2874e3349de8a494890c4783fcacb75be7af16a64338fdb58bed750fb35a27ef

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 20:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_62cad864a71548b3ac5848e1f58e5fa9_elex_rhadamanthys_stop.exe
Size 243KB
Sample260702-za2f7sa18m
SHA256 2874e3349de8a494890c4783fcacb75be7af16a64338fdb58bed750fb35a27ef
MD5 62cad864a71548b3ac5848e1f58e5fa9
SHA1 9055be587e8b0a48436255779f93a8c1e1b1eaa2
SHA512 5d9c36f17ea2a34eb6ae3147bd5e9c31bc9732d670ab30328b5a7ba7818b5ef36211712837ddeb98489716ea7cc89ef73da7be3f7f7b57edc6a9bfddbb25c73b
SSDEEP 3072:bMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA79:fGii9IL8Xa3lLNngoqRttA79
TLSH
T10034490272818031E71A0B74046AE7A046BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2904	CP.exe
1072	pnifaysqki.exe
2668	CP.exe
5032	CP.exe
2984	i_pnifaysqki.exe
688	axspkicaus.sys
120	CP.exe
3472	vpnhfzxspk.exe
3016	CP.exe
608	CP.exe
4084	i_vpnhfzxspk.exe
852	spnhfcxupn.sys
2772	CP.exe
5296	hecwupmhfz.exe
3116	CP.exe
4224	CP.exe
3000	i_hecwupmhfz.exe
2760	mkecwupmhe.sys
5676	CP.exe
2024	jhczurmkec.exe
1980	CP.exe
5520	CP.exe
4368	i_jhczurmkec.exe
1852	cwuomjecwu.sys
2656	CP.exe
604	rpjhbztrlj.exe
5620	CP.exe
3012	CP.exe
2104	i_rpjhbztrlj.exe
4408	ojhbztrlje.sys
3712	CP.exe
4076	mgeywqojgb.exe
4716	CP.exe
1572	CP.exe
1828	i_mgeywqojgb.exe
6044	wqojgbywqo.sys
4560	CP.exe
1664	qoljdbytqo.exe
2504	CP.exe
6040	CP.exe
1264	i_qoljdbytqo.exe
2256	dyvqnlgdyv.sys
1976	CP.exe
1600	vqnlfaysql.exe
5128	CP.exe
5608	CP.exe
6092	i_vqnlfaysql.exe
3572	vsqkidavtn.sys
3200	CP.exe
2652	qnigaysqki.exe
5060	CP.exe
5260	CP.exe
928	i_qnigaysqki.exe
5168	xnifaxspki.sys
1956	CP.exe
6044	kifaxsqkic.exe
5612	CP.exe
1008	CP.exe
1840	i_kifaxsqkic.exe
3208	xvpnhfzxsp.sys
3484	CP.exe
1740	vpfzxrpkhc.exe
5880	CP.exe
904	CP.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5580_802704591\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5580_954824435\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5580_1644256773\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5580_1644256773\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5580_359625199\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5580_359625199\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5580_359625199\office_endpoints_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5580_954824435\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5580_359625199\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoljdbytqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoljdbytqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnlfaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdyvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kifaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpfzxrpkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mheczurpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgebztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spnkiusnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnhfzxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnhfzxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hecwupmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omhezxrpje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spnkiusnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upnhfzxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhczurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kifaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywqojgbyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywqojgbyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdyvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mheczurpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snlfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpfzxrpkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omhezxrpje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trligaywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trligaywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snlfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_62cad864a71548b3ac5848e1f58e5fa9_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhczurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnlfaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgebztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upnhfzxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hecwupmhfz.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5604	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4756	ipconfig.exe
1044	ipconfig.exe
5560	ipconfig.exe
6036	ipconfig.exe
424	ipconfig.exe
5860	ipconfig.exe
5436	ipconfig.exe
4528	ipconfig.exe
2988	ipconfig.exe
4880	ipconfig.exe
1756	ipconfig.exe
4240	ipconfig.exe
2352	ipconfig.exe
1008	ipconfig.exe
5448	ipconfig.exe
1276	ipconfig.exe
5800	ipconfig.exe
5352	ipconfig.exe
852	ipconfig.exe
1912	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274979069582208"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{0D15EFE1-1FCB-4BC9-8F30-A5D8D5DD13B4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2396	msedge.exe
2396	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2984	i_pnifaysqki.exe
Token: SeDebugPrivilege	4084	i_vpnhfzxspk.exe
Token: SeDebugPrivilege	3000	i_hecwupmhfz.exe
Token: SeDebugPrivilege	4368	i_jhczurmkec.exe
Token: SeDebugPrivilege	2104	i_rpjhbztrlj.exe
Token: SeDebugPrivilege	1828	i_mgeywqojgb.exe
Token: SeDebugPrivilege	1264	i_qoljdbytqo.exe
Token: SeDebugPrivilege	6092	i_vqnlfaysql.exe
Token: SeDebugPrivilege	928	i_qnigaysqki.exe
Token: SeDebugPrivilege	1840	i_kifaxsqkic.exe
Token: SeDebugPrivilege	4924	i_vpfzxrpkhc.exe
Token: SeDebugPrivilege	4852	i_mheczurpjh.exe
Token: SeDebugPrivilege	5884	i_omhezxrpje.exe
Token: SeDebugPrivilege	1628	i_ojgebztrlj.exe
Token: SeDebugPrivilege	612	i_bywqojgbyw.exe
Token: SeDebugPrivilege	3040	i_trligaywqo.exe
Token: SeDebugPrivilege	3156	i_vtnlfdyvqn.exe
Token: SeDebugPrivilege	8	i_snlfdxvpni.exe
Token: SeDebugPrivilege	5772	i_spnkiusnkf.exe
Token: SeDebugPrivilege	2552	i_upnhfzxupn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5580	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 3064	4884	2026-07-02_62cad864a71548b3ac5848e1f58e5fa9_elex_rhadamanthys_stop.exe	88
PID 3064 wrote to memory of 5580	3064	iexplore.exe	89
PID 5580 wrote to memory of 6020	5580	msedge.exe	90
PID 5580 wrote to memory of 5604	5580	msedge.exe	91
PID 5580 wrote to memory of 5548	5580	msedge.exe	92
PID 5580 wrote to memory of 5508	5580	msedge.exe	93
PID 5580 wrote to memory of 5548	5580	msedge.exe	92
PID 5580 wrote to memory of 5548	5580	msedge.exe	92
PID 5580 wrote to memory of 5508	5580	msedge.exe	93
PID 5580 wrote to memory of 2124	5580	msedge.exe	94
PID 5580 wrote to memory of 4412	5580	msedge.exe	95
PID 5580 wrote to memory of 2124	5580	msedge.exe	94
PID 5580 wrote to memory of 2124	5580	msedge.exe	94
PID 5580 wrote to memory of 4412	5580	msedge.exe	95
PID 5580 wrote to memory of 4412	5580	msedge.exe	95
PID 5580 wrote to memory of 5640	5580	msedge.exe	97
PID 5580 wrote to memory of 1144	5580	msedge.exe	98
PID 5580 wrote to memory of 5640	5580	msedge.exe	97
PID 5580 wrote to memory of 5640	5580	msedge.exe	97
PID 5580 wrote to memory of 1144	5580	msedge.exe	98
PID 5580 wrote to memory of 1144	5580	msedge.exe	98
PID 5580 wrote to memory of 4084	5580	msedge.exe	100
PID 5580 wrote to memory of 4084	5580	msedge.exe	100
PID 5580 wrote to memory of 3572	5580	msedge.exe	101
PID 5580 wrote to memory of 1220	5580	msedge.exe	102
PID 5580 wrote to memory of 3572	5580	msedge.exe	101
PID 5580 wrote to memory of 1220	5580	msedge.exe	102
PID 4884 wrote to memory of 2904	4884	2026-07-02_62cad864a71548b3ac5848e1f58e5fa9_elex_rhadamanthys_stop.exe	103
PID 1072 wrote to memory of 2668	1072	pnifaysqki.exe	106
PID 5580 wrote to memory of 2608	5580	msedge.exe	110
PID 5580 wrote to memory of 5652	5580	msedge.exe	111
PID 5580 wrote to memory of 5652	5580	msedge.exe	111
PID 5580 wrote to memory of 2700	5580	msedge.exe	112
PID 5580 wrote to memory of 2700	5580	msedge.exe	112
PID 4884 wrote to memory of 5032	4884	2026-07-02_62cad864a71548b3ac5848e1f58e5fa9_elex_rhadamanthys_stop.exe	115
PID 4884 wrote to memory of 120	4884	2026-07-02_62cad864a71548b3ac5848e1f58e5fa9_elex_rhadamanthys_stop.exe	119
PID 3472 wrote to memory of 3016	3472	vpnhfzxspk.exe	121
PID 4884 wrote to memory of 608	4884	2026-07-02_62cad864a71548b3ac5848e1f58e5fa9_elex_rhadamanthys_stop.exe	124
PID 4884 wrote to memory of 2772	4884	2026-07-02_62cad864a71548b3ac5848e1f58e5fa9_elex_rhadamanthys_stop.exe	128
PID 5296 wrote to memory of 3116	5296	hecwupmhfz.exe	130
PID 4884 wrote to memory of 4224	4884	2026-07-02_62cad864a71548b3ac5848e1f58e5fa9_elex_rhadamanthys_stop.exe	133
PID 4884 wrote to memory of 5676	4884	2026-07-02_62cad864a71548b3ac5848e1f58e5fa9_elex_rhadamanthys_stop.exe	137
PID 2024 wrote to memory of 1980	2024	jhczurmkec.exe	139
PID 4884 wrote to memory of 5520	4884	2026-07-02_62cad864a71548b3ac5848e1f58e5fa9_elex_rhadamanthys_stop.exe	142
PID 5580 wrote to memory of 6092	5580	msedge.exe	145
PID 5580 wrote to memory of 2852	5580	msedge.exe	146
PID 5580 wrote to memory of 4476	5580	msedge.exe	147
PID 4884 wrote to memory of 2656	4884	2026-07-02_62cad864a71548b3ac5848e1f58e5fa9_elex_rhadamanthys_stop.exe	150
PID 604 wrote to memory of 5620	604	rpjhbztrlj.exe	152
PID 4884 wrote to memory of 3012	4884	2026-07-02_62cad864a71548b3ac5848e1f58e5fa9_elex_rhadamanthys_stop.exe	155
PID 4884 wrote to memory of 3712	4884	2026-07-02_62cad864a71548b3ac5848e1f58e5fa9_elex_rhadamanthys_stop.exe	159
PID 4076 wrote to memory of 4716	4076	mgeywqojgb.exe	161
PID 4884 wrote to memory of 1572	4884	2026-07-02_62cad864a71548b3ac5848e1f58e5fa9_elex_rhadamanthys_stop.exe	164
PID 4884 wrote to memory of 4560	4884	2026-07-02_62cad864a71548b3ac5848e1f58e5fa9_elex_rhadamanthys_stop.exe	168
PID 1664 wrote to memory of 2504	1664	qoljdbytqo.exe	170
PID 4884 wrote to memory of 6040	4884	2026-07-02_62cad864a71548b3ac5848e1f58e5fa9_elex_rhadamanthys_stop.exe	173
PID 4884 wrote to memory of 1976	4884	2026-07-02_62cad864a71548b3ac5848e1f58e5fa9_elex_rhadamanthys_stop.exe	177
PID 1600 wrote to memory of 5128	1600	vqnlfaysql.exe	179
PID 4884 wrote to memory of 5608	4884	2026-07-02_62cad864a71548b3ac5848e1f58e5fa9_elex_rhadamanthys_stop.exe	182
PID 5580 wrote to memory of 5344	5580	msedge.exe	184
PID 5580 wrote to memory of 5344	5580	msedge.exe	184
PID 4884 wrote to memory of 3200	4884	2026-07-02_62cad864a71548b3ac5848e1f58e5fa9_elex_rhadamanthys_stop.exe	190
PID 2652 wrote to memory of 5060	2652	qnigaysqki.exe	192
PID 4884 wrote to memory of 5260	4884	2026-07-02_62cad864a71548b3ac5848e1f58e5fa9_elex_rhadamanthys_stop.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-02_62cad864a71548b3ac5848e1f58e5fa9_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_62cad864a71548b3ac5848e1f58e5fa9_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x358,0x7ffd113fc188,0x7ffd113fc194,0x7ffd113fc1a0
      4⤵
      PID:6020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,4609203696190041786,18405802215743651573,524288 --field-trial-handle=2344,i,7158042607108026886,2749751770080244740,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:11
      4⤵
      System Time Discovery
      PID:5604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,10606028592190736610,9769817813658190854,262144 --field-trial-handle=2344,i,7158042607108026886,2749751770080244740,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
      4⤵
      PID:5548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,7419739748655605632,10378506572102917841,524288 --field-trial-handle=2344,i,7158042607108026886,2749751770080244740,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:13
      4⤵
      PID:5508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,14630713932531508300,16290700066779412613,2097152 --field-trial-handle=2344,i,7158042607108026886,2749751770080244740,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:2124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,2795698564562869299,5820134442803183016,2097152 --field-trial-handle=2344,i,7158042607108026886,2749751770080244740,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
      4⤵
      PID:4412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,1659176049085368592,15071193333844548856,2097152 --field-trial-handle=2344,i,7158042607108026886,2749751770080244740,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:1
      4⤵
      PID:5640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,18023856819792675781,9231040919667031412,2097152 --field-trial-handle=2344,i,7158042607108026886,2749751770080244740,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:9
      4⤵
      PID:1144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,9512097754404958012,12240137157087963919,524288 --field-trial-handle=2344,i,7158042607108026886,2749751770080244740,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
      4⤵
      PID:4084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,14915303956264011959,16314241867444651767,524288 --field-trial-handle=2344,i,7158042607108026886,2749751770080244740,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
      4⤵
      PID:3572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,17810689770412367557,14635129001035224566,524288 --field-trial-handle=2344,i,7158042607108026886,2749751770080244740,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
      4⤵
      PID:1220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,6522185072840204615,13478621439811893350,524288 --field-trial-handle=2344,i,7158042607108026886,2749751770080244740,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
      4⤵
      PID:3116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,6522185072840204615,13478621439811893350,524288 --field-trial-handle=2344,i,7158042607108026886,2749751770080244740,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
      4⤵
      PID:2608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,13408228184732022602,15690940811329558488,524288 --field-trial-handle=2344,i,7158042607108026886,2749751770080244740,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:5652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,4643630463916115651,11552479251697794304,524288 --field-trial-handle=2344,i,7158042607108026886,2749751770080244740,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
      4⤵
      PID:2700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,2770618915692458987,8274660896038375187,524288 --field-trial-handle=2344,i,7158042607108026886,2749751770080244740,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
      4⤵
      PID:6092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,1172686986410207523,2117995555464284727,524288 --field-trial-handle=2344,i,7158042607108026886,2749751770080244740,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
      4⤵
      PID:2852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,9319207704066477256,16731295433624600286,524288 --field-trial-handle=2344,i,7158042607108026886,2749751770080244740,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:14
      4⤵
      PID:4476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,3956410312289862054,8153452887627249745,524288 --field-trial-handle=2344,i,7158042607108026886,2749751770080244740,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
      4⤵
      PID:5344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4720,i,13382707795692535708,6314785086346597493,524288 --field-trial-handle=2344,i,7158042607108026886,2749751770080244740,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
      4⤵
      PID:1792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,16995760106677323933,3758351076760299202,524288 --field-trial-handle=2344,i,7158042607108026886,2749751770080244740,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
      4⤵
      PID:6072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3376,i,17699617347562945115,15795997194119388294,524288 --field-trial-handle=2344,i,7158042607108026886,2749751770080244740,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
      4⤵
      PID:4852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5408,i,329988655599686009,9499496724583415221,262144 --field-trial-handle=2344,i,7158042607108026886,2749751770080244740,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,15972404749804154675,13480829776975507874,524288 --field-trial-handle=2344,i,7158042607108026886,2749751770080244740,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
      4⤵
      PID:2732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnifaysqki.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2904
- - C:\Temp\pnifaysqki.exe
    C:\Temp\pnifaysqki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1072
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2668
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnifaysqki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5032
- - C:\Temp\i_pnifaysqki.exe
    C:\Temp\i_pnifaysqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnhfzxspk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:120
- - C:\Temp\vpnhfzxspk.exe
    C:\Temp\vpnhfzxspk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3472
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3016
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnhfzxspk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:608
- - C:\Temp\i_vpnhfzxspk.exe
    C:\Temp\i_vpnhfzxspk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hecwupmhfz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2772
- - C:\Temp\hecwupmhfz.exe
    C:\Temp\hecwupmhfz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5296
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3116
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hecwupmhfz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4224
- - C:\Temp\i_hecwupmhfz.exe
    C:\Temp\i_hecwupmhfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhczurmkec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5676
- - C:\Temp\jhczurmkec.exe
    C:\Temp\jhczurmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2024
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1980
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhczurmkec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5520
- - C:\Temp\i_jhczurmkec.exe
    C:\Temp\i_jhczurmkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhbztrlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2656
- - C:\Temp\rpjhbztrlj.exe
    C:\Temp\rpjhbztrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:604
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5620
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhbztrlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3012
- - C:\Temp\i_rpjhbztrlj.exe
    C:\Temp\i_rpjhbztrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgeywqojgb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3712
- - C:\Temp\mgeywqojgb.exe
    C:\Temp\mgeywqojgb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4076
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4716
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgeywqojgb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1572
- - C:\Temp\i_mgeywqojgb.exe
    C:\Temp\i_mgeywqojgb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoljdbytqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4560
- - C:\Temp\qoljdbytqo.exe
    C:\Temp\qoljdbytqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1664
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2504
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoljdbytqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6040
- - C:\Temp\i_qoljdbytqo.exe
    C:\Temp\i_qoljdbytqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqnlfaysql.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1976
- - C:\Temp\vqnlfaysql.exe
    C:\Temp\vqnlfaysql.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1600
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5128
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqnlfaysql.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5608
- - C:\Temp\i_vqnlfaysql.exe
    C:\Temp\i_vqnlfaysql.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnigaysqki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3200
- - C:\Temp\qnigaysqki.exe
    C:\Temp\qnigaysqki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5060
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnigaysqki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5260
- - C:\Temp\i_qnigaysqki.exe
    C:\Temp\i_qnigaysqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kifaxsqkic.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1956
- - C:\Temp\kifaxsqkic.exe
    C:\Temp\kifaxsqkic.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6044
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5612
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6036
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kifaxsqkic.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1008
- - C:\Temp\i_kifaxsqkic.exe
    C:\Temp\i_kifaxsqkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1840
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpfzxrpkhc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3484
- - C:\Temp\vpfzxrpkhc.exe
    C:\Temp\vpfzxrpkhc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1740
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5880
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpfzxrpkhc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:904
- - C:\Temp\i_vpfzxrpkhc.exe
    C:\Temp\i_vpfzxrpkhc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mheczurpjh.exe ups_run
  2⤵
  PID:2104
- - C:\Temp\mheczurpjh.exe
    C:\Temp\mheczurpjh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5244
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5836
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mheczurpjh.exe ups_ins
  2⤵
  PID:3452
- - C:\Temp\i_mheczurpjh.exe
    C:\Temp\i_mheczurpjh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omhezxrpje.exe ups_run
  2⤵
  PID:6036
- - C:\Temp\omhezxrpje.exe
    C:\Temp\omhezxrpje.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3780
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:692
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omhezxrpje.exe ups_ins
  2⤵
  PID:2616
- - C:\Temp\i_omhezxrpje.exe
    C:\Temp\i_omhezxrpje.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojgebztrlj.exe ups_run
  2⤵
  PID:4768
- - C:\Temp\ojgebztrlj.exe
    C:\Temp\ojgebztrlj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1016
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5780
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojgebztrlj.exe ups_ins
  2⤵
  PID:1260
- - C:\Temp\i_ojgebztrlj.exe
    C:\Temp\i_ojgebztrlj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bywqojgbyw.exe ups_run
  2⤵
  PID:3436
- - C:\Temp\bywqojgbyw.exe
    C:\Temp\bywqojgbyw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2532
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4684
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bywqojgbyw.exe ups_ins
  2⤵
  PID:1136
- - C:\Temp\i_bywqojgbyw.exe
    C:\Temp\i_bywqojgbyw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trligaywqo.exe ups_run
  2⤵
  PID:788
- - C:\Temp\trligaywqo.exe
    C:\Temp\trligaywqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2216
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5800
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trligaywqo.exe ups_ins
  2⤵
  PID:1264
- - C:\Temp\i_trligaywqo.exe
    C:\Temp\i_trligaywqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnlfdyvqn.exe ups_run
  2⤵
  PID:1232
- - C:\Temp\vtnlfdyvqn.exe
    C:\Temp\vtnlfdyvqn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:336
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5656
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnlfdyvqn.exe ups_ins
  2⤵
  PID:2580
- - C:\Temp\i_vtnlfdyvqn.exe
    C:\Temp\i_vtnlfdyvqn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3156
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snlfdxvpni.exe ups_run
  2⤵
  PID:6080
- - C:\Temp\snlfdxvpni.exe
    C:\Temp\snlfdxvpni.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:888
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2868
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snlfdxvpni.exe ups_ins
  2⤵
  PID:1520
- - C:\Temp\i_snlfdxvpni.exe
    C:\Temp\i_snlfdxvpni.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:8
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spnkiusnkf.exe ups_run
  2⤵
  PID:1680
- - C:\Temp\spnkiusnkf.exe
    C:\Temp\spnkiusnkf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:812
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3784
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5436
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spnkiusnkf.exe ups_ins
  2⤵
  PID:3556
- - C:\Temp\i_spnkiusnkf.exe
    C:\Temp\i_spnkiusnkf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upnhfzxupn.exe ups_run
  2⤵
  PID:4208
- - C:\Temp\upnhfzxupn.exe
    C:\Temp\upnhfzxupn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5868
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1960
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upnhfzxupn.exe ups_ins
  2⤵
  PID:1488
- - C:\Temp\i_upnhfzxupn.exe
    C:\Temp\i_upnhfzxupn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4476

C:\Temp\axspkicaus.sys
C:\Temp\axspkicaus.sys
1⤵
- Executes dropped EXE
PID:688

C:\Temp\spnhfcxupn.sys
C:\Temp\spnhfcxupn.sys
1⤵
- Executes dropped EXE
PID:852

C:\Temp\mkecwupmhe.sys
C:\Temp\mkecwupmhe.sys
1⤵
- Executes dropped EXE
PID:2760

C:\Temp\cwuomjecwu.sys
C:\Temp\cwuomjecwu.sys
1⤵
- Executes dropped EXE
PID:1852

C:\Temp\ojhbztrlje.sys
C:\Temp\ojhbztrlje.sys
1⤵
- Executes dropped EXE
PID:4408

C:\Temp\wqojgbywqo.sys
C:\Temp\wqojgbywqo.sys
1⤵
- Executes dropped EXE
PID:6044

C:\Temp\dyvqnlgdyv.sys
C:\Temp\dyvqnlgdyv.sys
1⤵
- Executes dropped EXE
PID:2256

C:\Temp\vsqkidavtn.sys
C:\Temp\vsqkidavtn.sys
1⤵
- Executes dropped EXE
PID:3572

C:\Temp\xnifaxspki.sys
C:\Temp\xnifaxspki.sys
1⤵
- Executes dropped EXE
PID:5168

C:\Temp\xvpnhfzxsp.sys
C:\Temp\xvpnhfzxsp.sys
1⤵
- Executes dropped EXE
PID:3208

C:\Temp\khfzxupmke.sys
C:\Temp\khfzxupmke.sys
1⤵
PID:3936

C:\Temp\uomjecwuom.sys
C:\Temp\uomjecwuom.sys
1⤵
PID:2800

C:\Temp\urmgecwujh.sys
C:\Temp\urmgecwujh.sys
1⤵
PID:3040

C:\Temp\bzwroljdbz.sys
C:\Temp\bzwroljdbz.sys
1⤵
PID:3028

C:\Temp\tqoigdbvtq.sys
C:\Temp\tqoigdbvtq.sys
1⤵
PID:204

C:\Temp\yvsqkigays.sys
C:\Temp\yvsqkigays.sys
1⤵
PID:2984

C:\Temp\davtndxvpn.sys
C:\Temp\davtndxvpn.sys
1⤵
PID:3344

C:\Temp\ausnkicavs.sys
C:\Temp\ausnkicavs.sys
1⤵
PID:5884

C:\Temp\rpnkfzxrpk.sys
C:\Temp\rpnkfzxrpk.sys
1⤵
PID:2256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

axspkicaus.sys

Path C:\Temp\axspkicaus.sys
Size 141KB
SHA256 7c4a20871655c596366da61c1e4380f52bf1d0bdffacb20cae9b2aefc191a38d
MD5 2e2dd05b26b8b146f4a376a91223d2b8
SHA1 06459a054abaeceb13d1552439340efcb54a6779
SHA512 1449f9be0907f36165b472ce7f275c6ec28cea286c0d3c2e1255e0a8c5933c2b59a1b86dc41906cec579ad2405a1477bc63aecdded02b34ad3375c51bb67b719
SSDEEP 1536:Ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T172E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwuomjecwu.sys

Path C:\Temp\cwuomjecwu.sys
Size 141KB
SHA256 0308741e195186b4e9ee1c746b91fdc71114c7a6673f2e8b4e3601fddf12414a
MD5 a7475367dc5b962398dbd0a08d88b713
SHA1 67f7e31abaa3a0bf55544615fa68a3a6a6603687
SHA512 c559ed9bdd438c17a89c756c69fd2598c076a79d3d8cc9e559de6d836b0a005b615a2180bab38df43b106b82c2056e2f6ad976014224effaddd89e2e98bc2138
SSDEEP 1536:La3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:La3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T137E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hecwupmhfz.exe

Path C:\Temp\hecwupmhfz.exe
Size 243KB
SHA256 71830819f87772bf6a48b810c1d0aba874191ff029d6b136976b58596b500fcc
MD5 0659696c86f719b2b7b43b74c64bf5ee
SHA1 9592e2c7365e358a9e845da1741487c127d0d9c2
SHA512 8df4c8291777c45bc81440c6a30023d86902a64d4f75f9fc009bc6bc8e0c9bfbb3c9f7d7eed2df4e686d33ccb079900e7d89b7e6c58e4d99e2e4598a1efe15eb
SSDEEP 3072:8MaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7G:uGii9IL8Xa3lLNngoqRttA7G
TLSH
T13A34490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hecwupmhfz.exe

Path C:\Temp\i_hecwupmhfz.exe
Size 243KB
SHA256 ad02b2daf3d3ba2f861110bf679211d02e797cfd854ff12fb17ff392fa46c565
MD5 0e73f0760bdfdbb978ea5d2848f1445d
SHA1 13f519c783f250173f006ebd81c29041890af8c8
SHA512 083e1450ffa4208009c137cae746b5bbb00870028394bb37ddca0fab4d6c9094c5894115baa9bb8527d5a8a316d357216b50e2e290cbe16fb4c3d70a5e216797
SSDEEP 3072:qMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:MGii9IL8Xa3lLNngoqRttA7o
TLSH
T1C934490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jhczurmkec.exe

Path C:\Temp\i_jhczurmkec.exe
Size 243KB
SHA256 dafe9479633287fa695fe5090fb3ff21ae8acf011a921e18305e1415e6e59760
MD5 cbcbd4a8c037fbe9b21bbd1cf2f6f716
SHA1 16dd968e5b3ae3630dae86799907f110b819664d
SHA512 adf4ad278558b278eeb2a4450809034cfad43d430595e30851b6c179ee1d7b125a92a9590a6d65288e0f4d0d7f0aea978bcd8151a258b0fdb6283400e5fa2111
SSDEEP 3072:4MaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7a:SGii9IL8Xa3lLNngoqRttA7a
TLSH
T1D434490272818031E71A0B74046AE7A046BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mgeywqojgb.exe

Path C:\Temp\i_mgeywqojgb.exe
Size 243KB
SHA256 af858f8047e53a6cbe7714c4bd03360b869192cca1403909da5c40cfbfbb9c68
MD5 63d127245a9c9b2b19ebcf54976efcfd
SHA1 3fa364d0a8975a63e36e2aa4a4dcca0bf2a02106
SHA512 2d9bf25f6a227b8bbd915c7c117310d921b68b68ece5f8082db5580e5085fd90a23ca25655d3344baec9462dd2067eb22717b62d984c51493717b10d8206150e
SSDEEP 3072:wMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7a:6Gii9IL8Xa3lLNngoqRttA7a
TLSH
T19C34490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnifaysqki.exe

Path C:\Temp\i_pnifaysqki.exe
Size 243KB
SHA256 3f1ef0bbb2468ed1e6402dc395b6e16cc8b0e3dfe32bfee56447fb9a5f89b2bc
MD5 3121be0db049a125b37a5f53fa3baf27
SHA1 6f9eec7751f2131fddd1820f1eb56c9534faa923
SHA512 aed983630ea34a87b76accf0e7cc6919021642fd59acaed00f15a7f88e8b98d0470a6d463038e614f075f9c445587f11e93809787834a2042e4e04a1837ad19e
SSDEEP 3072:eMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7s:4Gii9IL8Xa3lLNngoqRttA7s
TLSH
T1AF34490272818031E75A0B78046AE7A046BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpjhbztrlj.exe

Path C:\Temp\i_rpjhbztrlj.exe
Size 243KB
SHA256 3b4701ff49ad237095ca6ec96dd98d5cf2f567d51a254192f2713c73b710da6e
MD5 2df9f015ce9a855687c5063e20a5b620
SHA1 c0f1f538fbc8d63f2920ad62317a357ce0c8ebb4
SHA512 767dba56fae5171e0b95f59bde4486e24997b715f9a400b69bdcda67cc214504bf3a1f28a37c9dee72563ef194d8a2a8ac0a28a58dea9add639ae9d72a94ab82
SSDEEP 3072:cMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7C:OGii9IL8Xa3lLNngoqRttA7C
TLSH
T14C34490272818031E75A0B78046AE7A046BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vpnhfzxspk.exe

Path C:\Temp\i_vpnhfzxspk.exe
Size 243KB
SHA256 4d923d82ea1595641abb31bc0fcec088a9910d7798cd2bb0fd47009b2cebfbeb
MD5 d27efde0d700abe7a1a433459dd3f63a
SHA1 34ff94922b5a84eef3fa662167b589b6ce2a8989
SHA512 fd18f48228f92dc22c7cf171b98dadd0d10dbd4626885446de70e2a7be232987a7542f62a572fb86dfea0e96234e3214a6888626c712e8f2e277ac0bf5a3ce83
SSDEEP 3072:/MaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7F:bGii9IL8Xa3lLNngoqRttA7F
TLSH
T19034490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhczurmkec.exe

Path C:\Temp\jhczurmkec.exe
Size 243KB
SHA256 086b3e2bbedb9fe7a379642c43a92538a945805c4656c144db0367d207d0a0e7
MD5 2bb521458f147b7b368267ad7853a0ec
SHA1 17363958e80e3973c7c7634c37381708b607cee2
SHA512 c3230b2cc6ebbda08b09a6062d596b6486c152c138fdec8c1a97612325f54bf70fdc967570f0f583037286632056f6d0c980d094d98a763ab8d44e4a8d0e75c4
SSDEEP 3072:IMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:CGii9IL8Xa3lLNngoqRttA7W
TLSH
T17334490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgeywqojgb.exe

Path C:\Temp\mgeywqojgb.exe
Size 243KB
SHA256 1a21db05ed379ea1fb4f7858fa002f37c444a073ff551ba406190924fc6398aa
MD5 8e0c2915f5004466e6595588a14f0aee
SHA1 f12aff2ca8d7b74198614d6c53e1cb043446de37
SHA512 af38a96e2079763548000b041dc52edc455f9b5a21ec4a9d701903b7e26525afb99612ec6a5221ce717d334195f6963d66d5ede17d283e63bc805af392c35e13
SSDEEP 3072:OMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7I:IGii9IL8Xa3lLNngoqRttA7I
TLSH
T1F534490272818031E71A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkecwupmhe.sys

Path C:\Temp\mkecwupmhe.sys
Size 141KB
SHA256 bd18b93c5a911258562e7bb3b42d165413df1c22c7016b7708b68539bf270736
MD5 ead4e5aa7b69110d3c44cf26691dae9a
SHA1 15ee4c012c3fef03ffe73cb211d13c6704053e10
SHA512 f45ca8ffafd14dbf52d79a67e97e8b7c3525c4fcca82fdd4ffe9aa7ebb040c730757a84a49ae4570f770abcf82c8e9214df7f8476cd81f8e66bdd7fc7b938754
SSDEEP 1536:ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T18CE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojhbztrlje.sys

Path C:\Temp\ojhbztrlje.sys
Size 141KB
SHA256 9120a92a7d54acfd48caa367e19806015269b7e54588f57617c3fff33e6606b5
MD5 06b14adac240a2a9eaf71c8e4766d74c
SHA1 85851bfe506ff742fc47930e06bf6d0694b1ed79
SHA512 a8787c8b355bd0a394eaab0f5368b1a14f22bd29b9aa746104f4f952b40466def2d98763549825a7b08a1c1a1dfb88eacf4bb45063d843eaf14bebb1c8f755da
SSDEEP 1536:Ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T114E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnifaysqki.exe

Path C:\Temp\pnifaysqki.exe
Size 243KB
SHA256 24d541647a8559e258e70b1765c2b585f7646c8b0ea24ccbc8293750ef4afbde
MD5 88999c8e39903f6df3228b5d93018fc7
SHA1 76d2ad3dc231d0ab8097031755f4c9d1ae4cfb03
SHA512 db26666af5ca253ca24410d3fc5d8c06d59dcc726cb46698d01ff12edfdacae68a9514fdb09ea7ca3b07a999bfb30aac209bbb08874d9122522dc93fd45ca182
SSDEEP 3072:rMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7N:PGii9IL8Xa3lLNngoqRttA7N
TLSH
T19334490272818031E71A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhbztrlj.exe

Path C:\Temp\rpjhbztrlj.exe
Size 243KB
SHA256 d9137318e51249291ffc82ff57d37762540a5d6781ebab7c72eb9021d308ac54
MD5 f500646565c803c83ed48a3771439ad4
SHA1 6ef961a1e60193853fda767bb200ed21d875ebef
SHA512 9e5bc6dea1ac560befeb20f31cfd024326984297ac312c0e03f202aef2f0e97293ca520ca788ae6a707b1df4be9030da7b9ed3b298151911f81970f3d8ad530c
SSDEEP 3072:GMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k:wGii9IL8Xa3lLNngoqRttA7k
TLSH
T18334490272818031E71A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spnhfcxupn.sys

Path C:\Temp\spnhfcxupn.sys
Size 141KB
SHA256 3627c10a90b3cf8d99e438e32f1aaa983ef12732b24e32e2283d830ddf06ba09
MD5 5836099971e8c296bd30057890893e73
SHA1 4793c371f303976b038f5c23226784de153edea6
SHA512 0462200a94bb313e6d6ec79b5168fddbd928eed1b8e471267cc85f63aa2f871380a72c6d0983157258d1292feb27ecabdd1480cc2ce09ccb8d563ce3420d4003
SSDEEP 1536:Sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F9E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnhfzxspk.exe

Path C:\Temp\vpnhfzxspk.exe
Size 243KB
SHA256 dc5a150b1f66454cac071df3dffb578364ce74c2e8fb63139a37f1feb68df790
MD5 d271e8fd407dbed1ef36b09ccdb6b055
SHA1 3cf2566e2aaeee7f96923f0c1ebb0a6d445e48b4
SHA512 cb520042188762beac88b6c97fbc392a86683d06e388d909e9b65ce94c3691ac340c3f1112102edbcf2d5c84a58535824e1c287fd52770997b51d719a3e1e2f1
SSDEEP 3072:xMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7n:FGii9IL8Xa3lLNngoqRttA7n
TLSH
T14434490272818031E71A0B74046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqojgbywqo.sys

Path C:\Temp\wqojgbywqo.sys
Size 141KB
SHA256 c469f1df63e60747abd0e29a5d1bd1ce9f557d87553c8504bf5d2e22ec692df8
MD5 2a3d2df2af1e1c2f6f672a78f7eb6b35
SHA1 ec38fb52c60b013dc8278f77095fb889623fb7f0
SHA512 a8df377b9fef6b849dfbb7f0209a8aa5aa6074dc9361a741a11055b622641ad16a8618106afdc6e2a103a09f21778f9eb660ca97408d0933934b6a6912ed0835
SSDEEP 1536:Qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T119E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 674d24008448b140a9b320032b4ed333cf5a592b073bf375c453c816d33c703b
MD5 b989ec4e221bd567659492bc1ad7ab3b
SHA1 372670805b3060960e77e6ba32a3b9edd0241cf0
SHA512 f6934e6a831bcac97110107a79389dae0e669b743e0d62e5b411c19471bf237f4d61c7cee27d9fcacbd7045cbe27e78b4e6c38f6e76ca789a7760295558b0bb3
TLSH
T1CBD0C0383E28F508C5402076E4504310E3238131742B8242B010F02DEC581810BDF0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e1a5fea1006889b9c3bcf0a470a6a4256d5300a4b7036038ddce5fd042c424c
MD5 e9af81b8f1175d007e2c699939cb3df6
SHA1 696178bffe86e4e363a26747d6a5cb80e28621ce
SHA512 38174d529846c50b0af9a056e65ca491645c3cbf1fb867ef22a3b7c7ee4287ba29c3a28d736bc2e9c562faa24bb671db3b9cc40507a467140e47eaa4aeae6d51
TLSH
T145D0C0343E38F408C540207AE4514310E3138131302B8242B010F03DEC581810BDE0CF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 96dd7a64a5b2c0725dadd9e9c3cf38c55fac6bb0c58d9a67030df638fddaa627
MD5 7cf7daea76a5250b0adbe0b3d367877a
SHA1 7562e572703f5f7f10d534ffcd60cb55ce3e4915
SHA512 58bd46ef5101b27f161fa8c028aa641ca9df0409ca5c6d5ee3752f9631d455192c733fabb2f7d2e49bbeb4a3b192d5d66936c17dc58366c05f7b9936d5237e03
TLSH
T133717109D5220D1DFB2637F1A1FD94A877B4EBB2423F6D16806490B5AAF7F607841330
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59189f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59189f.TMP
Size 3KB
SHA256 361d9d24d396fbc01e0be4798fd515e17ab63e983e5659431390545ea9317a9a
MD5 d7e5f74f7d88c814236281d06c35602b
SHA1 cd190576a5b9202aca642f03913a21c0baf122a3
SHA512 3a67d2c415d4d7c9eca82efbdc51fde17eeff09f8599bb80f7296897913db39c826b4c3a995a115200686e4e2a31e0f6628803798d6f0e8f00a5bd0a66293fd5
TLSH
T109717109D5124D0DFB2637F1A1FD94A877B4EBB2422F6D16806494B5AAF7F607841330
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 894f29a897fd1c62ea4c1411555ace8f0f46b3ab03c62435db2bcd908a9070ce
MD5 a9ee339bdc6c6197efe770e12534d6e4
SHA1 23259b134445c190a53d3eb3cd80b121fae42338
SHA512 0df95faf0f9b8de4e7cacaebb6e304b8eaa6dacf434ed7e9249c43f29659a4c87fb8e80c5ccaa38830ff6dd27b851962f06a95d0ea28dd65b5d2a68862c445f2
TLSH
T1BD41ADF7C3E4856EC91195F0BA186E2BCE1D0915832C3D5AC9E4EF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 46fc908a84eb67c926db939b88c2aa563fae51f29ff18864314b5381e70dcc1c
MD5 b212e4dbb173afbdfa4a28c406c670d1
SHA1 71d3eb4b8255e2fdf45e10e273c3fb3628c05a5f
SHA512 f311d89c98309dcf8a3d992ab45f7eea41d99577de3ef78b8189df31a05500759ae2a8d1b004e02c76f5588ad5ccd438e11092c43064ed439818763b9eda83ed
SSDEEP 192:sxRCRbyM/jK1Ml8wcE/f4e/sqXTnjZIXZ13zoA8p9Y/g6+WNCtC/Y+kuFiGiIgDy:sxRC7CE/f4e/sqrNIGK/5N/LFwu
TLSH
T15D62DA15AA345A778CDBD219FA55BF53D6F81472E2900E48AAFCCA0C02E77DD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 fb94bed4fd64baa384300777522abf103256de0f62c6ea9eedec998fea485c37
MD5 54abb65d3c2e1e6a0f17d0f1ea960fa9
SHA1 2dcf1862b7452502e38f17d277c87af2119f6cbf
SHA512 c28a14bf6e7fced56d20df4711de99170904db746bc8792af39cba362184dffd1336561185dfe55eb4dce9f21fb5b616a425c577a61365b068b5cdf031ecabef
SSDEEP 192:sxRCRbyM/jK1Ml8UQ8cE/f4e/sqXenjZIXZ13zoA8prY/g6+WNCtC/Y+5QuFiGiI:sxRC7qbE/f4e/sqONIGM/5N/9FwI
TLSH
T13562DA16A6345A778CDBD219FA55BF53D6F81572E2900E44AAFCCB0C02E76DD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a56c82f57990860b63a2794720af7c759d6dab80eac19be26c0b0fbeb53268d0
MD5 c4ad1d7dcf70f0f0320b77b4bf6d9ef5
SHA1 2bb7cb7d590cf060b4ac7d2a0ffb8a8b1c5877b9
SHA512 4246082f7517f08925d276e28f6fc447c72cc222b1c8d8cb5e8f3ca0bf210d13e07604ef7b749365aac78b8a7f19ea0fce448d52d3527a6d7d1e95e904f0da49
SSDEEP 192:sxRVRbyM/jK1Ml8wcE/f4e/spXTnjZIXZ13zoA8p9Y/g6+WNCtC/Y+kuFiGiIgtJ:sxRV7CE/f4e/sprNIGK/5N/LFw3
TLSH
T11A62E9156A345A778CDBD219FA55BF53D6F81572E2900E48AAFCCA0C02E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 9b694bfea69385f2d43e70b9064c0e80cbcce8c3a3ccf814dc8fc21fa4103d3d
MD5 9a65c30ed0c85b1f6f24bccecc615599
SHA1 2bed230a5b41180d77b1d2a73199010e50d6a5b3
SHA512 e42361f0350d634bd1da42ea03e3d3fffd716da6c50ccfba4462d4b9b8658e8b54722512a982c65ee3bd6804f8d31808008f1b3776c0c0a4a08c4fb84b408e5c
SSDEEP 768:7dUhBR7pLuL7tgWgEyf3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OVS6Ge0Garoddlt:7dUhBHE7tgWgEyf3wu1jaB6GRGRd3t
TLSH
T17EE2FB3B680CCB7F4F4049DCEC29BD9AADA901CF9698CD5447FA840C03C6AEB551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59b481.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59b481.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 db36a1472d40a8649e867ef4f7b9d45512650a673cd2a303851d867dada555f2
MD5 cb056c07ba0e0f8d2e8d781f84e58f40
SHA1 69bc28a65900c0ffd773e857e08ff01034ba9ce8
SHA512 ec37a252005beb62c76a86ec40de0ab527ca58ce063ee3f0ca86dafa86933d718e17ceb07d2bfbc7ed4dd424fcf307f92e94005ee214208458e3aa39f7e4d38c
SSDEEP 768:Orv+4UNbdp3n05gdMcvnWgWWR+2SrXH78tRk3+8rr6F:Obsb/3tJPWg1bSro2Dr6
TLSH
T14E03BF32A8688DB3DCE2DA84720B76037FF44193D6C91B88C4D91B4D439B9DD270BD6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 828962439ce7d8d953ed0801e3955072382798da8454f3dacf513d3a95300870
MD5 7e612bbef080237a86e836d0fd49ce4b
SHA1 c7c3a24983fc05af61478464a621c797ffab231d
SHA512 88e703836d76920ec25a1bcb364a674311cd54f5f038acb92be4b210d8474a7650d6b72438b23b64575617e86465ae954ce1bd606e33816e0c9238fe61650be1
SSDEEP 768:Xrv+4UNbdt3W7F5g+UMcvnWgWWR+2SrXH78tRM9+8rr6R:Xbsbv3FJPWg1bSroIDrS
TLSH
T17913BF31A8688DB39CE2D644B207B2837FF41093D9C90F98C4D95B4D464B9DE2B1BD6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 600b43aed0d825a08ae0db25bd5be5a8c2689a4a6e0405ff298eb54335478dc7
MD5 3a10c0dbe98081c99b92130a4f128939
SHA1 941dd7738ebc7d4e27bb925b78491b73abf9e70a
SHA512 aa099a89a3c05f8692ff6d902d8a5f84aeab674bddf00d9a07ac6cf1d6a52727a89a2e9658ec95252733783bc36799614456d9d85a0f8f3cd00eaf0d42bbdf7b
SSDEEP 768:cF1j+9U3Kwgm0n8+1McvnWgWWR+2SrXH78tRM9Dl8BvTPaIl:R9U3gJPWg1bSroIDl0W6
TLSH
T1311328F198D38972D8AE8787633D6E429EBCC163B4885994B7C45E0CCD831BFD706929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0fc06d72a6a1c0b72c0fe5720f54922ad912122055496edfd39a6b7e93ad7210
MD5 1e41054c79b3463d740264103c055c54
SHA1 0480548f092727ec62e37df4d5a31a4a5a6a109c
SHA512 0e09b17e2937a9af09cfa3e90fd7a5f281619e846415be227b07dbce30c4c648820dd720027a4ee535a74ca8ea99ebd800ce75f3e04263ef2ebe0645523695c7
SSDEEP 768:Dj+973tEF5g+cMcvnWgWWR+2SrXH78tRM9Dl8BvTPaIl:G973XJPWg1bSroIDl0W6
TLSH
T117F2AE31B8658DB38CE2DA84B207B783BEF411A3D5891F98C4D85B0D469769D2B07D3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5580_1257084388\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/204-449-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/688-185-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/852-232-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1852-276-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2256-324-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2256-503-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2760-260-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2760-277-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2800-413-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2984-454-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3028-437-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3028-448-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3040-417-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3208-373-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3344-474-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3572-328-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3572-361-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3936-393-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4408-299-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5168-343-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5884-486-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5884-504-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6044-319-0x0000000000010000-0x0000000000083000-memory.dmp

Download