a93633009757b496ed03c1ecf12bb474e1424732eae45659074d1e04a36a4760

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_e4ff7f51a22e6bd1822906a76787a8d1_elex_rhadamanthys_stop.exe
Size 243KB
Sample260703-bdh72aes6j
SHA256 a93633009757b496ed03c1ecf12bb474e1424732eae45659074d1e04a36a4760
MD5 e4ff7f51a22e6bd1822906a76787a8d1
SHA1 6f348e4fff39befb00d27f6e5d409bea73ddbe8d
SHA512 05ca0fc73d73896bd6831533b69fd7671788ade41992f632f0280e16e694516abfd3c6d2b69a3d568d7b0b6201639c0fac44fb588814dc26a2abb893865a9d0b
SSDEEP 3072:KMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA74:sGii9IL8Xa3lLNngoqRttA74
TLSH
T15F34490272818031E71A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4920	CP.exe
1400	mjhcwupmhc.exe
3228	CP.exe
4912	CP.exe
2020	i_mjhcwupmhc.exe
5760	cwupmhfzxr.sys
5180	CP.exe
120	rpmhezwuom.exe
4560	CP.exe
2532	CP.exe
2524	i_rpmhezwuom.exe
1660	urpjgezwrp.sys
1116	CP.exe
888	romgezwroj.exe
3268	CP.exe
1364	CP.exe
3720	i_romgezwroj.exe
3688	tolgeywqoi.sys
5564	CP.exe
1540	wqojgbztrl.exe
3304	CP.exe
1148	CP.exe
5676	i_wqojgbztrl.exe
2404	vtnlgdyvtn.sys
5760	CP.exe
936	qolgdyvtqo.exe
3240	CP.exe
2676	CP.exe
4440	i_qolgdyvtqo.exe
6104	yvqoigdywq.sys
2432	CP.exe
3056	lfdxvtnlfa.exe
1668	CP.exe
3296	CP.exe
1592	i_lfdxvtnlfa.exe
5324	sqkicayvqn.sys
1940	CP.exe
3332	tnlfdxvqni.exe
6128	CP.exe
1912	CP.exe
4160	i_tnlfdxvqni.exe
5468	vpnkfcausq.sys
5052	CP.exe
1008	vsnkicausm.exe
2584	CP.exe
700	CP.exe
4384	i_vsnkicausm.exe
3864	ausmkecwus.sys
5616	CP.exe
5336	zxupnhfzxr.exe
2032	CP.exe
3660	CP.exe
3684	i_zxupnhfzxr.exe
5812	ausmkecxup.sys
5544	CP.exe
1900	jecwuomgez.exe
5600	CP.exe
2436	CP.exe
1608	i_jecwuomgez.exe
2744	urmjecwuom.sys
2176	CP.exe
1656	urmjebwuom.exe
2844	CP.exe
684	CP.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2880_1297164337\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2880_923690763\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2880_1721993469\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2880_1721993469\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2880_2000649745\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2880_1297164337\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2880_923690763\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2880_1721993469\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2880_1721993469\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmjebwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wupmhfcxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbzurpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_romgezwroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxupnhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wupmhfcxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhbzurpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbzwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spnhfzxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	romgezwroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxupnhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jecwuomgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbqlidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qolgdyvtqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxvtnlfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhcwupmhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqojgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qolgdyvtqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbzwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idaysqkigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idaysqkigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_e4ff7f51a22e6bd1822906a76787a8d1_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhcwupmhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnkicausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jecwuomgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfcaysnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfcaysnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spnhfzxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpmhezwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpmhezwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmjebwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbqlidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqojgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxvtnlfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnkicausm.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5952	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5324	ipconfig.exe
5060	ipconfig.exe
908	ipconfig.exe
4916	ipconfig.exe
4744	ipconfig.exe
952	ipconfig.exe
5040	ipconfig.exe
2868	ipconfig.exe
2668	ipconfig.exe
3908	ipconfig.exe
1000	ipconfig.exe
5500	ipconfig.exe
5004	ipconfig.exe
5432	ipconfig.exe
2872	ipconfig.exe
3640	ipconfig.exe
1592	ipconfig.exe
864	ipconfig.exe
3304	ipconfig.exe
2980	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275141031418011"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{7FEE448C-9DB4-43C7-8CC5-6DC69A833258}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1576	msedge.exe
1576	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2020	i_mjhcwupmhc.exe
Token: SeDebugPrivilege	2524	i_rpmhezwuom.exe
Token: SeDebugPrivilege	3720	i_romgezwroj.exe
Token: SeDebugPrivilege	5676	i_wqojgbztrl.exe
Token: SeDebugPrivilege	4440	i_qolgdyvtqo.exe
Token: SeDebugPrivilege	1592	i_lfdxvtnlfa.exe
Token: SeDebugPrivilege	4160	i_tnlfdxvqni.exe
Token: SeDebugPrivilege	4384	i_vsnkicausm.exe
Token: SeDebugPrivilege	3684	i_zxupnhfzxr.exe
Token: SeDebugPrivilege	1608	i_jecwuomgez.exe
Token: SeDebugPrivilege	1756	i_urmjebwuom.exe
Token: SeDebugPrivilege	2716	i_trljdbzwro.exe
Token: SeDebugPrivilege	2364	i_trljdbvtol.exe
Token: SeDebugPrivilege	2572	i_dbqlidbvtn.exe
Token: SeDebugPrivilege	6104	i_idaysqkigd.exe
Token: SeDebugPrivilege	1892	i_nhfcaysnki.exe
Token: SeDebugPrivilege	4836	i_spnhfzxspk.exe
Token: SeDebugPrivilege	796	i_wupmhfcxus.exe
Token: SeDebugPrivilege	5332	i_rpjhbzurpj.exe
Token: SeDebugPrivilege	5756	i_rojhbztrmj.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5712 wrote to memory of 4408	5712	2026-07-02_e4ff7f51a22e6bd1822906a76787a8d1_elex_rhadamanthys_stop.exe	88
PID 4408 wrote to memory of 2880	4408	iexplore.exe	89
PID 2880 wrote to memory of 2132	2880	msedge.exe	90
PID 2880 wrote to memory of 5952	2880	msedge.exe	91
PID 2880 wrote to memory of 5184	2880	msedge.exe	92
PID 2880 wrote to memory of 5184	2880	msedge.exe	92
PID 2880 wrote to memory of 5984	2880	msedge.exe	94
PID 2880 wrote to memory of 5984	2880	msedge.exe	94
PID 2880 wrote to memory of 5984	2880	msedge.exe	94
PID 2880 wrote to memory of 3092	2880	msedge.exe	95
PID 2880 wrote to memory of 5672	2880	msedge.exe	96
PID 2880 wrote to memory of 3092	2880	msedge.exe	95
PID 2880 wrote to memory of 3092	2880	msedge.exe	95
PID 2880 wrote to memory of 5672	2880	msedge.exe	96
PID 2880 wrote to memory of 5672	2880	msedge.exe	96
PID 2880 wrote to memory of 2992	2880	msedge.exe	97
PID 2880 wrote to memory of 5912	2880	msedge.exe	98
PID 2880 wrote to memory of 2992	2880	msedge.exe	97
PID 2880 wrote to memory of 2992	2880	msedge.exe	97
PID 2880 wrote to memory of 5912	2880	msedge.exe	98
PID 2880 wrote to memory of 5912	2880	msedge.exe	98
PID 2880 wrote to memory of 2836	2880	msedge.exe	99
PID 2880 wrote to memory of 2836	2880	msedge.exe	99
PID 2880 wrote to memory of 2288	2880	msedge.exe	102
PID 2880 wrote to memory of 1252	2880	msedge.exe	101
PID 2880 wrote to memory of 2288	2880	msedge.exe	102
PID 2880 wrote to memory of 1252	2880	msedge.exe	101
PID 2880 wrote to memory of 4792	2880	msedge.exe	104
PID 2880 wrote to memory of 2604	2880	msedge.exe	105
PID 2880 wrote to memory of 2604	2880	msedge.exe	105
PID 5712 wrote to memory of 4920	5712	2026-07-02_e4ff7f51a22e6bd1822906a76787a8d1_elex_rhadamanthys_stop.exe	106
PID 1400 wrote to memory of 3228	1400	mjhcwupmhc.exe	110
PID 2880 wrote to memory of 1272	2880	msedge.exe	114
PID 2880 wrote to memory of 1272	2880	msedge.exe	114
PID 5712 wrote to memory of 4912	5712	2026-07-02_e4ff7f51a22e6bd1822906a76787a8d1_elex_rhadamanthys_stop.exe	115
PID 5712 wrote to memory of 5180	5712	2026-07-02_e4ff7f51a22e6bd1822906a76787a8d1_elex_rhadamanthys_stop.exe	119
PID 120 wrote to memory of 4560	120	rpmhezwuom.exe	121
PID 5712 wrote to memory of 2532	5712	2026-07-02_e4ff7f51a22e6bd1822906a76787a8d1_elex_rhadamanthys_stop.exe	124
PID 5712 wrote to memory of 1116	5712	2026-07-02_e4ff7f51a22e6bd1822906a76787a8d1_elex_rhadamanthys_stop.exe	128
PID 888 wrote to memory of 3268	888	romgezwroj.exe	130
PID 5712 wrote to memory of 1364	5712	2026-07-02_e4ff7f51a22e6bd1822906a76787a8d1_elex_rhadamanthys_stop.exe	133
PID 5712 wrote to memory of 5564	5712	2026-07-02_e4ff7f51a22e6bd1822906a76787a8d1_elex_rhadamanthys_stop.exe	137
PID 1540 wrote to memory of 3304	1540	wqojgbztrl.exe	139
PID 5712 wrote to memory of 1148	5712	2026-07-02_e4ff7f51a22e6bd1822906a76787a8d1_elex_rhadamanthys_stop.exe	142
PID 2880 wrote to memory of 1040	2880	msedge.exe	145
PID 2880 wrote to memory of 4428	2880	msedge.exe	146
PID 2880 wrote to memory of 4168	2880	msedge.exe	147
PID 5712 wrote to memory of 5760	5712	2026-07-02_e4ff7f51a22e6bd1822906a76787a8d1_elex_rhadamanthys_stop.exe	150
PID 936 wrote to memory of 3240	936	qolgdyvtqo.exe	152
PID 5712 wrote to memory of 2676	5712	2026-07-02_e4ff7f51a22e6bd1822906a76787a8d1_elex_rhadamanthys_stop.exe	155
PID 5712 wrote to memory of 2432	5712	2026-07-02_e4ff7f51a22e6bd1822906a76787a8d1_elex_rhadamanthys_stop.exe	159
PID 3056 wrote to memory of 1668	3056	lfdxvtnlfa.exe	161
PID 5712 wrote to memory of 3296	5712	2026-07-02_e4ff7f51a22e6bd1822906a76787a8d1_elex_rhadamanthys_stop.exe	164
PID 5712 wrote to memory of 1940	5712	2026-07-02_e4ff7f51a22e6bd1822906a76787a8d1_elex_rhadamanthys_stop.exe	168
PID 3332 wrote to memory of 6128	3332	tnlfdxvqni.exe	170
PID 5712 wrote to memory of 1912	5712	2026-07-02_e4ff7f51a22e6bd1822906a76787a8d1_elex_rhadamanthys_stop.exe	173
PID 5712 wrote to memory of 5052	5712	2026-07-02_e4ff7f51a22e6bd1822906a76787a8d1_elex_rhadamanthys_stop.exe	177
PID 1008 wrote to memory of 2584	1008	vsnkicausm.exe	179
PID 5712 wrote to memory of 700	5712	2026-07-02_e4ff7f51a22e6bd1822906a76787a8d1_elex_rhadamanthys_stop.exe	182
PID 2880 wrote to memory of 2244	2880	msedge.exe	184
PID 2880 wrote to memory of 2244	2880	msedge.exe	184
PID 5712 wrote to memory of 5616	5712	2026-07-02_e4ff7f51a22e6bd1822906a76787a8d1_elex_rhadamanthys_stop.exe	190
PID 5336 wrote to memory of 2032	5336	zxupnhfzxr.exe	192
PID 5712 wrote to memory of 3660	5712	2026-07-02_e4ff7f51a22e6bd1822906a76787a8d1_elex_rhadamanthys_stop.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-02_e4ff7f51a22e6bd1822906a76787a8d1_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_e4ff7f51a22e6bd1822906a76787a8d1_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5712
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x310,0x7ffe5d87c188,0x7ffe5d87c194,0x7ffe5d87c1a0
      4⤵
      PID:2132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,5895339108175069180,16963953317004267904,524288 --field-trial-handle=2608,i,13378260827943495897,1918434429032564179,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:11
      4⤵
      System Time Discovery
      PID:5952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,718019477697717199,12286010450037914236,524288 --field-trial-handle=2608,i,13378260827943495897,1918434429032564179,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:13
      4⤵
      PID:5184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,8219821231196957602,17979826291931749572,262144 --field-trial-handle=2608,i,13378260827943495897,1918434429032564179,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:2
      4⤵
      PID:5984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,6906345581910593223,15214030096869012473,2097152 --field-trial-handle=2608,i,13378260827943495897,1918434429032564179,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:3092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,15513881238319689418,18311894307542969159,2097152 --field-trial-handle=2608,i,13378260827943495897,1918434429032564179,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:5672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,15756309465360470167,2162218357341864552,2097152 --field-trial-handle=2608,i,13378260827943495897,1918434429032564179,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
      4⤵
      PID:2992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,13969810020119849740,14397796748386268101,2097152 --field-trial-handle=2608,i,13378260827943495897,1918434429032564179,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:9
      4⤵
      PID:5912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,5646294977769601764,4590828552479826277,524288 --field-trial-handle=2608,i,13378260827943495897,1918434429032564179,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
      4⤵
      PID:2836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,11066450935758174690,15243063338017917678,524288 --field-trial-handle=2608,i,13378260827943495897,1918434429032564179,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14
      4⤵
      PID:1252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3424,i,15133302602424424686,9762506311980054720,524288 --field-trial-handle=2608,i,13378260827943495897,1918434429032564179,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:14
      4⤵
      PID:2288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,17131477051304074426,11417010420607628068,524288 --field-trial-handle=2608,i,13378260827943495897,1918434429032564179,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
      4⤵
      PID:4108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,17131477051304074426,11417010420607628068,524288 --field-trial-handle=2608,i,13378260827943495897,1918434429032564179,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
      4⤵
      PID:4792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,9516402875390054081,1786178480596690794,524288 --field-trial-handle=2608,i,13378260827943495897,1918434429032564179,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
      4⤵
      PID:2604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,3584632236049560320,16501623396591940123,524288 --field-trial-handle=2608,i,13378260827943495897,1918434429032564179,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
      4⤵
      PID:1272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,2117077619419828870,12453967148747669019,524288 --field-trial-handle=2608,i,13378260827943495897,1918434429032564179,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
      4⤵
      PID:1040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,14364037836955578416,12114022942735459951,524288 --field-trial-handle=2608,i,13378260827943495897,1918434429032564179,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
      4⤵
      PID:4428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,1808658041155360132,17281159765369453908,524288 --field-trial-handle=2608,i,13378260827943495897,1918434429032564179,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:14
      4⤵
      PID:4168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,14072499905248491145,2175320094308493715,524288 --field-trial-handle=2608,i,13378260827943495897,1918434429032564179,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
      4⤵
      PID:2244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3064,i,8896818090023634592,3752919927755538119,524288 --field-trial-handle=2608,i,13378260827943495897,1918434429032564179,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:14
      4⤵
      PID:1576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,12533902432692302802,14033835774164369523,524288 --field-trial-handle=2608,i,13378260827943495897,1918434429032564179,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14
      4⤵
      PID:5016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,13207346927101694296,17249429117646425025,524288 --field-trial-handle=2608,i,13378260827943495897,1918434429032564179,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14
      4⤵
      PID:4428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6184,i,5698800293674864861,7613983786660260364,262144 --field-trial-handle=2608,i,13378260827943495897,1918434429032564179,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,9033006471382017413,13600054630114818373,524288 --field-trial-handle=2608,i,13378260827943495897,1918434429032564179,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:14
      4⤵
      PID:4756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjhcwupmhc.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4920
- - C:\Temp\mjhcwupmhc.exe
    C:\Temp\mjhcwupmhc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1400
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3228
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjhcwupmhc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4912
- - C:\Temp\i_mjhcwupmhc.exe
    C:\Temp\i_mjhcwupmhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2020
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpmhezwuom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5180
- - C:\Temp\rpmhezwuom.exe
    C:\Temp\rpmhezwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:120
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4560
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpmhezwuom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2532
- - C:\Temp\i_rpmhezwuom.exe
    C:\Temp\i_rpmhezwuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\romgezwroj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1116
- - C:\Temp\romgezwroj.exe
    C:\Temp\romgezwroj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:888
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3268
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_romgezwroj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1364
- - C:\Temp\i_romgezwroj.exe
    C:\Temp\i_romgezwroj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqojgbztrl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5564
- - C:\Temp\wqojgbztrl.exe
    C:\Temp\wqojgbztrl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1540
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3304
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqojgbztrl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1148
- - C:\Temp\i_wqojgbztrl.exe
    C:\Temp\i_wqojgbztrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5676
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qolgdyvtqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5760
- - C:\Temp\qolgdyvtqo.exe
    C:\Temp\qolgdyvtqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:936
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3240
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qolgdyvtqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2676
- - C:\Temp\i_qolgdyvtqo.exe
    C:\Temp\i_qolgdyvtqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdxvtnlfa.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2432
- - C:\Temp\lfdxvtnlfa.exe
    C:\Temp\lfdxvtnlfa.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1668
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdxvtnlfa.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3296
- - C:\Temp\i_lfdxvtnlfa.exe
    C:\Temp\i_lfdxvtnlfa.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlfdxvqni.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1940
- - C:\Temp\tnlfdxvqni.exe
    C:\Temp\tnlfdxvqni.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3332
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6128
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlfdxvqni.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1912
- - C:\Temp\i_tnlfdxvqni.exe
    C:\Temp\i_tnlfdxvqni.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsnkicausm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5052
- - C:\Temp\vsnkicausm.exe
    C:\Temp\vsnkicausm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1008
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2584
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsnkicausm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:700
- - C:\Temp\i_vsnkicausm.exe
    C:\Temp\i_vsnkicausm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxupnhfzxr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5616
- - C:\Temp\zxupnhfzxr.exe
    C:\Temp\zxupnhfzxr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5336
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2032
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxupnhfzxr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3660
- - C:\Temp\i_zxupnhfzxr.exe
    C:\Temp\i_zxupnhfzxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jecwuomgez.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5544
- - C:\Temp\jecwuomgez.exe
    C:\Temp\jecwuomgez.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1900
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5600
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jecwuomgez.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2436
- - C:\Temp\i_jecwuomgez.exe
    C:\Temp\i_jecwuomgez.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1608
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urmjebwuom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2176
- - C:\Temp\urmjebwuom.exe
    C:\Temp\urmjebwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1656
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2844
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urmjebwuom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:684
- - C:\Temp\i_urmjebwuom.exe
    C:\Temp\i_urmjebwuom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljdbzwro.exe ups_run
  2⤵
  PID:5824
- - C:\Temp\trljdbzwro.exe
    C:\Temp\trljdbzwro.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4632
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5976
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljdbzwro.exe ups_ins
  2⤵
  PID:612
- - C:\Temp\i_trljdbzwro.exe
    C:\Temp\i_trljdbzwro.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljdbvtol.exe ups_run
  2⤵
  PID:5872
- - C:\Temp\trljdbvtol.exe
    C:\Temp\trljdbvtol.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6044
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5912
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljdbvtol.exe ups_ins
  2⤵
  PID:4720
- - C:\Temp\i_trljdbvtol.exe
    C:\Temp\i_trljdbvtol.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbqlidbvtn.exe ups_run
  2⤵
  PID:5308
- - C:\Temp\dbqlidbvtn.exe
    C:\Temp\dbqlidbvtn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2144
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5080
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbqlidbvtn.exe ups_ins
  2⤵
  PID:4452
- - C:\Temp\i_dbqlidbvtn.exe
    C:\Temp\i_dbqlidbvtn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\idaysqkigd.exe ups_run
  2⤵
  PID:1964
- - C:\Temp\idaysqkigd.exe
    C:\Temp\idaysqkigd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2672
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3308
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_idaysqkigd.exe ups_ins
  2⤵
  PID:5280
- - C:\Temp\i_idaysqkigd.exe
    C:\Temp\i_idaysqkigd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfcaysnki.exe ups_run
  2⤵
  PID:3024
- - C:\Temp\nhfcaysnki.exe
    C:\Temp\nhfcaysnki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5132
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2576
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfcaysnki.exe ups_ins
  2⤵
  PID:4832
- - C:\Temp\i_nhfcaysnki.exe
    C:\Temp\i_nhfcaysnki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spnhfzxspk.exe ups_run
  2⤵
  PID:3408
- - C:\Temp\spnhfzxspk.exe
    C:\Temp\spnhfzxspk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5876
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2664
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spnhfzxspk.exe ups_ins
  2⤵
  PID:4384
- - C:\Temp\i_spnhfzxspk.exe
    C:\Temp\i_spnhfzxspk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wupmhfcxus.exe ups_run
  2⤵
  PID:4576
- - C:\Temp\wupmhfcxus.exe
    C:\Temp\wupmhfcxus.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6096
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5980
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wupmhfcxus.exe ups_ins
  2⤵
  PID:5512
- - C:\Temp\i_wupmhfcxus.exe
    C:\Temp\i_wupmhfcxus.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhbzurpj.exe ups_run
  2⤵
  PID:2044
- - C:\Temp\rpjhbzurpj.exe
    C:\Temp\rpjhbzurpj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4212
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2928
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhbzurpj.exe ups_ins
  2⤵
  PID:4508
- - C:\Temp\i_rpjhbzurpj.exe
    C:\Temp\i_rpjhbzurpj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5332
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rojhbztrmj.exe ups_run
  2⤵
  PID:3452
- - C:\Temp\rojhbztrmj.exe
    C:\Temp\rojhbztrmj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1988
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4684
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rojhbztrmj.exe ups_ins
  2⤵
  PID:5640
- - C:\Temp\i_rojhbztrmj.exe
    C:\Temp\i_rojhbztrmj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5756

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5400

C:\Temp\cwupmhfzxr.sys
C:\Temp\cwupmhfzxr.sys
1⤵
- Executes dropped EXE
PID:5760

C:\Temp\urpjgezwrp.sys
C:\Temp\urpjgezwrp.sys
1⤵
- Executes dropped EXE
PID:1660

C:\Temp\tolgeywqoi.sys
C:\Temp\tolgeywqoi.sys
1⤵
- Executes dropped EXE
PID:3688

C:\Temp\vtnlgdyvtn.sys
C:\Temp\vtnlgdyvtn.sys
1⤵
- Executes dropped EXE
PID:2404

C:\Temp\yvqoigdywq.sys
C:\Temp\yvqoigdywq.sys
1⤵
- Executes dropped EXE
PID:6104

C:\Temp\sqkicayvqn.sys
C:\Temp\sqkicayvqn.sys
1⤵
- Executes dropped EXE
PID:5324

C:\Temp\vpnkfcausq.sys
C:\Temp\vpnkfcausq.sys
1⤵
- Executes dropped EXE
PID:5468

C:\Temp\ausmkecwus.sys
C:\Temp\ausmkecwus.sys
1⤵
- Executes dropped EXE
PID:3864

C:\Temp\ausmkecxup.sys
C:\Temp\ausmkecxup.sys
1⤵
- Executes dropped EXE
PID:5812

C:\Temp\urmjecwuom.sys
C:\Temp\urmjecwuom.sys
1⤵
- Executes dropped EXE
PID:2744

C:\Temp\ztrljdbwto.sys
C:\Temp\ztrljdbwto.sys
1⤵
PID:5980

C:\Temp\qolgdbvtqo.sys
C:\Temp\qolgdbvtqo.sys
1⤵
PID:2524

C:\Temp\gaytqlidbv.sys
C:\Temp\gaytqlidbv.sys
1⤵
PID:4868

C:\Temp\fdxvtnlfdb.sys
C:\Temp\fdxvtnlfdb.sys
1⤵
PID:2940

C:\Temp\nifaxvpnki.sys
C:\Temp\nifaxvpnki.sys
1⤵
PID:2540

C:\Temp\dxvpnifaxs.sys
C:\Temp\dxvpnifaxs.sys
1⤵
PID:5628

C:\Temp\zxvpmkecxu.sys
C:\Temp\zxvpmkecxu.sys
1⤵
PID:4860

C:\Temp\xrpjhczurm.sys
C:\Temp\xrpjhczurm.sys
1⤵
PID:3360

C:\Temp\rpjhbztrpj.sys
C:\Temp\rpjhbztrpj.sys
1⤵
PID:1736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwupmhfzxr.sys

Path C:\Temp\cwupmhfzxr.sys
Size 141KB
SHA256 61117f0ab96233dc1fd8ed0601aa66c7acbb4f78e922821f1bee1d79333cbaab
MD5 c55584c3c997c29acc85094d0a0d5af7
SHA1 5cffccfc6d6ddff53c3da4917f58750cd188446d
SHA512 0f44e529d749d596c41c03955b1b65b5b04f5273972c77393fa17d817754c12a1c49661ebd3bfcf04ad789dbb3c4a7f0e8bda295b5579f5e442c09ade72104a6
SSDEEP 1536:oa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:oa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T12EE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lfdxvtnlfa.exe

Path C:\Temp\i_lfdxvtnlfa.exe
Size 243KB
SHA256 21f76d3d0bec20e3de4aa5e6d5eeedf41601509f09c079b73301b30920895775
MD5 57463b6e328d371d08bb1b608e1c862b
SHA1 1e4c5947a58bb4b72b1205d765238dbd7947bc06
SHA512 6f02dbb634718e4fd6e53c0e6faa58f31bb5cff6a703e32b19d650cde09ac0edd533d3e3d8acf17dc7cc274fef6ab441ec2f53e18b74c566b976f3eb1107d417
SSDEEP 3072:TMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7F:nGii9IL8Xa3lLNngoqRttA7F
TLSH
T12F34490272818031E71A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mjhcwupmhc.exe

Path C:\Temp\i_mjhcwupmhc.exe
Size 243KB
SHA256 6ed55d4fa785edec4c5678c8d3faa838964463d24d2fe6c74c6af883fc7c79cb
MD5 b0b22f48a9e035008d5fd735d7766791
SHA1 d4b1c69d8d637dab3dac459e3afe9afb1306ff59
SHA512 fb48528fd48e319070bdde4024ac7034c69e3a20777cd2613d5aab0dc8d86fa78dd36845fb6abb85ef3149082dfcce2ffef9865534e4ed9d58c42332057564ed
SSDEEP 3072:oMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA72:iGii9IL8Xa3lLNngoqRttA72
TLSH
T15C34490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qolgdyvtqo.exe

Path C:\Temp\i_qolgdyvtqo.exe
Size 243KB
SHA256 34b5dc9926fc4c3e78c35b50b120663d109ec58eaf20a22a9a926e6d5d50821b
MD5 50bc8d75a8f19736a3069491dfb94e20
SHA1 787282f236ac78c9d31834f18d73af8e56641fe7
SHA512 370b81e659a9a4c4d033ec8bfac9042fb0ca175ac009fbfd19344865dcdf2201ad4edb57d9917e923d310633893ca509b42be163371b954a11a5b4d6b080b408
SSDEEP 3072:ZMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA77:dGii9IL8Xa3lLNngoqRttA77
TLSH
T17034490272818031E71A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_romgezwroj.exe

Path C:\Temp\i_romgezwroj.exe
Size 243KB
SHA256 53d77c1e846eb171186961341a1c6e2a778bc14157bb38ab782b775a2b7fe207
MD5 7e24cdd0c7601443f8296d8ec6d39b14
SHA1 846967f72622becfcb848f7b08119ffca8250e29
SHA512 9ac6eeb0efdea346926cf7c017cec2c8d3c74b34945d06a210c81bf481769f8fc5e9125677a75b421f5e4a00e8a24961e933f64d6f28f5f2eb823110f04061c2
SSDEEP 3072:PMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7d:LGii9IL8Xa3lLNngoqRttA7d
TLSH
T1F234490272818031E75A0B74046AE7A046BE7D344FB5E58FF7A83B795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpmhezwuom.exe

Path C:\Temp\i_rpmhezwuom.exe
Size 243KB
SHA256 d760c6e8d55d19bbb8e7964b0cde22ec9434b7001d05e9c4c65ec3daca50a6ef
MD5 2c812f753984e15d0dc255fad83e2146
SHA1 6a78c6310aec334314480ed6ac46beba898377d6
SHA512 3ab9b674d512198a545cc50dff564efb1418fd2d6475e96e394d61e8761bd1e7b944422acfdca5692ab25c6b9727aa5a23a572c9f56aa7b4d661959111f28ae4
SSDEEP 3072:4MaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7C:SGii9IL8Xa3lLNngoqRttA7C
TLSH
T1E534490272818031E75A0B78046AE7A046BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wqojgbztrl.exe

Path C:\Temp\i_wqojgbztrl.exe
Size 243KB
SHA256 021124f69a52bfe5fa0d325405eb38cea960500b454fd8a596080144965d539a
MD5 c0950cba12f111425ee10e2227177bd7
SHA1 3c6b9087547978f9aa2cc4b67a15f28b56cbe11a
SHA512 623294e349f6127d01a7495f0a7f3415c4acbb4e01bc574d0b110cf8f08247c599e507a17c22b8306365332424d352b6570f1b7ae54beac5aecdf244595fa5d0
SSDEEP 3072:wMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7S:6Gii9IL8Xa3lLNngoqRttA7S
TLSH
T14834490272818031E71A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdxvtnlfa.exe

Path C:\Temp\lfdxvtnlfa.exe
Size 243KB
SHA256 3e3230e4ffc956e9b1605af06a99c2ca0d1a9cab0a885a4f2b8cd012641aac4c
MD5 d2fe855af91c7091fce8beaff399804e
SHA1 a8c7d0251f16dfcaa8e7e4fe6ee5bbe2463849cd
SHA512 e2cf8f5c7610c9f4bf73a4f73436d20e21f93aa39fb7818b6a3d5cc473b4c8cbe685545306de8b3f59cfb7abc307a458568168c5b4a51060653e56abd0a4d6f7
SSDEEP 3072:eMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7I:4Gii9IL8Xa3lLNngoqRttA7I
TLSH
T1B934490272818031E71A0B74046AE7A046BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjhcwupmhc.exe

Path C:\Temp\mjhcwupmhc.exe
Size 243KB
SHA256 0a226b64f67b5d79ac3f5e8cd5ebca392b7ca5442f44ab94f4ed259cd5a8ccb2
MD5 75cfe00c23ef7b740fc3a8fd951d3403
SHA1 a2e0d90ce68969f8167b1ff18328c30822d6f8b0
SHA512 bad64db0b6cb8e08c2613da64ea213c1cac9c742dd00d63b2b62f011b45a030569e4fba60e526e70778aad4818a81ce29df9b325f4bca548b02ac612efc226a0
SSDEEP 3072:0MaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7e:WGii9IL8Xa3lLNngoqRttA7e
TLSH
T10334490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qolgdyvtqo.exe

Path C:\Temp\qolgdyvtqo.exe
Size 243KB
SHA256 964ec240b1498cb69a867f5d4ad4d21d0dd91518b328ed3860036a73c9ffdda2
MD5 eed7ea1b5f0283ef16b0c6a02fab1d52
SHA1 af9fd8680af2498b7fa85bed297d332851100b73
SHA512 614221b157ee62ee6eb9ab198ee0d33f94f2977e0186b734f779a9890d6a2a9937b3cebfc2385e43e4be6908f53599980b7704f0567460fdef701a7f5ed2712b
SSDEEP 3072:0MaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7K:WGii9IL8Xa3lLNngoqRttA7K
TLSH
T12734490272818031E71A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

romgezwroj.exe

Path C:\Temp\romgezwroj.exe
Size 243KB
SHA256 f028950d185d77c24a47651e1426d00f4fab5e041f53f75dfdfd062263edc2b1
MD5 68d47293c4b62118d4621b45b418e306
SHA1 f192bb93ae9c8db33706d7c0b56f4786fd570047
SHA512 5c8a452205d1e511141d4b15973fbabc9a5aa664f9a2c4038a383bf515b18e6d3cb06abe3e78078c5464c597364f732f5cf169664a2766ac50f078594d24013e
SSDEEP 3072:cMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7O:OGii9IL8Xa3lLNngoqRttA7O
TLSH
T10B34490272818031E71A0B74046AE7A046BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpmhezwuom.exe

Path C:\Temp\rpmhezwuom.exe
Size 243KB
SHA256 890a7cc9c5a51b3a258d1d7899e2d1ea2bb672a9e26d68415ba0ec91cff7587b
MD5 67970d05ca4f5a7040030168a3521225
SHA1 4208627208629f828790cae334993ef7e09414c5
SHA512 10cb7dd043d81dabc43fd57287b44f273f24a51e18e9adab494637eec2138cab6eb8ce4c99cb2edf353396e3790968390f8887757bd820c07e8552e9c82d0e0a
SSDEEP 3072:nMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7J:zGii9IL8Xa3lLNngoqRttA7J
TLSH
T1DF34490272818031E75A0B74046AE7A046BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tolgeywqoi.sys

Path C:\Temp\tolgeywqoi.sys
Size 141KB
SHA256 2ffe17b8a4e1825639df07370e956d062702c55445af40f3a1b258f4b37e7faa
MD5 15a364f1de3826dc89cc3b28a962f7db
SHA1 14824fa481bf33b9f81c6b1795b6de8681509d12
SHA512 d5ce9203efd325760bb5da40c9d113458aa0d037d02bcdb01d861307fd48fa9ad19e21989c2da1c3895f64eb5a8f16df89c960900f339e5d9ae8e4c69b3c95f7
SSDEEP 1536:Qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T131E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urpjgezwrp.sys

Path C:\Temp\urpjgezwrp.sys
Size 141KB
SHA256 93197728251814a824a6f71d26a827899aa092db22795118475caad5593eb300
MD5 8ae55497281580401c9e05f5e29f7480
SHA1 d9fc56d86ac0bfa61ba0f49e790d378c6950e105
SHA512 209e2bba9c3151a0343bc0395cff39b7c426e58e6f01750e842e423c8f4f0b13a0f2cb05620ab134b6c6f3f1ca5617dc73d9bb9c1bb39aa1561cf719da1381e7
SSDEEP 1536:da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T160E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlgdyvtn.sys

Path C:\Temp\vtnlgdyvtn.sys
Size 141KB
SHA256 728d5eb199daec7daef7f72b8aaa9dfab1de42877f1e80d26fe2ae42045e4451
MD5 d2a42bd57018c300db3a2718babdeddc
SHA1 c7d7f4e188b550f78fa9538ad45a3d2a3ccae12e
SHA512 122f1be61185b5a64efea8751458877982242b84de974bd0a6745000ac9785f0ee022931204015f57302d197df1261ca5baecb89163036ec38d68afafd6644a3
SSDEEP 1536:xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T186E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqojgbztrl.exe

Path C:\Temp\wqojgbztrl.exe
Size 243KB
SHA256 0c0e9aed9c8e8a67602fd43ca58fade1066c3cacc7d8e8ea51d62c7ae193c5a1
MD5 61fd73b9f1f893dc1d7beab39582ca11
SHA1 607bbe4583c64b2895773660f685a18c04c473e5
SHA512 a70efeaf40c6fb8ef0afc09ca1dbc565a915611940add366fe627ec67541ecbd1c66579563338655f2dfd70d22fb4b8eb44e03b53c68b30e458aded8f2d9f076
SSDEEP 3072:WMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:gGii9IL8Xa3lLNngoqRttA7A
TLSH
T1A434490272818031E71A0B74046AE7A046BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqoigdywq.sys

Path C:\Temp\yvqoigdywq.sys
Size 141KB
SHA256 ddc7012214e73d1661809c0a3294383c6107f4dde1ad0ef0f74e49ae07da728a
MD5 ae88d78916e505d5a0c1b109d153e4e3
SHA1 56db42b921e73d5955b2956104bee0bde5b19e27
SHA512 3c80eb1679f1e533747be8c176a1fb6bb2fbf670dad8bd60654130366e9f77153b3fdc6c3df1e13fd96ca22bb3262e69f729b05577ddb100f3fa749cede36262
SSDEEP 1536:Ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T14FE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 674d24008448b140a9b320032b4ed333cf5a592b073bf375c453c816d33c703b
MD5 b989ec4e221bd567659492bc1ad7ab3b
SHA1 372670805b3060960e77e6ba32a3b9edd0241cf0
SHA512 f6934e6a831bcac97110107a79389dae0e669b743e0d62e5b411c19471bf237f4d61c7cee27d9fcacbd7045cbe27e78b4e6c38f6e76ca789a7760295558b0bb3
TLSH
T1CBD0C0383E28F508C5402076E4504310E3238131742B8242B010F02DEC581810BDF0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e1a5fea1006889b9c3bcf0a470a6a4256d5300a4b7036038ddce5fd042c424c
MD5 e9af81b8f1175d007e2c699939cb3df6
SHA1 696178bffe86e4e363a26747d6a5cb80e28621ce
SHA512 38174d529846c50b0af9a056e65ca491645c3cbf1fb867ef22a3b7c7ee4287ba29c3a28d736bc2e9c562faa24bb671db3b9cc40507a467140e47eaa4aeae6d51
TLSH
T145D0C0343E38F408C540207AE4514310E3138131302B8242B010F03DEC581810BDE0CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2ddca577b1305c13dfd5c4b784c34d1cbdb46c48fc735647e96c863f4bd36c26
MD5 9d30fb9c17fc58c95bfb400ca6c5d97d
SHA1 278b3e5ee5a4fe5a90da7bfcb77d33605b18b88c
SHA512 8f2e3aee378b0e71ea18e0b8d36130268aa8c824ec1a094e0ad04ac561be4b06b32fde41b7439c74995369ebb514f424a9d4060b111e656f952c7437a8fbd383
TLSH
T1CA71900B46520923C3E115F6C1EA68C537BCF8923E232E1E9C88A3FF5B6774D6042836
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596008.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596008.TMP
Size 3KB
SHA256 4506404e0eca70d3ae169dca040d11074bfcd0c76a3de884960ce933e661c68e
MD5 2f054254616015724d519bb651eb07f7
SHA1 72e25780e0455e1017f9b96f9fcfe587871032e4
SHA512 d2e80cf6a61093e0f7b35a63a841e6212ffa9bde52591e505c914fdbd44a662fbde19f5a7cbfda69ce5c237744eb9ae3f8280ee4ec0cd202f02eaaab74155580
TLSH
T1F471800B46520923C3E115F6C5EA68C537BCF8923E236E1E8C88A3FF576774C6082936
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 844f9e4500c3a72d3926b6907e7ef4e75a4a31aa6b0899f46165a5a1f95540af
MD5 20a918ec2e56cde3cc4126d33e6527a0
SHA1 078b9b74bc78a20be5dc882f0b79134575c4039a
SHA512 4599a851bfa8bf5b36a15986aad14bb319cbba3d97bb3b76674fd4744043353edca11e98ac2a734ecdb731a7dda9ac0c7c4a372efa1a1ce500173868f5fad31e
TLSH
T1E541A1F7C3E4866E890156F0BB186E2BCE1D0915831C7D5AC5E4AF1B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 60e3598a468ffdeabb5d31bf2c9b9b2aac090e10c53754d27193a588b6ed3ebe
MD5 23be86b9558b88ad33c03a643a41c405
SHA1 e9c3a5ed36222ce3a89f17c1903c0c58c64b982d
SHA512 e6793ea8a3da200dd56db4c1a041742bd05f831fa0367589945cbb5756e22020cd99c0e57725a126bd0ae2d84f1aa17b2369492ea1a46769cdc18f82f478210c
SSDEEP 192:sxRGR3yM/jK1Ml8wcU/f4eMsPEnvjZNpTbdzoA8p9p/g6+WNCrU/Y+yuFnGmIgDp:sxRGJCU/f4eMsPEvNNpMj/57/RFXd
TLSH
T15862EA166A34597B8CDBD209FA957F53D2F91473E2901E48AAFCCA1C01E76ED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 155a3a7d9474ef3a1248fc5a3fe10d1366f7c8cfef20200e9f5c5f28250da093
MD5 d47416ba1d071f84c4ade73c320f79dd
SHA1 884bcb0acbfe88b3f875dd5ca430096b8d4259b2
SHA512 c0834d971c4fac837a2497490a4ca383c6b0ce4bbd8d804ac1dc5039b118f87e594485b3cb194bef5d1fec508877220b9b6976c3f2fee33ba058d21e9b3a973c
SSDEEP 192:sxRGR3yM/jK1Ml8UQwcU/f4eMsPEndjZNpTbdzoA8prp/g6+WNCrU/Y+VuFnGmIA:sxRGJqPU/f4eMsPEdNNpMN/57/+FXL
TLSH
T1D862D916AA34597B8CDBD20DFA917F53D2F91472D2911E48AAFCCA1C01E76ED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 31c6f2fa55520c139e13730572912c637b02c947a29a94c5aa3c1e3f617d14d1
MD5 50f4ea07faa4ea4d5c86079f6ce83227
SHA1 c1cc6d422845939e226d19b01d2336b2d56f7ea4
SHA512 9cb9bc322e28cbbd2ba7cef0dba95a58896ea17ee4f76f38d638f3f9bf99901d91a6cc06b0ffd020c6d39e8c9831cb1c480aa60569d05449497b04023aa9f8fe
SSDEEP 192:sxRBR3yM/jK1Ml8wcU/f4eMspEnvjZNpTbdzoA8p9p/g6+WNCrU/Y+yuFnGmIgtJ:sxRBJCU/f4eMspEvNNpMj/57/RFX3
TLSH
T10362E9166A34597B8CDBD209FA557F53D2F91473E2901E48AAFCCA2C01E76ED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 c3e9dd4e540d135c9dfa65ddb02a9f1bcbdd2e496e80f384e04977671f4289a4
MD5 6478c35635384d1ed0f06ea6d2fef91a
SHA1 364ffc45423d9f89d2f1d7fc7b4c6004f395a856
SHA512 f879746dbffc8552b9efb3924b14fc09f59247b43cdd70dabcd70926e7ca962b05596f60dd4b7b2c3679963f62687b1929c0705c7c9a03c32a4f0c2e8156b490
SSDEEP 768:7dUhBR7pLuL7tgWgEyf3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEcGe0GmroddL1:7dUhBHE7tgWgEyf3wu1jafcGRGddR1
TLSH
T16AE2FB3B680CCB7F4F404ADCE8297E9AADA801CF9698CD5447EA841C03C6AEF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 94d1a6f5ff72faf86a3cd3e98df42842aff058dade83469dde85f15b404dccfe
MD5 83e5c2854b2924de551e8c9500a4b9f3
SHA1 bb0a92ec069acaac763c11622fae0a582fcee3a1
SHA512 a45edb8acbbbdbb7eeb31d51f57829d96899d2a99e5c1a93aca16fb85681306cbb08e2803cc2e639c2781bf98a05174ecd0eba244412752ad8735d8ae242f2fd
SSDEEP 96:KYVWKmsK6qoKfKpI5MYKWaAW+jTgAAK4VgiAcQATCoNH4Jco6GKQz:8t34I5MYKWaH+jMA0VgifQATCoNH4JcU
TLSH
T1FA918418767B2700383E385EA274991BD283706731AAF42B776860D51FE7E029EFD5C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59fc0a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59fc0a.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 b640bc260fa4bc5bc2c4c6f0c6651130de6b9b6fdbd931d485960bcb4041c66c
MD5 2f76f5ffbf783de3b9cb65c0cdb6d71e
SHA1 18456f9bf115e373186a7cf0a283698d0284dc22
SHA512 db4ef0fb99d1ec489b4248666643f321e71a83e48cf578eda00b1d616773beedf74187d221244049a516ef4fe4d6bef8b7007ace8b76b796a917fbdaca7acc8b
SSDEEP 768:MF1j+9m33wg4aKCtiMcvnWgWWR+2SrXH78tRMib9MT:h9m3m3JPWg1bSroDb+T
TLSH
T1961327F198D38976D8AE8783A33D6E46AEBCC093B5885984F7C44D0DCD875BFC606814
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3f749cd0a6a1b5363fea917bae6c0aafcf0d480b84ca17cb1c28eae8379a9b42
MD5 3453755027108a026f55caed8746b469
SHA1 29d800dd3979aad04aad7c1c62d7bf4024580abd
SHA512 f212cbebc9f673f6af517828bb90ab7dfcdc5442fb17a6457be82070c9c6f1f5ff93e1ec989fa576bf13c6c5c7fbaaddfcf05c648d3e066094b5edea9aa6cdc9
SSDEEP 768:Orv+4UNbdp3hO5JMcvnWgWWR+2SrXH78tRk0+8rr6F:Obsb/3yJPWg1bSrohDr6
TLSH
T15F03BF32A8688D73DCF2D684720A72037FF44193D6C91B88C4D91B4E429F9DE270BCA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 feae073040fb540e9cf9f860bbf2df465e1f89e706901f126bf9545f70e06288
MD5 86ea6367a70c75e536e0c1c107e13cec
SHA1 bf302dcd50e2dc118721b11c1ef650ffc343a974
SHA512 0dd329c47deb6de7a765446f105815b2640aef3178c1111bc065ac36c3a5dc1fcc68f181aa6051af5605d395cb07c28261072ea568f1a2401cf73cca9d37fef6
SSDEEP 768:drv+4UNbdr37XI5+t0McvnWgWWR+2SrXH78tRMib9Mw:dbsbR37aJPWg1bSroDb+w
TLSH
T1D713BF31A8689D738CF2D255B15AB793BEF410D3C9C90F88D4D55B4E464B8DE2B0BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2d360b699a8f2cc5162ffcc42848ff6c934039595922abedaa612bda02b42767
MD5 3789ba9f312f66c7ea3af9022ae79123
SHA1 95c673025d148488a97ba06351a0c71342a588f3
SHA512 5abb818e6f3ecf027065642ffd3cd60b58d548451a318ad8b0f2e3881b4f8d584cbb49d205d0c294e848eca0fd9aeefbaa6ccfd8e3ee9417d4cc983fcf18287f
SSDEEP 768:rj+9V3QQI5+t4McvnWgWWR+2SrXH78tRMib9MT:+9V3QbJPWg1bSroDb+T
TLSH
T10EF2BE31AC558D738CE2D694B2167797BEF011E3C9CD1F88D4D99B0E068BA9D1F0782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a0011f06f3a79eeb0b7c94c281b7253c5ce07481e63f8291899393270b1c55f6
MD5 a984d37f57add2ecb31ebbac91ace1b0
SHA1 09fc5e8647d8eb9a273cf70834552a5960d0e610
SHA512 e04f6811976e0f05033df5c435fbad614829bc40bf48b156e1afe3c27bc8a0b5e746e0c894eb84e9df09b3cafbf0537cdc6e765e6730ec562413a68d96a8b82e
SSDEEP 768:uj+9V37QI5+t4McvnWgWWR+2SrXH78tRMib9MT:N9V37bJPWg1bSroDb+T
TLSH
T1EAF2BE31AC558D738CE2C695B2167797BEF011E3C9CD1F88D4D99B0E068BA9D1F0782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

43c8cd72-98e9-49a2-8bc6-dec41c8b901a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\43c8cd72-98e9-49a2-8bc6-dec41c8b901a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2880_173733200\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1660-235-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1736-500-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2404-275-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2524-395-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2540-452-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2540-438-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2744-370-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2940-434-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3360-502-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3360-483-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3688-263-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3864-328-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4860-471-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4868-414-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5324-318-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5468-322-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5628-449-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5760-188-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5812-341-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5980-382-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6104-291-0x0000000000010000-0x0000000000083000-memory.dmp

Download