	cmd.exe	97
PID 6012 wrote to memory of 1168	6012	ZqousPerm.exe	98
PID 1168 wrote to memory of 4780	1168	cmd.exe	99
PID 6012 wrote to memory of 6124	6012	ZqousPerm.exe	100
PID 6124 wrote to memory of 444	6124	cmd.exe	101
PID 6012 wrote to memory of 5736	6012	ZqousPerm.exe	102
PID 5736 wrote to memory of 3436	5736	cmd.exe	103
PID 6012 wrote to memory of 5360	6012	ZqousPerm.exe	104
PID 5360 wrote to memory of 4420	5360	cmd.exe	105
PID 6012 wrote to memory of 4484	6012	ZqousPerm.exe	106
PID 4484 wrote to memory of 3340	4484	cmd.exe	107
PID 6012 wrote to memory of 1284	6012	ZqousPerm.exe	108
PID 1284 wrote to memory of 3984	1284	cmd.exe	109
PID 6012 wrote to memory of 5020	6012	ZqousPerm.exe	110
PID 5020 wrote to memory of 2604	5020	cmd.exe	111
PID 6012 wrote to memory of 3608	6012	ZqousPerm.exe	112
PID 3608 wrote to memory of 5056	3608	cmd.exe	113
PID 6012 wrote to memory of 4612	6012	ZqousPerm.exe	114
PID 4612 wrote to memory of 1772	4612	cmd.exe	115
PID 6012 wrote to memory of 5008	6012	ZqousPerm.exe	116
PID 5008 wrote to memory of 4788	5008	cmd.exe	117
PID 6012 wrote to memory of 2264	6012	ZqousPerm.exe	118
PID 2264 wrote to memory of 4584	2264	cmd.exe	119
PID 6012 wrote to memory of 1440	6012	ZqousPerm.exe	120
PID 1440 wrote to memory of 2108	1440	cmd.exe	121
PID 6012 wrote to memory of 5080	6012	ZqousPerm.exe	122
PID 5080 wrote to memory of 1436	5080	msedge.exe	123
PID 5080 wrote to memory of 3432	5080	msedge.exe	124
PID 5080 wrote to memory of 3836	5080	msedge.exe	125
PID 5080 wrote to memory of 3432	5080	msedge.exe	124
PID 5080 wrote to memory of 3432	5080	msedge.exe	124
PID 5080 wrote to memory of 6072	5080	msedge.exe	126
PID 5080 wrote to memory of 6072	5080	msedge.exe	126
PID 5080 wrote to memory of 4632	5080	msedge.exe	129
PID 5080 wrote to memory of 1904	5080	msedge.exe	128
PID 5080 wrote to memory of 4632	5080	msedge.exe	129
PID 5080 wrote to memory of 4632	5080	msedge.exe	129
PID 5080 wrote to memory of 1904	5080	msedge.exe	128
PID 5080 wrote to memory of 1904	5080	msedge.exe	128
PID 5080 wrote to memory of 3704	5080	msedge.exe	130
PID 5080 wrote to memory of 3704	5080	msedge.exe	130
PID 5080 wrote to memory of 3704	5080	msedge.exe	130
PID 5080 wrote to memory of 2600	5080	msedge.exe	131
PID 5080 wrote to memory of 2600	5080	msedge.exe	131
PID 5080 wrote to memory of 2600	5080	msedge.exe	131
PID 5080 wrote to memory of 6052	5080	msedge.exe	132
PID 5080 wrote to memory of 6052	5080	msedge.exe	132
PID 5080 wrote to memory of 800	5080	msedge.exe	134
PID 5080 wrote to memory of 5876	5080	msedge.exe	135
PID 5080 wrote to memory of 800	5080	msedge.exe	134
PID 5080 wrote to memory of 5876	5080	msedge.exe	135
PID 5080 wrote to memory of 4916	5080	msedge.exe	136
PID 4916 wrote to memory of 4528	4916	msedge.exe	137
PID 4916 wrote to memory of 4344	4916	msedge.exe	139
PID 4916 wrote to memory of 2520	4916	msedge.exe	141
PID 4916 wrote to memory of 4344	4916	msedge.exe	139
PID 4916 wrote to memory of 4344	4916	msedge.exe	139

C:\Users\Admin\AppData\Local\Temp\ZqousPerm.exe
"C:\Users\Admin\AppData\Local\Temp\ZqousPerm.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic computersystem get Name
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get Name
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic cpu get Name
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get Name
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic computersystem get TotalPhysicalMemory
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3832
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get TotalPhysicalMemory
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic bios get SerialNumber
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4024
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get SerialNumber
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get SerialNumber
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1168
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get SerialNumber
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic computersystem get SystemType
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6124
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get SystemType
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get Version
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5736
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get Version
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get BuildNumber
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5360
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get BuildNumber
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic baseboard get Product
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4484
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get Product
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic baseboard get SerialNumber
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get SerialNumber
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get IdentifyingNumber
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get IdentifyingNumber
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic nic get MACAddress
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3608
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nic get MACAddress
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic bios get Version
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get Version
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get uuid
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic cpu get SerialNumber
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get SerialNumber
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic cpu get ProcessorId
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get ProcessorId
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://keyauth.cc/
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffdbd47c188,0x7ffdbd47c194,0x7ffdbd47c1a0
    3⤵
    PID:1436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,14655015815266664507,2602530164524847239,262144 --field-trial-handle=2292,i,13585351110404111330,11239865574562482123,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:2
    3⤵
    PID:3432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,6773302043172539881,3267979791260900343,524288 --field-trial-handle=2292,i,13585351110404111330,11239865574562482123,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,15112896822635389971,11688167566111470027,524288 --field-trial-handle=2292,i,13585351110404111330,11239865574562482123,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:13
    3⤵
    PID:6072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3340,i,10022532703647866331,13094153607765270551,2097152 --field-trial-handle=2292,i,13585351110404111330,11239865574562482123,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:1904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,15446928638664744770,9649803414404379663,2097152 --field-trial-handle=2292,i,13585351110404111330,11239865574562482123,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
    3⤵
    PID:4632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,17030669067225514542,41860393120768288,2097152 --field-trial-handle=2292,i,13585351110404111330,11239865574562482123,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:9
    3⤵
    PID:3704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,3845184124284623651,8649874170922186326,2097152 --field-trial-handle=2292,i,13585351110404111330,11239865574562482123,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:1
    3⤵
    PID:2600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,11034057979646631299,12980551068335044111,524288 --field-trial-handle=2292,i,13585351110404111330,11239865574562482123,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
    3⤵
    PID:6052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,7605596620669314185,9743120631760854392,524288 --field-trial-handle=2292,i,13585351110404111330,11239865574562482123,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
    3⤵
    PID:800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,10257556488080508850,16808164842006908567,524288 --field-trial-handle=2292,i,13585351110404111330,11239865574562482123,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
    3⤵
    PID:5876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2cc,0x7ffdbd47c188,0x7ffdbd47c194,0x7ffdbd47c1a0
      4⤵
      PID:4528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1936,i,582689344147092733,8170932114105428272,262144 --field-trial-handle=3292,i,4390480847771223185,17614901066490414239,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:2
      4⤵
      PID:4344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2124,i,9472770205043665990,10349996040639429004,524288 --field-trial-handle=3292,i,4390480847771223185,17614901066490414239,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:11
      4⤵
      System Time Discovery
      PID:2520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,13567728704969236748,6173517959943995556,524288 --field-trial-handle=3292,i,4390480847771223185,17614901066490414239,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:13
      4⤵
      PID:4196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,16367314223692938338,16198366966957574431,524288 --field-trial-handle=3292,i,4390480847771223185,17614901066490414239,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:14
      4⤵
      PID:3548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,13162020039274815548,12463341656607788246,524288 --field-trial-handle=3292,i,4390480847771223185,17614901066490414239,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:14
      4⤵
      PID:5316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,13162020039274815548,12463341656607788246,524288 --field-trial-handle=3292,i,4390480847771223185,17614901066490414239,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:14
      4⤵
      PID:3124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,4469206719909125235,6071342025324761560,524288 --field-trial-handle=3292,i,4390480847771223185,17614901066490414239,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:14
      4⤵
      PID:4876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,12342610519029575807,1646008848327149452,524288 --field-trial-handle=3292,i,4390480847771223185,17614901066490414239,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
      4⤵
      PID:2292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,12627690747261193819,10821678042320529044,524288 --field-trial-handle=3292,i,4390480847771223185,17614901066490414239,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
      4⤵
      PID:3004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,1613245028011707718,6426727606559906255,524288 --field-trial-handle=3292,i,4390480847771223185,17614901066490414239,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:14
      4⤵
      PID:5296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,10743588078429757178,8254795700679396681,524288 --field-trial-handle=3292,i,4390480847771223185,17614901066490414239,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:14
      4⤵
      PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,3732477903991707887,7493545527338063538,524288 --field-trial-handle=3292,i,4390480847771223185,17614901066490414239,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
      4⤵
      PID:2320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,7322524900112602446,10138003686764829663,524288 --field-trial-handle=3292,i,4390480847771223185,17614901066490414239,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
      4⤵
      PID:1928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,10361282830484574003,9631181263483385995,524288 --field-trial-handle=3292,i,4390480847771223185,17614901066490414239,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
      4⤵
      PID:2372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,5247282140987834293,8316796751063980313,524288 --field-trial-handle=3292,i,4390480847771223185,17614901066490414239,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
      4⤵
      PID:2824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5260,i,5106166777238878148,14547961867619846566,262144 --field-trial-handle=3292,i,4390480847771223185,17614901066490414239,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:10
      4⤵
      PID:1164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,17153660915612464913,1830542232386885231,524288 --field-trial-handle=3292,i,4390480847771223185,17614901066490414239,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:14
      4⤵
      PID:4836

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6000

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5156

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3408

C:\Users\Admin\AppData\Local\Temp\ZqousPerm.exe
"C:\Users\Admin\AppData\Local\Temp\ZqousPerm.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic computersystem get Name
  2⤵
  - Executes a command shell one-liner
  PID:3200
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get Name
    3⤵
    PID:5300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic cpu get Name
  2⤵
  - Executes a command shell one-liner
  PID:1724
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get Name
    3⤵
    PID:5052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic computersystem get TotalPhysicalMemory
  2⤵
  - Executes a command shell one-liner
  PID:2348
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get TotalPhysicalMemory
    3⤵
    PID:4544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic bios get SerialNumber
  2⤵
  - Executes a command shell one-liner
  PID:4584
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get SerialNumber
    3⤵
    PID:900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get SerialNumber
  2⤵
  - Executes a command shell one-liner
  PID:3256
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get SerialNumber
    3⤵
    PID:4940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic computersystem get SystemType
  2⤵
  PID:3408
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get SystemType
    3⤵
    PID:2944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get Version
  2⤵
  - Executes a command shell one-liner
  PID:2864
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get Version
    3⤵
    PID:4928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get BuildNumber
  2⤵
  PID:248
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get BuildNumber
    3⤵
    PID:684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic baseboard get Product
  2⤵
  - Executes a command shell one-liner
  PID:996
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get Product
    3⤵
    PID:1244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic baseboard get SerialNumber
  2⤵
  - Executes a command shell one-liner
  PID:3172
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get SerialNumber
    3⤵
    PID:3948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get IdentifyingNumber
  2⤵
  - Executes a command shell one-liner
  PID:5524
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get IdentifyingNumber
    3⤵
    PID:5496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic nic get MACAddress
  2⤵
  - Executes a command shell one-liner
  PID:4636
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nic get MACAddress
    3⤵
    PID:4368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic bios get Version
  2⤵
  - Executes a command shell one-liner
  PID:3480
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get Version
    3⤵
    PID:2180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get uuid
  2⤵
  - Executes a command shell one-liner
  PID:4360
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:3768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic cpu get SerialNumber
  2⤵
  - Executes a command shell one-liner
  PID:1184
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get SerialNumber
    3⤵
    PID:4888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic cpu get ProcessorId
  2⤵
  - Executes a command shell one-liner
  PID:5212
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get ProcessorId
    3⤵
    PID:3516
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\void.exe C: 6521-92c2
  2⤵
  - Executes a command shell one-liner
  PID:1032
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\void.exe E: ba08-e7a9
  2⤵
  - Executes a command shell one-liner
  PID:4648
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\void.exe F: 1a95-fb75
  2⤵
  - Executes a command shell one-liner
  PID:2180
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /SU auto > NUL 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4892
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /SU auto
    3⤵
    - Executes dropped EXE
    PID:472
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /IVN "Dell Inc." > NUL 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4508
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /IVN "Dell Inc."
    3⤵
    - Executes dropped EXE
    PID:5520
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /BS "CN7115276" > NUL 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5072
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /BS "CN7115276"
    3⤵
    - Executes dropped EXE
    PID:5820
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /CS "CN8576189" > NUL 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5952
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /CS "CN8576189"
    3⤵
    - Executes dropped EXE
    PID:3100
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /SM "Dell Inc." > NUL 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5684
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /SM "Dell Inc."
    3⤵
    - Executes dropped EXE
    PID:5456
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /SP "G5 5000" > NUL 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3664
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /SP "G5 5000"
    3⤵
    - Executes dropped EXE
    PID:2632
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /SV "1.0" > NUL 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1620
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /SV "1.0"
    3⤵
    - Executes dropped EXE
    PID:3960
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /SK "G5 5000" > NUL 2>&1
  2⤵
  PID:4884
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /SK "G5 5000"
    3⤵
    - Executes dropped EXE
    PID:920
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /SS "CN3341138" > NUL 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4724
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /SS "CN3341138"
    3⤵
    - Executes dropped EXE
    PID:5160
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /SF "Dell" > NUL 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2880
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /SF "Dell"
    3⤵
    - Executes dropped EXE
    PID:2092
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /BT "1.8824.4094" > NUL 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5828
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /BT "1.8824.4094"
    3⤵
    - Executes dropped EXE
    PID:3252
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /BLC "en-US" > NUL 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6004
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /BLC "en-US"
    3⤵
    - Executes dropped EXE
    PID:5968
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /BTH 2 "1.8824.4094" > NUL 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2268
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /BTH 2 "1.8824.4094"
    3⤵
    - Executes dropped EXE
    PID:4784
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /BLCH 2 "en-US" > NUL 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5520
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /BLCH 2 "en-US"
    3⤵
    - Executes dropped EXE
    PID:2244
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /BM "Dell Inc." > NUL 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5820
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /BM "Dell Inc."
    3⤵
    - Executes dropped EXE
    PID:4944
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /BP "G5 5000" > NUL 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5288
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /BP "G5 5000"
    3⤵
    - Executes dropped EXE
    PID:5304
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /BV "1.0" > NUL 2>&1
  2⤵
  PID:4004
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /BV "1.0"
    3⤵
    - Executes dropped EXE
    PID:3100
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /BA "14232216" > NUL 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4048
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /BA "14232216"
    3⤵
    - Executes dropped EXE
    PID:3176
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /CM "Dell Inc." > NUL 2>&1
  2⤵
  PID:2364
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /CM "Dell Inc."
    3⤵
    - Executes dropped EXE
    PID:2056
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /CV "1.0" > NUL 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5680
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /CV "1.0"
    3⤵
    - Executes dropped EXE
    PID:4324
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /CA "27954312" > NUL 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4412
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /CA "27954312"
    3⤵
    - Executes dropped EXE
    PID:4768
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /CSK "G5 5000" > NUL 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4220
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /CSK "G5 5000"
    3⤵
    - Executes dropped EXE
    PID:3032
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /CMH 3 "Dell Inc." > NUL 2>&1
  2⤵
  PID:952
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /CMH 3 "Dell Inc."
    3⤵
    - Executes dropped EXE
    PID:4756
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /CVH 3 "1.0" > NUL 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1664
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /CVH 3 "1.0"
    3⤵
    - Executes dropped EXE
    PID:5496
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /CSH 3 "CN8576189" > NUL 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5704
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /CSH 3 "CN8576189"
    3⤵
    - Executes dropped EXE
    PID:2180
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /CAH 3 "27954312" > NUL 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4448
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /CAH 3 "27954312"
    3⤵
    - Executes dropped EXE
    PID:1672
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /CSKH 3 "G5 5000" > NUL 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3704
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /CSKH 3 "G5 5000"
    3⤵
    - Executes dropped EXE
    PID:3680
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /OS 1 "Dell System" > NUL 2>&1
  2⤵
  PID:2244
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /OS 1 "Dell System"
    3⤵
    - Executes dropped EXE
    PID:4308
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /OS 2 "G5 5000" > NUL 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3912
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /OS 2 "G5 5000"
    3⤵
    - Executes dropped EXE
    PID:4796
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /OS 3 "" > NUL 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2560
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /OS 3 ""
    3⤵
    - Executes dropped EXE
    PID:436
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /OS 4 "" > NUL 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1104
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /OS 4 ""
    3⤵
    - Executes dropped EXE
    PID:1472
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /OS 5 "" > NUL 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2352
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /OS 5 ""
    3⤵
    - Executes dropped EXE
    PID:3060
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /OS 6 "" > NUL 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5436
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /OS 6 ""
    3⤵
    - Executes dropped EXE
    PID:2144
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /OS 7 "" > NUL 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1232
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /OS 7 ""
    3⤵
    - Executes dropped EXE
    PID:4768
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /OS 8 "" > NUL 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4996
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /OS 8 ""
    3⤵
    - Executes dropped EXE
    PID:5824
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /SCO 1 "To Be Filled By O.E.M." > NUL 2>&1
  2⤵
  PID:5840
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /SCO 1 "To Be Filled By O.E.M."
    3⤵
    - Executes dropped EXE
    PID:1244
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /SCO 2 "To Be Filled By O.E.M." > NUL 2>&1
  2⤵
  PID:5576
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /SCO 2 "To Be Filled By O.E.M."
    3⤵
    - Executes dropped EXE
    PID:2440
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /SCO 3 "To Be Filled By O.E.M." > NUL 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1092
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /SCO 3 "To Be Filled By O.E.M."
    3⤵
    - Executes dropped EXE
    PID:440
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /SCO 4 "To Be Filled By O.E.M." > NUL 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5968
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /SCO 4 "To Be Filled By O.E.M."
    3⤵
    - Executes dropped EXE
    PID:2180
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /PAT "Intel(R) Core(TM) i5-1623" > NUL 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5656
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /PAT "Intel(R) Core(TM) i5-1623"
    3⤵
    - Executes dropped EXE
    PID:3516
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\winxsrcsv64.exe /PPN "46066184" > NUL 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3096
- - C:\Windows\System32\0409\winxsrcsv64.exe
    C:\Windows\System32\0409\winxsrcsv64.exe /PPN "46066184"
    3⤵
    - Executes dropped EXE
    PID:936
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C C:\Windows\System32\0409\arp.bat < NUL > NUL 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5724
- - C:\Windows\system32\netsh.exe
    netsh interface ipv6 uninstall
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5084
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall set rule group="File and Printer Sharing" new enable=no
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3020
- - C:\Windows\system32\netsh.exe
    netsh int tcp set global autotuninglevel=normal
    3⤵
    PID:4988
- - C:\Windows\system32\netsh.exe
    netsh interface set interface "Microsoft Network Adapter Multiplexor Protocol" admin=disabled
    3⤵
    PID:3176
- - C:\Windows\system32\sc.exe
    sc config lltdsvc start=disabled
    3⤵
    - Launches sc.exe
    PID:5668
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall set rule group="Network Discovery" new enable=no
    3⤵
    - Modifies Windows Firewall
    PID:920
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" /v DisabledComponents /t REG_DWORD /d 0xFFFFFFFF /f
    3⤵
    PID:2616
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall set rule group="Network Discovery" new enable=no
    3⤵
    - Modifies Windows Firewall
    PID:2092
- - C:\Windows\system32\sc.exe
    sc config lltdsvc start=disabled
    3⤵
    - Launches sc.exe
    PID:5496
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" /v DisabledComponents /t REG_DWORD /d 0xFFFFFFFF /f
    3⤵
    PID:2404
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v EEE /t REG_DWORD /d 0 /f
    3⤵
    PID:4296
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces" /v NetworkAddress /t REG_SZ /d "" /f
    3⤵
    PID:1792
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v ArpOffload /t REG_DWORD /d 0 /f
    3⤵
    PID:628
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v TcpAckFrequency /t REG_DWORD /d 1 /f
    3⤵
    PID:4516
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v TcpChecksumOffloadIPv4 /t REG_DWORD /d 0 /f
    3⤵
    PID:3844
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v LargeSendOffloadv2IPv6 /t REG_DWORD /d 0 /f
    3⤵
    PID:2784
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v TcpChecksumOffloadIPv6 /t REG_DWORD /d 0 /f
    3⤵
    PID:4488
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v UdpChecksumOffloadIPv6 /t REG_DWORD /d 0 /f
    3⤵
    PID:1732
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" /v "Dhcpv6DNSServers" /t REG_BINARY /d 9247087579062406638529390638 /f
    3⤵
    PID:3020
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" /v "Dhcpv6DomainSearchList" /t REG_BINARY /d 6726504914883631144072290030 /f
    3⤵
    PID:3196
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" /v "Dhcpv6DUID" /t REG_BINARY /d 3003137704381310388244523804 /f
    3⤵
    PID:3176
- - C:\Windows\system32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:2432
- - C:\Windows\system32\ipconfig.exe
    ipconfig /registerdns
    3⤵
    - Gathers network information
    PID:2144

C:\Windows\System32\0409\winxsrcsv64.sys
C:\Windows\System32\0409\winxsrcsv64.sys
1⤵
- Executes dropped EXE
PID:3556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 44a0f674b9e4ee576e1e1049a47182e5ca3b1801a2182e0da6b18f8419aeea96
MD5 c42fa73f2eface3ad4cf00a96c4805ba
SHA1 267b7cd079bf02be569a999e59ae16d58be97598
SHA512 acd7261cf5efb595152d652b31cafd0957d2c8210d5fa050a08ee9f42e328229ca34e861290783f38cd30bef9d65ecf7d9fdf8d9af8dd12b8410ec6febe5658a
TLSH
T175D023255225BFCAF029B27571E13694B539146399459AC62504953D8C7528207F3CFE
MD5 SHA1 SHA512 TLSH

Submit Download

56a452d9-14f8-458d-9e18-0da6f15304ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\56a452d9-14f8-458d-9e18-0da6f15304ae.tmp
Size 13KB
SHA256 33396682fc71f14de25410967ca3c24bf25587de14eb6d11dcc188ac77eb8a95
MD5 0fbc2472b4be59354372a3b74f1abe52
SHA1 1d71a8fd10ca27cfcf2c3b61b02717462d581ef6
SHA512 e7dd43e9e8023f300b025327b219c951de95a164af46af4f20dc7540b3a5433cd3c728dec5a8c7e87eff193c89857d7c37a1459e9fd4ccd5a8ca63f4c17086ac
SSDEEP 192:sxRqRSCy/fOs2WpVEKpZ/g9zoD8pIwL/g6+WNyaUT/lKW7G4uOEGUiIgVGudJ:sxRqry/fOs2WvEKn/8I2/5M/1dF
TLSH
T15052A6165928AD3B8CC7D61DFB65BF63D3F91022A1D51E44EAFC8A1C04EB6DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 a6b31c6d18cd2a4c20cbd6dfa00d84e5f077c0e93e33c0e5f0dbbec6be7ddd28
MD5 295c81e18c25efbd35959a24145f1c78
SHA1 47342d533eb1441f29e0226b3192cd520f337e93
SHA512 603f4f67a06b49ebf64e4a62a7681bce02f25d511f3a94d6d6aeb444e8fcb94c27cdb733ac57a2448035e056998596d9711c32de02217eba463bf16e6e95334d
SSDEEP 192:tAea9pLEoD1UcmoJkqVqxqdDjWRV5c5GSbw4A3rx+uc6BcG0Ra8oF1ht1wIQU7V:tANKWUcm7VkAbM9RFoFjgIQU7
TLSH
T118135F7E32204D56C3D3683C069B6F7423B2E62CE2C466534BB17E995622F22DCDD61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 647444bf49038528975265a1dd036d54a6a48a7fdf0ac02e65a4c43def19e51b
MD5 8045527b9b12a3993ea0c72f3f42fe3f
SHA1 496be49ee969554f69f241e5d8d276137aced741
SHA512 01fda3dfa56111d8f5f63e581ca6ed200fc2cbe9148a5a670a6b2a9ad9393da363297b90e9546817cd5183c81a7d78b0f6a63d003a0e314f80a47ae2456441c8
SSDEEP 1536:+DHa7eHYL/MVL/XNvgCAbCLNrrH6+iLniRuegq5aT:+G7bL/kL/x/iDq5
TLSH
T1534460F70911A01BCBA512F5E2033A3ED17B411E7CD1E9AAE27C5CC12865F35B6F8A85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 367f76ac0ae466ead6ed1a5c200b6d63e8b7cf29a0a5f82313d11732cf2dd8b1
MD5 759abcf95440d03adaa93974fc59711c
SHA1 2b3c0f3a11f5c1bb2dac94e651c5804ed1a69e7b
SHA512 4482a79c57598959926f506d16cd16c37b48e7ca1840486e6fe2c131357bcca9123ae8641f860bbd6129b6ed65e723c211d89dad26d295b8dd6f721f92249359
SSDEEP 1536:ui49G+PFuAukMkHF2uxWHcnAmyWPWRX8DQDz+2aRKsPR9SOsBcSjdpyQa6N0akDF:uv9G+9/Dc9HBmc8T80LDnl/SDkfT3Mt
TLSH
T17F253BEEC7681C82CF67CB70B4E0D81B7E702182BA9DD0D35940C5E957D6B8176E82AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 86d9ab0ca24f38537f1daf09ccc3394ae4f4ad0574b50d62f390f6df667501df
MD5 7df5f2780477781bfd2fbcd694b7bd20
SHA1 626b0fe8928aee94b87b2555a44c4657879deea2
SHA512 1461d71cb98d749c1c3c753638c6ea6280259e3dcd6009d9856f9863c778c2bb29d2231ddbc11d37da5a2ea84b39f4e05e486bb591f1f8588737667b0f7f7481
SSDEEP 24576:ZHgFXZik67L38Jc1lvd4+WlamZTlCrpxMqh/i:ZA5Q777VXdu7lCrpxMqk
TLSH
T106167DEDCA6858C3CD639A30B4F0E9477C7413C3F595C1D6889CC584026BBC5BFAA66A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 58b7a2cd86a226335ea793fa607b8e75c31a6f1f82d5da32cc11eade749f6bcf
MD5 b918ce9b429f1ce06008f4c078e36806
SHA1 88746b7ac79c591ee367d9baab14087c330c15c3
SHA512 51ce8f54f47af3f7d972b3bbcc6b0dcd566a581c2158610511254df5ce1bc858173befbf56f5529aec86378a9b61562fa5226828e8755c6a26af8ebb2cb7d4d8
TLSH
T12661C58E03321AC0E7A764B264E5559833F6A20A0A0B6F731750AE337947F29E1FE113
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a2462.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a2462.TMP
Size 3KB
SHA256 03dcf33d8d5ea21ad0ebf82859085dc79ffd9b58062ac4b60af3a4323ee2f125
MD5 21a060cbb511316ded3d3ced3d559f34
SHA1 f021d14cc9ae665d41ac51d4b7f41822a1fb58e1
SHA512 b1bf0dfb62bda41fe5385bad21fd89644336cccc9a1430a834440c729a11de0f67fe835164f09c494b928b0400c76125106a38d3626ef7e028de6b59cb139f50
TLSH
T17651B69E03221AC0E7A760B664E4558937F6A60A0A0B5E335754AF337A4BF19E1FE113
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 7af3e39800b229906012de655723b3edcf247f0d200a11877ab739ea7ad23218
MD5 11c00ae61b56156fcd071639fcb1c440
SHA1 8dc4ff1566e6a28c92fd3f1a2a39479fc98ab252
SHA512 60fd5852c69b238eab90a17a954d68ee40ea833ce055def051fef5e3779ad19c376cfb5a08cffab14ff844c3461ea68b8d1190e5a7c10a1e8616f60a86db03a6
TLSH
T198E0209555CBC19E595074C35168671CC3C17547D685AD072B04ECC4FBD2451B7C5547
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG
Size 322B
SHA256 c3b7c0f6f837831379f1a493cd2382ae25e764bebbdda8452012945af4b977de
MD5 8bd4d2b5c8ebe30d12057c21060edf37
SHA1 27547b19ff0d3b4a7303efdf8508416239b8f1cb
SHA512 a756667b0be8e8b08f3b36e09524f7b7058f72df565bcc597a55605f56105eebf0d104f02e7f7cdb42fa9d832b91f94860dc868282fb28b63eb0975b2aee3d3d
TLSH
T18EE0268F18CAC3AB646874C3C2A9A30DC3A2360BE3883E035F0C8CC5F042515B2BA285
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG
Size 326B
SHA256 842a8990e078d4f4b9f6b8b2b4003543d62ec1afaa7aa866607cb1bdcba1ed6f
MD5 ea03d93d993b8dac26b1bde8a88b8369
SHA1 1ef45909120ab9bf7c70d9a44e6f8011703fd70f
SHA512 df73cdacb2d31be23c2702d65cce84994a67018182d130e65003b3ea0ffb2a036e63d40c35ed50ab3d0ebc480f9c7ed025cae0fb116b278fbf762649a9224525
TLSH
T1D3E026CD08CAC26F506468C3927AB30DC3D23603A288BE022B08CCC4E06660AA6B7281
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 285B
SHA256 fff9c841af450dfefe7f284f645d4a26b048e6bd5709ad766b308172bc260a53
MD5 785c71b68bf89a0e9973e06d76434ab1
SHA1 2eb96ed892a724f5f223fe37abbd075d448d45e3
SHA512 a84d94a4b22d325a41b84c193a2e279bc3969085d87eda3fad0dc1032989bd26e67aba7cefa085838590e5aef8958c40e22a000d158fd80782b614dcdbc55030
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 07f74267f86856005114f331f1a8662e3ecbfa3bfa5d122fdca819cdba8e7ec4
MD5 e735a407773712b03ec831620f593dff
SHA1 77c0f021ede42a5d1bd933ff94c4021f16c11b08
SHA512 f2cdcef5c1b6d2cf95e1ac6d79cdd7efe9b6d8f87a6b15ef8b381b542d5b73c1024969b310cf1c52053dfdf6489d339a4594797c30397ee9bd145218b1b8eb74
TLSH
T1E5E020CC54CDC21A54EC64E3426C730DC3D03A43A6847E011708C844E1425416259142
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 cbf5a7171baf68208f4bdf793baa0f946266646e7f5efbc44293d49f5006a5ce
MD5 81b730e24095cfea3fd317656e0edf79
SHA1 ddfb09185def3076816a7d9523f98e2a5cc1df15
SHA512 388150adeec54ca76b329397a7b9a66e1f0b6f88e24bd8b9b907ea67d46ce856079a4b0908bec871bb365a0195e1f57423abdebb5b573f948aed73f9d3abdc57
SSDEEP 96:rzgU97tejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/9lw8bbEOVpZf24JkMfXSFRe:rkU6H+bF+UI3iWGVoWN3qL/Q+VVV63
TLSH
T138240F4E5F342722CDBD913669E744A35C7DF03F8B1366DA6C6114B5CEE2642A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Size 8KB
SHA256 e33b66730f5f5ab9d6745dfa030f73890f29c356197fd1069b0acb4a9bd0fb44
MD5 71a5e7547b265c176abbf5f9c14b8dbf
SHA1 e029a839342b488de214510333b3e39fbe81ba81
SHA512 997fe8e433b3dacaf61ef6ab4c69fe60a450d6d4c007e300cce83cf1f0dca6d132c0e709bc409fd65c323fcb095814643c329c25aadbe47990667bf7a5a97291
SSDEEP 3:D1Ml93lljq7A/mhWJFuQ30VkWUyl/4dwenqFtjE9SFcTpL0WWaV1vGrV9RUIYmn:pME7/VkUlQd4FS99pLTB1eBvn
TLSH
T15F028C924B609873FC08EB3DB2D742EC2FB37E0C8952CA01800CCC510EC1ADCA24845F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 2144f97fa57fdcecf86f89462f19000ab62880441d61d00674bf7cf4ea17baac
MD5 a8a5da27f013a4b2ebe3819b3b1eaecd
SHA1 7173caafd7520cdb3608f3c2778d31c419156cbe
SHA512 427742108611deb0f46954f6dc1f19fb3c32ac0b93224b0b75099bd2939481af8f7c63731ae6f6a7508cd6e4fdd25444c2f5f779639eba223425cbb51035f2e4
TLSH
T19FE0DFE544DEC23EA664648B9228B74DC3B03647E6C87F026B089889F99B504A6862C2
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 f74f6c0d7c54904896fc7ee81658b1d8d50af1c2e9dfed288a08c508b6e95198
MD5 1dda325b68b663a87774afe47bd4d80c
SHA1 feec7c479b5353b4796a0242115167a2c6b05e0c
SHA512 c546dbe8e61c85a4010be25730e0f53c643b3d687856795de65c3dbfaf8093dd8c912e32fd9fd23f2cad05735304608d5a777cce210e404c606a6051b2290717
SSDEEP 48:Txk/LopFMaty423w/a9NUuTtw734s09MinCXogwh5Ve83DN:qDeMatha9rTl9MZnK5VJ3h
TLSH
T1E2B2B90E0F206251D1F54B72EFD089672E3C211DC3B3274D9D1860F2CE531ABFA4916A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 ecea99d8bcff64cb09731d01154e1bb1386e772ab0bd55964c0f0c24a76a412a
MD5 a0eca77a41e285c3c87f22fdb42ab698
SHA1 efadb0223eba3073fcccf19d536e004153cc809f
SHA512 7a81a9bad82ac66e8c56be511491407420eb98f1a32f78728992fc36bca0bf51640b473b252db35fc97d950c457d5588cea8cc246ecc82c770266c40dd52d41c
SSDEEP 96:DesmaViZjhnwZ2zbIz5FvF6tfBF1ElFQn:DebaViZjhn42PIz5FvF6tJF1oFQn
TLSH
T1F1917CF783F48A6DCE1155F0AE146F1FCE590526436C3D2689E4AE2B93F2471E240A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 80da1d4dc48f2c07eae951a39768986e4ce2a64b4ea3b06c3f8b8d4bba86942f
MD5 843af49f608b5b4e3f02098784be3143
SHA1 ebfbb328b44989c27960369b4727157f12ea662b
SHA512 c3730fcfde52846b46722457d8a9e3b4e6000dc667db87bedee8e4b25596fedf0fe2b7ca641f5175799611126b8b278af3c4ddc2d51d7f584c44395a18a84933
SSDEEP 96:DZnOVaVZjhqzDz5FvF6tfByElFQAw6Ewox:DZOVaVZjhqHz5FvF6tJyoFQATEwox
TLSH
T1E2A17DF783E48A6DCD1155F0AF146F1FCE5D0525836C3D2A89E4AE2B93E2471E240A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 6e680aa4975e5aa932bea9e14c24f59276960b4bd0ed7ffd4a38a1db4f96e947
MD5 aab83282afa6d3ed65df950f475c3ee5
SHA1 e1a1185728077c438033cc91589ebffe85371869
SHA512 2a353d5be7fbb67cd520c7179c91f435e8f1e1d30ed00685e7303ccb2494951540c2548a8d8f044ecfc20fef48d3c21819c94b28ae1a0128ea6469b9c102c8ed
SSDEEP 96:OIEumQv8m1ccnvS6S5h4LL9JrfofHYnFrRmwg3r4g:OIEumQv8m1ccnvS6S5h41rRaF
TLSH
T147F200F713635609D95454B0E884AB8EAF16001B07B266EC67C05EF3F3E20E2F679745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 847B
SHA256 8e70152e75d3acbb1d583ce5e05919c0b4a895c7b1e7c4469f0f0588863197aa
MD5 2015175748073409803fad44b746601a
SHA1 6414fb158758e9a6a1d5fdd224320ea3d5fd7d41
SHA512 cd729b17c08136723e8dd72a3c36361437eaf173ed55a376db3771cc2f9451d572f0e2df57ddb43cd5497ebbbb6e5fee729a8b28f489621e3e369e9ef3361f5f
TLSH
T122014CA7A47FA12BA078487E0D40FC4779BAEC32C64198F8DB9780BCB0C29A35715436
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 eb22a85aad9d8f2fe621d94176e8abb35a8e7127e5efad11a904e01fe7ccddfc
MD5 7523447b7013fc1b871f491e8e7c9cf2
SHA1 cca2ada79221367e759c3bcc6ddfa61f4a3d07e4
SHA512 e6c73a16db0561f59a2eb38663a9ad4cc350de26bdf7c502dd4e4e6b2697b02f1441d1b94dc6300ed597e0b25bcdd6d4aed6e749d4b61c1eef3321df453cbd93
SSDEEP 192:sxR1RSCy/fOsSWpVENpZ/g9zoD8pIwL/g6+WNyaUT/lKW7G6uOEGUiIgvGudJ:sxR1ry/fOsSWvENn/8I2/5M/Bdf
TLSH
T10752A5165928AD3B9CC7D61DFB55BF53D3F91022A1D61E48AAFC8A1C00EB6DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9c6bfee72754ee86e93942aca1ad05146d901dc2c186a23878c4af060b1169b2
MD5 e127f884e9e994eb75374666762d0cfa
SHA1 5127393840fa618d4e0757c0b7122998a9afd8a5
SHA512 1650f3eae182dd6192c2f856e245a2a973366ebc8496d5d0bfe7d55d33d87df8e207d7f8ea5a1484671f7da06ce38587065d79ca017d6608d501c1ca573ef755
SSDEEP 192:sxRqRSCy/fOsmWpVEtDde5lSUzoD8pIwL/g6+WNyaUT/lKW7G4uONgUiIgV9OJ:sxRqry/fOsmWvEtc5lPI2/5M/1O+
TLSH
T1D052B6166928AD3B8CC7D61DFB55BF63D3F91032A1D51E44AAFC8A1C04EB6DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d5868529455b05f55acf25bb407e306a03a4481e36787e2bb6bac4ec3fa7774c
MD5 32ba0cc4449a05b08b7c68b921099def
SHA1 b02b99697f6df3f19edc14fc2d700269b36b12d1
SHA512 b2a225533529d82f4154a220ea27c3888b0fb38a091a8f83c4c0bcecf54220a4bcaaf9aa1ddb35a64f13c859ef0f9d9bd0b5f0cf699a4d33835bb78e220ed508
SSDEEP 192:sxR1RSCy/fOsSWpVEKpZ/g9zoD8pIwL/g6+WNyaUT/lKW7G4uOEGUiIgVGudJ:sxR1ry/fOsSWvEKn/8I2/5M/1dF
TLSH
T10652A6165928AD3B8CC7D61DFB55BF53D3F91022A1D51E48EAFC8A1C04EB6DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 9501d391586d81cb337aa24af773d00274fdc2e13a8624c000ec18a2405e3e32
MD5 4b6c4552e1c6d078db3ba7316b02747b
SHA1 87b1b19a6c57012bac1bd681aaef9420715d4983
SHA512 0f02bd5065d8508692f4ba011983d38e45d856fa802c23de1fd1113bca36b975cc080031ba56141c0849782c6724b7b0933e1a933a1820d91e7042ddb1f3ace4
SSDEEP 768:jC+vAN7pLuL7JQWgQ+fk+8F1+UoAYDCx9Tuqh0VfUC9xbog/OViQqcNroZI:jC+vA7E7JQWgQ+fk+u1japVcm2
TLSH
T125C2F97B340CCB7F4F800ADDEC197E9B6DA802CB5698CD8047FE941C02C6BEA52194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 19005d914f9fe38a2c7619253a06dba16dacd719aca80a948d8ed3bffc256c60
MD5 a78516167e28037c9661a19e8234ede2
SHA1 4f131dafe138c69fc1c0b7edd0ebe6eff337de9b
SHA512 50a35957a9f450b4802385f8ec3a85c72a60627668ed0311a02d1c303b1a631bb4299c3028dac8a38a94104098bbc971716973cab287f4e95491a965e603ad4a
TLSH
T13AE086980ADBC27E746930CB0668930DD3E47617D6C87E82AF44EA84E593E58B197286
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 e9a344fa1b71dad35c41248c676e70fb7f33690697875b412ebc1a986ccf37d6
MD5 a67c994fa5991bb3f9d5d451db0f4b13
SHA1 957c76a4336362e10abb33ce41a54f5b3119435f
SHA512 65a5956641e454c4ce268523d661076a85a9013fdce57c207003701d4e90e72111ecf6ed0dd7a41276ebdae53295a8baf129d84bafc0f1d4b98feef1724f40ea
TLSH
T10FE0D8642ADAC32F719930C79238F30E82A2B603DAC8AE526B08A484E347E407247281
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 a6c7a18a56e77d4a5930ff839de7ee3b4e12ce66bc5b042d45fdcb782ab115e0
MD5 4b3092d0c371914be2ed06b8e480a5f5
SHA1 802f468e6613fa09923eaa965c8512d4d03d1d83
SHA512 f4f31b848a2bd524e73c12f8127f1c44883232498b9bfff90f8b816c9b89b5c5fa18ab860106e50b99cad0c8355bde0ee4376959730965ab4222b87751b4fb4b
TLSH
T105E026B446CEC37A545874C34268A71EC3F17A5793C9BF0257089884F582910B2AA191
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 c2be52ff886220836d06b6fbcff00b2f1b539c85543d47a2acedb01d72988e5e
MD5 655d6729be22df4206c6a10715d8b412
SHA1 ad8c98f7ba708290ab8c622482e9e712985b8b19
SHA512 d6a77cc8906c10df6ba5ed0098234fb9f3953d6753975950bf42d19e022d94fbf4a6b63464ace749bfc113b1449b72c95748be9b7c1e2ba22ac97b7fe0d15db4
SSDEEP 384:DNrRZyCSDnxTICYMEhIKyll7svbFKfk7:xFZJSDniQyI1l7svbF9
TLSH
T12344730A7B747001EDE6D9725CB080771E3C716D8F22E6916DA254698EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 497B
SHA256 b96d4f9fa061cad8b95fd90c56a632c702daeed0f4f4daf827d0375ef0699dc6
MD5 b79f5eb5783f49873bb6f7d2246e6f3f
SHA1 392e4c40f1a10ce5abb6a3630d4a95495ccaf263
SHA512 28c3819894645fff46ae473c15b26b3931159b9645ca87996773b231edff67d53eca79add47c8550167906c67511f9cf9ddc0e32819cc16fd8cb567a37e362ca
TLSH
T1F0F0C2C76E021977CC12547150336783FF6189CB0424B46743CD246B5A2D2F1C9CC0D2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 6322bcf73eca969c3e5ac150e5c5c859708ea6bc4823e6cd77b2d4ac5c1fc3b8
MD5 c6ed5eee1bdad35bdccd769898dffb3a
SHA1 4b59258fd344ff22c979dd2d115d6d60d2540c12
SHA512 d46201809438748eaf7e49ecf0df865a2923daaef403ab7417196f5193d28a48ed3bd8392f67dc12d0e765fa437563723dc78c7c8d37e38551139403ed55a5ec
TLSH
T10FE0205854C5C29F74E574C71138530E83803F07EA842E451F04C888F4825107659152
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 8213d620e47aa2704849c5f5bb859d0bc95ab691a5b8cd8108471d70d8e4f1c6
MD5 c2b370abfecacf011ac63ff74a28e5b8
SHA1 9151342b961e1a33e234855b6b1826d57672a96b
SHA512 e167a23833d4492d51671c92545be9d1071f4463eb2a39c674f3a7b40413bb43bf69736107ccb22ba7765ae05a8504c43d624d3e480cc5a6515a82c9c6432db3
TLSH
T1B5219256F330C004E25D867E506F9B351738E8528FBCED0F857920646E76A180E4B6E4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 125297190c59996882973ce9f91cba618cf2412b891d41fd10ffffc477e12d86
MD5 287067a560efb3d8ee9f9cd517434549
SHA1 f22c8b5ae9289527233207782901783510fd9f13
SHA512 80661dcff0b66165b440277f713d85f7e9f18b0b0ced64410cc17e37727632f1bab78112f022b6ade02b60a1b0771f1d0dd2aa229af13a7204939c30ce195bde
TLSH
T1F4E0209874C9C2DF51E164C30178A34E83913E03EA843F451F00CC48F542555775E152
MD5 SHA1 SHA512 TLSH

Submit Download

9199de6d-0e2b-4eba-a1eb-c49a271b144e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9199de6d-0e2b-4eba-a1eb-c49a271b144e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 7267f3231e29512c53542a09b0e5b183008536f4cf51eb7512a139acc3c57776
MD5 405788aa5304d6db94eca4fda61e59eb
SHA1 08ce0d3c334e8dcc44d078889e8f2ce8822ae0df
SHA512 bd5edfd869ae1601ab644ec4bece758fbd26dbc35e6cc2a3fc2f9acedac76f97cbca24773a2158bc3170a60d59c5395d283a87a47bae10c09d77b557f1e654e8
SSDEEP 3:MsEllllkEthXllkl2zEflSQvhs/ll:/M/xT02z/Qyt
TLSH
T10B4404447FD0044DC70010744051C3501371D4110531574734D104335CC75550C000C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 02eeb911c3c068d0f50b8f737c1183049c4a6c6ae3102eb5024e8d5b8fd1f435
MD5 cdd81a86ccef94acd6df4ccb7be003e7
SHA1 16f001a774c2b1d89d710355f1e0b95efc2714e4
SHA512 a46e302cd8111111c010086f5c5aacb576ac3d4892183bbd3ecbfe8beace9df828f92b0e260a90754d7861d70f5379f482a538148e152649ed1e9b4a49efc493
SSDEEP 3:MsEllllkEthXllkl2zEflJR+/l:/M/xT02zmR+/
TLSH
T138440404FFD00C0DC50030704151C7501371F4504531575335D304337CC75510C10400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e42250029c681a68d2324f8eabe2e7d3b7f763e1ad87d1f9e0a7683323f18bb0
MD5 9da1247102f49ca6c24a9facec7e07b6
SHA1 9689bab86f835f682c1717966896d8dc9e969230
SHA512 ca8c834865410603608e1e17ebcb7cf7a7df240b4aea93a99cd08bc4454c92ded6926a85498a96ac07bec7aab5bce525d5e288e19c8b2834e81cf783347d7f26
SSDEEP 768:Prv+4UNbdM3BwzHi0p8+p3bd66j+4BRv86aLIF18f:Pbsb63wiC8+p3Z6n4yeU
TLSH
T14303AF72F8ACDD338CE6C644B15776436FB820A399C10ED4D9D9AB5D018B19E2B0F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 92de5fe419e7d4220c60b722fcf6a473db4b05f9069ade7c9e9e57cbd10856ee
MD5 baaeab659c41ee6dc4eab3d47e2bdf92
SHA1 4f23f565f2e4460d5dc6de420f1e097e2ca4b502
SHA512 9461d6f933696efb08d954ab61218cfe947e9657edda4d2d70f5045e761d626fb7686d66e953bf158dfade4a6d56db7bfcf24700b67ea0a21cc6e80bd4c96fc5
SSDEEP 768:Irv+4UNbdD3iceNp8+p3bd66j+4BRv86aLIiO2bwCl1:Ibsbp3wL8+p3Z6n4yE0ww
TLSH
T19703CE73F8A899739CE6C644B2467A437FF821A396C10EC4D5DD2B4E419A19E230BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 65KB
SHA256 c1252ea59344d8dddd8d953037969d8c3b1fe13251972a4aa57e765d80fa9d07
MD5 225c34678cd000355317c1531342ec59
SHA1 5105770c94b2c277264c3a21c2852e067cdac085
SHA512 f0155705b324c3eb147283d05d4585d0084a4d566ba3b683dda81de98b61efe6301856ff91ae7fd2576db6c045599e0f51cb3f193d4c8d4ee63ea50b05331a5d
SSDEEP 768:SF0rv+4UNbdM30wgEf4lp8+p3bd66j+4BRv86aLI1oa99xhP2ChSgqxnt94IgM2z:zbsb63Y8+p3Z6n4y0oEhetuIgMD4F
TLSH
T1D4637BF6D9DB893BD8AE9743A33D2E025EBCC163B5944994F7845A4CCC621BFE306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 397ace1ac5519c78b3905a4005c93073984313fdb4c4010544271b6c2ff6f3b3
MD5 c1c6922b6e3ca7c1e0774a1a660b92ad
SHA1 92e46ede64b7c933647acb4e7442ceb488ca091d
SHA512 9589eabebd9c6688660701246b88661446c3270921fbcb1dad06fc8efb0d4a27a135b882243a46cceca7176bea641fac083ad642589c646e7e9b483364470a4e
SSDEEP 768:5rv+4UNbdM3Bw6l51p8+p3bd66j+4BRv86aLIFvx9Upf:5bsb63DD8+p3Z6n4yK45
TLSH
T14213BF36EC589A3B8CFAE740B14B3A036FB8517795D10DA8D6CD5B4C817619DB30B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6c637e6603910df9053fe989ae25cde239d519c3573707716b2ad642d55b6ce1
MD5 4181e0c168c58867b7bedf87454c705f
SHA1 ed2e8f7161725bf738232475cd2b6f4f7a8aab12
SHA512 6addb7c7a98e2446a738a39587984b62d04d32dabaee55869f8c6154f03edf10c1fb21172f74831b0c597c69c51c563b50d610f8d60b085c3d6d89b52cae73b4
SSDEEP 768:vrv+4UNbdM3ewzHi0p8+p3bd66j+4BRv86aLIF18f:vbsb63tiC8+p3Z6n4yeU
TLSH
T18003BF72F8ACDD338CF6C644B15776436FB820A399C10ED4D9D9AB5D418A19E2B0F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 c9fc7da86ee7c41b92f89aa4f00644b3dcb2bbeabc968802840ccf00ed91bf9c
MD5 914cd48d69cdf0e5a1d90dda65613839
SHA1 2337a32cdf5414e9ce2aef3994617d5637ec5aed
SHA512 c2d154a9e0ae4a34c98b1b12e98d99654e1e41b6b4700d49563df7665b9ff7ffa0d770d2b13e242afbc52ee0a304a202c0708b542bda57b2c2d01e0209269f35
SSDEEP 768:Brv+4UNbdD3wNHiNp8+p3bd66j+4BRv86aLIT82bwCl1:Bbsbp38iL8+p3Z6n4yN0ww
TLSH
T17703BE72F4A8E9739DEAC644B18677837FF821A399C10ED4D5D96B4E004A19E370B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 e77660056a857306d965ac559180a39d802f2410952b29f20548d107eb22732c
MD5 72cb5b6b450bec1627766bfe4aee08cf
SHA1 25a5418f021853e8c9e27a9e115487259069300e
SHA512 b648791d77591db014ed928f2d8b0d84cd33c5cdd874b2d95e4b7d26415c1c37d04259cdfabc5ca1ac90b924a532f22e86f932601332dff02badf817b01ef594
SSDEEP 768:brv+4UNbdM3SZzHiNp8+p3bd66j+4BRv86aLIWOL9Nh0:bbsb63QiL8+p3Z6n4yo7h0
TLSH
T1E6139D79AC68A93F88EEFB04714E6A136FA81177D5F008A8D7C55B4DD07609EF707822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 9e24cb4d3da87d2a4f82e05e98884c85dd715b6878df3952faea680f78814f2a
MD5 47595fab9507e4c45048689a00354081
SHA1 771351aaf6924327f2ba31373c3ad969bdc630a0
SHA512 76713addf5ebd8405c40b31f14f179423dea92806892a29196716fc0e5fb18443acde7efcc7bb2d86b438248bf0670bda963995317e411e57c39fc82be69aa18
SSDEEP 768:brv+4UNbdM3eozHiIp8+p3bd66j+4BRv86aLIF18f:bbsb63fiW8+p3Z6n4yeU
TLSH
T11F03AF72F8ACDD338CF6C644B19776436FB820A399C10ED4D9C9AB5D418619E2B0F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 8063e68131496501c18087750c78630f97d725ac2590d0b64d12fc229674d84d
MD5 975270d678ebff3c5589f7ebcc5292d6
SHA1 90f0529c3fabe08c0809b8785f7f16580c0c20a7
SHA512 9279b8b42925dca3fe3e6de260cd6097ed34d1f7ac59f5eb010ea3eeae30f78e2bc74b48bb0eaf9b3d3a4a5c95f0b075522a82c36924272e1a0125659950d9a8
SSDEEP 3:MsEllllkEthXllkl2zEflp5R+/l:/M/xT02z+5R+/
TLSH
T1B44404047FC4144DC5001130D053C3501771F4100571574334D114335CC75401C00001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

1947a789-456c-4240-a88d-86a58655de8c.tmp

Path C:\Users\Admin\AppData\Local\Temp\1947a789-456c-4240-a88d-86a58655de8c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

518fc55f-71ce-4e4e-8573-1f2d85281e18.tmp

Path C:\Users\Admin\AppData\Local\Temp\518fc55f-71ce-4e4e-8573-1f2d85281e18.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

imgui.ini

Path C:\Users\Admin\AppData\Local\Temp\imgui.ini
Size 123B
SHA256 6daecc6f842711f02b0799c667adfe54318f64ba241b52cf25729149787e2128
MD5 a961d8495a1afaea7b127598f538d0b7
SHA1 078748f7c8cc98a45c73e61fd55a16ebf1e3ac60
SHA512 26b20c9a6998af8aa166df8bce916373091c686792090db474699c834927843f0ac91c7681132cff557da9be530f16769772df5c2fabb58dea984a02a12d158f
TLSH
T168B09207732103AE12F7A14052BA67EC75CD6B04B00271E822A402DABE0692728479DC
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4916_1638301263\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download