e283a89bc675b8cc4ed3f4c63e297d8997ac20e7e7bec1c01a9ebb807e1d46d0

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 21:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_0fb9d927fc33f747122b5f9d6dd52e70_elex_rhadamanthys_stop.exe
Size 243KB
Sample260702-1bgc4afs71
SHA256 e283a89bc675b8cc4ed3f4c63e297d8997ac20e7e7bec1c01a9ebb807e1d46d0
MD5 0fb9d927fc33f747122b5f9d6dd52e70
SHA1 2572b7f0ec2ccb2521b5676e3401990ad1d43cef
SHA512 7fbe0db8c7eaf3aaccbcc657e03614457ed4d5ec0f7cc090609a357b453edda1b6f1be0f5f87e9df56b6386cdc7772b320a6e37e69c7c9e0b4c1b75d8242d804
SSDEEP 3072:UCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7e:nvMsLaOa3lLNngoqRttA7e
TLSH
T1A9345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2332	CP.exe
1848	zwrojebwuo.exe
2548	CP.exe
5256	CP.exe
5228	i_zwrojebwuo.exe
4780	qolgeywrlj.sys
1992	CP.exe
2184	olgeywtrlj.exe
1048	CP.exe
3100	CP.exe
1780	i_olgeywtrlj.exe
1004	dbytqliday.sys
4468	CP.exe
4340	aytnljdbvt.exe
4900	CP.exe
1932	CP.exe
4612	i_aytnljdbvt.exe
1156	qnlfdxvqni.sys
3200	CP.exe
1392	qkifayvtnl.exe
4440	CP.exe
2536	CP.exe
1460	i_qkifayvtnl.exe
5144	ysqkifaysq.sys
856	CP.exe
3384	hfaxsqkifa.exe
4880	CP.exe
1516	CP.exe
200	i_hfaxsqkifa.exe
5792	spkifzxvpn.sys
5744	CP.exe
5772	spnhfcausp.exe
3000	CP.exe
5736	CP.exe
4208	i_spnhfcausp.exe
1448	zxrpmkhczx.sys
3580	CP.exe
940	fzwupmkhcz.exe
1560	CP.exe
5484	CP.exe
3380	i_fzwupmkhcz.exe
5448	mhfrpjhczu.sys
4700	CP.exe
4180	ezxrpjhcwu.exe
1928	CP.exe
4492	CP.exe
5096	i_ezxrpjhcwu.exe
1808	ecwurmjhbz.sys
6076	CP.exe
5024	ezwjhbztro.exe
5932	CP.exe
1952	CP.exe
944	i_ezwjhbztro.exe
2480	ywtomgebwt.sys
5224	CP.exe
5208	ywqojgbytr.exe
1916	CP.exe
3984	CP.exe
4904	i_ywqojgbytr.exe
5864	lgdbvtoljd.sys
2280	CP.exe
3380	geywtnlgdb.exe
3776	CP.exe
1124	CP.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_166146558\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_1702460872\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_1702460872\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_1324235998\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_1324235998\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_1324235998\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_1291636665\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_1291636665\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_1324235998\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwrojebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgeywtrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfaxsqkifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwjhbztro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhezwusmjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwrojebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqojgbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icaysqkifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwtrljezt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqolgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqoigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spnhfcausp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icaysqkifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkfcxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwuomhezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgeywtrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aytnljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkifayvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzwupmkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezxrpjhcwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwuomhezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzwupmkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwjhbztro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lifdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iczuspkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhezwusmjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfaxsqkifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spnhfcausp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezxrpjhcwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lifdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwtrljezt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_0fb9d927fc33f747122b5f9d6dd52e70_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aytnljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkifayvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqojgbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywtnlgdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkfcxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqolgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqoigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywtnlgdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_iczuspkhca.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4788	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4892	ipconfig.exe
1680	ipconfig.exe
1708	ipconfig.exe
1156	ipconfig.exe
3448	ipconfig.exe
1268	ipconfig.exe
6132	ipconfig.exe
2168	ipconfig.exe
4036	ipconfig.exe
2980	ipconfig.exe
1380	ipconfig.exe
6036	ipconfig.exe
2936	ipconfig.exe
2848	ipconfig.exe
1004	ipconfig.exe
5496	ipconfig.exe
3716	ipconfig.exe
2280	ipconfig.exe
5448	ipconfig.exe
3564	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275013101605559"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{D9D0F935-A80D-4BD3-B458-709A530DA76E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2056	msedge.exe
2056	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5228	i_zwrojebwuo.exe
Token: SeDebugPrivilege	1780	i_olgeywtrlj.exe
Token: SeDebugPrivilege	4612	i_aytnljdbvt.exe
Token: SeDebugPrivilege	1460	i_qkifayvtnl.exe
Token: SeDebugPrivilege	200	i_hfaxsqkifa.exe
Token: SeDebugPrivilege	4208	i_spnhfcausp.exe
Token: SeDebugPrivilege	3380	i_fzwupmkhcz.exe
Token: SeDebugPrivilege	5096	i_ezxrpjhcwu.exe
Token: SeDebugPrivilege	944	i_ezwjhbztro.exe
Token: SeDebugPrivilege	4904	i_ywqojgbytr.exe
Token: SeDebugPrivilege	3664	i_geywtnlgdb.exe
Token: SeDebugPrivilege	2832	i_lifdyvqoig.exe
Token: SeDebugPrivilege	1088	i_icaysqkifa.exe
Token: SeDebugPrivilege	2340	i_snkfcxvpnh.exe
Token: SeDebugPrivilege	456	i_iczuspkhca.exe
Token: SeDebugPrivilege	5160	i_jhezwusmjh.exe
Token: SeDebugPrivilege	1696	i_zwuomhezwr.exe
Token: SeDebugPrivilege	960	i_ebwtrljezt.exe
Token: SeDebugPrivilege	4060	i_ywqolgeywq.exe
Token: SeDebugPrivilege	2272	i_yvqoigaysq.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5944	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 5140	1316	2026-07-02_0fb9d927fc33f747122b5f9d6dd52e70_elex_rhadamanthys_stop.exe	88
PID 5140 wrote to memory of 5944	5140	iexplore.exe	89
PID 5944 wrote to memory of 3088	5944	msedge.exe	90
PID 5944 wrote to memory of 772	5944	msedge.exe	92
PID 5944 wrote to memory of 4788	5944	msedge.exe	93
PID 5944 wrote to memory of 772	5944	msedge.exe	92
PID 5944 wrote to memory of 772	5944	msedge.exe	92
PID 5944 wrote to memory of 2368	5944	msedge.exe	94
PID 5944 wrote to memory of 2368	5944	msedge.exe	94
PID 5944 wrote to memory of 6076	5944	msedge.exe	95
PID 5944 wrote to memory of 1300	5944	msedge.exe	96
PID 5944 wrote to memory of 6076	5944	msedge.exe	95
PID 5944 wrote to memory of 6076	5944	msedge.exe	95
PID 5944 wrote to memory of 1300	5944	msedge.exe	96
PID 5944 wrote to memory of 1300	5944	msedge.exe	96
PID 5944 wrote to memory of 2344	5944	msedge.exe	97
PID 5944 wrote to memory of 1068	5944	msedge.exe	98
PID 5944 wrote to memory of 2344	5944	msedge.exe	97
PID 5944 wrote to memory of 2344	5944	msedge.exe	97
PID 5944 wrote to memory of 1068	5944	msedge.exe	98
PID 5944 wrote to memory of 1068	5944	msedge.exe	98
PID 5944 wrote to memory of 1148	5944	msedge.exe	100
PID 5944 wrote to memory of 1148	5944	msedge.exe	100
PID 5944 wrote to memory of 5924	5944	msedge.exe	101
PID 5944 wrote to memory of 576	5944	msedge.exe	102
PID 5944 wrote to memory of 5924	5944	msedge.exe	101
PID 5944 wrote to memory of 576	5944	msedge.exe	102
PID 5944 wrote to memory of 2540	5944	msedge.exe	104
PID 1316 wrote to memory of 2332	1316	2026-07-02_0fb9d927fc33f747122b5f9d6dd52e70_elex_rhadamanthys_stop.exe	105
PID 1848 wrote to memory of 2548	1848	zwrojebwuo.exe	108
PID 5944 wrote to memory of 5560	5944	msedge.exe	111
PID 5944 wrote to memory of 5560	5944	msedge.exe	111
PID 5944 wrote to memory of 4144	5944	msedge.exe	114
PID 5944 wrote to memory of 4144	5944	msedge.exe	114
PID 1316 wrote to memory of 5256	1316	2026-07-02_0fb9d927fc33f747122b5f9d6dd52e70_elex_rhadamanthys_stop.exe	115
PID 1316 wrote to memory of 1992	1316	2026-07-02_0fb9d927fc33f747122b5f9d6dd52e70_elex_rhadamanthys_stop.exe	119
PID 2184 wrote to memory of 1048	2184	olgeywtrlj.exe	121
PID 1316 wrote to memory of 3100	1316	2026-07-02_0fb9d927fc33f747122b5f9d6dd52e70_elex_rhadamanthys_stop.exe	124
PID 1316 wrote to memory of 4468	1316	2026-07-02_0fb9d927fc33f747122b5f9d6dd52e70_elex_rhadamanthys_stop.exe	128
PID 4340 wrote to memory of 4900	4340	aytnljdbvt.exe	130
PID 1316 wrote to memory of 1932	1316	2026-07-02_0fb9d927fc33f747122b5f9d6dd52e70_elex_rhadamanthys_stop.exe	133
PID 1316 wrote to memory of 3200	1316	2026-07-02_0fb9d927fc33f747122b5f9d6dd52e70_elex_rhadamanthys_stop.exe	137
PID 1392 wrote to memory of 4440	1392	qkifayvtnl.exe	139
PID 1316 wrote to memory of 2536	1316	2026-07-02_0fb9d927fc33f747122b5f9d6dd52e70_elex_rhadamanthys_stop.exe	142
PID 5944 wrote to memory of 2984	5944	msedge.exe	145
PID 5944 wrote to memory of 1924	5944	msedge.exe	146
PID 5944 wrote to memory of 2752	5944	msedge.exe	147
PID 1316 wrote to memory of 856	1316	2026-07-02_0fb9d927fc33f747122b5f9d6dd52e70_elex_rhadamanthys_stop.exe	150
PID 3384 wrote to memory of 4880	3384	hfaxsqkifa.exe	152
PID 1316 wrote to memory of 1516	1316	2026-07-02_0fb9d927fc33f747122b5f9d6dd52e70_elex_rhadamanthys_stop.exe	155
PID 1316 wrote to memory of 5744	1316	2026-07-02_0fb9d927fc33f747122b5f9d6dd52e70_elex_rhadamanthys_stop.exe	159
PID 5772 wrote to memory of 3000	5772	spnhfcausp.exe	161
PID 1316 wrote to memory of 5736	1316	2026-07-02_0fb9d927fc33f747122b5f9d6dd52e70_elex_rhadamanthys_stop.exe	164
PID 1316 wrote to memory of 3580	1316	2026-07-02_0fb9d927fc33f747122b5f9d6dd52e70_elex_rhadamanthys_stop.exe	168
PID 940 wrote to memory of 1560	940	fzwupmkhcz.exe	170
PID 1316 wrote to memory of 5484	1316	2026-07-02_0fb9d927fc33f747122b5f9d6dd52e70_elex_rhadamanthys_stop.exe	173
PID 1316 wrote to memory of 4700	1316	2026-07-02_0fb9d927fc33f747122b5f9d6dd52e70_elex_rhadamanthys_stop.exe	177
PID 4180 wrote to memory of 1928	4180	ezxrpjhcwu.exe	179
PID 1316 wrote to memory of 4492	1316	2026-07-02_0fb9d927fc33f747122b5f9d6dd52e70_elex_rhadamanthys_stop.exe	182
PID 5944 wrote to memory of 5248	5944	msedge.exe	184
PID 5944 wrote to memory of 5248	5944	msedge.exe	184
PID 1316 wrote to memory of 6076	1316	2026-07-02_0fb9d927fc33f747122b5f9d6dd52e70_elex_rhadamanthys_stop.exe	190
PID 5024 wrote to memory of 5932	5024	ezwjhbztro.exe	192
PID 1316 wrote to memory of 1952	1316	2026-07-02_0fb9d927fc33f747122b5f9d6dd52e70_elex_rhadamanthys_stop.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-02_0fb9d927fc33f747122b5f9d6dd52e70_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_0fb9d927fc33f747122b5f9d6dd52e70_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7fff2c5ec188,0x7fff2c5ec194,0x7fff2c5ec1a0
      4⤵
      PID:3088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1948,i,15256475915072990789,7477808625580634873,262144 --field-trial-handle=2468,i,9716460778323061227,6933715091775353697,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:2
      4⤵
      PID:772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2104,i,18063706356665193719,4100581475975519842,524288 --field-trial-handle=2468,i,9716460778323061227,6933715091775353697,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:11
      4⤵
      System Time Discovery
      PID:4788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2672,i,15529859775598421141,3018415705560825441,524288 --field-trial-handle=2468,i,9716460778323061227,6933715091775353697,262144 --variations-seed-version --mojo-platform-channel-handle=3360 /prefetch:13
      4⤵
      PID:2368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,1111347603336784571,778455489949100391,2097152 --field-trial-handle=2468,i,9716460778323061227,6933715091775353697,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
      4⤵
      PID:6076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,5848535091092688620,3108516389310626713,2097152 --field-trial-handle=2468,i,9716460778323061227,6933715091775353697,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
      4⤵
      PID:1300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,5888770830238586891,13802149680706391618,2097152 --field-trial-handle=2468,i,9716460778323061227,6933715091775353697,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:9
      4⤵
      PID:2344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,6682752117535132992,11084591338440352509,2097152 --field-trial-handle=2468,i,9716460778323061227,6933715091775353697,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:1
      4⤵
      PID:1068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,6051707407142975626,15307854117880369577,524288 --field-trial-handle=2468,i,9716460778323061227,6933715091775353697,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:14
      4⤵
      PID:1148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,12863204278650551670,15240084986197512155,524288 --field-trial-handle=2468,i,9716460778323061227,6933715091775353697,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
      4⤵
      PID:5924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,8461170957953028112,14437886306864210131,524288 --field-trial-handle=2468,i,9716460778323061227,6933715091775353697,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
      4⤵
      PID:576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,14172326064563100176,12878842324225906039,524288 --field-trial-handle=2468,i,9716460778323061227,6933715091775353697,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
      4⤵
      PID:5132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,14172326064563100176,12878842324225906039,524288 --field-trial-handle=2468,i,9716460778323061227,6933715091775353697,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
      4⤵
      PID:2540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,583546847716564538,7323616103792453079,524288 --field-trial-handle=2468,i,9716460778323061227,6933715091775353697,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:5560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,10019280234656171186,9011884653796719132,524288 --field-trial-handle=2468,i,9716460778323061227,6933715091775353697,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
      4⤵
      PID:4144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1456,i,11134456706395659308,7693247483813795941,524288 --field-trial-handle=2468,i,9716460778323061227,6933715091775353697,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:14
      4⤵
      PID:2984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1464,i,6799583772452986952,11821199881735958098,524288 --field-trial-handle=2468,i,9716460778323061227,6933715091775353697,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:14
      4⤵
      PID:1924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1472,i,4260614096388237028,9324092346332206066,524288 --field-trial-handle=2468,i,9716460778323061227,6933715091775353697,262144 --variations-seed-version --mojo-platform-channel-handle=164 /prefetch:14
      4⤵
      PID:2752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,18438867717841612148,16530925439013860171,524288 --field-trial-handle=2468,i,9716460778323061227,6933715091775353697,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:14
      4⤵
      PID:5248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,6398455041973647162,12141217796523451017,524288 --field-trial-handle=2468,i,9716460778323061227,6933715091775353697,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
      4⤵
      PID:2948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,17984492706130540053,13288303735701101799,524288 --field-trial-handle=2468,i,9716460778323061227,6933715091775353697,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:14
      4⤵
      PID:5976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,16588875024592783517,222899986404778735,524288 --field-trial-handle=2468,i,9716460778323061227,6933715091775353697,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:14
      4⤵
      PID:4964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5508,i,11086148559710378911,1140915295631280644,262144 --field-trial-handle=2468,i,9716460778323061227,6933715091775353697,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,14954322384824312808,15785529911024244078,524288 --field-trial-handle=2468,i,9716460778323061227,6933715091775353697,262144 --variations-seed-version --mojo-platform-channel-handle=1220 /prefetch:14
      4⤵
      PID:2276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwrojebwuo.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2332
- - C:\Temp\zwrojebwuo.exe
    C:\Temp\zwrojebwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1848
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2548
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwrojebwuo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5256
- - C:\Temp\i_zwrojebwuo.exe
    C:\Temp\i_zwrojebwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\olgeywtrlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1992
- - C:\Temp\olgeywtrlj.exe
    C:\Temp\olgeywtrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2184
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1048
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_olgeywtrlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3100
- - C:\Temp\i_olgeywtrlj.exe
    C:\Temp\i_olgeywtrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1780
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aytnljdbvt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4468
- - C:\Temp\aytnljdbvt.exe
    C:\Temp\aytnljdbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4340
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4900
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aytnljdbvt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1932
- - C:\Temp\i_aytnljdbvt.exe
    C:\Temp\i_aytnljdbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkifayvtnl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3200
- - C:\Temp\qkifayvtnl.exe
    C:\Temp\qkifayvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1392
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4440
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2280
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkifayvtnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2536
- - C:\Temp\i_qkifayvtnl.exe
    C:\Temp\i_qkifayvtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfaxsqkifa.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:856
- - C:\Temp\hfaxsqkifa.exe
    C:\Temp\hfaxsqkifa.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3384
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4880
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfaxsqkifa.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1516
- - C:\Temp\i_hfaxsqkifa.exe
    C:\Temp\i_hfaxsqkifa.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spnhfcausp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5744
- - C:\Temp\spnhfcausp.exe
    C:\Temp\spnhfcausp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5772
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3000
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spnhfcausp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5736
- - C:\Temp\i_spnhfcausp.exe
    C:\Temp\i_spnhfcausp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4208
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzwupmkhcz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3580
- - C:\Temp\fzwupmkhcz.exe
    C:\Temp\fzwupmkhcz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:940
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1560
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1156
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzwupmkhcz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5484
- - C:\Temp\i_fzwupmkhcz.exe
    C:\Temp\i_fzwupmkhcz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezxrpjhcwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4700
- - C:\Temp\ezxrpjhcwu.exe
    C:\Temp\ezxrpjhcwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4180
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1928
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezxrpjhcwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4492
- - C:\Temp\i_ezxrpjhcwu.exe
    C:\Temp\i_ezxrpjhcwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5096
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezwjhbztro.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6076
- - C:\Temp\ezwjhbztro.exe
    C:\Temp\ezwjhbztro.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5024
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5932
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezwjhbztro.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1952
- - C:\Temp\i_ezwjhbztro.exe
    C:\Temp\i_ezwjhbztro.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqojgbytr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5224
- - C:\Temp\ywqojgbytr.exe
    C:\Temp\ywqojgbytr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5208
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1916
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqojgbytr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3984
- - C:\Temp\i_ywqojgbytr.exe
    C:\Temp\i_ywqojgbytr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywtnlgdb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2280
- - C:\Temp\geywtnlgdb.exe
    C:\Temp\geywtnlgdb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3380
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3776
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywtnlgdb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1124
- - C:\Temp\i_geywtnlgdb.exe
    C:\Temp\i_geywtnlgdb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3664
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lifdyvqoig.exe ups_run
  2⤵
  PID:2964
- - C:\Temp\lifdyvqoig.exe
    C:\Temp\lifdyvqoig.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5888
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5876
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lifdyvqoig.exe ups_ins
  2⤵
  PID:1368
- - C:\Temp\i_lifdyvqoig.exe
    C:\Temp\i_lifdyvqoig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icaysqkifa.exe ups_run
  2⤵
  PID:3788
- - C:\Temp\icaysqkifa.exe
    C:\Temp\icaysqkifa.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3148
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4540
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4036
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icaysqkifa.exe ups_ins
  2⤵
  PID:3648
- - C:\Temp\i_icaysqkifa.exe
    C:\Temp\i_icaysqkifa.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snkfcxvpnh.exe ups_run
  2⤵
  PID:5904
- - C:\Temp\snkfcxvpnh.exe
    C:\Temp\snkfcxvpnh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5404
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4996
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snkfcxvpnh.exe ups_ins
  2⤵
  PID:3028
- - C:\Temp\i_snkfcxvpnh.exe
    C:\Temp\i_snkfcxvpnh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\iczuspkhca.exe ups_run
  2⤵
  PID:3344
- - C:\Temp\iczuspkhca.exe
    C:\Temp\iczuspkhca.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3364
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5496
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_iczuspkhca.exe ups_ins
  2⤵
  PID:720
- - C:\Temp\i_iczuspkhca.exe
    C:\Temp\i_iczuspkhca.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhezwusmjh.exe ups_run
  2⤵
  PID:3448
- - C:\Temp\jhezwusmjh.exe
    C:\Temp\jhezwusmjh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:992
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5152
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhezwusmjh.exe ups_ins
  2⤵
  PID:3916
- - C:\Temp\i_jhezwusmjh.exe
    C:\Temp\i_jhezwusmjh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwuomhezwr.exe ups_run
  2⤵
  PID:5692
- - C:\Temp\zwuomhezwr.exe
    C:\Temp\zwuomhezwr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1704
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2480
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwuomhezwr.exe ups_ins
  2⤵
  PID:3176
- - C:\Temp\i_zwuomhezwr.exe
    C:\Temp\i_zwuomhezwr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebwtrljezt.exe ups_run
  2⤵
  PID:6080
- - C:\Temp\ebwtrljezt.exe
    C:\Temp\ebwtrljezt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4024
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4452
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6036
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebwtrljezt.exe ups_ins
  2⤵
  PID:5412
- - C:\Temp\i_ebwtrljezt.exe
    C:\Temp\i_ebwtrljezt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqolgeywq.exe ups_run
  2⤵
  PID:2660
- - C:\Temp\ywqolgeywq.exe
    C:\Temp\ywqolgeywq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3564
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2212
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqolgeywq.exe ups_ins
  2⤵
  PID:456
- - C:\Temp\i_ywqolgeywq.exe
    C:\Temp\i_ywqolgeywq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\yvqoigaysq.exe ups_run
  2⤵
  PID:2044
- - C:\Temp\yvqoigaysq.exe
    C:\Temp\yvqoigaysq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2240
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1808
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_yvqoigaysq.exe ups_ins
  2⤵
  PID:924
- - C:\Temp\i_yvqoigaysq.exe
    C:\Temp\i_yvqoigaysq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2272

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4904

C:\Temp\qolgeywrlj.sys
C:\Temp\qolgeywrlj.sys
1⤵
- Executes dropped EXE
PID:4780

C:\Temp\dbytqliday.sys
C:\Temp\dbytqliday.sys
1⤵
- Executes dropped EXE
PID:1004

C:\Temp\qnlfdxvqni.sys
C:\Temp\qnlfdxvqni.sys
1⤵
- Executes dropped EXE
PID:1156

C:\Temp\ysqkifaysq.sys
C:\Temp\ysqkifaysq.sys
1⤵
- Executes dropped EXE
PID:5144

C:\Temp\spkifzxvpn.sys
C:\Temp\spkifzxvpn.sys
1⤵
- Executes dropped EXE
PID:5792

C:\Temp\zxrpmkhczx.sys
C:\Temp\zxrpmkhczx.sys
1⤵
- Executes dropped EXE
PID:1448

C:\Temp\mhfrpjhczu.sys
C:\Temp\mhfrpjhczu.sys
1⤵
- Executes dropped EXE
PID:5448

C:\Temp\ecwurmjhbz.sys
C:\Temp\ecwurmjhbz.sys
1⤵
- Executes dropped EXE
PID:1808

C:\Temp\ywtomgebwt.sys
C:\Temp\ywtomgebwt.sys
1⤵
- Executes dropped EXE
PID:2480

C:\Temp\lgdbvtoljd.sys
C:\Temp\lgdbvtoljd.sys
1⤵
- Executes dropped EXE
PID:5864

C:\Temp\idaysqlida.sys
C:\Temp\idaysqlida.sys
1⤵
PID:5908

C:\Temp\snlfdxvtqn.sys
C:\Temp\snlfdxvtqn.sys
1⤵
PID:1416

C:\Temp\snkfcxvpnh.sys
C:\Temp\snkfcxvpnh.sys
1⤵
PID:5836

C:\Temp\fcxvpnhfzx.sys
C:\Temp\fcxvpnhfzx.sys
1⤵
PID:3372

C:\Temp\pmkecaukhf.sys
C:\Temp\pmkecaukhf.sys
1⤵
PID:6060

C:\Temp\bzwrpjhecw.sys
C:\Temp\bzwrpjhecw.sys
1⤵
PID:5828

C:\Temp\ebwuomgeyw.sys
C:\Temp\ebwuomgeyw.sys
1⤵
PID:5872

C:\Temp\zwqoigdbwt.sys
C:\Temp\zwqoigdbwt.sys
1⤵
PID:2264

C:\Temp\geywqoigby.sys
C:\Temp\geywqoigby.sys
1⤵
PID:1640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aytnljdbvt.exe

Path C:\Temp\aytnljdbvt.exe
Size 243KB
SHA256 580852a16b2bdb42d884cdd9429c401eb79b31738ebd9b8f8e7e7a43b1a8efb9
MD5 10d2e35f0916053c8800f4cdd9c44562
SHA1 96f6a25480a9f307877c9815f8744777939cf726
SHA512 9265c04f38ff1de02d97e884e86ad207f220c3b22f7e8ccb5dd7a915855d50e91fdb02aa95bb08fe025eb29719ff155c56ecb35e53808d5a6634496e1cde73b3
SSDEEP 3072:/CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7R:KvMsLaOa3lLNngoqRttA7R
TLSH
T110345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbytqliday.sys

Path C:\Temp\dbytqliday.sys
Size 141KB
SHA256 c370c26f2298732ffa764104e681bd104b4cd3979602d9d865a8b077fee6c0ce
MD5 63f1b1d094cb8085412a9deca8708424
SHA1 ce267096556c28717b7efc5868663767713a0063
SHA512 1fc1cc70b6ead9c80c744568af5a1c3595611d3e898173cedcd08899bfb26cd3f43858fe5748f5775407dd876f1ada19b863008394446ac7b7e304aaaccf46b7
SSDEEP 1536:da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T133E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfaxsqkifa.exe

Path C:\Temp\hfaxsqkifa.exe
Size 243KB
SHA256 a7ce6dba39f179650e685c3fd0af1fbf39fc599f393720467e99818be076c17a
MD5 5abe575bb63fa8f1093a47b83ffc1c8a
SHA1 227165513b22b986455907c56f41e7f55a145685
SHA512 2c8abda3301585291ab266077013d1bea2ecafa9d11ab3b0f89452baef848e0c8b1421fa3209963812b5bea13013703d41d35a548ffd05ca472e987ae4caa151
SSDEEP 3072:VCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7n:YvMsLaOa3lLNngoqRttA7n
TLSH
T1A2345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aytnljdbvt.exe

Path C:\Temp\i_aytnljdbvt.exe
Size 243KB
SHA256 f66115576d091adbedbe59dfc84ef3e3ba36f39ceadd2c3187caafa09c24609a
MD5 e0aecc432917022e451434821f830f1e
SHA1 0d43b1c4be1b87492fb2ed389a6698fb1d55d077
SHA512 d42f0b08bdac6586a245f516382622d27a10f30b444875dba6ac9fe840f64a19385f052ea3ef930da256b2b8b7327abfc24f7afc5149922c456a5e0eb2f99397
SSDEEP 3072:aCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7E:FvMsLaOa3lLNngoqRttA7E
TLSH
T136345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hfaxsqkifa.exe

Path C:\Temp\i_hfaxsqkifa.exe
Size 243KB
SHA256 9064d0aaea576c92394f0bac00299a05849d487bd30c7812093d80ca859caca9
MD5 2ddfbffbf8db4dd6c92f422f9cc0c40b
SHA1 09a830ef0d9a466f43f086d2fa92d0bccb4c0a77
SHA512 565b4fbb40b8b8fd874b9812f0975d321a79bc892939a9a27d387d34c5f40aad56ccd38609c6a020351fe2f4e61b3bdd739115a5a61f86e6524ae0a3d7961edc
SSDEEP 3072:dCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7L:QvMsLaOa3lLNngoqRttA7L
TLSH
T18C345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_olgeywtrlj.exe

Path C:\Temp\i_olgeywtrlj.exe
Size 243KB
SHA256 e8b27b5fd4efdfdcee372f189c3847a21b6e181b27ea1c8ffdb76110849b5250
MD5 9422510fa152c4d19b60f4ac8aa8234d
SHA1 ecc38ced1e5ec671a1ec3d741b1a03995a133cb4
SHA512 c0b28068c0bc331bef26e2a66e535f4fbcc3c74a76f92b5d6d3efc0eb7dee4e74c6f31487d39157b053bbd8b615ae0c603d4e7197ac6bc4a4e267f1e262c8621
SSDEEP 3072:QCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:LvMsLaOa3lLNngoqRttA7W
TLSH
T18C345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qkifayvtnl.exe

Path C:\Temp\i_qkifayvtnl.exe
Size 243KB
SHA256 ebba39de00b5125bc4d10d48a20c62fc4e432a437483c4a6bfb38db1c2bd819a
MD5 3fdb1684f438fb438d0ad1763eb52b20
SHA1 9064ff60cd9d5ee0bdc1fceabfee422533c68c18
SHA512 2c4e4a299abeba91b866dc80bff60805c88d57a86a3bbd88deed90656ca20428f6d554180c5688de23e32bbcdceec1c237b22978715c153b14fb0f2e99e00545
SSDEEP 3072:qCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:VvMsLaOa3lLNngoqRttA7A
TLSH
T1FA345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_spnhfcausp.exe

Path C:\Temp\i_spnhfcausp.exe
Size 243KB
SHA256 3badaeafa676afaef01501de74a62ca97c0052aa88f399b56d95f349501b66fc
MD5 7b0df16e0adeb363744ca945415950ac
SHA1 a4bbf02b4a395557bb296d0230143e692a2a07c5
SHA512 925dd78b195e44b701d7e01c2a5117293df5e4bb4726962728d84920fa0a66fcc0f0033c6a2dd54d1f17434a455480b51bf1fcb56b1624b8408b9841807050bd
SSDEEP 3072:jCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:mvMsLaOa3lLNngoqRttA71
TLSH
T1AB345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zwrojebwuo.exe

Path C:\Temp\i_zwrojebwuo.exe
Size 243KB
SHA256 90dfa65107caa9bc839f5f4c1979927015c4ccdd8dca33ca84a88e4ea5515ae2
MD5 d460bef1e228a91a4d9d54b7951cae81
SHA1 04ea0c262f8270fbc3af0ab1589bcef5785e03c0
SHA512 87595222ac1cf97fbb8175f1f32725d911ac7541e80a32bd33f965bde98d3b46f403fba9b8ebde0ff4b972420e7d76175d5e1c670047a567120fbf7645aa23e3
SSDEEP 3072:BCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7n:cvMsLaOa3lLNngoqRttA7n
TLSH
T1CB345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgeywtrlj.exe

Path C:\Temp\olgeywtrlj.exe
Size 243KB
SHA256 4ac2276c446e5305abf8873b8d3b5679ac7f6502aabf0c7e1da245965e86fda0
MD5 a3076b0663c6e8971019a8c9f5b3d176
SHA1 e8a28993a698560ce16de1450239380ef4adbc56
SHA512 a5b664fde540b5d36bae6d3b853e13c72c269bf46c24e426af74557923629e9b9a7c13860d517a242adc4a8a05c441dfb30b33cbbaafaa45532d86f1e5b09bcd
SSDEEP 3072:OCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7I:BvMsLaOa3lLNngoqRttA7I
TLSH
T113345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkifayvtnl.exe

Path C:\Temp\qkifayvtnl.exe
Size 243KB
SHA256 3b0b9164bab0ad9cca8da87265ddc7ec70f576ecde10ccf42f8d53fd4708e270
MD5 c304af95e0be98a8ee8b9efd64ee9467
SHA1 39e34b59d48881ceb714452bbb47a78352654494
SHA512 e6b78ddfaf39569dcf53ed205f0ff3c2ae911ccd482d4f0d85601fc6695b8ec7b38b0a934a346c6d93e9cf14abac5eff7320a19c8e6ccb18cc069e9a371b9d8d
SSDEEP 3072:aCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7w:FvMsLaOa3lLNngoqRttA7w
TLSH
T152345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnlfdxvqni.sys

Path C:\Temp\qnlfdxvqni.sys
Size 141KB
SHA256 37e82b1dc8eadf83381aa7b31b07bda134e66f942837e4c0eee185bb80ed3807
MD5 1bc16ccd15f0d8d693178c4c86880479
SHA1 5a1348afc1868fef4c7ee23746e629bedfc98bc4
SHA512 4857b0da4ed43772afa493c2b5037718bcc9ee00565cef9cf73b68fe60ce804295f3740faf0fa5cd8dec4ea0ee6b619b7f2daeb7828b054a6e34767df1a210e8
SSDEEP 1536:wa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:wa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T119E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qolgeywrlj.sys

Path C:\Temp\qolgeywrlj.sys
Size 141KB
SHA256 fa6ebc7e909b676a8f5675bf88793ef4a1e748cffddb4c05868c6af62aaa2c1f
MD5 999b4d4d374c232f06f2538c498b188e
SHA1 a61716749764f788b95a0b290f91c1e0556aba93
SHA512 23c63ad36aeb30543490f66b80a76d363f218cd1aa81a943d0bcd1479e7497c3994afd8d105a14137662a42194450b9fdef398934b206c157fefecdff5430a09
SSDEEP 1536:wa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:wa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T10FE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spkifzxvpn.sys

Path C:\Temp\spkifzxvpn.sys
Size 141KB
SHA256 67b906225facb7842d5f195fe07daaa50d0ccc15f448b7351f3a932aabb98412
MD5 5585c88c5c84093ead8d0175a129a8c4
SHA1 6a1865522cdb5fc5678e6ccd1609ae4372341cbc
SHA512 4d0da8c71de71babc5b5c2caea3e9afc20f8cf3f40d727d9852cde39b083023f7eb715493e680aac2dcae1949c9339f06fcba6f2c3364f2bb2cc64e53b31ddb6
SSDEEP 1536:3a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:3a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T12AE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spnhfcausp.exe

Path C:\Temp\spnhfcausp.exe
Size 243KB
SHA256 0cd4c55a42ca80a8fde024952b61a02ca1eb654bd1dae21b61d5bcdc2a2b6dc2
MD5 46ecf755b6d402a85a1b75a8477ac07a
SHA1 fab0b067392093e81431379c066db2e2bc8ff2bd
SHA512 d906aaa8892c6511212bf78764ba20189090efb9d929054b6b70e9fe2560ba76baa885b1308f6754d293e6084b5fc278949372b4c4084865ed3880129e5589e0
SSDEEP 3072:5CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7H:kvMsLaOa3lLNngoqRttA7H
TLSH
T1C7345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqkifaysq.sys

Path C:\Temp\ysqkifaysq.sys
Size 141KB
SHA256 ed691eb0eaf2dcc2e947b85574e0fa85958c28ad6e945065a3fcad07c7719be6
MD5 c26864d8658f43207714900b773e768a
SHA1 a753dc3c2159b5416fc990bb6cbbe22442091653
SHA512 fdc9b4a263de6ce3d58ff93d9ae8250f0c2920216af8cd964d7e9874b9c0d26d867f394ec8e948b8fee129a3afff2a72a3df92664ba4085b512fe150f02f7223
SSDEEP 1536:aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T150E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwrojebwuo.exe

Path C:\Temp\zwrojebwuo.exe
Size 243KB
SHA256 30304d0769a1b4e4107d138347dfdf6ee14ad9085d78d3be88999f8fb80f8644
MD5 c8639e0d353a4183136ff2b1bed5d4a9
SHA1 69a9a6664d6abdff3682a3e9a01fe6d87b98c65d
SHA512 446f6b92203223d25897bf6db9816a65530664e01af8c2c144a5177006119c874ba494f1e11e5a24040b64679bcf5b02917c9511e9ae48429b3acbdf9bfeafd4
SSDEEP 3072:NCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7H:AvMsLaOa3lLNngoqRttA7H
TLSH
T17F345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpmkhczx.sys

Path C:\Temp\zxrpmkhczx.sys
Size 141KB
SHA256 11f1beb842b822495a72391078ee9b18df3f434e8d3ca2eedc869dd4ca1f948b
MD5 e2fdd094720183fb173508ab4dc0097b
SHA1 3056b1ebdd546970067f00d7c750ec9ce32e2420
SHA512 2318620ac40ffc728bae252d77f81b8826077c0dd6000c31b12fb5d1c4c8e8abd60e6bdff8fc9cfbb6e57cce9d2194aafee0fe2507b6c8fceb00291198e40fbf
SSDEEP 1536:na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T126E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 48b0127c48894e5c8e42b14bcc7f6b1f91ca5d97355f42d22391fb602568bb1d
MD5 df62623cabc43e309a7767f4081f29d9
SHA1 420f1a4b11b86944a73d3cbcd4aec4883dfdfd62
SHA512 02067a08d194a87842f985ff7d0bee13c7b7228146565bf19114ffaebc120cb3d2ba8b19c941bb0d2773043366f064246a55efd57127d4a0de5768f453b2730c
TLSH
T1FDD08035774DFD08C18054717890D3517A204460345AC3186329A01DDDBC68513DF0EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a958178f477b8cf0f18d83e0835916167b3eaf95d859728b647bc0100a82efc
MD5 b2c496fb89251ff9b8ff1c46a5315932
SHA1 19626950ca3b280d084016871229a48eb3fa5ffc
SHA512 bbd974e4a08ca8f629f0b9a8892ba78ac7d4191c1640d1037e4fd018dadb4d8edd0a663e4a673a29497151c4defd9be09b6a4a4788adf24b182cbc36b18ccda7
TLSH
T1C5D08031774DFD08C18054757890D3517A104460245AC3186329E01DDDBC68513DF0DF
MD5 SHA1 SHA512 TLSH

Submit Download

00e8f033-f9e2-4168-89bf-1eefdc018569.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\00e8f033-f9e2-4168-89bf-1eefdc018569.tmp
Size 14KB
SHA256 82bb88e113beb63112a41761ba17c4e8f0f4662b0bd2279a915107d3eacacfad
MD5 de8e0b9915a1be67e4214118bb87a4d8
SHA1 b4cfae2a211fe8659ebea2d3e8a5651287d94d77
SHA512 3b50e2a7a6ebcb240ad82cfa7fb4cdd6755d560509ad5e421b3cc5fa399a32893daec2bf6cf0e20b144a9b91fb2f530fb21bff3e241e786709cef6ac82899126
SSDEEP 192:sxRHeRRyM/jK1Ml8wcb/fXssQZfZ7DHzoA8p9h/g6+WNCvKr1/Y4R+Ae08GHIgtJ:sxRHepCb/fXssqBnuL/5h/7e0/3
TLSH
T1B162FA056A249D3BCCDBD609FA557F63D6F81573A2901E44AAFC8B0C05E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 86fdf5b68aaf49c3d009fc8c534bfed97fc358757be2f66380a114e600057ec4
MD5 c6830561695983f5754cd1e0faed922f
SHA1 23cd5282ac1bacdf08d1191830869a8c0c818cd8
SHA512 18227993d051584ae8e47a52a0ced083a7c0b9e9f18586663f5d903139e963edb206f2faf12e63dc663f4b4e9ea0e948957d4bf0bac0f99316890a477ab946ca
TLSH
T18D610B9F39F10693C329B8B651E1D1B6FFE8A36A6607ED1B7050DB74D94EF08526101C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a09b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a09b.TMP
Size 3KB
SHA256 ff3ffc4da860d95aae1ca46701e46619ecfa239af38ce97315e02ad5f6085d9e
MD5 b45e28f01befebbb1e4408ae891b9657
SHA1 3d597f53136a59efb5e3a882bdf3b8ddb2e6aa25
SHA512 f88dd8497666f3752a55de485766d8ca12fc558f6d05a15fa062d027817bbe527f8d27eaa18df4b7f47159ac05143913069698898e7d1af6ca9d3a2f1b42189b
TLSH
T1A7612C9F39F10A93C329B8B651E1C1B5FFE8A36A6607ED1B3050DB74D90EF08526101C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 30641f86c3f79378faa230746aeaa8d94d5b6cac74921e0348d2d4eb7057af59
MD5 ec7a0beff4257c3e5029b2d98b882ce2
SHA1 d9923d93b422a47a335c1835f516428a1e31ade4
SHA512 4f9bb997536dfcc9d5bc005a984477b982e003b4afcba9dedf4196b5159a993f8b95b14e3fce3eae430f0c3b022a1be6eefa44c1ca10a22ed07058698b48e186
TLSH
T1F351AEF7C3E8856ECA0195F4BA147E1BCE1D0915832C3D5AC9E4AF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4dbcd1df66a750efdaf83441338ca88b75229cc0e1408d5ca4dac8b67adf66f4
MD5 ff4c4d9dae876522b1fbe1b3e7cbca83
SHA1 da5bba4285ca1863ff9b80a744fb128c60bba712
SHA512 f24d9234222e71a57ba45ee7d2040129af11495c41960ae8b4558ecc8e37e6877f5c33292ea729ea0c3acc5921cdbb45575505d11c5a0fb15b9d2968150b4075
SSDEEP 192:sxRHBRRyM/jK1Ml8wcb/fXsMQZfZ7DHzoA8p9h/g6+WNCvKr1/Y4R+Ae08GHIgDp:sxRHBpCb/fXsMqBnuL/5h/7e0/l
TLSH
T1BF62EA05AA245D3BCCDBD609FA557FA3D6F81573A2901E44AAFC8B0C05E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 71492f1b586669d40b7ab5fbba5b1e6401dbd94d054744867e3eef0b37d3b903
MD5 2f8417ce661406fdf51b25015a28b387
SHA1 c1e1527a870cdc046e47db536e6b7b1cd6c69eff
SHA512 5663cb4677f93a43def0f8ab511a7b945d31d4256582aac933a99dc9ab1fb6607b992f744cb6b5f6601ecb3df5acfccf8f1109583c980c339678315e881c51b4
SSDEEP 192:sxRHBRRyM/jK1Ml8UQ9cb/fXsMQXfZ7DHzoA8prh/g6+WNCvKr1/Y4R5OAe08GHj:sxRHBpqCb/fXsMQBnu1/5h/9e0/j
TLSH
T1D762E856A9245D3BCCDBD609FA517FA3D6F81572A2801E44AAFCCB0C01E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 bdeff3ac5243a722ed9b53b6ee131fd463f07a79dfc5aa112a37bf85c5b38245
MD5 4bebbbdcd13fde17b107dbce8d81a896
SHA1 a109a78403b0d548b1549833d91e254edcc4bca7
SHA512 5300b4126751a6ca22d08d23502cd0133aa33a2e162d79740e6a6c57c8229afcd58ba21595c409897a634958c70e37ac88296bea2d848a98368745d58bc9c733
SSDEEP 768:Tqi0NR7pLuL7C3WgNxfez8F1+UoAYDCx9Tuqh0VfUC9xbog/OV7RzXNG7roKTpyB:Tqi0NHE7C3WgNxfezu1jaQRz9GIh
TLSH
T164E2DC3B680CCB7E4F804E9CEC2A7E9A6DE802CF56D8C95447EA841C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a3b45.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a3b45.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 6d64004e346b855e54789ca46f584595ae2ab8082613294a1af051dee7cd49e2
MD5 5d8218e9da6cc00d50299d7b1e72a343
SHA1 4d2e4ff5cb5c1cef487002e988396e788c06d033
SHA512 1eb529020252d13a2bc109bc97bb317301659efc7a6a36dd113bf12c6e51ff416aa04204df8e08f6f0778ad74cf0734080a3fbda1fb81e9eef238cf2df8e03b6
SSDEEP 768:NF1j+9K3VwgxIY6hz0Ybt+AW+152MvSCaitb9MUX:E9K3d2tpx2pub+y
TLSH
T19E1328F598D78936C8AE8783A33E2E469DBCD153B4884984FBC45E0DCC831BFC646816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7806fcd6d4b711bf15d4363a14a7e2fe8e851cc311a43c86d29cf5f725890b0a
MD5 f49be917766d538cd9b01a2692b04e30
SHA1 9a1f8b45f5ff31098a25449688585d8ffff0ceab
SHA512 2f784aed04d21c332fb273f21dab9a212bc8502d05906581cee73c02a7edc114f8fbc2714f8de379563e319a25fd306ac2cd5b5cc4e5fed7d83861cafcf116e0
SSDEEP 768:Arv+4UNbd23/ZPthz0c+AW+152MvSCa24Y+8rir9:Absbs3/lpx2plYDriR
TLSH
T10803BE32E86AA973CCB686C4B64B36037EB0119385C10F94CDD96B4D469B6CD231BD77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 ffff6a2a6bef2acdf920693fb1d7f3b14a9ffdc0e39a49a9dd9550e9dab14eef
MD5 ec55413b93bb48c46690f5e0aaa3db40
SHA1 e9e648a57a179104008a274595e4d42340c3f58a
SHA512 89f1cd874111ba527b18b280fc51879969af3a404c8dbb803f15775d92c79de4ba0d7b2c2b8ef3e5f2e401ee114620d10847197ff563472de5cfb38f713c50c4
SSDEEP 768:0rv+4UNbdq3KIZthz0Ybj+AW+152MvSCaitb9MUK:0bsbI3K+jpx2pub+r
TLSH
T1FD13BE31E86ADD738DE7D294B24B7A937EB025A388840F44CDD9AF0D068758D274BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 573c87f945837443d939e4eec3a3fd673cbeda027ec0960c313fd8d45db6ade1
MD5 8b30c60730ebb412ef3be662257ed7b9
SHA1 a5f4418dfc2a59ac5f02b66ee2925e680917aefe
SHA512 d3ca2edd36747a9e179e1ce979168fc3f2e16a3a65cf453b0ae11f3a9f9a147e1a6c0134fa550273c6d327552c426ebb7dd09aa475627f08812a140361cca625
SSDEEP 768:aj+903HIZthz0Ybi+AW+152MvSCaitb9MUX:Z903H+ipx2pub+y
TLSH
T1B0F2BE31A85A9D738CE6C7D4B34B3B96AEF015A784C40E48CDD9AF0E058764D1B4AD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e04e4987f2c1c3f9a916a038899c428cd75c6ff5cb89d58489f70cc1aed07ebb
MD5 146b61b420152a40d006c4de51505cf8
SHA1 311930382373fe547137cd8ec7d7cf15c310e865
SHA512 95c356a9e929bb81bb6a3632bde3fdf70fdc575605cc39c9f8ab8ee8daa4b7aa79eb4a91850e97a5a203c398db0648a49ea51590f3db247d8d300eac8c7cd3e1
SSDEEP 768:1j+903kIZthz0Ybi+AW+152MvSCaitb9MUX:A903k+ipx2pub+y
TLSH
T1BFF2BE31A85A9D738CE6C3D4B34B3B96AEF015A784C40E48CDD9AF0E058764D1B5AD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

b66ea77a-62f9-4b14-b883-33d9ac04a10b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b66ea77a-62f9-4b14-b883-33d9ac04a10b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5944_2088618041\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1004-238-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1156-287-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1156-266-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1416-417-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1448-322-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1640-506-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1808-342-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2264-489-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2480-377-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2480-347-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3372-441-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4780-191-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5144-278-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5448-343-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5448-327-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5792-294-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5792-324-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5828-457-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5836-421-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5864-376-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5872-477-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5908-397-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6060-452-0x0000000000010000-0x0000000000083000-memory.dmp

Download