e183b0d40e19d29e16696e7ee47e4ec70e51f9b13a9cea106ce0c9b1a0f53b1f

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 01:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_b39de48020e1b6e21bf5daa52102fce5_elex_rhadamanthys_stop.exe
Size 243KB
Sample260707-bvtp4act5j
SHA256 e183b0d40e19d29e16696e7ee47e4ec70e51f9b13a9cea106ce0c9b1a0f53b1f
MD5 b39de48020e1b6e21bf5daa52102fce5
SHA1 aac253c038655fcc2c92c9665723db1f69ac2350
SHA512 67b02146154ba7cee0de86c9ce2360d352bfcf016d0a055f02b3c7c3f7a619beef5ec49710ede0e04407f2aaaa5155575bd778abb0354d67e02e353e4d136009
SSDEEP 3072:QMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7y:aGii9IL8Xa3lLNngoqRttA7y
TLSH
T13034490272818031E75A0B78046AE7A046BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
6080	CP.exe
5956	mkecwrmkez.exe
4144	CP.exe
4948	CP.exe
5288	i_mkecwrmkez.exe
5992	hbzurljebw.sys
2800	CP.exe
1588	trljhbwtrm.exe
5936	CP.exe
4612	CP.exe
5580	i_trljhbwtrm.exe
5716	dbztoljdyw.sys
2600	CP.exe
944	tomgeywroj.exe
5204	CP.exe
4152	CP.exe
1128	i_tomgeywroj.exe
1000	geywqojgbz.sys
1628	CP.exe
3976	nlgdbvqoid.exe
3908	CP.exe
6072	CP.exe
3748	i_nlgdbvqoid.exe
1064	dbvtolgays.sys
4420	CP.exe
2808	tqlidbvtnl.exe
2632	CP.exe
3404	CP.exe
6004	i_tqlidbvtnl.exe
3384	ayvqkigays.sys
5580	CP.exe
5716	qnlfdxvqni.exe
5308	CP.exe
5832	CP.exe
5208	i_qnlfdxvqni.exe
4548	dxvpnhfzxs.sys
1144	CP.exe
3380	vsnhfzxvpk.exe
3348	CP.exe
4804	CP.exe
2652	i_vsnhfzxvpk.exe
3756	spfaxspkhc.sys
6044	CP.exe
1344	zxrpjhczus.exe
3740	CP.exe
1812	CP.exe
4692	i_zxrpjhczus.exe
5176	uspkecausm.sys
2780	CP.exe
2284	bzurmjecwu.exe
1608	CP.exe
2992	CP.exe
2044	i_bzurmjecwu.exe
4864	zurmjecwuo.sys
1972	CP.exe
5824	omkecwuomh.exe
4316	CP.exe
3732	CP.exe
2068	i_omkecwuomh.exe
204	dbwtljhbzt.sys
5164	CP.exe
3480	romgeywroj.exe
2636	CP.exe
3668	CP.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3920_1502279721\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3920_1433618369\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3920_1433618369\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3920_1433618369\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3920_2076783269\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3920_1433618369\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3920_1644654968\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3920_1644654968\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3920_1644654968\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3920_1644654968\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3920_2106543806\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3920_2076783269\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3920_1502279721\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_b39de48020e1b6e21bf5daa52102fce5_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljhbwtrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_romgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqlidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omkecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omkecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrmjwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwrmkez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvpnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlgdbvqoid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnhfzxvpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzurmjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	romgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytrlgdbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkfdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davsnlfdys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tomgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnhfzxvpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrmjwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbztrmjebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbztrmjebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqlidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzurmjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytrlgdbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davsnlfdys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjeczusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljhbwtrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tomgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlgdbvqoid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwrmkez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkfdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjeczusmk.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2384	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3768	ipconfig.exe
5200	ipconfig.exe
1408	ipconfig.exe
5472	ipconfig.exe
1344	ipconfig.exe
2004	ipconfig.exe
6108	ipconfig.exe
5012	ipconfig.exe
2208	ipconfig.exe
3620	ipconfig.exe
6108	ipconfig.exe
1192	ipconfig.exe
772	ipconfig.exe
5876	ipconfig.exe
5684	ipconfig.exe
5924	ipconfig.exe
2144	ipconfig.exe
3188	ipconfig.exe
4444	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2699128254-3633964024-152949075-1000\{CB992E7F-56C2-422A-8443-18501D645AB6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1392	msedge.exe
1392	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5288	i_mkecwrmkez.exe
Token: SeDebugPrivilege	5580	i_trljhbwtrm.exe
Token: SeDebugPrivilege	1128	i_tomgeywroj.exe
Token: SeDebugPrivilege	3748	i_nlgdbvqoid.exe
Token: SeDebugPrivilege	6004	i_tqlidbvtnl.exe
Token: SeDebugPrivilege	5208	i_qnlfdxvqni.exe
Token: SeDebugPrivilege	2652	i_vsnhfzxvpk.exe
Token: SeDebugPrivilege	4692	i_zxrpjhczus.exe
Token: SeDebugPrivilege	2044	i_bzurmjecwu.exe
Token: SeDebugPrivilege	2068	i_omkecwuomh.exe
Token: SeDebugPrivilege	292	i_romgeywroj.exe
Token: SeDebugPrivilege	640	i_ytrlgdbytr.exe
Token: SeDebugPrivilege	4784	i_aysqkfdbvt.exe
Token: SeDebugPrivilege	2860	i_davsnlfdys.exe
Token: SeDebugPrivilege	1660	i_fdxvpnifay.exe
Token: SeDebugPrivilege	1300	i_nhfzxupmhf.exe
Token: SeDebugPrivilege	1524	i_rmjeczusmk.exe
Token: SeDebugPrivilege	4884	i_hbztrmjwuo.exe
Token: SeDebugPrivilege	4604	i_dbztrmjebw.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3920	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5708 wrote to memory of 5696	5708	2026-07-06_b39de48020e1b6e21bf5daa52102fce5_elex_rhadamanthys_stop.exe	87
PID 5696 wrote to memory of 3920	5696	iexplore.exe	88
PID 3920 wrote to memory of 1316	3920	msedge.exe	89
PID 3920 wrote to memory of 1988	3920	msedge.exe	90
PID 3920 wrote to memory of 2384	3920	msedge.exe	91
PID 3920 wrote to memory of 1988	3920	msedge.exe	90
PID 3920 wrote to memory of 1988	3920	msedge.exe	90
PID 3920 wrote to memory of 4000	3920	msedge.exe	93
PID 3920 wrote to memory of 4000	3920	msedge.exe	93
PID 3920 wrote to memory of 1508	3920	msedge.exe	94
PID 3920 wrote to memory of 1508	3920	msedge.exe	94
PID 3920 wrote to memory of 1508	3920	msedge.exe	94
PID 3920 wrote to memory of 2736	3920	msedge.exe	95
PID 3920 wrote to memory of 2736	3920	msedge.exe	95
PID 3920 wrote to memory of 2736	3920	msedge.exe	95
PID 3920 wrote to memory of 640	3920	msedge.exe	97
PID 3920 wrote to memory of 1968	3920	msedge.exe	96
PID 3920 wrote to memory of 640	3920	msedge.exe	97
PID 3920 wrote to memory of 640	3920	msedge.exe	97
PID 3920 wrote to memory of 1968	3920	msedge.exe	96
PID 3920 wrote to memory of 1968	3920	msedge.exe	96
PID 3920 wrote to memory of 3884	3920	msedge.exe	99
PID 3920 wrote to memory of 3884	3920	msedge.exe	99
PID 5708 wrote to memory of 6080	5708	2026-07-06_b39de48020e1b6e21bf5daa52102fce5_elex_rhadamanthys_stop.exe	100
PID 5956 wrote to memory of 4144	5956	mkecwrmkez.exe	103
PID 3920 wrote to memory of 1532	3920	msedge.exe	107
PID 3920 wrote to memory of 1532	3920	msedge.exe	107
PID 3920 wrote to memory of 3080	3920	msedge.exe	106
PID 3920 wrote to memory of 3080	3920	msedge.exe	106
PID 3920 wrote to memory of 2532	3920	msedge.exe	109
PID 3920 wrote to memory of 5848	3920	msedge.exe	110
PID 3920 wrote to memory of 5848	3920	msedge.exe	110
PID 5708 wrote to memory of 4948	5708	2026-07-06_b39de48020e1b6e21bf5daa52102fce5_elex_rhadamanthys_stop.exe	113
PID 3920 wrote to memory of 4808	3920	msedge.exe	115
PID 3920 wrote to memory of 4808	3920	msedge.exe	115
PID 5708 wrote to memory of 2800	5708	2026-07-06_b39de48020e1b6e21bf5daa52102fce5_elex_rhadamanthys_stop.exe	118
PID 1588 wrote to memory of 5936	1588	trljhbwtrm.exe	120
PID 5708 wrote to memory of 4612	5708	2026-07-06_b39de48020e1b6e21bf5daa52102fce5_elex_rhadamanthys_stop.exe	123
PID 5708 wrote to memory of 2600	5708	2026-07-06_b39de48020e1b6e21bf5daa52102fce5_elex_rhadamanthys_stop.exe	127
PID 944 wrote to memory of 5204	944	tomgeywroj.exe	129
PID 5708 wrote to memory of 4152	5708	2026-07-06_b39de48020e1b6e21bf5daa52102fce5_elex_rhadamanthys_stop.exe	132
PID 5708 wrote to memory of 1628	5708	2026-07-06_b39de48020e1b6e21bf5daa52102fce5_elex_rhadamanthys_stop.exe	136
PID 3976 wrote to memory of 3908	3976	nlgdbvqoid.exe	138
PID 5708 wrote to memory of 6072	5708	2026-07-06_b39de48020e1b6e21bf5daa52102fce5_elex_rhadamanthys_stop.exe	141
PID 3920 wrote to memory of 4964	3920	msedge.exe	143
PID 3920 wrote to memory of 3484	3920	msedge.exe	144
PID 3920 wrote to memory of 5012	3920	msedge.exe	145
PID 5708 wrote to memory of 4420	5708	2026-07-06_b39de48020e1b6e21bf5daa52102fce5_elex_rhadamanthys_stop.exe	148
PID 2808 wrote to memory of 2632	2808	tqlidbvtnl.exe	150
PID 5708 wrote to memory of 3404	5708	2026-07-06_b39de48020e1b6e21bf5daa52102fce5_elex_rhadamanthys_stop.exe	153
PID 5708 wrote to memory of 5580	5708	2026-07-06_b39de48020e1b6e21bf5daa52102fce5_elex_rhadamanthys_stop.exe	157
PID 5716 wrote to memory of 5308	5716	qnlfdxvqni.exe	159
PID 5708 wrote to memory of 5832	5708	2026-07-06_b39de48020e1b6e21bf5daa52102fce5_elex_rhadamanthys_stop.exe	162
PID 5708 wrote to memory of 1144	5708	2026-07-06_b39de48020e1b6e21bf5daa52102fce5_elex_rhadamanthys_stop.exe	166
PID 3380 wrote to memory of 3348	3380	vsnhfzxvpk.exe	168
PID 5708 wrote to memory of 4804	5708	2026-07-06_b39de48020e1b6e21bf5daa52102fce5_elex_rhadamanthys_stop.exe	171
PID 5708 wrote to memory of 6044	5708	2026-07-06_b39de48020e1b6e21bf5daa52102fce5_elex_rhadamanthys_stop.exe	175
PID 1344 wrote to memory of 3740	1344	zxrpjhczus.exe	177
PID 5708 wrote to memory of 1812	5708	2026-07-06_b39de48020e1b6e21bf5daa52102fce5_elex_rhadamanthys_stop.exe	180
PID 3920 wrote to memory of 3344	3920	msedge.exe	182
PID 3920 wrote to memory of 3344	3920	msedge.exe	182
PID 5708 wrote to memory of 2780	5708	2026-07-06_b39de48020e1b6e21bf5daa52102fce5_elex_rhadamanthys_stop.exe	188
PID 2284 wrote to memory of 1608	2284	bzurmjecwu.exe	190
PID 5708 wrote to memory of 2992	5708	2026-07-06_b39de48020e1b6e21bf5daa52102fce5_elex_rhadamanthys_stop.exe	193

C:\Users\Admin\AppData\Local\Temp\2026-07-06_b39de48020e1b6e21bf5daa52102fce5_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_b39de48020e1b6e21bf5daa52102fce5_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5708
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2cc,0x2f4,0x2f8,0x2c8,0x304,0x7ffeea31c188,0x7ffeea31c194,0x7ffeea31c1a0
      4⤵
      PID:1316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,2760149407664165339,11086251588737646152,262144 --field-trial-handle=2424,i,10318774498372665624,16064830969019425925,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:2
      4⤵
      PID:1988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,8309862319909863489,401941358508739268,524288 --field-trial-handle=2424,i,10318774498372665624,16064830969019425925,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:11
      4⤵
      System Time Discovery
      PID:2384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,15604027128888121693,10647320294994703782,524288 --field-trial-handle=2424,i,10318774498372665624,16064830969019425925,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:13
      4⤵
      PID:4000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,1205234750229999167,11627649028724329329,2097152 --field-trial-handle=2424,i,10318774498372665624,16064830969019425925,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:1508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,4866248478608846438,18412905347542452429,2097152 --field-trial-handle=2424,i,10318774498372665624,16064830969019425925,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:2736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,14337132912552126877,12009213316037806788,2097152 --field-trial-handle=2424,i,10318774498372665624,16064830969019425925,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
      4⤵
      PID:1968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,3144553453004843000,1768960819324924986,2097152 --field-trial-handle=2424,i,10318774498372665624,16064830969019425925,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:9
      4⤵
      PID:640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,10233968176895646225,16507843202312876351,524288 --field-trial-handle=2424,i,10318774498372665624,16064830969019425925,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:14
      4⤵
      PID:3884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,2058875523486883153,9846295401743992504,524288 --field-trial-handle=2424,i,10318774498372665624,16064830969019425925,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
      4⤵
      PID:3080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,9791146134819123383,16260958927704464901,524288 --field-trial-handle=2424,i,10318774498372665624,16064830969019425925,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:14
      4⤵
      PID:1532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,6792701671455106375,10539918482427631515,524288 --field-trial-handle=2424,i,10318774498372665624,16064830969019425925,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
      4⤵
      PID:4308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,6792701671455106375,10539918482427631515,524288 --field-trial-handle=2424,i,10318774498372665624,16064830969019425925,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
      4⤵
      PID:2532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,18200163728179700938,600573986557590124,524288 --field-trial-handle=2424,i,10318774498372665624,16064830969019425925,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
      4⤵
      PID:5848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,14421881287252647888,7953403499249766701,524288 --field-trial-handle=2424,i,10318774498372665624,16064830969019425925,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
      4⤵
      PID:4808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=752,i,10552512592999445131,11807956449214819108,524288 --field-trial-handle=2424,i,10318774498372665624,16064830969019425925,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
      4⤵
      PID:4964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,10696420145717140049,16590574979798406887,524288 --field-trial-handle=2424,i,10318774498372665624,16064830969019425925,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
      4⤵
      PID:3484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,3683475385919542570,4063712547384049209,524288 --field-trial-handle=2424,i,10318774498372665624,16064830969019425925,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14
      4⤵
      PID:5012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,1615962939074310658,6036180908191612537,524288 --field-trial-handle=2424,i,10318774498372665624,16064830969019425925,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
      4⤵
      PID:3344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,15942939440306241152,16598793659496009982,524288 --field-trial-handle=2424,i,10318774498372665624,16064830969019425925,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
      4⤵
      PID:3728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,614161601902009456,16594683184678422752,524288 --field-trial-handle=2424,i,10318774498372665624,16064830969019425925,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:14
      4⤵
      PID:3060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2768,i,13315243686931692520,1971110607178174801,524288 --field-trial-handle=2424,i,10318774498372665624,16064830969019425925,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
      4⤵
      PID:3536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6728,i,8554586019940576785,18289769510529296426,262144 --field-trial-handle=2424,i,10318774498372665624,16064830969019425925,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,1525324074930816285,13549006477582770371,524288 --field-trial-handle=2424,i,10318774498372665624,16064830969019425925,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
      4⤵
      PID:2512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6748,i,8836300368576052327,1209350863492155268,2097152 --field-trial-handle=2424,i,10318774498372665624,16064830969019425925,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
      4⤵
      PID:3536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=3668,i,16988956817036123476,6937237995699557932,2097152 --field-trial-handle=2424,i,10318774498372665624,16064830969019425925,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:4784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=3604,i,14030244091453597517,14421147072070909277,2097152 --field-trial-handle=2424,i,10318774498372665624,16064830969019425925,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:1
      4⤵
      PID:3428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=3664,i,11624454095210853475,14669152762441652851,2097152 --field-trial-handle=2424,i,10318774498372665624,16064830969019425925,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:1128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6748,i,6602613272029964862,9163355609427342971,2097152 --field-trial-handle=2424,i,10318774498372665624,16064830969019425925,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:1
      4⤵
      PID:3524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,6990102383002452487,10025098319856109508,524288 --field-trial-handle=2424,i,10318774498372665624,16064830969019425925,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
      4⤵
      PID:5848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkecwrmkez.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6080
- - C:\Temp\mkecwrmkez.exe
    C:\Temp\mkecwrmkez.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4144
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkecwrmkez.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4948
- - C:\Temp\i_mkecwrmkez.exe
    C:\Temp\i_mkecwrmkez.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljhbwtrm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2800
- - C:\Temp\trljhbwtrm.exe
    C:\Temp\trljhbwtrm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1588
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5936
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljhbwtrm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4612
- - C:\Temp\i_trljhbwtrm.exe
    C:\Temp\i_trljhbwtrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tomgeywroj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2600
- - C:\Temp\tomgeywroj.exe
    C:\Temp\tomgeywroj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:944
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5204
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tomgeywroj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4152
- - C:\Temp\i_tomgeywroj.exe
    C:\Temp\i_tomgeywroj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlgdbvqoid.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1628
- - C:\Temp\nlgdbvqoid.exe
    C:\Temp\nlgdbvqoid.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3976
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3908
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlgdbvqoid.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6072
- - C:\Temp\i_nlgdbvqoid.exe
    C:\Temp\i_nlgdbvqoid.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tqlidbvtnl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4420
- - C:\Temp\tqlidbvtnl.exe
    C:\Temp\tqlidbvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2632
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tqlidbvtnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3404
- - C:\Temp\i_tqlidbvtnl.exe
    C:\Temp\i_tqlidbvtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnlfdxvqni.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5580
- - C:\Temp\qnlfdxvqni.exe
    C:\Temp\qnlfdxvqni.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5716
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5308
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnlfdxvqni.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5832
- - C:\Temp\i_qnlfdxvqni.exe
    C:\Temp\i_qnlfdxvqni.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5208
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsnhfzxvpk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1144
- - C:\Temp\vsnhfzxvpk.exe
    C:\Temp\vsnhfzxvpk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3380
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3348
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsnhfzxvpk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4804
- - C:\Temp\i_vsnhfzxvpk.exe
    C:\Temp\i_vsnhfzxvpk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpjhczus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6044
- - C:\Temp\zxrpjhczus.exe
    C:\Temp\zxrpjhczus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1344
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3740
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpjhczus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1812
- - C:\Temp\i_zxrpjhczus.exe
    C:\Temp\i_zxrpjhczus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bzurmjecwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2780
- - C:\Temp\bzurmjecwu.exe
    C:\Temp\bzurmjecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2284
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1608
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bzurmjecwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2992
- - C:\Temp\i_bzurmjecwu.exe
    C:\Temp\i_bzurmjecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omkecwuomh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1972
- - C:\Temp\omkecwuomh.exe
    C:\Temp\omkecwuomh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5824
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4316
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omkecwuomh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3732
- - C:\Temp\i_omkecwuomh.exe
    C:\Temp\i_omkecwuomh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\romgeywroj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5164
- - C:\Temp\romgeywroj.exe
    C:\Temp\romgeywroj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3480
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2636
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_romgeywroj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3668
- - C:\Temp\i_romgeywroj.exe
    C:\Temp\i_romgeywroj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:292
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytrlgdbytr.exe ups_run
  2⤵
  PID:4732
- - C:\Temp\ytrlgdbytr.exe
    C:\Temp\ytrlgdbytr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1452
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5476
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2144
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytrlgdbytr.exe ups_ins
  2⤵
  PID:6068
- - C:\Temp\i_ytrlgdbytr.exe
    C:\Temp\i_ytrlgdbytr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqkfdbvt.exe ups_run
  2⤵
  PID:3152
- - C:\Temp\aysqkfdbvt.exe
    C:\Temp\aysqkfdbvt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4280
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1252
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2208
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqkfdbvt.exe ups_ins
  2⤵
  PID:1000
- - C:\Temp\i_aysqkfdbvt.exe
    C:\Temp\i_aysqkfdbvt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\davsnlfdys.exe ups_run
  2⤵
  PID:2408
- - C:\Temp\davsnlfdys.exe
    C:\Temp\davsnlfdys.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5560
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1168
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_davsnlfdys.exe ups_ins
  2⤵
  PID:4680
- - C:\Temp\i_davsnlfdys.exe
    C:\Temp\i_davsnlfdys.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvpnifay.exe ups_run
  2⤵
  PID:5752
- - C:\Temp\fdxvpnifay.exe
    C:\Temp\fdxvpnifay.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2540
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2144
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvpnifay.exe ups_ins
  2⤵
  PID:1740
- - C:\Temp\i_fdxvpnifay.exe
    C:\Temp\i_fdxvpnifay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfzxupmhf.exe ups_run
  2⤵
  PID:2880
- - C:\Temp\nhfzxupmhf.exe
    C:\Temp\nhfzxupmhf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5416
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3016
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfzxupmhf.exe ups_ins
  2⤵
  PID:5084
- - C:\Temp\i_nhfzxupmhf.exe
    C:\Temp\i_nhfzxupmhf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1300
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmjeczusmk.exe ups_run
  2⤵
  PID:256
- - C:\Temp\rmjeczusmk.exe
    C:\Temp\rmjeczusmk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1156
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4320
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3620
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmjeczusmk.exe ups_ins
  2⤵
  PID:1304
- - C:\Temp\i_rmjeczusmk.exe
    C:\Temp\i_rmjeczusmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbztrmjwuo.exe ups_run
  2⤵
  PID:5884
- - C:\Temp\hbztrmjwuo.exe
    C:\Temp\hbztrmjwuo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5448
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4532
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbztrmjwuo.exe ups_ins
  2⤵
  PID:5900
- - C:\Temp\i_hbztrmjwuo.exe
    C:\Temp\i_hbztrmjwuo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbztrmjebw.exe ups_run
  2⤵
  PID:2064
- - C:\Temp\dbztrmjebw.exe
    C:\Temp\dbztrmjebw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1292
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4864
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbztrmjebw.exe ups_ins
  2⤵
  PID:5776
- - C:\Temp\i_dbztrmjebw.exe
    C:\Temp\i_dbztrmjebw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4604

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5396

C:\Temp\hbzurljebw.sys
C:\Temp\hbzurljebw.sys
1⤵
- Executes dropped EXE
PID:5992

C:\Temp\dbztoljdyw.sys
C:\Temp\dbztoljdyw.sys
1⤵
- Executes dropped EXE
PID:5716

C:\Temp\geywqojgbz.sys
C:\Temp\geywqojgbz.sys
1⤵
- Executes dropped EXE
PID:1000

C:\Temp\dbvtolgays.sys
C:\Temp\dbvtolgays.sys
1⤵
- Executes dropped EXE
PID:1064

C:\Temp\ayvqkigays.sys
C:\Temp\ayvqkigays.sys
1⤵
- Executes dropped EXE
PID:3384

C:\Temp\dxvpnhfzxs.sys
C:\Temp\dxvpnhfzxs.sys
1⤵
- Executes dropped EXE
PID:4548

C:\Temp\spfaxspkhc.sys
C:\Temp\spfaxspkhc.sys
1⤵
- Executes dropped EXE
PID:3756

C:\Temp\uspkecausm.sys
C:\Temp\uspkecausm.sys
1⤵
- Executes dropped EXE
PID:5176

C:\Temp\zurmjecwuo.sys
C:\Temp\zurmjecwuo.sys
1⤵
- Executes dropped EXE
PID:4864

C:\Temp\dbwtljhbzt.sys
C:\Temp\dbwtljhbzt.sys
1⤵
- Executes dropped EXE
PID:204

C:\Temp\igeywqoigb.sys
C:\Temp\igeywqoigb.sys
1⤵
PID:6060

C:\Temp\tqljdbvtni.sys
C:\Temp\tqljdbvtni.sys
1⤵
PID:4332

C:\Temp\nigdysqnig.sys
C:\Temp\nigdysqnig.sys
1⤵
PID:2516

C:\Temp\nkicausnkf.sys
C:\Temp\nkicausnkf.sys
1⤵
PID:5984

C:\Temp\xsmkicausm.sys
C:\Temp\xsmkicausm.sys
1⤵
PID:1696

C:\Temp\hfzxrpjhcz.sys
C:\Temp\hfzxrpjhcz.sys
1⤵
PID:3228

C:\Temp\mjhczurmke.sys
C:\Temp\mjhczurmke.sys
1⤵
PID:4980

C:\Temp\omgezwuojh.sys
C:\Temp\omgezwuojh.sys
1⤵
PID:1696

C:\Temp\rljgbytolj.sys
C:\Temp\rljgbytolj.sys
1⤵
PID:5960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ayvqkigays.sys

Path C:\Temp\ayvqkigays.sys
Size 141KB
SHA256 d81f644f9626d07a4872fae395db64dadce8f3bb4d0799c9aef6e0f3ff7e91fe
MD5 bdcd7b80f315d8666c8ec1c99805af7a
SHA1 8e830ae57d46b63db057a4b23ce129096040645b
SHA512 e7d83f70c650f16b8702724aed1a5c2630b5f145a785e66e4b43de3ab28f6c75225aa59f322ef956761f2674d7d600bd09baba36aa1127fb0a769289d196d716
SSDEEP 1536:Ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T14EE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtolgays.sys

Path C:\Temp\dbvtolgays.sys
Size 141KB
SHA256 71de9d0276f628c3a952dae7bcea82baeeccae2776831a0a68dc9955231d03ba
MD5 11c3bb1c18aa08f21ef98b893e1d6fc2
SHA1 9cb94a569fb0a0e4fa8fe81fdb916db9186a840a
SHA512 32b372815e716d2e5cc5bc431ee33d17aaff5009ee69973cb460205c275a101589d86b12f59e7a668be1c36369c58d10577979adc798c34b09429958867e9f75
SSDEEP 1536:5a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:5a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1BEE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbztoljdyw.sys

Path C:\Temp\dbztoljdyw.sys
Size 141KB
SHA256 8f233d67e98c9c3f03176e594e56b922ae8637433a460af6e5a30b62577a613b
MD5 594c5555af10f27df17f2d762bf4879c
SHA1 2ca7e92d8a7279c1f1e8e94d04549239adde26aa
SHA512 afcefc223df2e42c89dbb5c0f46f4bdc579ac10aed39924619a75bc800b7dda213477bf6909d138029578852a082cf6b3d52bf45c790522e73c7a5f0787e4325
SSDEEP 1536:ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1FAE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvpnhfzxs.sys

Path C:\Temp\dxvpnhfzxs.sys
Size 141KB
SHA256 513c4fc6452b353a1dabde97b0ade7e71882a8c0cfd3ce8a90686eb3bb4cd5d4
MD5 88484027d022933c42ac5f5249cd0a43
SHA1 7398ef3c47d15f6057294aec7485daebaf0b5110
SHA512 4941b0924bfccc76bb871660e2279e1f7d28c9f4abcff2a9472892c8ae8b9b32209ec1a90972f5b533636f2a3bd9889f7645bd0a77eafd9d47e0d87397976788
SSDEEP 1536:la3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:la3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T138E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywqojgbz.sys

Path C:\Temp\geywqojgbz.sys
Size 141KB
SHA256 1c6b741800778cd42c7ea01f73195a13c83359d19fcf9aecba5677e09a7c1a16
MD5 efda6b0d714f0a4af61517b67c9400ff
SHA1 82a8847a8086952914d2140135b308ed19de77c7
SHA512 dd7632b158a61e58e34a7bf409d959fa551843be7fdd750354403b208dfa945a2b14b2bb2e068705ba8dff4f90acef2e01f645c05dc376316edd5bdf7df5fc45
SSDEEP 1536:Ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T159E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbzurljebw.sys

Path C:\Temp\hbzurljebw.sys
Size 141KB
SHA256 07e56983bf09459ea68bc8be67e6973bfb9ea0b94712853eae1b9e7599929d61
MD5 a57da44a95542f0fef9fae903ca54192
SHA1 bfd4b8cf4cf34b75692fa4e7c50ff93dfbac7cc3
SHA512 95aa26145ec6e4cb068cdf345e19b0661c51ded8b1fa3b50aec86b2782fc842e348faa37a5b33410d892cc394ab1359985e1f313ecbef4a04c7b2c2f58b1a563
SSDEEP 1536:wa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:wa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C1E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkecwrmkez.exe

Path C:\Temp\i_mkecwrmkez.exe
Size 243KB
SHA256 300b68c1cab27c76652f2c14af027f693d0926610666e352118768fed78c39c9
MD5 3e36ff144c09f9696c46b1bb346cef3d
SHA1 e23b70b45303b8d61f4832fc3f30ba5b76ec88c4
SHA512 375e5b5f1b1df012d13d102a882b8196648c984cc5fe056aad26c8540413be55d1b9d4eaba1a669a76f1f7f3dab696c30c584c99c3a8485ea250f17f0429b95d
SSDEEP 3072:vMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7F:rGii9IL8Xa3lLNngoqRttA7F
TLSH
T12434490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlgdbvqoid.exe

Path C:\Temp\i_nlgdbvqoid.exe
Size 243KB
SHA256 b66b3ae0b9531f4fc683282911f144679d21f03a63ec7da708f99cbd47fddb30
MD5 ad6ed01fb617317b960214eb51809519
SHA1 0ec85c6d2d3a6841ea73b3c785f334ef0388b14e
SHA512 a1cac5fc2d7fbc0c837eaeb53848b85181df4ecba3217e3bc67209ea2b67735539ee976b5b067a99e924cbae7f6e0fe1aa01f03ebf5f7fbe68ebe242a3b1b685
SSDEEP 3072:GMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7E:wGii9IL8Xa3lLNngoqRttA7E
TLSH
T15A34490272818031E71A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qnlfdxvqni.exe

Path C:\Temp\i_qnlfdxvqni.exe
Size 243KB
SHA256 7ac62bf0b6f4ab5d0a142eb8671804c12b0f280bdd9d932bed7ad4277380fe64
MD5 19a8418d3c78eda0b310e67bb94f6231
SHA1 0a9d176109ecf9886700774015e6fc6dd96d71ca
SHA512 549fa4012bb047a68fa897583370353d247c0ada002edd7c1a2261fd60489433806ee1bb7d06f03d631ebfe2de0ea1fb7f1edb3ab20039bdd31c393de577c01e
SSDEEP 3072:NMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7z:JGii9IL8Xa3lLNngoqRttA7z
TLSH
T10A34490272818031E75A0B78046AE7A046BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tomgeywroj.exe

Path C:\Temp\i_tomgeywroj.exe
Size 243KB
SHA256 c6254e49f144a0b2a56fb938c13a3e0af89c0469d6a218404830da81ac51609e
MD5 604fd188ac2c2455e545afaebf7e1971
SHA1 0c9bfe8ca6d7d05601e96e909c08f2b236be7b8d
SHA512 c68d2912856d178f37ebcb7d4ad1d843afe2186106fc9dcea610d1705f069bf3e04b282f31e2b522e316d1002da5221a008f575b7142ca97d369c80806d95fa2
SSDEEP 3072:LMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Z:vGii9IL8Xa3lLNngoqRttA7Z
TLSH
T1C334490272818031E71A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tqlidbvtnl.exe

Path C:\Temp\i_tqlidbvtnl.exe
Size 243KB
SHA256 695fbed559a4462a78d8c62d5bd3b5d621a6c342f93c17bca5bfb737788f33a5
MD5 425f91294f6ea59facb4955fdd6404dc
SHA1 74e9a86fde326c4e3822cb4cc6e89cb0c612ef19
SHA512 5b2e4c157622997ddc722f174f186add2b51ff5b1e3b40b676f5ddeecdb9974230f16a66acbacf78872a7631c23c4d80a3795bc24c37419ab4e484f2ccc7ea35
SSDEEP 3072:QMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA76:aGii9IL8Xa3lLNngoqRttA76
TLSH
T1BF34490272818031E75A0B78046AE7A046BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trljhbwtrm.exe

Path C:\Temp\i_trljhbwtrm.exe
Size 243KB
SHA256 f64c542298a41c407615d4c7313aa53f1351e4c4e441453d830ec007fbc79d62
MD5 d572d7ca41cc413abe0a136f10aad60a
SHA1 8f02fff50372db110afee12412c8065876126295
SHA512 93e671e027f8042f936c025a8bf4a0b48faf1cca0b3d47cd1df79da3be6b95b9124c87b4232f29a4e376264528f5a42d726a72e57bdc3c1846b3f6d048e030f1
SSDEEP 3072:xMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7P:FGii9IL8Xa3lLNngoqRttA7P
TLSH
T1E434490272818031E75A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkecwrmkez.exe

Path C:\Temp\mkecwrmkez.exe
Size 243KB
SHA256 fc23dce91632a74fc4dcb869763c3095f96bd64c37812972d902e1278c210be8
MD5 f10db5dc060d2cefae48502e7f88acde
SHA1 6f2379361e60afbeed4193cedbb910c063aea679
SHA512 a2f90d1d52de2459a5aaeb6f5e7496f640ce209d57db51d41e650cf45cacaf5a036b1b08bc3d143faab8300854857c6f2b14b8ed5252dfefa4b4033aa6877788
SSDEEP 3072:PMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7l:LGii9IL8Xa3lLNngoqRttA7l
TLSH
T15D34490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlgdbvqoid.exe

Path C:\Temp\nlgdbvqoid.exe
Size 243KB
SHA256 4f0a0b2994c307e1fe29bf73542bd2b1e0d93a41e47fe9ae765a25edd5d7014a
MD5 f5e802e5c9b5b2782ffdd5c1aea6897a
SHA1 51e307142a273af590438fc966e7d20ea12fb1a6
SHA512 417071cf30854023ae32ddc252c19ccdd01977b03bbfc2fc93f54c44f3c792b63ecbe7ba8e2b617cb170213ec293222fe3551e9c347e76b2a3573afe54679126
SSDEEP 3072:cMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7+:OGii9IL8Xa3lLNngoqRttA7+
TLSH
T11D34490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnlfdxvqni.exe

Path C:\Temp\qnlfdxvqni.exe
Size 243KB
SHA256 0e57c39f7fb687b47c70e04fd3c13e149f232d90b66e9570e7ad34153167b789
MD5 5938979dc0f153b8863b2223c8a6580d
SHA1 bbb984b0727fa0991717f69ed41d080b1b841f4e
SHA512 6528747fc6e56b86c71fc425e04b529e4d04efb62318f76f441133b25e923b2d0ed9e71a4a465442e8c404beb666c738b1844349301e66ebad9bec7af873ce31
SSDEEP 3072:vMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Z:rGii9IL8Xa3lLNngoqRttA7Z
TLSH
T13934490272818031E71A0B78046AE7A046BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tomgeywroj.exe

Path C:\Temp\tomgeywroj.exe
Size 243KB
SHA256 634d650aad2dcc259e7ac206223c61669eeb6582a5383fbf2f568c2d0239e55f
MD5 b6c64980398557f7502eae1928345ea7
SHA1 27475421460d02647d8de34e895a967ebb994f14
SHA512 7ecda0889ef4ab89c0f7dafffa3cc0c6d08f641a37bbbb2475dfab0f6f6949523de8943ad18d7ea0bfcfea9ce6c79c0d2c18671ab1a0a4d277d8f474ee288a89
SSDEEP 3072:PMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7J:LGii9IL8Xa3lLNngoqRttA7J
TLSH
T1EB34490272818031E75A0B78046AE7A046BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqlidbvtnl.exe

Path C:\Temp\tqlidbvtnl.exe
Size 243KB
SHA256 27ad29f3bdb32244ab88d315eb5f1454f7b5b2a15e51be6ebb438bbe6c2f6ead
MD5 381bf0bc333a9dda8ce8f85140609aaa
SHA1 3a6ef57314502126778d6abd2e402d1a2ac2b01d
SHA512 64887e7132daff6325f406cbbb405623680d759beef647f02ba4ba4e07fb97d4269834b8dd672a4ef86b60fa972d8a600322e4b36796ceb80fb8a017b73ba0dc
SSDEEP 3072:KMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:sGii9IL8Xa3lLNngoqRttA7Y
TLSH
T1C334490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljhbwtrm.exe

Path C:\Temp\trljhbwtrm.exe
Size 243KB
SHA256 b8dd965e4490e07b3287e84d720f17150c4eb4a325b7c1a3b6eb3196ed72a20b
MD5 5b7f7b624a315636a5b9ba919c22f7b5
SHA1 d0d5794ee1648c805299f5ed20eca08812e47027
SHA512 7ce481509ff0969322a0b70086c67f1094631a7ac6d85fd966f8fabd8e752088801cec381e59a177ad3cf97955b08acd2574743f3784a57096c7d0678302a7ba
SSDEEP 3072:QMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7u:aGii9IL8Xa3lLNngoqRttA7u
TLSH
T11D34490272818031E75A0B78046AE7A046BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 04de10cb82930e79f08535d557f64ac9621c6cda1d0eccfac6473c0104a0d637
MD5 dea6cb2606db8cdd2fabbd87e0a40db7
SHA1 c2098eca31b6920f57a11bd7cba61a0b491c4813
SHA512 f6292db5c9d79125ec3a39855ecfc244c3c4923eb58b067d4b707a04d5db627e491e5e836c8b067160f89ccf33eb15dca3b9d7fff40fd18590bc2a2ca2ba56e2
TLSH
T1C6D09B557244A94BCB81217235D4B2555214946654150658055171B8C9F62D305BB8ED
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5eeca2aa6e917b76d239047f52a1c2b6b37364fe74e84180ac7fdc9548b3be90
MD5 a153df1b2dbe0717abacfb5c09939775
SHA1 91c63971114b63dacf725afb7452bd3a26feb97e
SHA512 79f36c0948649f3fad8501147974bd9fd20b8a31fdfc130e22546c6adb15a9ea187ca804e252771bfe133494aa84c78a92d9352ebb50e60be11ddd64e17fcbcc
TLSH
T1DED09266B254A84BCB81217639E9B255A2189466401A0A580662B2B8C9F62D306BB8EA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 8ff2f4a6c9eaaaab9201184eabc26b04c1175ba7bb4168f3efe1207b1ba8bc51
MD5 a96ff7d70c89b43f60bad7a64666da21
SHA1 00290627b46c1108f12e618790c27452e8856896
SHA512 341760bb158379d23d65a7ae225c83b6ec48adad14d7e3319bf21d6aa65cd4cc3745b8f2ebc3fec25df1d6b833a38f363a3ecff07c5683ca12666bd42eb0f0fc
TLSH
T12C517461233E47D1F7248FB712EBD28D3AB1ACAA698F2F084156E1F13907F15F242161
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597277.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe597277.TMP
Size 2KB
SHA256 7d0cef99f5c4a4c38ab81242aa87e64f36564f6b7b40e509c656124b51da0ca6
MD5 0d34939f4bb436409bc4f38dbae19be9
SHA1 2d51954b9a012138cd17edd1dea9a8e3c049f5bc
SHA512 df06f123d9f2adbd3c87f377ef4662b8ba9f3e06823694d89a40855e3a94a138cfaf66856878810645f5f7662fde34d2b2ab834a854fd123b78ed90cda4c2824
TLSH
T19A518561233E47E1F7248FB312EBD28D3AB1ACAA698F2F084155E1F13907F15F2511A1
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 49fde47e0a82cf37a53f74dc9e6c440de6be17340478907e0a04dc8c33d61fba
MD5 5ddb9e6e4215629b3aa16fa4b9461a83
SHA1 c832f9d2d4959628b5bded05c3abce072c041126
SHA512 f7f3e64f6cb0a2c3183061488796dc701b90bc8dc0e770d80b42d3e273c724a5e60fe25fad8672ca1541fd65f117e4191b4625e321120c60d8cf4f7c1776e2db
TLSH
T1A8519CF382E9866DC91156F0AB187E2BCE1D0914822C3D5AC9E4EF5B93E2471E142A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1e6583142c754052887140d3e8f878cd35f3433365f2acbd6ffd72cb31341f6a
MD5 75ac72f34c8d549229b4d3b3ffc6b5d1
SHA1 a59d3fe3c0d9de48ec0efd93097c825ea6b35bbe
SHA512 5381e0b65f2e0efe9f6ea17eaca40979f462e439c33ecc443f1b201cff1fb50d36054f9153ec4126408f175140a8093934715384b6ecb776e996db8e7f1fb16e
SSDEEP 192:sxRi/yM/jK1Ml8wCt/fxsWVB3ZKvzoA8pi/g6+WNIYaUbCGtIgtJ:sxRi58t/fxsWTJVi/5Iez3
TLSH
T11552DA15AA34993BCCDBD20DFA557F53D6F81563A2901E44AAFCDA0C01E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 82288990c54a92feed2bfd82758d98a82d0180ca4f9505b54dc73c998b9d4519
MD5 0d81ad93e1bf72e8defb373a5388f50c
SHA1 351162e842db70fe29a39c6b2cb9968c216487de
SHA512 5e274c248bba394990883aa699d80449a77cef174a8a97575dacf19a1fc0dfd82f80c59ba444d066bafb5d8c45b8a0239de07fb6cac4fe0a389aa4702128c6fe
SSDEEP 192:sxRx/yM/jK1Ml8wCt/fxscVB3ZKvzoA8pi/g6+WNIYaUbCGtIgDXJ:sxRx58t/fxscTJVi/5IezV
TLSH
T16852D915AA34993BCCDBD209FA557F53D6F81563A2901E44AAFCDB0C01E76EC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 617cddac61f7ec9f722710397c78161ea32910c16936b04058967e858f0a3da6
MD5 f4dd113eadd72778a5b7f816f49e0127
SHA1 c63cabef7af9ee5790e67dd8978ba387cb1e6397
SHA512 9789085fa29e3d121c0e5bce96b53e8862e10c72ef9fcb521cce41aa9e83cbb38dfaeef71bc3045de7c2a6a6c9aabda38b3be2263220214204f4c1cead4b1180
SSDEEP 192:sxRx/yM/jK1Ml8UQMCt/fxscVB3ZivzoA8pro/g6+WNIYaobCGtIgDXJ:sxRx5qrt/fxscTJtM/5ImzV
TLSH
T11162D915AA349937CCDBD209FA957F53D6F81573A2901E44AAFCDA0C01E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 323344e076f3e8288c84a1aa084c86fd0dde717a9e6fe1f5c42a418e519124b7
MD5 93abfa8223d8c4c75417c240d1e17c9a
SHA1 634928a4c61fa5036a09d34533676c06726fd0e1
SHA512 d7910a766c137b8bcb0d7fd77be0f3bdf62a1d0ba4e9e0ca909ea8903ddf94fb7c0f153b972b90803e02446c87ab60fa1d4d66e7bc1e5f360e54b4c1645061ed
SSDEEP 768:nTSdtH7pLuL7kFWg+wfla8F1+UoAYDCx9Tuqh0VfUC9xbog/OV1N9B0UJroKA:nTSdtBE7kFWg+wflau1jayN9mUiz
TLSH
T177E2FB3B680CCB7E4F844A9CEC29BE9AADE801CF57D8895447FA841C03C67EB51165DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a0dbd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a0dbd.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 21a6a6393619dd4836058c42b2c6ebf73f7f80be0d78f4226ead142388092e5e
MD5 5cea8bb4ab6d6f5f8313fca5be6dda2c
SHA1 6d0f66701160ebac1fea035006848b042292c7c1
SHA512 04dff5a5f61b51597e562c860eb315a1716dc8d05e1c8ac7a95c57410c658bb32ec9977078cf2bea77a3877d79e63f33a4978deac56e8200a7847c8f680ed017
SSDEEP 768:trv+4UNbdi3eIQU5LBLQ93XVGRh9zb3bm5zeVH1S7E:tbsbE3ess9nVG1ziEH15
TLSH
T10203BF32A8B899338CF38684B20B36077FB85167D6C90688D8ED2F4D439B59D6707D67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 2caec8f7380db50cab473ed344e79951189434032fbd5350af9067c108cdde10
MD5 ac600f050379decd2ea4bfad94b58acc
SHA1 fe93ff9fea7fedd8492de0a19eecd437f0d9524a
SHA512 7a9cdb414691846b24381f9d3ee1eb6cdc61714215a1055f6da32f8f639befed1b763224bd3d3c76af58f03a19d077947a75464d4a0416483aadd377493ff59b
SSDEEP 768:0F1j+9K3XwgoIKcGLWMHw93XVGRh9zb3bmlub9Mr:Z9K36hQ9nVG1zTb+r
TLSH
T19C038C72D965CE739CE68BD5B30A3A46EEF002B785CD59C8DAD86E4C01C729D1B07C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 b149c890b011ab477bb7c125d4b38b2a4eb045e0db5a5e1db812ef9d7d9b8c26
MD5 f513a0c028f27c941a4055009722ce1f
SHA1 54f72835edc480bd7752128ceb6e9dbcca001e82
SHA512 be8cb9765f039629fb479a12189990c7b801a9c6322a23ab377a2b1e0d60abf4f921dd87edb418896542c7f55f7640b8150bd50b6cda8eb0f28a16577fcce929
SSDEEP 768:Qrv+4UNbdo3aIJa5LBLWMH993XVGRh9zb3bmlueVH1S72:Qbsbm3apBd9nVG1zTEH1b
TLSH
T11713BF71A9789C338CF79688B20B3643BFF4117795C90A88D8E95F4D468B58D2B0BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 39a44a78f651fd95cfc10401e79e3290e06a010b1b37db34199e88a625e7714d
MD5 e313c81512de96dcf2f56e30f1347a49
SHA1 fdb41ebccb09f3349f5ac6991d93587a2be3b170
SHA512 8a6ccb13a464f5155b99c44f8bdccd0c1d086313e228c0e8f04761c86ad057b8ce64f6d119083a322407892559960a23ad97a28b21b497138f4b8fa921c0057f
SSDEEP 768:pj+9K3wIKa5LBLWMHc93XVGRh9zb3bmlub9Mr:09K3wOB89nVG1zTb+r
TLSH
T149F2BF71A9669C73CCE68698B30B3796EFF0027795C91D4CD9ECAF0D028769C5B07826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

508773f3-5ac8-4bdc-8429-efb1f3d51b34.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\508773f3-5ac8-4bdc-8429-efb1f3d51b34.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3920_1450174536\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/204-369-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1000-260-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1064-276-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1696-471-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1696-503-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1696-452-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2516-428-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3228-470-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3384-305-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3756-321-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4332-417-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4548-317-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4864-360-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4980-499-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5176-336-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5716-232-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5960-520-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5984-432-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5992-185-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6060-396-0x0000000000010000-0x0000000000083000-memory.dmp

Download