80c566cdecca591eff03c0784569d7814e7df83659b413d2028153fc0d7d6db8

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 07:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_a8e8a8914cf885db4faffd3d9dc57727_elex_rhadamanthys_stop.exe
Size 243KB
Sample260702-jdrheacs7p
SHA256 80c566cdecca591eff03c0784569d7814e7df83659b413d2028153fc0d7d6db8
MD5 a8e8a8914cf885db4faffd3d9dc57727
SHA1 d51d879223976bc02c507e1e3235673599794e1a
SHA512 feb14ae24418887dd0676d338395b4986c45aee778a1c85ac214fd9d533f6d16e0ee5802d9a947dacdeff54d8fd6f53387180a500bd3eeb1cd56c02a77f6ac1c
SSDEEP 3072:zCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA79:2vMsLaOa3lLNngoqRttA79
TLSH
T1E0345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3924	CP.exe
3616	nkfdxvpnif.exe
4476	CP.exe
4760	CP.exe
1344	i_nkfdxvpnif.exe
2600	cxupmkfcxu.sys
2044	CP.exe
1396	upnhfzxrpk.exe
6076	CP.exe
3048	CP.exe
3360	i_upnhfzxrpk.exe
5036	mkecwupmhf.sys
5916	CP.exe
5204	hezxrpjhez.exe
4292	CP.exe
1792	CP.exe
5736	i_hezxrpjhez.exe
2384	rpjhfzxrpj.sys
4232	CP.exe
5596	jebzxrmjec.exe
5560	CP.exe
1400	CP.exe
4916	i_jebzxrmjec.exe
5320	pmgezwrojh.sys
3552	CP.exe
932	jgezwrpjhb.exe
5624	CP.exe
3336	CP.exe
1380	i_jgezwrpjhb.exe
5508	eywroigeyw.sys
3360	CP.exe
1080	gbztrljgbz.exe
2184	CP.exe
1064	CP.exe
3716	i_gbztrljgbz.exe
5708	dyvtqoigdb.sys
4800	CP.exe
3356	gdytqoigby.exe
4484	CP.exe
2792	CP.exe
5952	i_gdytqoigby.exe
6136	qlidbvtqli.sys
4984	CP.exe
4736	daysqkidav.exe
2100	CP.exe
3024	CP.exe
5652	i_daysqkidav.exe
5180	lfdxvsnkig.sys
2444	CP.exe
1380	fdxvpnifax.exe
5488	CP.exe
3220	CP.exe
6104	i_fdxvpnifax.exe
244	fdxvpnicau.sys
2032	CP.exe
1868	cxvsmkfcxv.exe
2720	CP.exe
2368	CP.exe
2748	i_cxvsmkfcxv.exe
3016	cxupnhfzxr.sys
2312	CP.exe
5668	upmkhfzxrp.exe
2400	CP.exe
3044	CP.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4288_900761005\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4288_900761005\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4288_1973280482\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4288_1556377178\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4288_1973280482\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4288_1556377178\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4288_1556377178\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4288_1556377178\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4288_7206864\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgezwrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdytqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdytqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxvsmkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzurpmhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upnhfzxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxvsmkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqolgbywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxvqnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjebztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezxrpjhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmkhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqligaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xjhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xjhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfdxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebzxrmjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgezwrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpnifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmkhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjebztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfdxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvpnifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxsqnifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebzxrmjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxvqnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keczxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_a8e8a8914cf885db4faffd3d9dc57727_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezxrpjhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbztrljgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_daysqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzurpmhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oljdbywtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqolgbywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqligaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upnhfzxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbztrljgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daysqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oljdbywtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxsqnifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_keczxvpnhf.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4960	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2608	ipconfig.exe
2556	ipconfig.exe
2652	ipconfig.exe
2976	ipconfig.exe
5436	ipconfig.exe
3396	ipconfig.exe
2500	ipconfig.exe
3536	ipconfig.exe
3736	ipconfig.exe
2748	ipconfig.exe
5908	ipconfig.exe
3620	ipconfig.exe
928	ipconfig.exe
4304	ipconfig.exe
3296	ipconfig.exe
2948	ipconfig.exe
4812	ipconfig.exe
5400	ipconfig.exe
4240	ipconfig.exe
6080	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274512159287843"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{9B6E3225-FE8C-4364-9FC1-D68DD5C462A4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6096	msedge.exe
6096	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1344	i_nkfdxvpnif.exe
Token: SeDebugPrivilege	3360	i_upnhfzxrpk.exe
Token: SeDebugPrivilege	5736	i_hezxrpjhez.exe
Token: SeDebugPrivilege	4916	i_jebzxrmjec.exe
Token: SeDebugPrivilege	1380	i_jgezwrpjhb.exe
Token: SeDebugPrivilege	3716	i_gbztrljgbz.exe
Token: SeDebugPrivilege	5952	i_gdytqoigby.exe
Token: SeDebugPrivilege	5652	i_daysqkidav.exe
Token: SeDebugPrivilege	6104	i_fdxvpnifax.exe
Token: SeDebugPrivilege	2748	i_cxvsmkfcxv.exe
Token: SeDebugPrivilege	5784	i_upmkhfzxrp.exe
Token: SeDebugPrivilege	5036	i_bzurpmhezx.exe
Token: SeDebugPrivilege	4908	i_mjebztrmje.exe
Token: SeDebugPrivilege	2916	i_oljdbywtol.exe
Token: SeDebugPrivilege	1068	i_tqolgbywqo.exe
Token: SeDebugPrivilege	2372	i_vtqligaysq.exe
Token: SeDebugPrivilege	5404	i_lfdxvqnifa.exe
Token: SeDebugPrivilege	5372	i_faxsqnifax.exe
Token: SeDebugPrivilege	1148	i_keczxvpnhf.exe
Token: SeDebugPrivilege	1512	i_xjhfzxrpjh.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4288	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5168 wrote to memory of 3380	5168	2026-07-02_a8e8a8914cf885db4faffd3d9dc57727_elex_rhadamanthys_stop.exe	88
PID 3380 wrote to memory of 4288	3380	iexplore.exe	90
PID 4288 wrote to memory of 3120	4288	msedge.exe	91
PID 4288 wrote to memory of 4960	4288	msedge.exe	92
PID 4288 wrote to memory of 5768	4288	msedge.exe	93
PID 4288 wrote to memory of 5768	4288	msedge.exe	93
PID 4288 wrote to memory of 2152	4288	msedge.exe	94
PID 4288 wrote to memory of 2152	4288	msedge.exe	94
PID 4288 wrote to memory of 2152	4288	msedge.exe	94
PID 4288 wrote to memory of 5164	4288	msedge.exe	95
PID 4288 wrote to memory of 5164	4288	msedge.exe	95
PID 4288 wrote to memory of 5164	4288	msedge.exe	95
PID 4288 wrote to memory of 1336	4288	msedge.exe	96
PID 4288 wrote to memory of 1336	4288	msedge.exe	96
PID 4288 wrote to memory of 1336	4288	msedge.exe	96
PID 4288 wrote to memory of 2860	4288	msedge.exe	98
PID 4288 wrote to memory of 2860	4288	msedge.exe	98
PID 4288 wrote to memory of 2860	4288	msedge.exe	98
PID 4288 wrote to memory of 2556	4288	msedge.exe	99
PID 4288 wrote to memory of 2556	4288	msedge.exe	99
PID 4288 wrote to memory of 2556	4288	msedge.exe	99
PID 4288 wrote to memory of 3332	4288	msedge.exe	100
PID 4288 wrote to memory of 3332	4288	msedge.exe	100
PID 4288 wrote to memory of 1708	4288	msedge.exe	103
PID 4288 wrote to memory of 1708	4288	msedge.exe	103
PID 4288 wrote to memory of 5828	4288	msedge.exe	102
PID 4288 wrote to memory of 5828	4288	msedge.exe	102
PID 5168 wrote to memory of 3924	5168	2026-07-02_a8e8a8914cf885db4faffd3d9dc57727_elex_rhadamanthys_stop.exe	104
PID 3616 wrote to memory of 4476	3616	nkfdxvpnif.exe	107
PID 4288 wrote to memory of 5216	4288	msedge.exe	111
PID 4288 wrote to memory of 2384	4288	msedge.exe	112
PID 4288 wrote to memory of 2384	4288	msedge.exe	112
PID 4288 wrote to memory of 1236	4288	msedge.exe	113
PID 4288 wrote to memory of 1236	4288	msedge.exe	113
PID 5168 wrote to memory of 4760	5168	2026-07-02_a8e8a8914cf885db4faffd3d9dc57727_elex_rhadamanthys_stop.exe	116
PID 5168 wrote to memory of 2044	5168	2026-07-02_a8e8a8914cf885db4faffd3d9dc57727_elex_rhadamanthys_stop.exe	120
PID 1396 wrote to memory of 6076	1396	upnhfzxrpk.exe	122
PID 5168 wrote to memory of 3048	5168	2026-07-02_a8e8a8914cf885db4faffd3d9dc57727_elex_rhadamanthys_stop.exe	125
PID 5168 wrote to memory of 5916	5168	2026-07-02_a8e8a8914cf885db4faffd3d9dc57727_elex_rhadamanthys_stop.exe	129
PID 5204 wrote to memory of 4292	5204	hezxrpjhez.exe	131
PID 5168 wrote to memory of 1792	5168	2026-07-02_a8e8a8914cf885db4faffd3d9dc57727_elex_rhadamanthys_stop.exe	134
PID 5168 wrote to memory of 4232	5168	2026-07-02_a8e8a8914cf885db4faffd3d9dc57727_elex_rhadamanthys_stop.exe	138
PID 5596 wrote to memory of 5560	5596	jebzxrmjec.exe	140
PID 5168 wrote to memory of 1400	5168	2026-07-02_a8e8a8914cf885db4faffd3d9dc57727_elex_rhadamanthys_stop.exe	143
PID 4288 wrote to memory of 3116	4288	msedge.exe	146
PID 4288 wrote to memory of 2876	4288	msedge.exe	147
PID 4288 wrote to memory of 5192	4288	msedge.exe	148
PID 5168 wrote to memory of 3552	5168	2026-07-02_a8e8a8914cf885db4faffd3d9dc57727_elex_rhadamanthys_stop.exe	151
PID 932 wrote to memory of 5624	932	jgezwrpjhb.exe	153
PID 5168 wrote to memory of 3336	5168	2026-07-02_a8e8a8914cf885db4faffd3d9dc57727_elex_rhadamanthys_stop.exe	156
PID 5168 wrote to memory of 3360	5168	2026-07-02_a8e8a8914cf885db4faffd3d9dc57727_elex_rhadamanthys_stop.exe	160
PID 1080 wrote to memory of 2184	1080	gbztrljgbz.exe	162
PID 5168 wrote to memory of 1064	5168	2026-07-02_a8e8a8914cf885db4faffd3d9dc57727_elex_rhadamanthys_stop.exe	165
PID 5168 wrote to memory of 4800	5168	2026-07-02_a8e8a8914cf885db4faffd3d9dc57727_elex_rhadamanthys_stop.exe	169
PID 3356 wrote to memory of 4484	3356	gdytqoigby.exe	171
PID 5168 wrote to memory of 2792	5168	2026-07-02_a8e8a8914cf885db4faffd3d9dc57727_elex_rhadamanthys_stop.exe	174
PID 5168 wrote to memory of 4984	5168	2026-07-02_a8e8a8914cf885db4faffd3d9dc57727_elex_rhadamanthys_stop.exe	178
PID 4736 wrote to memory of 2100	4736	daysqkidav.exe	180
PID 5168 wrote to memory of 3024	5168	2026-07-02_a8e8a8914cf885db4faffd3d9dc57727_elex_rhadamanthys_stop.exe	183
PID 4288 wrote to memory of 5980	4288	msedge.exe	185
PID 4288 wrote to memory of 5980	4288	msedge.exe	185
PID 5168 wrote to memory of 2444	5168	2026-07-02_a8e8a8914cf885db4faffd3d9dc57727_elex_rhadamanthys_stop.exe	191
PID 1380 wrote to memory of 5488	1380	fdxvpnifax.exe	193
PID 5168 wrote to memory of 3220	5168	2026-07-02_a8e8a8914cf885db4faffd3d9dc57727_elex_rhadamanthys_stop.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-07-02_a8e8a8914cf885db4faffd3d9dc57727_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_a8e8a8914cf885db4faffd3d9dc57727_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5168
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x35c,0x7ffbcb3ec188,0x7ffbcb3ec194,0x7ffbcb3ec1a0
      4⤵
      PID:3120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,4337355330656301648,13368967347409645623,524288 --field-trial-handle=2224,i,1066405039430111254,4744628096857443783,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:11
      4⤵
      System Time Discovery
      PID:4960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,1326489010374776680,6906372628331133940,524288 --field-trial-handle=2224,i,1066405039430111254,4744628096857443783,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:13
      4⤵
      PID:5768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,11107305123619607940,4806982573417926062,262144 --field-trial-handle=2224,i,1066405039430111254,4744628096857443783,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
      4⤵
      PID:2152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3612,i,6130573305582564722,11959640232516406919,2097152 --field-trial-handle=2224,i,1066405039430111254,4744628096857443783,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
      4⤵
      PID:5164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3616,i,1787720561245669259,8772912351496304443,2097152 --field-trial-handle=2224,i,1066405039430111254,4744628096857443783,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
      4⤵
      PID:1336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,3177056627255923165,15575831286963642949,2097152 --field-trial-handle=2224,i,1066405039430111254,4744628096857443783,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:1
      4⤵
      PID:2860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,14885896406860972582,16318103450803674091,2097152 --field-trial-handle=2224,i,1066405039430111254,4744628096857443783,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:9
      4⤵
      PID:2556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3816,i,18120510624485170882,13536228184459793558,524288 --field-trial-handle=2224,i,1066405039430111254,4744628096857443783,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:14
      4⤵
      PID:3332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,10313451956026886163,123776528023258323,524288 --field-trial-handle=2224,i,1066405039430111254,4744628096857443783,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
      4⤵
      PID:5828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,15406282934479643830,7998264661565442444,524288 --field-trial-handle=2224,i,1066405039430111254,4744628096857443783,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
      4⤵
      PID:1708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,13171983217252819275,12989785405823555351,524288 --field-trial-handle=2224,i,1066405039430111254,4744628096857443783,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
      4⤵
      PID:2756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,13171983217252819275,12989785405823555351,524288 --field-trial-handle=2224,i,1066405039430111254,4744628096857443783,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
      4⤵
      PID:5216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,14061786694718128890,3015134924803658367,524288 --field-trial-handle=2224,i,1066405039430111254,4744628096857443783,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
      4⤵
      PID:2384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,6164500629880718200,12636924509340627848,524288 --field-trial-handle=2224,i,1066405039430111254,4744628096857443783,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
      4⤵
      PID:1236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,17518965932876391793,1204226963328748278,524288 --field-trial-handle=2224,i,1066405039430111254,4744628096857443783,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
      4⤵
      PID:3116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,9181376667757698607,11717191878460153413,524288 --field-trial-handle=2224,i,1066405039430111254,4744628096857443783,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
      4⤵
      PID:2876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,6071430006911629688,8404732077314225332,524288 --field-trial-handle=2224,i,1066405039430111254,4744628096857443783,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:14
      4⤵
      PID:5192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,8502213933809575732,7168787337489173655,524288 --field-trial-handle=2224,i,1066405039430111254,4744628096857443783,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
      4⤵
      PID:5980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,12156812849149675807,14141636436438046854,524288 --field-trial-handle=2224,i,1066405039430111254,4744628096857443783,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:14
      4⤵
      PID:3536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,7167339235490806527,8548712105660843340,524288 --field-trial-handle=2224,i,1066405039430111254,4744628096857443783,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:14
      4⤵
      PID:2756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,5273188666500314046,4735399223116953412,524288 --field-trial-handle=2224,i,1066405039430111254,4744628096857443783,262144 --variations-seed-version --mojo-platform-channel-handle=1288 /prefetch:14
      4⤵
      PID:828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6760,i,8034187482904707020,3134878121016962002,262144 --field-trial-handle=2224,i,1066405039430111254,4744628096857443783,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2736,i,9654988527446243077,2371958766546143803,524288 --field-trial-handle=2224,i,1066405039430111254,4744628096857443783,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:14
      4⤵
      PID:2116
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkfdxvpnif.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3924
- - C:\Temp\nkfdxvpnif.exe
    C:\Temp\nkfdxvpnif.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3616
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4476
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkfdxvpnif.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4760
- - C:\Temp\i_nkfdxvpnif.exe
    C:\Temp\i_nkfdxvpnif.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upnhfzxrpk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2044
- - C:\Temp\upnhfzxrpk.exe
    C:\Temp\upnhfzxrpk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1396
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6076
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2608
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upnhfzxrpk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3048
- - C:\Temp\i_upnhfzxrpk.exe
    C:\Temp\i_upnhfzxrpk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hezxrpjhez.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5916
- - C:\Temp\hezxrpjhez.exe
    C:\Temp\hezxrpjhez.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5204
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4292
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3620
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hezxrpjhez.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1792
- - C:\Temp\i_hezxrpjhez.exe
    C:\Temp\i_hezxrpjhez.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jebzxrmjec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4232
- - C:\Temp\jebzxrmjec.exe
    C:\Temp\jebzxrmjec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5596
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5560
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jebzxrmjec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1400
- - C:\Temp\i_jebzxrmjec.exe
    C:\Temp\i_jebzxrmjec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgezwrpjhb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3552
- - C:\Temp\jgezwrpjhb.exe
    C:\Temp\jgezwrpjhb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:932
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5624
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgezwrpjhb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3336
- - C:\Temp\i_jgezwrpjhb.exe
    C:\Temp\i_jgezwrpjhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbztrljgbz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3360
- - C:\Temp\gbztrljgbz.exe
    C:\Temp\gbztrljgbz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1080
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2184
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbztrljgbz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1064
- - C:\Temp\i_gbztrljgbz.exe
    C:\Temp\i_gbztrljgbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdytqoigby.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4800
- - C:\Temp\gdytqoigby.exe
    C:\Temp\gdytqoigby.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3356
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4484
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5436
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdytqoigby.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2792
- - C:\Temp\i_gdytqoigby.exe
    C:\Temp\i_gdytqoigby.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\daysqkidav.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4984
- - C:\Temp\daysqkidav.exe
    C:\Temp\daysqkidav.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4736
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2100
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_daysqkidav.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3024
- - C:\Temp\i_daysqkidav.exe
    C:\Temp\i_daysqkidav.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvpnifax.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2444
- - C:\Temp\fdxvpnifax.exe
    C:\Temp\fdxvpnifax.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1380
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5488
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvpnifax.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3220
- - C:\Temp\i_fdxvpnifax.exe
    C:\Temp\i_fdxvpnifax.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxvsmkfcxv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2032
- - C:\Temp\cxvsmkfcxv.exe
    C:\Temp\cxvsmkfcxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1868
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2720
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxvsmkfcxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2368
- - C:\Temp\i_cxvsmkfcxv.exe
    C:\Temp\i_cxvsmkfcxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upmkhfzxrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2312
- - C:\Temp\upmkhfzxrp.exe
    C:\Temp\upmkhfzxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5668
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2400
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upmkhfzxrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3044
- - C:\Temp\i_upmkhfzxrp.exe
    C:\Temp\i_upmkhfzxrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bzurpmhezx.exe ups_run
  2⤵
  PID:5792
- - C:\Temp\bzurpmhezx.exe
    C:\Temp\bzurpmhezx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2652
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3600
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bzurpmhezx.exe ups_ins
  2⤵
  PID:124
- - C:\Temp\i_bzurpmhezx.exe
    C:\Temp\i_bzurpmhezx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5036
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjebztrmje.exe ups_run
  2⤵
  PID:5000
- - C:\Temp\mjebztrmje.exe
    C:\Temp\mjebztrmje.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1884
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1716
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjebztrmje.exe ups_ins
  2⤵
  PID:1592
- - C:\Temp\i_mjebztrmje.exe
    C:\Temp\i_mjebztrmje.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oljdbywtol.exe ups_run
  2⤵
  PID:5936
- - C:\Temp\oljdbywtol.exe
    C:\Temp\oljdbywtol.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3116
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6068
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oljdbywtol.exe ups_ins
  2⤵
  PID:5580
- - C:\Temp\i_oljdbywtol.exe
    C:\Temp\i_oljdbywtol.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tqolgbywqo.exe ups_run
  2⤵
  PID:1136
- - C:\Temp\tqolgbywqo.exe
    C:\Temp\tqolgbywqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3296
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6108
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tqolgbywqo.exe ups_ins
  2⤵
  PID:3564
- - C:\Temp\i_tqolgbywqo.exe
    C:\Temp\i_tqolgbywqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtqligaysq.exe ups_run
  2⤵
  PID:5420
- - C:\Temp\vtqligaysq.exe
    C:\Temp\vtqligaysq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5552
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:200
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtqligaysq.exe ups_ins
  2⤵
  PID:4908
- - C:\Temp\i_vtqligaysq.exe
    C:\Temp\i_vtqligaysq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdxvqnifa.exe ups_run
  2⤵
  PID:2916
- - C:\Temp\lfdxvqnifa.exe
    C:\Temp\lfdxvqnifa.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5684
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:8
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdxvqnifa.exe ups_ins
  2⤵
  PID:4572
- - C:\Temp\i_lfdxvqnifa.exe
    C:\Temp\i_lfdxvqnifa.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faxsqnifax.exe ups_run
  2⤵
  PID:4612
- - C:\Temp\faxsqnifax.exe
    C:\Temp\faxsqnifax.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3260
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3456
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faxsqnifax.exe ups_ins
  2⤵
  PID:4964
- - C:\Temp\i_faxsqnifax.exe
    C:\Temp\i_faxsqnifax.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\keczxvpnhf.exe ups_run
  2⤵
  PID:2664
- - C:\Temp\keczxvpnhf.exe
    C:\Temp\keczxvpnhf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6128
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3400
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_keczxvpnhf.exe ups_ins
  2⤵
  PID:5892
- - C:\Temp\i_keczxvpnhf.exe
    C:\Temp\i_keczxvpnhf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xjhfzxrpjh.exe ups_run
  2⤵
  PID:2888
- - C:\Temp\xjhfzxrpjh.exe
    C:\Temp\xjhfzxrpjh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5828
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1332
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xjhfzxrpjh.exe ups_ins
  2⤵
  PID:4844
- - C:\Temp\i_xjhfzxrpjh.exe
    C:\Temp\i_xjhfzxrpjh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1512

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5936

C:\Temp\cxupmkfcxu.sys
C:\Temp\cxupmkfcxu.sys
1⤵
- Executes dropped EXE
PID:2600

C:\Temp\mkecwupmhf.sys
C:\Temp\mkecwupmhf.sys
1⤵
- Executes dropped EXE
PID:5036

C:\Temp\rpjhfzxrpj.sys
C:\Temp\rpjhfzxrpj.sys
1⤵
- Executes dropped EXE
PID:2384

C:\Temp\pmgezwrojh.sys
C:\Temp\pmgezwrojh.sys
1⤵
- Executes dropped EXE
PID:5320

C:\Temp\eywroigeyw.sys
C:\Temp\eywroigeyw.sys
1⤵
- Executes dropped EXE
PID:5508

C:\Temp\dyvtqoigdb.sys
C:\Temp\dyvtqoigdb.sys
1⤵
- Executes dropped EXE
PID:5708

C:\Temp\qlidbvtqli.sys
C:\Temp\qlidbvtqli.sys
1⤵
- Executes dropped EXE
PID:6136

C:\Temp\lfdxvsnkig.sys
C:\Temp\lfdxvsnkig.sys
1⤵
- Executes dropped EXE
PID:5180

C:\Temp\fdxvpnicau.sys
C:\Temp\fdxvpnicau.sys
1⤵
- Executes dropped EXE
PID:244

C:\Temp\cxupnhfzxr.sys
C:\Temp\cxupnhfzxr.sys
1⤵
- Executes dropped EXE
PID:3016

C:\Temp\keczxrpnhf.sys
C:\Temp\keczxrpnhf.sys
1⤵
PID:5828

C:\Temp\pjhbztrmje.sys
C:\Temp\pjhbztrmje.sys
1⤵
PID:4612

C:\Temp\rljdbztrom.sys
C:\Temp\rljdbztrom.sys
1⤵
PID:2600

C:\Temp\tqligebwtn.sys
C:\Temp\tqligebwtn.sys
1⤵
PID:4740

C:\Temp\bywqoljdby.sys
C:\Temp\bywqoljdby.sys
1⤵
PID:2104

C:\Temp\lidaysqlid.sys
C:\Temp\lidaysqlid.sys
1⤵
PID:5720

C:\Temp\ifayspnifa.sys
C:\Temp\ifayspnifa.sys
1⤵
PID:4172

C:\Temp\kecaxvpnhf.sys
C:\Temp\kecaxvpnhf.sys
1⤵
PID:1624

C:\Temp\ausmkfcxup.sys
C:\Temp\ausmkfcxup.sys
1⤵
PID:4396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxupmkfcxu.sys

Path C:\Temp\cxupmkfcxu.sys
Size 141KB
SHA256 fc09c7825f16af8a3273eae6ecb025cad16e0c9be07816a4d13a80dfdfcc2572
MD5 20047b30e9b9ea153232a5a9cb977f7b
SHA1 2f977c0c8ffedf342193a6a9ec39e9ccff172f90
SHA512 16fb4735e13a894c4482323eb13e546abab87e5cab9955a7fb2a29250e4a9c5e5e393d937156bd65201d2942757fba9b4e06b30f660ee5f8cb5f41c5a275b057
SSDEEP 1536:ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1AEE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvtqoigdb.sys

Path C:\Temp\dyvtqoigdb.sys
Size 141KB
SHA256 4db762c3fb9a760871e28b669888821fd6cde0120966d5f37633afb42fe84011
MD5 4f4132091e2eec24df86ed14c86e3d27
SHA1 24de78b909dc8af8630cde31cda76e75c4505ef8
SHA512 15ee2f29eddff9656bc66363c7fb19c08d7954437fe5f659efe5439097ba6036f619ede4a646b3781b491273655e226cfa47e90a56e5bd493c31d655ca781e60
SSDEEP 1536:Pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T117E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywroigeyw.sys

Path C:\Temp\eywroigeyw.sys
Size 141KB
SHA256 3c8fc886f3ba1b7771f3d546c32764703a9cc41fabefdba711d7a17ac1ff0dd3
MD5 e0057d513646f2b0022a9e1af35de873
SHA1 f018ed64b2123b083a4dbeb0e1f915ce7a8a8a97
SHA512 46422d9e313b3c6d0153ddc29a591909393047ce496cf6beda4b693622f0b4c7f4241cd2ef903f8b06ddd2833c66365675f12dc8589fe6e564760a2c74d1b53d
SSDEEP 1536:Oa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Oa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1AEE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbztrljgbz.exe

Path C:\Temp\gbztrljgbz.exe
Size 243KB
SHA256 5bd28e7bcb0d196528ee2b533e555d381c9d0bca8ce6bc90d32af234941f638e
MD5 12ce1590ec2813c62239198ba2f07bf3
SHA1 b7e6066b6fe048079f07b90948eb128824d9d38f
SHA512 0338ea7741ca41c3ef7ba810bef1dd7936688b965e9b9a7f65137865b37df20f69898a7ed24ed868421340064519b25c6fe08c53bb9a8c168949754aaf4866b8
SSDEEP 3072:UCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7C:nvMsLaOa3lLNngoqRttA7C
TLSH
T152345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hezxrpjhez.exe

Path C:\Temp\hezxrpjhez.exe
Size 243KB
SHA256 5d983738081aed5b9ab35e2fb96a992f869aafe5b4a63edc0c465a586b42ff17
MD5 068b2dedf3a833bbef4b5a4560837710
SHA1 90da4495d4d89fca7c42f887efa812f0ef019d6c
SHA512 58d93be4add49fb0ab9112b5bdb2785f49157f2a8039f06f55ae16ee5cf1313022104d3eb382ce30356b3710b7e43b69dd010d530857eba88e65eee018485103
SSDEEP 3072:TCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7R:WvMsLaOa3lLNngoqRttA7R
TLSH
T109345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gbztrljgbz.exe

Path C:\Temp\i_gbztrljgbz.exe
Size 243KB
SHA256 20dac71d2fdfb48a25a087e32addad58a4d9aceaa85e771c794d6b90cf6534ab
MD5 e18ef9b37ae7aaef87d9cced1c2055fb
SHA1 253d7e4c2dc9414dbd29a7a08ad910069ab474f2
SHA512 73fb2bcb0c7c565c32936fae1646be10807ec0d47411d9fd3c43ec4852012716cc822f296d43b10b7dbe7f1d9193225ece7a58111c715c816e6390f795996894
SSDEEP 3072:NCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7n:AvMsLaOa3lLNngoqRttA7n
TLSH
T171345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hezxrpjhez.exe

Path C:\Temp\i_hezxrpjhez.exe
Size 243KB
SHA256 c6dc6a52c4112bd05979c503b9004864426c4475fd0e1d779d04fe49142db111
MD5 12c402fc6461ffa35d05fab3c85f9fb6
SHA1 76fed8db07d5d53e123d0e409445dfc122b207b1
SHA512 4b25d33edab5ce3e9790a2cd0bc6f9e97a64295678d67970298f5a5d04c88c8a2cebe46455f14c8a0b160605b681513ef4145bf4a914f53bae811aefa82ca1b0
SSDEEP 3072:SCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7M:NvMsLaOa3lLNngoqRttA7M
TLSH
T14F345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jebzxrmjec.exe

Path C:\Temp\i_jebzxrmjec.exe
Size 243KB
SHA256 47af997f0d3398bc142ec5af9296becc9e8f2e5005def3690cb3913a8d55e076
MD5 954ad8a599487222752e69e451f5a82a
SHA1 551e7c7d09b429ca85547c89bb4d4dc7f5c44d73
SHA512 1a664cb9398d5caed4e7a1dea27201cef954235500c5cfef10703ee90db032e93cfe114acee5538f1bfea3b5a8c0d0d7089de3d45900f8e13096fe40de5e09d4
SSDEEP 3072:nCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7V:CvMsLaOa3lLNngoqRttA7V
TLSH
T164345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jgezwrpjhb.exe

Path C:\Temp\i_jgezwrpjhb.exe
Size 243KB
SHA256 ff7d6208f0ed78918ea5ef93792142a6fcf0ea050a5f5f6f38ac7c3613c7bdc0
MD5 3514ce9c531f2ead3235427c3f9adff8
SHA1 c156cac4906b80dad2edd06bf80dc15d9b60cb8c
SHA512 aa13ada9b9d2f69f4ef5f15d1aee1118c3741859baec7b63e20accf9e315b0cc0fdd16d965ea8117a7198fa9b3c34c15856a9a0d1e78420cebed0cd7a49bac2d
SSDEEP 3072:rCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7J:evMsLaOa3lLNngoqRttA7J
TLSH
T1D5345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nkfdxvpnif.exe

Path C:\Temp\i_nkfdxvpnif.exe
Size 243KB
SHA256 f6746f3be28f8eb3b7605a3e70ecce68b6d1a23b49c0161cb01ffa1d9e37b925
MD5 4a9f6296e7c836a84fa1a4343dcebbea
SHA1 f0a31f88f13b4b0fb29cb37919e120bdacb27a76
SHA512 988e6542a3c171470d2275eafcccf499923d9e2010f95e45e21b7ebb2e7de565fcfa0a717af0f625f8be08f93be9e5a020d9f680c92f36f349d6e9a54b3c78ba
SSDEEP 3072:fCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:qvMsLaOa3lLNngoqRttA71
TLSH
T1D9345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_upnhfzxrpk.exe

Path C:\Temp\i_upnhfzxrpk.exe
Size 243KB
SHA256 a9968b55ba8702a2ea6e4bd7960ef4f3375f33c4cf3e26861cd3312073dfe7ff
MD5 1a3c1b05cecb16e3a179278182c52f18
SHA1 85a4794f889e2496b2b3885814a7c41c9c80c3c3
SHA512 082d671a53849e00772e86e88dcbc3e8740db70e64f2b9c6dd2ee654a6ead7e6b87d97b855961ca5e9d03a99c2aeae5ef37d33dc3fe2cbd791e5c92cb33becd9
SSDEEP 3072:PCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7h:avMsLaOa3lLNngoqRttA7h
TLSH
T1DB345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jebzxrmjec.exe

Path C:\Temp\jebzxrmjec.exe
Size 243KB
SHA256 702c7633922613373f28c12d1e859b0699a6bdcc4e6416c01044f35b4fc06cbc
MD5 6cfa3e61bc20b7db09dc64fe9d7472e4
SHA1 0880a37effb84a469ffb8164ea16c889b9d70c7e
SHA512 43707222c2fdeb063f40340cb3b127ab0711a919cb126d64f970c733e88746c993dc0bcbb3d24af66bbcc110a711149f22210df2beeb687b1602de89e1bf2d03
SSDEEP 3072:rCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7N:evMsLaOa3lLNngoqRttA7N
TLSH
T1A8345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgezwrpjhb.exe

Path C:\Temp\jgezwrpjhb.exe
Size 243KB
SHA256 ecc11eda736264f15a440edd58f129b314beccd41f840ceee29b3562880ab33a
MD5 f9af058b6f44f4d77f55a48d44701c0a
SHA1 04d178a0cd0869e1465627b492b71358f85d25c8
SHA512 a46b523e93bb80c6c53a524eb0299dfb02c5bce964ff2e8721d992d0579c97a55dee45b4d19eb5a48108333b00f8ceecfc67d2399941aa00cea6b4e40d8bafc1
SSDEEP 3072:QCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:LvMsLaOa3lLNngoqRttA7W
TLSH
T19A345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkecwupmhf.sys

Path C:\Temp\mkecwupmhf.sys
Size 141KB
SHA256 d15ca07c997c8442c329a95edbc4d084027213141a2a5c38cf4528228745cf11
MD5 0d119bf9151ecc1242a55b5bf18850e4
SHA1 57daf02963f9df8e9026eec16459a23c2be74baa
SHA512 4c28953c735c0b68bbf36d28d629e09f53827b6fb9ad91c84e832cad95134f71332b3dadad12c4e5058c7f85bb09c42de5e1ce3d0fb3d8c5ab148f57ce2658c7
SSDEEP 1536:Ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T176E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkfdxvpnif.exe

Path C:\Temp\nkfdxvpnif.exe
Size 243KB
SHA256 c0cf49bc988c9291908047d9abd1eea6138857cf03093c37d08b67c34cf5e6e8
MD5 54d3fb60f7464109e575414569c8670b
SHA1 34a0edb8fa7b0b42422aee7d887a4258f08fb21a
SHA512 cfaac72a09ae4a79e39d45c1493e99992fcf31b06e5f1d4882d1e7c7c817b26710778adae4d403204966664798ee5f40c98ee8f8ba22387c232c3d4bde94954a
SSDEEP 3072:yCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:tvMsLaOa3lLNngoqRttA7A
TLSH
T132345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmgezwrojh.sys

Path C:\Temp\pmgezwrojh.sys
Size 141KB
SHA256 137f4ddc3fa2c9fda4c959c769023d59cb650e8b3b23e0dc9964c1fadae65d6a
MD5 9fbe33be792dae7ed12df81f2b9c82f2
SHA1 9660c888a6ea6d6ec61c76b253e98aea334eb1ca
SHA512 5607ca16ca60aa9722bbe253ea0459a79678fc6040f7b24dbdbfac30cf2c77553bb640fa3048af453c2c2bee3f3d9e40b86183d2b746df18441fa8ed2ef7bff2
SSDEEP 1536:wa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:wa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T112E37C12B2D2D172D8A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhfzxrpj.sys

Path C:\Temp\rpjhfzxrpj.sys
Size 141KB
SHA256 b2cc389aeb9a909c958e0f8db0baacca04f8117a9349a678f644df786de96f5d
MD5 3acbc08ddf3c98e6979560546ed85faf
SHA1 3b616aefec937b88d9cb5cf48c323b3fefadc6fe
SHA512 8eefe6d6d8c4a3d89aff390fece07cd66756a7422dc8af6738119abe7c134a7e1bd0cff8a130a4570f476962bd8e9af7d9da4b94d63b28d63c6de98ffcb30051
SSDEEP 1536:da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T176E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upnhfzxrpk.exe

Path C:\Temp\upnhfzxrpk.exe
Size 243KB
SHA256 b4a00db5c75c01153d4caf3d27168f75365c992e9cf1ca3efdcf98482991d5e2
MD5 a2bb393da94f30d4b50efc7b0664c647
SHA1 eb089d28497a7988e98d6396106ca41c38e313e8
SHA512 f97cd57161f8314b7222528f576ca37e4ac7e9e4d6e297be483f3e184fea7bb6163d4bc0b3da515c50cb1ceb68bc54068590c9e53303e683cb89b5aa96bf123a
SSDEEP 3072:cCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7O:/vMsLaOa3lLNngoqRttA7O
TLSH
T14C345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 674d24008448b140a9b320032b4ed333cf5a592b073bf375c453c816d33c703b
MD5 b989ec4e221bd567659492bc1ad7ab3b
SHA1 372670805b3060960e77e6ba32a3b9edd0241cf0
SHA512 f6934e6a831bcac97110107a79389dae0e669b743e0d62e5b411c19471bf237f4d61c7cee27d9fcacbd7045cbe27e78b4e6c38f6e76ca789a7760295558b0bb3
TLSH
T1CBD0C0383E28F508C5402076E4504310E3238131742B8242B010F02DEC581810BDF0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e1a5fea1006889b9c3bcf0a470a6a4256d5300a4b7036038ddce5fd042c424c
MD5 e9af81b8f1175d007e2c699939cb3df6
SHA1 696178bffe86e4e363a26747d6a5cb80e28621ce
SHA512 38174d529846c50b0af9a056e65ca491645c3cbf1fb867ef22a3b7c7ee4287ba29c3a28d736bc2e9c562faa24bb671db3b9cc40507a467140e47eaa4aeae6d51
TLSH
T145D0C0343E38F408C540207AE4514310E3138131302B8242B010F03DEC581810BDE0CF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 86794c71cf0e88fb8473ba9c4f9eadb5be9638448c9f6d9420b0154f0dbff4e6
MD5 66a79f16368d04f55f33e2f42aa45fd0
SHA1 ec7c70a9003aaa1dd41c933047017f7dda359c04
SHA512 412d29002363220febcb758af73d3258473de6e85e0e1c4932e5ad44b5de32d0dd0ba72164a80ea1cfe807c039eff522298dc7585da92d144c66849ebc97d7de
TLSH
T18B61A527D5214B2DFB6A32F1C0D8A6A83B72D352062BEE25C054AB7958FAF141C1363C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592793.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592793.TMP
Size 3KB
SHA256 d3e1625fa423a4d9dc9fb992ad53452c1074af08bee6552e122e93e66f3a8db0
MD5 6e1181be7b0513a45c102f591d33b5d3
SHA1 d647cec4b0e9408e9794aced53b24ba331214ad5
SHA512 edf490a761d0f6f484bbd5116263805af658a5d5897ff5ce69b85e2d14669f9d1c0d9b9dbf3be0dab6b2b8ff9196e0c2ec75843c0dbf76da004c032aa2b095d9
TLSH
T16F61B723D5214B2DFB2A72F1C0D8A6A83B72D352062BEE25C054EB7954F6F041C1363C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 75e7cf8504283857b2d5085d315c6eb3a40fdc178defe55c25bb0c88c56fa5e2
MD5 b4b35d6cb405bba350085f5b055f1401
SHA1 a4c895359490be73425abb9f5d0d60e0af2421e1
SHA512 1bb6b4fa399efaa65a1e3a9c12685cda37eaaab6367104839175beffe44c43a45b9b5a65d57d86b62d3610c5ff9df605bbfd8977caef767ea3a8e5b77605512f
TLSH
T15941ACF7C3E4867E890196F0BA186E2BCE1D0955832C3D5A89E4AF1BA3E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4a06129daa868d3c462e6caf94eef1ee7be87324854a9980b29ce8b6bbc1fb5e
MD5 6928ba92208d8c20cbae9d683b81d5e8
SHA1 f91fa9c01783c9cc91f5b2c738b0c3c5beb62da2
SHA512 1bd613eb9ca6086d883cc49dc5a806c769cfb49d7247e4b6f6bc9d84a29459ad61af23eee9ea06e82534dc868765c217925471cd84371017f30687b659dade24
SSDEEP 192:sxR8RRyM/jK1Ml8wcL6/f4eYs9me8jZ/JJxzoA8p9A/g6+WNCFu/Y+YuFmGQIgDW:sxR8NC2/f4eYs9qNhme/5P/7FeS
TLSH
T13262D905AA24597B8CDBD209FA557B53D2F91573E2901E48AAFC8B1C01E77DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 15a635a0b880801db62e019105eb4988846fa2d474a94330b392ab4d24970828
MD5 f8bd4f4013a445ed3dd7c6a9ca8200a8
SHA1 77d987f7d982d4802cf5b31ab2b31617dd4dc923
SHA512 dd6ae939123f7b3b29382b39b8762919d52204c1f89cf3cf2e6ae169df05fe5093801f50ad1c65c932f23c1e4da4a5a2ed61b1302f10c321a67e0d99f7127925
SSDEEP 192:sxR8RRyM/jK1Ml8UQQcL6/f4eYs9meYjZ/JJxzoA8prA/g6+WNCFu/Y+BuFmGQID:sxR8Nqv2/f4eYs9eNhm8/5P/SFes
TLSH
T1A362C816AA24597B8CDBD209FA557B53D2F91573E2901E48AAFCCB0C01E77DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0249895459b0140ddd968368bbb0c042e67270ef51931cdaf91bbdade5331d25
MD5 85160b6bde1441fe7ccee2ca5738db95
SHA1 9569161b0419238b6480bff0f920980a5d199d2c
SHA512 2ca4fbb764934bff7f36e7e5cef209721c3b72554d964992f97e78056ab383c444cfe61e8fb6fb8f2d192c8b605daf54e27f7f5a4cad049b02654f1961e4bce7
SSDEEP 192:sxRHRRyM/jK1Ml8wcL6/f4eYsEme8jZ/JJxzoA8p9A/g6+WNCFu/Y+YuFmGQIgtJ:sxRHNC2/f4eYsEqNhme/5P/7Fe3
TLSH
T1AD62D9056A24597BCCDBD209FA557B53D2F91563E2901E48AAFC8B1C01E77DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 13f0994a8c4ab4ca0e62194a55fea070eb44d8721a9c042f4cd9cf8875a9dc4f
MD5 a65c6f7d3a2f713b9b80c635d91f48de
SHA1 62a44fc77d0168527aba0fe74fa4e273db22fb4d
SHA512 acdcb42d28aa38155979f400a0a15670acecd73e2af57de10d5c96720884d6e9ef646df242c2183f766b87289589c9a1e78fcfbc2f79fdc41c546f3f3636a83c
SSDEEP 768:7dUhBR7pLuL7tgWgEyf3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6EGe0GEroddwZ:7dUhBHE7tgWgEyf3wu1jaVEGRGPdiZ
TLSH
T171E2EC3B680CCB7F4F404ADCE829BE9A6DA801CF9698CD5447EA841C03C6BEF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de20358a-f7e8-416f-87d0-68eb189efff0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\de20358a-f7e8-416f-87d0-68eb189efff0.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 8fef60514219b746983f11a488d5eee1422830f95b80ea727ba3bf167e78a6ce
MD5 19f0ae4d56ac3b414bf32775bdc5a954
SHA1 4ea30f95ad499f756172013d643626e2078fb794
SHA512 2c32baf2dddbaf3119e8a9de5cf9cba9969e0a2b6fb299e4a55c398ad0c9294ffa670ce976bcf191b17fc81f484e802cd8f24dfbad383d5075e3e1e13b0397f3
SSDEEP 768:XF1j+903kwgxGX2L1McvnWgWWR+2SrXH78tRMIDl8BvTPati:e903GV1JPWg1bSroBDl0Wti
TLSH
T13F1327F198D38976D8AE8783633D6E429ABCC193B4885994B7C45E0DCC872BFD606825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 61c846018f9c004d92ff3b94e13697be59103c044adc80f70624b3fe396436e2
MD5 aaa65f5f24d723cbf59d2c7ea658917d
SHA1 f004f957723cee4083712e07fec799e43b97609d
SHA512 78628b083ee099d967591a0cf3b04e4d2ef466ac6dea876bcdc64d8512cf2b16257a0d1fb2ea7987d7c92da2531e94c1beeda30e85e8df286f1850fd87be3c06
SSDEEP 768:Hj+9+3Q15yLJMcvnWgWWR+2SrXH78tRMIDl8BvTPati:q9+3JJJPWg1bSroBDl0Wti
TLSH
T1EAF2AD31AC558DB34CE6D685B2077783AEF401A7D5C82E98C5D96F0E028779D2B07C3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a94379d763a36dc56e7a789e6b2d4e5237a0127b91c08f45c1bb7118e726b444
MD5 80bef25d67f217805309658219868a6f
SHA1 0940a997815ffca916225cf11da7eba1141897bc
SHA512 c9d9705ad74ba0c92b24024f47ea02ee604aac9921cdd1c0e86da2526005e255a964eb146a95bbdfdd645e334764a09d0cca10e57ccc5a601876aa9901cd2a06
SSDEEP 768:Orv+4UNbdp3IT5y7McvnWgWWR+2SrXH78tRk3+8rr6F:Obsb/3/JPWg1bSroCDr6
TLSH
T1B103BF32A8689973DCE2D685720B76437FF44183D6C91B88C4D91B4D829F9DE2707C67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 47762c8c05d51081c4802fa1c1bd1ee106c90f38046b998838ea56892770359f
MD5 18f44d08414c3e8b2894b271e12dcc82
SHA1 bde37e09ed55e44214c73c24186b4fc9716d9898
SHA512 f19bbeec104cc616339565fd94f945f575f71450cabb054caf890d6a5a8b3fd9e0101d63f88c8422c4354f61b226ef1654cb751b5e775563eca1eec84ede901f
SSDEEP 768:hj+9+3Aa15yL0McvnWgWWR+2SrXH78tRMIDl8BvTPati:89+3AH0JPWg1bSroBDl0Wti
TLSH
T1B3F2AD31AC558DB34CE6DA85B2077783AEF401A7D5C81E98C5D96F0E028B79D2B07C3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4288_346228977\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/244-344-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1624-490-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2104-473-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2104-450-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2384-266-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2600-418-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2600-440-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2600-191-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3016-373-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3016-395-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4172-477-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4396-507-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4612-399-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4740-438-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4740-451-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5036-238-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5180-329-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5320-278-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5508-293-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5708-321-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5720-455-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5720-479-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5828-385-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6136-325-0x0000000000010000-0x0000000000083000-memory.dmp

Download