37e8523214aa25ab76dda3462f283217328a0deda407a2ac05060ab1c930e62f

Analysis

max time kernel
149s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_d3f38376d7bfa5e5b8a34bf276c5212d_elex_rhadamanthys_stop.exe
Size 243KB
Sample260702-txe9lahx2s
SHA256 37e8523214aa25ab76dda3462f283217328a0deda407a2ac05060ab1c930e62f
MD5 d3f38376d7bfa5e5b8a34bf276c5212d
SHA1 cf1fa7e55f612eacba73a0e01126afd7c4db04d8
SHA512 aa16565126b8b06a9decb16611572d3f2144e789a6bf3a296237de8bd396ad86d5b61a0166aba22ea64eca17d96cb1fd450998a73c0ebc6bd43dac3d33d9b393
SSDEEP 3072:CCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7M:9vMsLaOa3lLNngoqRttA7M
TLSH
T1EA345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
5756	CP.exe
4748	xvpnhfavsn.exe
5300	CP.exe
5124	CP.exe
5664	i_xvpnhfavsn.exe
2384	cxupnhfzxr.sys
5344	CP.exe
5824	xupnhfzxrp.exe
2944	CP.exe
1608	CP.exe
1308	i_xupnhfzxrp.exe
5784	pmkeczxrpm.sys
1552	CP.exe
1916	mkhczxupmk.exe
4464	CP.exe
1436	CP.exe
5724	i_mkhczxupmk.exe
4724	czurmkecwu.sys
1356	CP.exe
4668	wuomgezwro.exe
6048	CP.exe
5396	CP.exe
1084	i_wuomgezwro.exe
4284	cwuomgezwu.sys
2496	CP.exe
2040	wrojgezwrp.exe
1788	CP.exe
256	CP.exe
3184	i_wrojgezwrp.exe
2348	wqomgeywqo.sys
6132	CP.exe
3372	wtoljdbvto.exe
3504	CP.exe
2560	CP.exe
5796	i_wtoljdbvto.exe
1344	tolgdywqoi.sys
2428	CP.exe
4508	tnlfdyvqoi.exe
2812	CP.exe
5952	CP.exe
2524	i_tnlfdyvqoi.exe
3652	bvqnligbvt.sys
2912	CP.exe
5224	sqnlfdavtn.exe
5732	CP.exe
1244	CP.exe
5404	i_sqnlfdavtn.exe
6008	dxvqnigays.sys
4736	CP.exe
5808	vsnlfaysqk.exe
5108	CP.exe
464	CP.exe
2072	i_vsnlfaysqk.exe
5672	smkfcausnk.sys
2984	CP.exe
5260	nhfdxuspki.exe
2340	CP.exe
2672	CP.exe
5784	i_nhfdxuspki.exe
1212	kfcwusmkec.sys
3280	CP.exe
5556	keczusmkec.exe
5900	CP.exe
1648	CP.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3600_2124263399\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3600_687462581\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3600_687462581\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3600_687462581\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3600_1956195688\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3600_2124263399\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3600_687462581\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3600_2133623258\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3600_2133623258\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_d3f38376d7bfa5e5b8a34bf276c5212d_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtoljdbvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uromhezurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtomgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtqolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvtqlidx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkhczxupmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojgezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlfdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keczusmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_keczusmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtomgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvtqlidx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfdxuspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvqnligay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwupmhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwupmhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupnhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtoljdbvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnlfaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmjhezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgezwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqnlfdavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfdxuspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpmkfcxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupnhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojgezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnlfaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxsqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpmkfcxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgezwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqnlfdavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uromhezurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmjhezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqnligay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkhczxupmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtqolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxsqkicavs.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4708	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3032	ipconfig.exe
1964	ipconfig.exe
5812	ipconfig.exe
3124	ipconfig.exe
696	ipconfig.exe
4124	ipconfig.exe
4408	ipconfig.exe
4188	ipconfig.exe
696	ipconfig.exe
5996	ipconfig.exe
756	ipconfig.exe
624	ipconfig.exe
1956	ipconfig.exe
1560	ipconfig.exe
2500	ipconfig.exe
1356	ipconfig.exe
2892	ipconfig.exe
1624	ipconfig.exe
1936	ipconfig.exe
1648	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274831637087279"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{E8BCCE1F-7174-4E6E-95A8-5B34813DBF6C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5664	i_xvpnhfavsn.exe
Token: SeDebugPrivilege	1308	i_xupnhfzxrp.exe
Token: SeDebugPrivilege	5724	i_mkhczxupmk.exe
Token: SeDebugPrivilege	1084	i_wuomgezwro.exe
Token: SeDebugPrivilege	3184	i_wrojgezwrp.exe
Token: SeDebugPrivilege	5796	i_wtoljdbvto.exe
Token: SeDebugPrivilege	2524	i_tnlfdyvqoi.exe
Token: SeDebugPrivilege	5404	i_sqnlfdavtn.exe
Token: SeDebugPrivilege	2072	i_vsnlfaysqk.exe
Token: SeDebugPrivilege	5784	i_nhfdxuspki.exe
Token: SeDebugPrivilege	1560	i_keczusmkec.exe
Token: SeDebugPrivilege	3800	i_uromhezurp.exe
Token: SeDebugPrivilege	2568	i_urmjhezwrp.exe
Token: SeDebugPrivilege	3720	i_bwtomgeywr.exe
Token: SeDebugPrivilege	976	i_jdbvtqolgd.exe
Token: SeDebugPrivilege	1204	i_dyvqnligay.exe
Token: SeDebugPrivilege	4628	i_fdxvtqlidx.exe
Token: SeDebugPrivilege	3188	i_dxsqkicavs.exe
Token: SeDebugPrivilege	5536	i_vpmkfcxupn.exe
Token: SeDebugPrivilege	996	i_cwupmhfzxr.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3600	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 1876	3840	2026-07-02_d3f38376d7bfa5e5b8a34bf276c5212d_elex_rhadamanthys_stop.exe	88
PID 1876 wrote to memory of 3600	1876	iexplore.exe	89
PID 3600 wrote to memory of 1384	3600	msedge.exe	90
PID 3600 wrote to memory of 4712	3600	msedge.exe	92
PID 3600 wrote to memory of 4708	3600	msedge.exe	93
PID 3600 wrote to memory of 4712	3600	msedge.exe	92
PID 3600 wrote to memory of 4712	3600	msedge.exe	92
PID 3600 wrote to memory of 4376	3600	msedge.exe	94
PID 3600 wrote to memory of 4376	3600	msedge.exe	94
PID 3600 wrote to memory of 5468	3600	msedge.exe	95
PID 3600 wrote to memory of 5468	3600	msedge.exe	95
PID 3600 wrote to memory of 5468	3600	msedge.exe	95
PID 3600 wrote to memory of 3536	3600	msedge.exe	96
PID 3600 wrote to memory of 3536	3600	msedge.exe	96
PID 3600 wrote to memory of 3536	3600	msedge.exe	96
PID 3600 wrote to memory of 5836	3600	msedge.exe	97
PID 3600 wrote to memory of 5836	3600	msedge.exe	97
PID 3600 wrote to memory of 5836	3600	msedge.exe	97
PID 3600 wrote to memory of 2712	3600	msedge.exe	98
PID 3600 wrote to memory of 2712	3600	msedge.exe	98
PID 3600 wrote to memory of 2712	3600	msedge.exe	98
PID 3600 wrote to memory of 3316	3600	msedge.exe	100
PID 3600 wrote to memory of 3316	3600	msedge.exe	100
PID 3600 wrote to memory of 4704	3600	msedge.exe	101
PID 3600 wrote to memory of 5984	3600	msedge.exe	102
PID 3600 wrote to memory of 4704	3600	msedge.exe	101
PID 3600 wrote to memory of 5984	3600	msedge.exe	102
PID 3600 wrote to memory of 3372	3600	msedge.exe	104
PID 3840 wrote to memory of 5756	3840	2026-07-02_d3f38376d7bfa5e5b8a34bf276c5212d_elex_rhadamanthys_stop.exe	105
PID 3600 wrote to memory of 3160	3600	msedge.exe	107
PID 3600 wrote to memory of 3160	3600	msedge.exe	107
PID 4748 wrote to memory of 5300	4748	xvpnhfavsn.exe	109
PID 3600 wrote to memory of 1684	3600	msedge.exe	114
PID 3600 wrote to memory of 1684	3600	msedge.exe	114
PID 3840 wrote to memory of 5124	3840	2026-07-02_d3f38376d7bfa5e5b8a34bf276c5212d_elex_rhadamanthys_stop.exe	115
PID 3840 wrote to memory of 5344	3840	2026-07-02_d3f38376d7bfa5e5b8a34bf276c5212d_elex_rhadamanthys_stop.exe	119
PID 5824 wrote to memory of 2944	5824	xupnhfzxrp.exe	121
PID 3840 wrote to memory of 1608	3840	2026-07-02_d3f38376d7bfa5e5b8a34bf276c5212d_elex_rhadamanthys_stop.exe	124
PID 3840 wrote to memory of 1552	3840	2026-07-02_d3f38376d7bfa5e5b8a34bf276c5212d_elex_rhadamanthys_stop.exe	128
PID 1916 wrote to memory of 4464	1916	mkhczxupmk.exe	130
PID 3840 wrote to memory of 1436	3840	2026-07-02_d3f38376d7bfa5e5b8a34bf276c5212d_elex_rhadamanthys_stop.exe	133
PID 3840 wrote to memory of 1356	3840	2026-07-02_d3f38376d7bfa5e5b8a34bf276c5212d_elex_rhadamanthys_stop.exe	137
PID 4668 wrote to memory of 6048	4668	wuomgezwro.exe	139
PID 3840 wrote to memory of 5396	3840	2026-07-02_d3f38376d7bfa5e5b8a34bf276c5212d_elex_rhadamanthys_stop.exe	142
PID 3600 wrote to memory of 5220	3600	msedge.exe	145
PID 3600 wrote to memory of 4908	3600	msedge.exe	146
PID 3600 wrote to memory of 5872	3600	msedge.exe	147
PID 3840 wrote to memory of 2496	3840	2026-07-02_d3f38376d7bfa5e5b8a34bf276c5212d_elex_rhadamanthys_stop.exe	150
PID 2040 wrote to memory of 1788	2040	wrojgezwrp.exe	152
PID 3840 wrote to memory of 256	3840	2026-07-02_d3f38376d7bfa5e5b8a34bf276c5212d_elex_rhadamanthys_stop.exe	155
PID 3840 wrote to memory of 6132	3840	2026-07-02_d3f38376d7bfa5e5b8a34bf276c5212d_elex_rhadamanthys_stop.exe	159
PID 3372 wrote to memory of 3504	3372	wtoljdbvto.exe	161
PID 3840 wrote to memory of 2560	3840	2026-07-02_d3f38376d7bfa5e5b8a34bf276c5212d_elex_rhadamanthys_stop.exe	164
PID 3840 wrote to memory of 2428	3840	2026-07-02_d3f38376d7bfa5e5b8a34bf276c5212d_elex_rhadamanthys_stop.exe	168
PID 4508 wrote to memory of 2812	4508	tnlfdyvqoi.exe	170
PID 3840 wrote to memory of 5952	3840	2026-07-02_d3f38376d7bfa5e5b8a34bf276c5212d_elex_rhadamanthys_stop.exe	173
PID 3840 wrote to memory of 2912	3840	2026-07-02_d3f38376d7bfa5e5b8a34bf276c5212d_elex_rhadamanthys_stop.exe	177
PID 5224 wrote to memory of 5732	5224	sqnlfdavtn.exe	179
PID 3840 wrote to memory of 1244	3840	2026-07-02_d3f38376d7bfa5e5b8a34bf276c5212d_elex_rhadamanthys_stop.exe	182
PID 3600 wrote to memory of 3244	3600	msedge.exe	184
PID 3600 wrote to memory of 3244	3600	msedge.exe	184
PID 3840 wrote to memory of 4736	3840	2026-07-02_d3f38376d7bfa5e5b8a34bf276c5212d_elex_rhadamanthys_stop.exe	190
PID 5808 wrote to memory of 5108	5808	vsnlfaysqk.exe	192
PID 3840 wrote to memory of 464	3840	2026-07-02_d3f38376d7bfa5e5b8a34bf276c5212d_elex_rhadamanthys_stop.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-02_d3f38376d7bfa5e5b8a34bf276c5212d_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_d3f38376d7bfa5e5b8a34bf276c5212d_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7fff30a5c188,0x7fff30a5c194,0x7fff30a5c1a0
      4⤵
      PID:1384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1960,i,3076118054140666951,5010091188034837236,262144 --field-trial-handle=2480,i,3658932652717674257,15198832262597254380,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:2
      4⤵
      PID:4712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2120,i,9752565396607707546,12494376514949891835,524288 --field-trial-handle=2480,i,3658932652717674257,15198832262597254380,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:11
      4⤵
      System Time Discovery
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2640,i,5602965035220224706,8000731772714999464,524288 --field-trial-handle=2480,i,3658932652717674257,15198832262597254380,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:13
      4⤵
      PID:4376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,15345349059415472975,2018413587718708600,2097152 --field-trial-handle=2480,i,3658932652717674257,15198832262597254380,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:5468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,6537740181158867674,3842395733532524555,2097152 --field-trial-handle=2480,i,3658932652717674257,15198832262597254380,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:3536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,6873741969586251254,17649916543535223551,2097152 --field-trial-handle=2480,i,3658932652717674257,15198832262597254380,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
      4⤵
      PID:5836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,3957391036560880617,6149075775994901872,2097152 --field-trial-handle=2480,i,3658932652717674257,15198832262597254380,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:9
      4⤵
      PID:2712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,8339638669823566961,13891348706814742709,524288 --field-trial-handle=2480,i,3658932652717674257,15198832262597254380,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
      4⤵
      PID:3316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,14221270869850077713,15091014837689487532,524288 --field-trial-handle=2480,i,3658932652717674257,15198832262597254380,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
      4⤵
      PID:4704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,1268828014134440123,15233559648650444322,524288 --field-trial-handle=2480,i,3658932652717674257,15198832262597254380,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
      4⤵
      PID:5984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,2165590067181407721,13673000962900929418,524288 --field-trial-handle=2480,i,3658932652717674257,15198832262597254380,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
      4⤵
      PID:3236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,2165590067181407721,13673000962900929418,524288 --field-trial-handle=2480,i,3658932652717674257,15198832262597254380,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
      4⤵
      PID:3372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,2271818796696259229,17670381730817274066,524288 --field-trial-handle=2480,i,3658932652717674257,15198832262597254380,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
      4⤵
      PID:3160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,14646824089536108950,14887455684072722322,524288 --field-trial-handle=2480,i,3658932652717674257,15198832262597254380,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:1684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1460,i,1311819277679232743,2297391253488019823,524288 --field-trial-handle=2480,i,3658932652717674257,15198832262597254380,262144 --variations-seed-version --mojo-platform-channel-handle=1316 /prefetch:14
      4⤵
      PID:5220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1468,i,15887146948963487426,17277119849577030766,524288 --field-trial-handle=2480,i,3658932652717674257,15198832262597254380,262144 --variations-seed-version --mojo-platform-channel-handle=1320 /prefetch:14
      4⤵
      PID:4908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1476,i,12864507800239296831,1485040582169206931,524288 --field-trial-handle=2480,i,3658932652717674257,15198832262597254380,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
      4⤵
      PID:5872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,18398790407735120158,4937021058666982035,524288 --field-trial-handle=2480,i,3658932652717674257,15198832262597254380,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
      4⤵
      PID:3244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,6463557485605149412,2127489238375679123,524288 --field-trial-handle=2480,i,3658932652717674257,15198832262597254380,262144 --variations-seed-version --mojo-platform-channel-handle=1308 /prefetch:14
      4⤵
      PID:5428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,13388247146808821279,2634913127085388721,524288 --field-trial-handle=2480,i,3658932652717674257,15198832262597254380,262144 --variations-seed-version --mojo-platform-channel-handle=1420 /prefetch:14
      4⤵
      PID:1300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,9913372245897837850,15672163013498956222,524288 --field-trial-handle=2480,i,3658932652717674257,15198832262597254380,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:14
      4⤵
      PID:3588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6220,i,4537218074542783390,2437425486452749171,262144 --field-trial-handle=2480,i,3658932652717674257,15198832262597254380,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1188,i,10031623359545044174,672341979066032258,524288 --field-trial-handle=2480,i,3658932652717674257,15198832262597254380,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:14
      4⤵
      PID:3912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnhfavsn.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5756
- - C:\Temp\xvpnhfavsn.exe
    C:\Temp\xvpnhfavsn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4748
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5300
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1356
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnhfavsn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5124
- - C:\Temp\i_xvpnhfavsn.exe
    C:\Temp\i_xvpnhfavsn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5664
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xupnhfzxrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5344
- - C:\Temp\xupnhfzxrp.exe
    C:\Temp\xupnhfzxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5824
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2944
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xupnhfzxrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1608
- - C:\Temp\i_xupnhfzxrp.exe
    C:\Temp\i_xupnhfzxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkhczxupmk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1552
- - C:\Temp\mkhczxupmk.exe
    C:\Temp\mkhczxupmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1916
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4464
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkhczxupmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1436
- - C:\Temp\i_mkhczxupmk.exe
    C:\Temp\i_mkhczxupmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomgezwro.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1356
- - C:\Temp\wuomgezwro.exe
    C:\Temp\wuomgezwro.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4668
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6048
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1648
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomgezwro.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5396
- - C:\Temp\i_wuomgezwro.exe
    C:\Temp\i_wuomgezwro.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrojgezwrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2496
- - C:\Temp\wrojgezwrp.exe
    C:\Temp\wrojgezwrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2040
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1788
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrojgezwrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:256
- - C:\Temp\i_wrojgezwrp.exe
    C:\Temp\i_wrojgezwrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtoljdbvto.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6132
- - C:\Temp\wtoljdbvto.exe
    C:\Temp\wtoljdbvto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3372
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3504
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtoljdbvto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2560
- - C:\Temp\i_wtoljdbvto.exe
    C:\Temp\i_wtoljdbvto.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlfdyvqoi.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2428
- - C:\Temp\tnlfdyvqoi.exe
    C:\Temp\tnlfdyvqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4508
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2812
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlfdyvqoi.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5952
- - C:\Temp\i_tnlfdyvqoi.exe
    C:\Temp\i_tnlfdyvqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqnlfdavtn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2912
- - C:\Temp\sqnlfdavtn.exe
    C:\Temp\sqnlfdavtn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5224
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5732
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqnlfdavtn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1244
- - C:\Temp\i_sqnlfdavtn.exe
    C:\Temp\i_sqnlfdavtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsnlfaysqk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4736
- - C:\Temp\vsnlfaysqk.exe
    C:\Temp\vsnlfaysqk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5808
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5108
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsnlfaysqk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:464
- - C:\Temp\i_vsnlfaysqk.exe
    C:\Temp\i_vsnlfaysqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2072
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfdxuspki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2984
- - C:\Temp\nhfdxuspki.exe
    C:\Temp\nhfdxuspki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5260
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2340
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfdxuspki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2672
- - C:\Temp\i_nhfdxuspki.exe
    C:\Temp\i_nhfdxuspki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\keczusmkec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3280
- - C:\Temp\keczusmkec.exe
    C:\Temp\keczusmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5556
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5900
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_keczusmkec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1648
- - C:\Temp\i_keczusmkec.exe
    C:\Temp\i_keczusmkec.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uromhezurp.exe ups_run
  2⤵
  PID:2324
- - C:\Temp\uromhezurp.exe
    C:\Temp\uromhezurp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4344
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2384
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uromhezurp.exe ups_ins
  2⤵
  PID:4704
- - C:\Temp\i_uromhezurp.exe
    C:\Temp\i_uromhezurp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urmjhezwrp.exe ups_run
  2⤵
  PID:1564
- - C:\Temp\urmjhezwrp.exe
    C:\Temp\urmjhezwrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5796
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3596
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urmjhezwrp.exe ups_ins
  2⤵
  PID:5368
- - C:\Temp\i_urmjhezwrp.exe
    C:\Temp\i_urmjhezwrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwtomgeywr.exe ups_run
  2⤵
  PID:3652
- - C:\Temp\bwtomgeywr.exe
    C:\Temp\bwtomgeywr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5496
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2680
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwtomgeywr.exe ups_ins
  2⤵
  PID:3716
- - C:\Temp\i_bwtomgeywr.exe
    C:\Temp\i_bwtomgeywr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbvtqolgd.exe ups_run
  2⤵
  PID:5232
- - C:\Temp\jdbvtqolgd.exe
    C:\Temp\jdbvtqolgd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5200
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2120
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbvtqolgd.exe ups_ins
  2⤵
  PID:4876
- - C:\Temp\i_jdbvtqolgd.exe
    C:\Temp\i_jdbvtqolgd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dyvqnligay.exe ups_run
  2⤵
  PID:4992
- - C:\Temp\dyvqnligay.exe
    C:\Temp\dyvqnligay.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5004
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:980
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dyvqnligay.exe ups_ins
  2⤵
  PID:2656
- - C:\Temp\i_dyvqnligay.exe
    C:\Temp\i_dyvqnligay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvtqlidx.exe ups_run
  2⤵
  PID:1120
- - C:\Temp\fdxvtqlidx.exe
    C:\Temp\fdxvtqlidx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5024
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4088
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvtqlidx.exe ups_ins
  2⤵
  PID:5720
- - C:\Temp\i_fdxvtqlidx.exe
    C:\Temp\i_fdxvtqlidx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dxsqkicavs.exe ups_run
  2⤵
  PID:1972
- - C:\Temp\dxsqkicavs.exe
    C:\Temp\dxsqkicavs.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:976
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1248
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dxsqkicavs.exe ups_ins
  2⤵
  PID:3048
- - C:\Temp\i_dxsqkicavs.exe
    C:\Temp\i_dxsqkicavs.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpmkfcxupn.exe ups_run
  2⤵
  PID:1328
- - C:\Temp\vpmkfcxupn.exe
    C:\Temp\vpmkfcxupn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:124
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5768
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpmkfcxupn.exe ups_ins
  2⤵
  PID:796
- - C:\Temp\i_vpmkfcxupn.exe
    C:\Temp\i_vpmkfcxupn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwupmhfzxr.exe ups_run
  2⤵
  PID:5492
- - C:\Temp\cwupmhfzxr.exe
    C:\Temp\cwupmhfzxr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4964
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5648
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwupmhfzxr.exe ups_ins
  2⤵
  PID:3448
- - C:\Temp\i_cwupmhfzxr.exe
    C:\Temp\i_cwupmhfzxr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:996

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1556

C:\Temp\cxupnhfzxr.sys
C:\Temp\cxupnhfzxr.sys
1⤵
- Executes dropped EXE
PID:2384

C:\Temp\pmkeczxrpm.sys
C:\Temp\pmkeczxrpm.sys
1⤵
- Executes dropped EXE
PID:5784

C:\Temp\czurmkecwu.sys
C:\Temp\czurmkecwu.sys
1⤵
- Executes dropped EXE
PID:4724

C:\Temp\cwuomgezwu.sys
C:\Temp\cwuomgezwu.sys
1⤵
- Executes dropped EXE
PID:4284

C:\Temp\wqomgeywqo.sys
C:\Temp\wqomgeywqo.sys
1⤵
- Executes dropped EXE
PID:2348

C:\Temp\tolgdywqoi.sys
C:\Temp\tolgdywqoi.sys
1⤵
- Executes dropped EXE
PID:1344

C:\Temp\bvqnligbvt.sys
C:\Temp\bvqnligbvt.sys
1⤵
- Executes dropped EXE
PID:3652

C:\Temp\dxvqnigays.sys
C:\Temp\dxvqnigays.sys
1⤵
- Executes dropped EXE
PID:6008

C:\Temp\smkfcausnk.sys
C:\Temp\smkfcausnk.sys
1⤵
- Executes dropped EXE
PID:5672

C:\Temp\kfcwusmkec.sys
C:\Temp\kfcwusmkec.sys
1⤵
- Executes dropped EXE
PID:1212

C:\Temp\causmkecxu.sys
C:\Temp\causmkecxu.sys
1⤵
PID:4840

C:\Temp\zurmjhezwr.sys
C:\Temp\zurmjhezwr.sys
1⤵
PID:4660

C:\Temp\ywuomgeywu.sys
C:\Temp\ywuomgeywu.sys
1⤵
PID:2000

C:\Temp\rojytrljdb.sys
C:\Temp\rojytrljdb.sys
1⤵
PID:1000

C:\Temp\bvtnljgayw.sys
C:\Temp\bvtnljgayw.sys
1⤵
PID:3188

C:\Temp\lfdyvqoiga.sys
C:\Temp\lfdyvqoiga.sys
1⤵
PID:5444

C:\Temp\fayvqkicav.sys
C:\Temp\fayvqkicav.sys
1⤵
PID:3036

C:\Temp\fdxvsqnifa.sys
C:\Temp\fdxvsqnifa.sys
1⤵
PID:3932

C:\Temp\cxupmhfzxu.sys
C:\Temp\cxupmhfzxu.sys
1⤵
PID:2704

C:\Temp\ecwupmhezx.sys
C:\Temp\ecwupmhezx.sys
1⤵
PID:2488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwuomgezwu.sys

Path C:\Temp\cwuomgezwu.sys
Size 141KB
SHA256 0bdba82954d14f9542781859829dc8f0da979bf289ab35c64ba5ab5c609b708c
MD5 eb61742b98d3be83ebfe9e5cea55a845
SHA1 33cc7ad57a947cd1c8bd3928f27e11ba824c5220
SHA512 5d025f06fa15ed2a6e2f102c82727c7522ca383d56957766be19b19fd19e64b100a33c64864201a0ce4331cbf400c24d008e89f333b1f501b2e05c6fec1e0a60
SSDEEP 1536:Ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B6E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxupnhfzxr.sys

Path C:\Temp\cxupnhfzxr.sys
Size 141KB
SHA256 1cdfa9df749d499b72e609ed09ac837e67ac4fed723befedb06988742e2ae72e
MD5 c6e9f250038db42955663cb32dfd0688
SHA1 51f6101dc0c8ac019e20256e247ba64964b52bdd
SHA512 9f0c1eeca577db46b006073e9015ba8d925c46a1535a5558b7bb977e210f198d126330b26c6699a1d5695f2bff83f0dbdfa5e3b1a49cb3bece3e3dfc72eb3946
SSDEEP 1536:ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1ABE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czurmkecwu.sys

Path C:\Temp\czurmkecwu.sys
Size 141KB
SHA256 9dc151083b2df8cb05e342c85c20ec86bdbd9de0c92a532cd576ca629c9417b5
MD5 8a7f1a86fd8c03c6f28ea4e43049b987
SHA1 9f02352f89e21d5f0a152765e94428d3b0c3cfbe
SHA512 6a7a50bb4258528130f01084891edb09c33f6948759ebee0f041981f23fbee87e323b889ae49fd47a2ebfd7402a1709da7ceb93fd428f3d3be362536baf8ba7b
SSDEEP 1536:ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1BAE37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkhczxupmk.exe

Path C:\Temp\i_mkhczxupmk.exe
Size 243KB
SHA256 0f31b50621da1920173918bcc65261221a00258772b759c146a9bf770048febe
MD5 492b80d5433ac655c558e832b8255687
SHA1 8dafb290947357c637fbe693da9e9fb0b1f4170a
SHA512 3fd74c5d462cda48b61a8e04b47293e2a0fe63225d6b3a4ca47d4e3bd4bd529e6044bc4e3f0eedebbdca6fb4d940c9d7d3a30d3a273aae9163a528d50b1da0aa
SSDEEP 3072:eCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7M:RvMsLaOa3lLNngoqRttA7M
TLSH
T1C6345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrojgezwrp.exe

Path C:\Temp\i_wrojgezwrp.exe
Size 243KB
SHA256 73411efef9b98c8978bfc12fa0c66e9c4454ca51613f906f0da4115785c577e9
MD5 188d71e4ff9a3c87f682054bc3200154
SHA1 eb943333ec49a144c104e581c260114175490e25
SHA512 dcf1d9513a85866db975b4dc67851ed60c56780b60bbfeee1b6bd656ab7bf883c02e57f0b2a6eb82100ef644415b184061576991ce20d23c9301fec44bb17c3e
SSDEEP 3072:KCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA78:1vMsLaOa3lLNngoqRttA78
TLSH
T131345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wtoljdbvto.exe

Path C:\Temp\i_wtoljdbvto.exe
Size 243KB
SHA256 a2e1b0f729bd12eb4d43aeccbe130a1dd76ab6aedc952319940972ab14773b21
MD5 73e6f4c1098d938a884b40733d9c1b16
SHA1 7c02366dbac991fa0d85cb4b1a81fc246a38e3ac
SHA512 e122b487384ed06b72cc402199699da759068cae8041ceadb626ea4eb921ccc6c7113fe32064fd3fb49282bfdc07c4f34a8c3dee9dfdd7bbe2d1a132d1f44bc5
SSDEEP 3072:rCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7t:evMsLaOa3lLNngoqRttA7t
TLSH
T165345A017281C031E7160B78045AE7A1467EBC384BA9E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wuomgezwro.exe

Path C:\Temp\i_wuomgezwro.exe
Size 243KB
SHA256 f9197582ee97984a04f8c474054b99e6035a1effbfb101a2917c0df28b9c3d2a
MD5 b5e054cff3b8649df3b6bb0d8c7e5976
SHA1 83f8d3fe44b3d079d53d0492c9806a8be2d07132
SHA512 2cc91cd32cde6b362165595824d6797e24714a35832a54e9629c69f6af37162dc742357497ab7900b9b239d7c69c27a6cddd3b00d04c9792e0ef9a44f8cb8d4e
SSDEEP 3072:ACvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7a:7vMsLaOa3lLNngoqRttA7a
TLSH
T154345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xupnhfzxrp.exe

Path C:\Temp\i_xupnhfzxrp.exe
Size 243KB
SHA256 9c3de0f30c2d22a02588a474aa2f1cdf06051609702506d7062eb474429b25aa
MD5 4761a0568a3d397edb73d2957200c808
SHA1 d67b89cd791b7633fd70f8c6aeae87da424486f0
SHA512 ecaaf158fdde94a5c99e1c5ba1413edb1c17690cd0b705d2d89f538b2dc583f853b26b9a060c41b293e04bbebee1e7e49f9b73d919e0708cd42c4bc5cc48c545
SSDEEP 3072:LCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7d:+vMsLaOa3lLNngoqRttA7d
TLSH
T1D1345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvpnhfavsn.exe

Path C:\Temp\i_xvpnhfavsn.exe
Size 243KB
SHA256 6101eb5793dced67cb11e1d5ad59bff9443dfe5c199b4357ba5c8b38f02d286f
MD5 b9c77524282f2967817f96d16673882a
SHA1 3c5ffba4f0d86c8a6f65c56f5ef84d075fbd13e9
SHA512 a4ee068ee5986aedeb0c3b9c48ab8a48f5ed2733ac21327ebb8cf534c19bcafe71483e8e1d5d876e05956317d03de1a4de946ec438605b486acc7fecd6c665f0
SSDEEP 3072:/CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7t:KvMsLaOa3lLNngoqRttA7t
TLSH
T102345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkhczxupmk.exe

Path C:\Temp\mkhczxupmk.exe
Size 243KB
SHA256 422a8432e8602cb60ebb4bbc13638c48b01dfc2a77fc58f39425caf916cb90b7
MD5 20ae2d34da42fc94e45b418239f2f71d
SHA1 b78a1ccea2c8cc0c0e1368838f3b7e472745f18b
SHA512 98f15691570ba8916eef1d7cefd0876a675abbe45bf8a2925ed3c8e7d4851495f59af47e2ec299c342d150db12bf78293372394a2b8ae712cae0875f76c96aef
SSDEEP 3072:TCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7J:WvMsLaOa3lLNngoqRttA7J
TLSH
T196345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmkeczxrpm.sys

Path C:\Temp\pmkeczxrpm.sys
Size 141KB
SHA256 69033ee8765b5ddbb00f05a8f9a7a75779fc8236b6c41cf5ef2267e92c0d5664
MD5 115f95718adf0e05855f1190fdee5feb
SHA1 3838df829d4a66a7ba369b351d80c8deee47db42
SHA512 22de5accd7a5bb4cbca3d41e0c754d4cca8d15807258e908fcd6ac509abac4fab176095e2243918129fa6b58ad1708f4cf081ec7493ab4e44de362696b55a254
SSDEEP 1536:ga3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ga3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T142E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tolgdywqoi.sys

Path C:\Temp\tolgdywqoi.sys
Size 141KB
SHA256 991eb8b9aa26fd2ceb905b981e22fafae0c176a954883a991e085b62cf6010b7
MD5 c0e21df2a83b6d1e0cc318206e818259
SHA1 a4627b30a1e7d515bcffd60a308cf7fdddae9ab4
SHA512 c7629a31caca9db36f668fc68d7725a8c308e3b417ba30bbd0214dbf900d20881e0c1689ad2a44e6d75e2bb429bbe799f62a05dde9dc02e345b7a83bfff1b996
SSDEEP 1536:2a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:2a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C7E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqomgeywqo.sys

Path C:\Temp\wqomgeywqo.sys
Size 141KB
SHA256 37fba055a1491534fe7cac7fb276ba8f38365d8e7dca3877119638e4046d39cc
MD5 16f6325fbc0c73d59fc60ead9f86f768
SHA1 41ef20d69fdb60be09742fe81622e9df567ebc4b
SHA512 5718175d9462e8a008e97323042770a07dbd57cdcb0372b8496a7fe7f1002c460138b0c12c8561a39d61d38bd4977ad1a55748be01b103f78f33386ad6bcc3a1
SSDEEP 1536:Na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D9E38C12B2D2D172D8A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrojgezwrp.exe

Path C:\Temp\wrojgezwrp.exe
Size 243KB
SHA256 bbcc72113ac954ea9fce839dabc431d00345b6447845432f51073cf7e339c200
MD5 d89b560037b406cc5246025592d6852c
SHA1 fc36bae65d3dbacb799db58d2fea7f319b9425b5
SHA512 36464c4e990aeac09234044dd2f722ffbdc1f09180da786922a3bc30d13456c6bbd2187181c827d677f931af1eeb6746aedf2137771061b2f2010cd8e005bcab
SSDEEP 3072:hCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7r:8vMsLaOa3lLNngoqRttA7r
TLSH
T12F345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtoljdbvto.exe

Path C:\Temp\wtoljdbvto.exe
Size 243KB
SHA256 a32b93f26cc0ff4e4532c61d6917fc044ad22928c5fc0b374857ff2af424b507
MD5 a5a7ae90d5c33977b7bca5f9158112b7
SHA1 23a83520cd6b6a65c46bef5bcba810d588bcde93
SHA512 c6bdf7779b4472880b22c8e68d14edc60410a36f88af6549cc111b8632a7c1c190c7d8fecc04f8bbe4b0db8ff76067d29f9987fee4cde3844cda2ff718745802
SSDEEP 3072:OCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Q:BvMsLaOa3lLNngoqRttA7Q
TLSH
T17E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomgezwro.exe

Path C:\Temp\wuomgezwro.exe
Size 243KB
SHA256 b6b7261c5dee33ee206c469936605c76fdfbebd83dcc0323be49f3e7d38d98b6
MD5 be3e559b0523caa9d3a5285451201372
SHA1 c3cdca619c8dd2f8709fdf554ffd0ee426ff01f6
SHA512 935ab22a1b44792625749d42efb80341772463d05a252403257896ce2868049b68d9d4c1d03eb11aaabb47848f1173b2e18408533c4de4498919caa331f1c24a
SSDEEP 3072:tCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7X:gvMsLaOa3lLNngoqRttA7X
TLSH
T122345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xupnhfzxrp.exe

Path C:\Temp\xupnhfzxrp.exe
Size 243KB
SHA256 bdb04dbd39c6cf0e114ad0aace9cd4085ef3a8cce35e585ee370ed44600f6db5
MD5 67f8f6236a347907f8a4219aa982de05
SHA1 3faa3992583b2cbe3a7f0a3f6055e498b840308d
SHA512 b3fa8a1a3054a7f29e50cbb04cdaa5d65ec965c63e65d57ae9851984ea9c438d59412fc36ae9d4a43b31a251af6f64e6e18eba9940c41d6dc8242a014f6db901
SSDEEP 3072:uCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA70:hvMsLaOa3lLNngoqRttA70
TLSH
T1DD345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnhfavsn.exe

Path C:\Temp\xvpnhfavsn.exe
Size 243KB
SHA256 0277d6247afaf404c88c9e434b3e43ae1e18f62003120a27b7a7ef7b21c95547
MD5 f7267572efeb9088f1b9a31dba40011c
SHA1 5c3509c9f8caf5b94dd8426a01e331c817d31156
SHA512 ae7366bf571f85f1807410b93802567307ea6b4a8a63308e1b66d5b56ac2aa7a772eea067094da4ca24ca8228a8bedd1db053febb01ffc063d3895e372de5e7d
SSDEEP 3072:fCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7l:qvMsLaOa3lLNngoqRttA7l
TLSH
T1B1345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2fd9384e79508a77111bb6310e9414898358885ca508610502ff6f1a15ad704f
MD5 714e68787bb5a6d2fd82139f833a5d0d
SHA1 f7a22adc92641d05515b3ae096da910924f11c1a
SHA512 b133f27abfa4ed5bdbd3eaf997e0664f0627537d4882fdaa63c0b1b301219d07f8ba46857db9a196b1210c29ed9f79e6cfd8c688d502b118a21640805665f762
TLSH
T16DD080F43795F605C786617357D0574173750872241647095051D01CCC645DD63DB1EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 233c07bfff48b5fbad30cd7d90579abd0886400017cd6e7fb037e5626abb1a4d
MD5 71fa6328268340b183c55defa643c474
SHA1 7c004defb21dc2981b3091495c900e02b34e3a86
SHA512 e5b634d358633981cd343c3da26ee18738fb6c54b2334814637e0a9a45343d14770fed7a09c63d55dd190bf7ef111664ba5872f5d5ce925e6bee783e166c75b7
TLSH
T1D4D080F437A5F505C786617357D0574173650872101647095151D02CCC645DD63DB1DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9dec39b402ceca465cc8af3735a39bf23ea0c3af761391d33ffef77e074047e6
MD5 9bf56991f7665ed21bf8e0b878d6e707
SHA1 285f5b69be123df02a6967fab0f5b54766791136
SHA512 e14cd7b2830e8ec188d1d192c3eb5b8eac6e96d12ce7155e23eea54a6cf62f24a4d063253baabaf6c677b5523986c309d7d0f099063838ba4318495e6f308089
TLSH
T1AB613F6F146749B5C73D4BF987E161AA77F8CD9A0E2F6E21049F947B58EE384A013830
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7473358939fad225500c92ee8083d2a17d22de3e8d23e67a411272a0e8402f38
MD5 c09ceeebd6edaa0397b8367fa0306c97
SHA1 8d14b2bd92825ed91ebde4834a95004e18665141
SHA512 9e5b47e43509798115e584084a80904b053411582fd91baa275a77e62834a03f308714919d50d9c82f90fce27d02779a51e2600e1c0e5c0623f1c73405566c9e
TLSH
T17F51ADF7C3E4852DC91146F0BA186E2BCE2D0914832C3D5AC9E4AF5BA3E2471D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 13d42a759273a1764fe406dcf0c6f68aed1e10766b5a51551c4491ab2f1f0ebd
MD5 3f4575717cfc213f451d5c10ecc1064c
SHA1 1d7f7f315ad92c2c5baf9a4929541d4ea78269f9
SHA512 a506b427ac402bc087183722465d755bc0db39755f6afa1f4acdd1eb2d85a0306eaa7ddef6fd0d4507d2c0bf7e351a1483280c6e5df3c71c4e7673d6294359ac
SSDEEP 192:sxRRRdyM/jK1Ml8wcO/f/sCr4eZYOp5zoA8p91/g6+WNCZ+/YyEJxG2IgtJ:sxRRpCO/f/sCcYYOyn/5D/gZ3
TLSH
T1BB62D916AA245D3BCCDBD209FA517F53D6F91576A2900E48AAFCCA0C01E76DD621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d2be14213c8fc44046af43f54edb7eaa80683e4b957a59aa26c4f2d0e220b634
MD5 4f7dc168529529dea7446bed21b237e6
SHA1 31af7c5dcaecb6a3e1f0a8187ff3b8b580f974cf
SHA512 73ee86538879f0af0a200c1fdf9d015f1eb646b1e26ef7df4f970833749ac0156c199373b935efdd63d71b82d86e6a80257ea357a7b1cd73bac52f97314fe859
SSDEEP 192:sxRORdyM/jK1Ml8wcO/f/syr4eZYOp5zoA8p91/g6+WNCZ+/YyEJxG2IgDsJ:sxROpCO/f/sycYYOyn/5D/gZc
TLSH
T17362D816AA245D3BCCDBD209FA517F53D6F91576A2900E48AAFC8A0C01E76DD621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3c4375b97ccd31fd9e25ad79ed2be6e733a82acdc91999b15a5ab9826b9e3d6c
MD5 564f5a1e344b014db52dc2dee214d620
SHA1 908e1bbfaf969cb6d7090d760812bfa44f4d2203
SHA512 a8701fb673193712177140f960909256c96c5ded68bc91c9ebca4c3d3874c35ebb7d666c09252300ba37cd49fb8757470ebd3f299bb9f1531fd9f030fc3c2822
SSDEEP 192:sxRORdyM/jK1Ml8UQQcO/f/syraeZYOp5zoA8pr1/g6+WNCZ+/YyUJxG2IgDiJ:sxROpqvO/f/syWYYOyJ/5D/0ZK
TLSH
T15762D816A9245D3BCCDBD209FA517F93D2F95577A2900E44AAFCCA0C01E7ADD621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 6049be19be355caaa7f7c46ceb2c947a2846d39ffcabd94b31b1df36b0487258
MD5 01909abc31861aeab2be3d8224bf86e9
SHA1 cabba80c0557896cffe64da620fa517a5de986c5
SHA512 9486b1a399a5e1690aff3bdd674d150378de4f7735ea048b7b56c28650fb0ec958d389df8cf4ac4b58b54c151fc0ef413fa816e6b79cc8a56a0ae2d3f80e9a3f
SSDEEP 768:AIox/O7pLuL7p0WguMfnA8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYdgcciWro5hlmY:AIox/OE7p0WguMfnAu1jaHdgXit5hz
TLSH
T1B5E2EB3B680CCB7F4F8049DCEC29BE9A6DA801CF96D8CD9447FA841C03C66EB55165DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 27beeee2d40342ede71d0c063ad5309c469d695abbd0b9033b494043c492d519
MD5 59e6c5972150b4dab1ece3b233322eee
SHA1 f3974cf3c36500236b45458a1270e5861a1aee2c
SHA512 4bc074bb7d0945e7fa1436a40ef6d112db27ba1062d4e14a4070bcbf9d41fa6bbe9e49f25d1345e414ba9a346a170030fe0bb829fb16d7251e89474c1a2fa720
SSDEEP 96:Kntgj/tzTxufes4nxKw44NxUVdGnTSOBWKiM6EFw0Oy2UWS/fg8UK4Rg2Uc00/uy:OPhxEFw0Oy2rS/I8oRg2700/uUJH3gFW
TLSH
T1C591B341747B27803C3E290D866C946A52C234A731ADB43B7BF890E25F66E115FFE5CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f2f8659-6e5f-4514-ab73-d6f45e2bb693.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9f2f8659-6e5f-4514-ab73-d6f45e2bb693.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c52134c6c84f139a17b0480017680392c71e175601ca00792bb9281fba1b211a
MD5 141a21ec8484fd330c8a75122cfeff09
SHA1 ae720c9a0f4c698fc7df7680d92e3f3cc50419cf
SHA512 47adc08115f0d3d958e20b580977b0d2faf75d0116306b9306d996131beef15bebd1983bad9edc7defa5f63fbf9b2f1f5d6d3631bc8c84fa37e2aaf9897a503c
SSDEEP 768:9rv+4UNbdF3ZjlQOJIvc/hUAFjQIMyOV3N5E9MN5+8r0mL:9bsbf3JhNFUIpONNmuDrv
TLSH
T1F803BF32E8A8DAB39CE7D6C5760A72437FF4416399C50B84C9DE2B0D824B5DD231BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ce13f64aa2367c1b0d948395bdab4f59fa2851dd650a2b1bc2b0c1b10a8f6ee1
MD5 c2a521510e24c2b60df607043b39f424
SHA1 53524a640430d0e2d231bc3e5426ed774c91ca33
SHA512 85e5222ca415be8f873bb9738013eba890d8f1d911febfe2b2fdffcbaaf98bb36dfe53e2ef42bb2a99f47bb0fffaa0545487dcf2ccfaf4b2d9356a3bffbd49ad
SSDEEP 768:Qj+923p5rlQOJIv5r/hUAFjQIMyOV3N5E9EyiDl8BvTPaXwb:v9238hNFUIpONNm1iDl0WXwb
TLSH
T18EF2AE71B895CEA74CEBD3C9B6166283AFE011B758841D84DADDAB0D418339D134BC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 f8cd7d1457f3c0f4b190ca38bddc401c3fc5314ab2dbb87ea110a9eb59c7e05d
MD5 5c727044a00cbbe69ad8bef507a98fe4
SHA1 417858c7098107d1a0abf03177172574c7069a3d
SHA512 cec26569e582a6ed3dbd7603e33623834ef1592599e0130b3d016d096ec55b10d2fa88c4837d4fa3932d58fc928b89c94be8d54eeaf616c339031c17e438a9b3
SSDEEP 768:6F1j+9i3Awg05FwrOJIv5w/hUAFjQIMyOV3N5E9EyiDl8BvTPaXwb:f9i3jhNFUIpONNm1iDl0WXwb
TLSH
T1D6132AF598D3CA76D8AE8787673D6D469AFCC16774845880BBC95D0CCC821BFC34A825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7ce7516f7bb3be44889a5f93451b4cc3cbb9af0022b7f7ac01757f030f052a44
MD5 f936fb1bce1024fede079be9c5b643de
SHA1 20254363fce9409d5b7de1016e80ceb714e2f572
SHA512 f1596155f35168a867f9fad98bad936b19e9ff1a211b29831cb3574682265758e77ece545e570901c3ccdf74d0275d72581db99e4897bba9528ef5058e979691
SSDEEP 768:qj+923S5rlQOJIv5r/hUAFjQIMyOV3N5E9EyiDl8BvTPaXwb:J923VhNFUIpONNm1iDl0WXwb
TLSH
T16CF2AE71B895CEA74CEBD3C9B6166283AFE411B758801E84DADD6B0D42873DD134BC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 cfc7a955d06c2c3141bbd489481f558eaf2412ad7cc4bbdc9c5f22bf1ad1a5e2
MD5 aa0e580aeb33b93c2933fb79320e1f42
SHA1 3033b285c3b20a606d9048ad22858e5802443b6c
SHA512 1499c45573e795c7f03ad3a1e525bbb93bc047b4d3c2951e36f4ea8e9b66498b50ff8ba99b03cea7265ca4ebc48080d6efbcad2b1152fb0930da1419fb3ffe30
SSDEEP 768:xrv+4UNbdA3d5slQOJIv5N/hUAFjQIMyOV3N5E9EyiDl8BvTPaXw3:xbsbC3LhNFUIpONNm1iDl0WXw3
TLSH
T1A513BF71B8A8DEB75DFBE2C5B61662837FF411A748840A84DADD6B0C42471DD234BC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

d35c50c3-912e-4fc0-b910-4400aec5c9a2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d35c50c3-912e-4fc0-b910-4400aec5c9a2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3600_1958099288\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1000-449-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1000-436-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1212-371-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1344-318-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2000-416-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2348-290-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2384-191-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2488-522-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2704-502-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3036-473-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3188-447-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3652-322-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3932-477-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4284-275-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4660-396-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4724-263-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4840-413-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4840-383-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5444-452-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5672-341-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5784-238-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6008-364-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6008-337-0x0000000000010000-0x0000000000083000-memory.dmp

Download