edf0881ab9d48b1e1933a87c14c6b367ce4ec5ef921284afb41e473945ee349b

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-07_7421c9b6d9131cf5ea19fa1c49b26844_elex_rhadamanthys_stop.exe
Size 243KB
Sample260707-wpdf5sbv2w
SHA256 edf0881ab9d48b1e1933a87c14c6b367ce4ec5ef921284afb41e473945ee349b
MD5 7421c9b6d9131cf5ea19fa1c49b26844
SHA1 454a8da1bc9e967176bd3804ba8475fcbd14465e
SHA512 228f65e1ec5f6c6b550c26b2bb6a3b3634e7d7c1c0652f1560dc83f402cfad41e4eaf7563e74d91affac3409df079cab87f21e2ff08085ff375cb33ec899e3ea
SSDEEP 3072:0CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7C:HvMsLaOa3lLNngoqRttA7C
TLSH
T12A345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4912	CP.exe
5980	vsqkicavsn.exe
5556	CP.exe
1184	CP.exe
5488	i_vsqkicavsn.exe
5176	aysqkicaqk.sys
4692	CP.exe
904	khfaxvpnif.exe
5144	CP.exe
5504	CP.exe
5352	i_khfaxvpnif.exe
3936	nkicaxvpnh.sys
700	CP.exe
5400	kiczxspfzx.exe
2468	CP.exe
5428	CP.exe
5964	i_kiczxspfzx.exe
4040	pkhczxrpkh.sys
944	CP.exe
4964	mjhfzxrpnh.exe
2456	CP.exe
2340	CP.exe
5124	i_mjhfzxrpnh.exe
2944	jhbzurmjhe.sys
1036	CP.exe
2232	ecwurmjecw.exe
1312	CP.exe
4284	CP.exe
5364	i_ecwurmjecw.exe
5520	mjhbztrmjh.sys
4208	CP.exe
256	dbztrojgey.exe
2008	CP.exe
1668	CP.exe
2156	i_dbztrojgey.exe
1900	oljebzwrol.sys
2524	CP.exe
2748	qomjebwtro.exe
1840	CP.exe
2836	CP.exe
6056	i_qomjebwtro.exe
3724	oigaytqoig.sys
1144	CP.exe
4976	oigaytqolg.exe
4092	CP.exe
3776	CP.exe
4852	i_oigaytqolg.exe
5604	nlidbysqli.sys
2608	CP.exe
204	gaysqkiday.exe
5372	CP.exe
5368	CP.exe
1432	i_gaysqkiday.exe
4104	nlfdxvqfax.sys
5676	CP.exe
4404	xvsqkicaxv.exe
3416	CP.exe
5408	CP.exe
708	i_xvsqkicaxv.exe
1292	kicauspkic.sys
6056	CP.exe
2000	nhfzxusqkf.exe
2040	CP.exe
3800	CP.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1712_1968258101\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1712_1109967101\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1712_1314976604\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1712_1968258101\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1712_1109967101\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1712_1109967101\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1712_1109967101\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1712_1416211242\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1712_1314976604\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqkiday.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvsqkicaxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbztrojgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qomjebwtro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqkiday.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsqkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigaytqolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigaytqolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qomjebwtro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxusqkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojgbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsqlfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kiczxspfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kiczxspfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwurmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbztrojgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxusqkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsqlfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-07_7421c9b6d9131cf5ea19fa1c49b26844_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khfaxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwurmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvsqkicaxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrmjgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxvpnkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxvpnkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khfaxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhfzxrpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhfzxrpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caxsqkifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrmjgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojgbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caxsqkifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsqkicavsn.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3384	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2704	ipconfig.exe
1548	ipconfig.exe
5016	ipconfig.exe
4432	ipconfig.exe
5952	ipconfig.exe
2032	ipconfig.exe
2608	ipconfig.exe
3928	ipconfig.exe
4736	ipconfig.exe
4044	ipconfig.exe
1628	ipconfig.exe
6000	ipconfig.exe
5332	ipconfig.exe
5276	ipconfig.exe
5408	ipconfig.exe
1576	ipconfig.exe
2500	ipconfig.exe
4052	ipconfig.exe
5892	ipconfig.exe
4048	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279211383109396"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2626306573-1585762579-411806764-1000\{B82D6AF7-2E0D-4339-9CA8-AB4526173591}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2848	msedge.exe
2848	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5488	i_vsqkicavsn.exe
Token: SeDebugPrivilege	5352	i_khfaxvpnif.exe
Token: SeDebugPrivilege	5964	i_kiczxspfzx.exe
Token: SeDebugPrivilege	5124	i_mjhfzxrpnh.exe
Token: SeDebugPrivilege	5364	i_ecwurmjecw.exe
Token: SeDebugPrivilege	2156	i_dbztrojgey.exe
Token: SeDebugPrivilege	6056	i_qomjebwtro.exe
Token: SeDebugPrivilege	4852	i_oigaytqolg.exe
Token: SeDebugPrivilege	1432	i_gaysqkiday.exe
Token: SeDebugPrivilege	708	i_xvsqkicaxv.exe
Token: SeDebugPrivilege	4612	i_nhfzxusqkf.exe
Token: SeDebugPrivilege	1780	i_pnhfzxrpkh.exe
Token: SeDebugPrivilege	1432	i_urmkhfzxrp.exe
Token: SeDebugPrivilege	1720	i_wtrmjgeywr.exe
Token: SeDebugPrivilege	3724	i_rojgbztrlj.exe
Token: SeDebugPrivilege	3680	i_ljdbvtolgd.exe
Token: SeDebugPrivilege	4192	i_dbvtnlfdyv.exe
Token: SeDebugPrivilege	5804	i_avsqlfdxvp.exe
Token: SeDebugPrivilege	2852	i_caxsqkifay.exe
Token: SeDebugPrivilege	5432	i_fcxvpnkfcx.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1712	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 4060	3372	2026-07-07_7421c9b6d9131cf5ea19fa1c49b26844_elex_rhadamanthys_stop.exe	87
PID 4060 wrote to memory of 1712	4060	iexplore.exe	88
PID 1712 wrote to memory of 2056	1712	msedge.exe	89
PID 1712 wrote to memory of 3188	1712	msedge.exe	90
PID 1712 wrote to memory of 3384	1712	msedge.exe	91
PID 1712 wrote to memory of 3188	1712	msedge.exe	90
PID 1712 wrote to memory of 3188	1712	msedge.exe	90
PID 1712 wrote to memory of 1592	1712	msedge.exe	92
PID 1712 wrote to memory of 1592	1712	msedge.exe	92
PID 1712 wrote to memory of 1824	1712	msedge.exe	93
PID 1712 wrote to memory of 3364	1712	msedge.exe	94
PID 1712 wrote to memory of 1824	1712	msedge.exe	93
PID 1712 wrote to memory of 1824	1712	msedge.exe	93
PID 1712 wrote to memory of 3364	1712	msedge.exe	94
PID 1712 wrote to memory of 3364	1712	msedge.exe	94
PID 1712 wrote to memory of 404	1712	msedge.exe	96
PID 1712 wrote to memory of 256	1712	msedge.exe	97
PID 1712 wrote to memory of 404	1712	msedge.exe	96
PID 1712 wrote to memory of 404	1712	msedge.exe	96
PID 1712 wrote to memory of 256	1712	msedge.exe	97
PID 1712 wrote to memory of 256	1712	msedge.exe	97
PID 1712 wrote to memory of 3228	1712	msedge.exe	98
PID 1712 wrote to memory of 3228	1712	msedge.exe	98
PID 3372 wrote to memory of 4912	3372	2026-07-07_7421c9b6d9131cf5ea19fa1c49b26844_elex_rhadamanthys_stop.exe	100
PID 5980 wrote to memory of 5556	5980	vsqkicavsn.exe	103
PID 1712 wrote to memory of 1808	1712	msedge.exe	106
PID 1712 wrote to memory of 1808	1712	msedge.exe	106
PID 1712 wrote to memory of 5652	1712	msedge.exe	107
PID 1712 wrote to memory of 5652	1712	msedge.exe	107
PID 1712 wrote to memory of 2800	1712	msedge.exe	109
PID 1712 wrote to memory of 5972	1712	msedge.exe	110
PID 1712 wrote to memory of 5972	1712	msedge.exe	110
PID 1712 wrote to memory of 2396	1712	msedge.exe	113
PID 1712 wrote to memory of 2396	1712	msedge.exe	113
PID 3372 wrote to memory of 1184	3372	2026-07-07_7421c9b6d9131cf5ea19fa1c49b26844_elex_rhadamanthys_stop.exe	115
PID 3372 wrote to memory of 4692	3372	2026-07-07_7421c9b6d9131cf5ea19fa1c49b26844_elex_rhadamanthys_stop.exe	119
PID 904 wrote to memory of 5144	904	khfaxvpnif.exe	121
PID 3372 wrote to memory of 5504	3372	2026-07-07_7421c9b6d9131cf5ea19fa1c49b26844_elex_rhadamanthys_stop.exe	124
PID 3372 wrote to memory of 700	3372	2026-07-07_7421c9b6d9131cf5ea19fa1c49b26844_elex_rhadamanthys_stop.exe	128
PID 5400 wrote to memory of 2468	5400	kiczxspfzx.exe	130
PID 3372 wrote to memory of 5428	3372	2026-07-07_7421c9b6d9131cf5ea19fa1c49b26844_elex_rhadamanthys_stop.exe	133
PID 3372 wrote to memory of 944	3372	2026-07-07_7421c9b6d9131cf5ea19fa1c49b26844_elex_rhadamanthys_stop.exe	137
PID 4964 wrote to memory of 2456	4964	mjhfzxrpnh.exe	139
PID 3372 wrote to memory of 2340	3372	2026-07-07_7421c9b6d9131cf5ea19fa1c49b26844_elex_rhadamanthys_stop.exe	142
PID 1712 wrote to memory of 1008	1712	msedge.exe	145
PID 1712 wrote to memory of 1108	1712	msedge.exe	146
PID 1712 wrote to memory of 2652	1712	msedge.exe	147
PID 3372 wrote to memory of 1036	3372	2026-07-07_7421c9b6d9131cf5ea19fa1c49b26844_elex_rhadamanthys_stop.exe	150
PID 2232 wrote to memory of 1312	2232	ecwurmjecw.exe	152
PID 3372 wrote to memory of 4284	3372	2026-07-07_7421c9b6d9131cf5ea19fa1c49b26844_elex_rhadamanthys_stop.exe	155
PID 3372 wrote to memory of 4208	3372	2026-07-07_7421c9b6d9131cf5ea19fa1c49b26844_elex_rhadamanthys_stop.exe	159
PID 256 wrote to memory of 2008	256	dbztrojgey.exe	161
PID 3372 wrote to memory of 1668	3372	2026-07-07_7421c9b6d9131cf5ea19fa1c49b26844_elex_rhadamanthys_stop.exe	164
PID 3372 wrote to memory of 2524	3372	2026-07-07_7421c9b6d9131cf5ea19fa1c49b26844_elex_rhadamanthys_stop.exe	168
PID 2748 wrote to memory of 1840	2748	qomjebwtro.exe	170
PID 3372 wrote to memory of 2836	3372	2026-07-07_7421c9b6d9131cf5ea19fa1c49b26844_elex_rhadamanthys_stop.exe	173
PID 3372 wrote to memory of 1144	3372	2026-07-07_7421c9b6d9131cf5ea19fa1c49b26844_elex_rhadamanthys_stop.exe	177
PID 4976 wrote to memory of 4092	4976	oigaytqolg.exe	179
PID 3372 wrote to memory of 3776	3372	2026-07-07_7421c9b6d9131cf5ea19fa1c49b26844_elex_rhadamanthys_stop.exe	182
PID 1712 wrote to memory of 1372	1712	msedge.exe	184
PID 1712 wrote to memory of 1372	1712	msedge.exe	184
PID 3372 wrote to memory of 2608	3372	2026-07-07_7421c9b6d9131cf5ea19fa1c49b26844_elex_rhadamanthys_stop.exe	190
PID 204 wrote to memory of 5372	204	gaysqkiday.exe	192
PID 3372 wrote to memory of 5368	3372	2026-07-07_7421c9b6d9131cf5ea19fa1c49b26844_elex_rhadamanthys_stop.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-07_7421c9b6d9131cf5ea19fa1c49b26844_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_7421c9b6d9131cf5ea19fa1c49b26844_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7fffda15c188,0x7fffda15c194,0x7fffda15c1a0
      4⤵
      PID:2056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,17336316839206647161,1293588977981143293,262144 --field-trial-handle=2192,i,4297554386136957813,9843359677467809740,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
      4⤵
      PID:3188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,9434339959959737291,11998271600637221356,524288 --field-trial-handle=2192,i,4297554386136957813,9843359677467809740,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:11
      4⤵
      System Time Discovery
      PID:3384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,3165157436964897627,8837604160503046805,524288 --field-trial-handle=2192,i,4297554386136957813,9843359677467809740,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:13
      4⤵
      PID:1592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,14833721033302128576,17706490255164636077,2097152 --field-trial-handle=2192,i,4297554386136957813,9843359677467809740,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:1824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,14127432675037936206,167363302609330168,2097152 --field-trial-handle=2192,i,4297554386136957813,9843359677467809740,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:3364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3456,i,15615346437237610656,8412275090936384290,2097152 --field-trial-handle=2192,i,4297554386136957813,9843359677467809740,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:1
      4⤵
      PID:404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3468,i,6046943272668317930,18172643808208593896,2097152 --field-trial-handle=2192,i,4297554386136957813,9843359677467809740,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:9
      4⤵
      PID:256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3940,i,1516071056666508447,11170498480778974821,524288 --field-trial-handle=2192,i,4297554386136957813,9843359677467809740,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
      4⤵
      PID:3228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3876,i,14553414489012104460,6296629411280366298,524288 --field-trial-handle=2192,i,4297554386136957813,9843359677467809740,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
      4⤵
      PID:1808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3944,i,10785194436455605728,248591824986623368,524288 --field-trial-handle=2192,i,4297554386136957813,9843359677467809740,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
      4⤵
      PID:5652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,17060282625377566356,10729751520717087723,524288 --field-trial-handle=2192,i,4297554386136957813,9843359677467809740,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
      4⤵
      PID:2976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,17060282625377566356,10729751520717087723,524288 --field-trial-handle=2192,i,4297554386136957813,9843359677467809740,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
      4⤵
      PID:2800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,1931110863420560217,5430449654282216410,524288 --field-trial-handle=2192,i,4297554386136957813,9843359677467809740,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:5972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,7551601893687702215,17690732302308568712,524288 --field-trial-handle=2192,i,4297554386136957813,9843359677467809740,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
      4⤵
      PID:2396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,4768936872116876684,1155343866626852633,524288 --field-trial-handle=2192,i,4297554386136957813,9843359677467809740,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
      4⤵
      PID:1008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,11149473723024053978,4023640402397266014,524288 --field-trial-handle=2192,i,4297554386136957813,9843359677467809740,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
      4⤵
      PID:1108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,18019605124949364054,13044816156206794541,524288 --field-trial-handle=2192,i,4297554386136957813,9843359677467809740,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
      4⤵
      PID:2652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,4431771803253804868,11380831489090808398,524288 --field-trial-handle=2192,i,4297554386136957813,9843359677467809740,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:14
      4⤵
      PID:1372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,14094294662321347910,13245222311148166890,524288 --field-trial-handle=2192,i,4297554386136957813,9843359677467809740,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
      4⤵
      PID:5028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3940,i,2715158975853190938,9294502570806607316,524288 --field-trial-handle=2192,i,4297554386136957813,9843359677467809740,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
      4⤵
      PID:1692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,2724191486663543407,6936303117001319742,524288 --field-trial-handle=2192,i,4297554386136957813,9843359677467809740,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
      4⤵
      PID:2332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4396,i,7191399671103616809,14554984347033330280,262144 --field-trial-handle=2192,i,4297554386136957813,9843359677467809740,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2824,i,17403461898479155816,9228166296857066663,524288 --field-trial-handle=2192,i,4297554386136957813,9843359677467809740,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
      4⤵
      PID:828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsqkicavsn.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4912
- - C:\Temp\vsqkicavsn.exe
    C:\Temp\vsqkicavsn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5980
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5556
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2608
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsqkicavsn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1184
- - C:\Temp\i_vsqkicavsn.exe
    C:\Temp\i_vsqkicavsn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5488
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\khfaxvpnif.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4692
- - C:\Temp\khfaxvpnif.exe
    C:\Temp\khfaxvpnif.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:904
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5144
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_khfaxvpnif.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5504
- - C:\Temp\i_khfaxvpnif.exe
    C:\Temp\i_khfaxvpnif.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kiczxspfzx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:700
- - C:\Temp\kiczxspfzx.exe
    C:\Temp\kiczxspfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5400
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2468
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kiczxspfzx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5428
- - C:\Temp\i_kiczxspfzx.exe
    C:\Temp\i_kiczxspfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjhfzxrpnh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:944
- - C:\Temp\mjhfzxrpnh.exe
    C:\Temp\mjhfzxrpnh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4964
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2456
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjhfzxrpnh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2340
- - C:\Temp\i_mjhfzxrpnh.exe
    C:\Temp\i_mjhfzxrpnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwurmjecw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1036
- - C:\Temp\ecwurmjecw.exe
    C:\Temp\ecwurmjecw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2232
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1312
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwurmjecw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4284
- - C:\Temp\i_ecwurmjecw.exe
    C:\Temp\i_ecwurmjecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbztrojgey.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4208
- - C:\Temp\dbztrojgey.exe
    C:\Temp\dbztrojgey.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:256
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2008
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbztrojgey.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1668
- - C:\Temp\i_dbztrojgey.exe
    C:\Temp\i_dbztrojgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2156
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qomjebwtro.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2524
- - C:\Temp\qomjebwtro.exe
    C:\Temp\qomjebwtro.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2748
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1840
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qomjebwtro.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2836
- - C:\Temp\i_qomjebwtro.exe
    C:\Temp\i_qomjebwtro.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigaytqolg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1144
- - C:\Temp\oigaytqolg.exe
    C:\Temp\oigaytqolg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4976
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4092
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigaytqolg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3776
- - C:\Temp\i_oigaytqolg.exe
    C:\Temp\i_oigaytqolg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gaysqkiday.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2608
- - C:\Temp\gaysqkiday.exe
    C:\Temp\gaysqkiday.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:204
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5372
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gaysqkiday.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5368
- - C:\Temp\i_gaysqkiday.exe
    C:\Temp\i_gaysqkiday.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvsqkicaxv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5676
- - C:\Temp\xvsqkicaxv.exe
    C:\Temp\xvsqkicaxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4404
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3416
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvsqkicaxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5408
- - C:\Temp\i_xvsqkicaxv.exe
    C:\Temp\i_xvsqkicaxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfzxusqkf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6056
- - C:\Temp\nhfzxusqkf.exe
    C:\Temp\nhfzxusqkf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2000
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2040
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfzxusqkf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3800
- - C:\Temp\i_nhfzxusqkf.exe
    C:\Temp\i_nhfzxusqkf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfzxrpkh.exe ups_run
  2⤵
  PID:5812
- - C:\Temp\pnhfzxrpkh.exe
    C:\Temp\pnhfzxrpkh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4800
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2944
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfzxrpkh.exe ups_ins
  2⤵
  PID:1080
- - C:\Temp\i_pnhfzxrpkh.exe
    C:\Temp\i_pnhfzxrpkh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1780
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urmkhfzxrp.exe ups_run
  2⤵
  PID:4924
- - C:\Temp\urmkhfzxrp.exe
    C:\Temp\urmkhfzxrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1168
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6124
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urmkhfzxrp.exe ups_ins
  2⤵
  PID:2556
- - C:\Temp\i_urmkhfzxrp.exe
    C:\Temp\i_urmkhfzxrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtrmjgeywr.exe ups_run
  2⤵
  PID:716
- - C:\Temp\wtrmjgeywr.exe
    C:\Temp\wtrmjgeywr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3504
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4772
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtrmjgeywr.exe ups_ins
  2⤵
  PID:4728
- - C:\Temp\i_wtrmjgeywr.exe
    C:\Temp\i_wtrmjgeywr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rojgbztrlj.exe ups_run
  2⤵
  PID:1292
- - C:\Temp\rojgbztrlj.exe
    C:\Temp\rojgbztrlj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4340
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1536
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rojgbztrlj.exe ups_ins
  2⤵
  PID:4532
- - C:\Temp\i_rojgbztrlj.exe
    C:\Temp\i_rojgbztrlj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbvtolgd.exe ups_run
  2⤵
  PID:4852
- - C:\Temp\ljdbvtolgd.exe
    C:\Temp\ljdbvtolgd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2136
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2712
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5332
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbvtolgd.exe ups_ins
  2⤵
  PID:1340
- - C:\Temp\i_ljdbvtolgd.exe
    C:\Temp\i_ljdbvtolgd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbvtnlfdyv.exe ups_run
  2⤵
  PID:1084
- - C:\Temp\dbvtnlfdyv.exe
    C:\Temp\dbvtnlfdyv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:624
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4104
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbvtnlfdyv.exe ups_ins
  2⤵
  PID:2844
- - C:\Temp\i_dbvtnlfdyv.exe
    C:\Temp\i_dbvtnlfdyv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avsqlfdxvp.exe ups_run
  2⤵
  PID:3536
- - C:\Temp\avsqlfdxvp.exe
    C:\Temp\avsqlfdxvp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2328
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5964
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avsqlfdxvp.exe ups_ins
  2⤵
  PID:2872
- - C:\Temp\i_avsqlfdxvp.exe
    C:\Temp\i_avsqlfdxvp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\caxsqkifay.exe ups_run
  2⤵
  PID:5596
- - C:\Temp\caxsqkifay.exe
    C:\Temp\caxsqkifay.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1460
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3812
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_caxsqkifay.exe ups_ins
  2⤵
  PID:3928
- - C:\Temp\i_caxsqkifay.exe
    C:\Temp\i_caxsqkifay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fcxvpnkfcx.exe ups_run
  2⤵
  PID:5672
- - C:\Temp\fcxvpnkfcx.exe
    C:\Temp\fcxvpnkfcx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4504
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2648
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fcxvpnkfcx.exe ups_ins
  2⤵
  PID:4264
- - C:\Temp\i_fcxvpnkfcx.exe
    C:\Temp\i_fcxvpnkfcx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5432

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4384

C:\Temp\aysqkicaqk.sys
C:\Temp\aysqkicaqk.sys
1⤵
- Executes dropped EXE
PID:5176

C:\Temp\nkicaxvpnh.sys
C:\Temp\nkicaxvpnh.sys
1⤵
- Executes dropped EXE
PID:3936

C:\Temp\pkhczxrpkh.sys
C:\Temp\pkhczxrpkh.sys
1⤵
- Executes dropped EXE
PID:4040

C:\Temp\jhbzurmjhe.sys
C:\Temp\jhbzurmjhe.sys
1⤵
- Executes dropped EXE
PID:2944

C:\Temp\mjhbztrmjh.sys
C:\Temp\mjhbztrmjh.sys
1⤵
- Executes dropped EXE
PID:5520

C:\Temp\oljebzwrol.sys
C:\Temp\oljebzwrol.sys
1⤵
- Executes dropped EXE
PID:1900

C:\Temp\oigaytqoig.sys
C:\Temp\oigaytqoig.sys
1⤵
- Executes dropped EXE
PID:3724

C:\Temp\nlidbysqli.sys
C:\Temp\nlidbysqli.sys
1⤵
- Executes dropped EXE
PID:5604

C:\Temp\nlfdxvqfax.sys
C:\Temp\nlfdxvqfax.sys
1⤵
- Executes dropped EXE
PID:4104

C:\Temp\kicauspkic.sys
C:\Temp\kicauspkic.sys
1⤵
- Executes dropped EXE
PID:1292

C:\Temp\pnhezxrpkh.sys
C:\Temp\pnhezxrpkh.sys
1⤵
PID:2928

C:\Temp\xupmhezxup.sys
C:\Temp\xupmhezxup.sys
1⤵
PID:3064

C:\Temp\ecwurmjhez.sys
C:\Temp\ecwurmjhez.sys
1⤵
PID:2700

C:\Temp\ljhbztrojg.sys
C:\Temp\ljhbztrojg.sys
1⤵
PID:2320

C:\Temp\lgdbwtrljd.sys
C:\Temp\lgdbwtrljd.sys
1⤵
PID:2544

C:\Temp\igdywqoiga.sys
C:\Temp\igdywqoiga.sys
1⤵
PID:2360

C:\Temp\lidavtqlid.sys
C:\Temp\lidavtqlid.sys
1⤵
PID:1408

C:\Temp\faysqkifax.sys
C:\Temp\faysqkifax.sys
1⤵
PID:2268

C:\Temp\icaxspkifa.sys
C:\Temp\icaxspkifa.sys
1⤵
PID:1336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aysqkicaqk.sys

Path C:\Temp\aysqkicaqk.sys
Size 141KB
SHA256 482ebcbf11e826bc4262c2968e8a7e1caba28c2197f74e8d6478444722c23c9a
MD5 1004dfef551b63a540a8008917edb51a
SHA1 66a8d7f2ff837852790268c524c83c6dd341995e
SHA512 3d78a1a5439f5599a03c91b9e64a31192566b8005e4c347a55aa718aeb6f70b495e07d8663d13c955dfdb6d1ca618b3873a30b0af979a18ead3022290cbf00a9
SSDEEP 1536:3a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:3a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T175E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbztrojgey.exe

Path C:\Temp\dbztrojgey.exe
Size 243KB
SHA256 04dbee7ffe1968e7c3a64c150421007e5bfc102a780308e4bdf499b4d806d1a1
MD5 1f8ba5e94b77ce5dfeac0dc2a8d1ce02
SHA1 be9040d531a3500868324c9af49e1d1391344b77
SHA512 3d3d89cee21d6de190e3ca02897eaf6baf6c0be2c3c022e0101c58124e70fc6a3eb41057972d7ef0aa4e2032ed3997f2d5087210e5655e8401f6c1c5172c449c
SSDEEP 3072:PCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7t:avMsLaOa3lLNngoqRttA7t
TLSH
T1C1345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwurmjecw.exe

Path C:\Temp\ecwurmjecw.exe
Size 243KB
SHA256 401e88e00eac54c46e89e6cb414b33d46d6114b43c8e18b49e1c850dabf2f1c9
MD5 be7e691a915a56374b70bff082149a53
SHA1 8b173c3e1f078d6e5379eea25a6abe2463a7b114
SHA512 c0343037e1a671b6da6f56f909b724b6af14a755d8cea368054a7e11c2919748ee9a813d4d6c24fc59778f1f592ef2e10f01ec19bf63467fa61e246ca5302361
SSDEEP 3072:fCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7B:qvMsLaOa3lLNngoqRttA7B
TLSH
T1C6345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbztrojgey.exe

Path C:\Temp\i_dbztrojgey.exe
Size 243KB
SHA256 7a0ed50f928847bf62f7a6cef2136b016ac01923f710662732eb2776eb3fa8c4
MD5 8c9692cdc6fd53f73c6d0624fc34d11a
SHA1 33de7a26fdd92aeb59972c86de78861e55e9c13e
SHA512 bc7a7fbd743581183bd61e2be8bcd3acca59c2ae36c4c60e94074fb02b546bac166d68af32a750b40be858188294cd5de6e1b5449df3b0bfbfc7f845eee1db24
SSDEEP 3072:sCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7O:PvMsLaOa3lLNngoqRttA7O
TLSH
T1A1345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ecwurmjecw.exe

Path C:\Temp\i_ecwurmjecw.exe
Size 243KB
SHA256 24791d0344f1f18611d6390585bc17ece22c75eb2aeea183e01ee0bd2272483e
MD5 33098db7dea26a1670aa6e454b98b3da
SHA1 2a66cac1792e303c259783a841c15e43a1a03623
SHA512 223dfc0036a0fd2a9537fa833ff2b4ce5f9e7f4c5997aba06d59559f0c69fb7c6e24e3a2bcb3ab3237f45023287cbc20deed4df4eaa44c02911d8392e8c3b52e
SSDEEP 3072:YCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7+:DvMsLaOa3lLNngoqRttA7+
TLSH
T1B2345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_khfaxvpnif.exe

Path C:\Temp\i_khfaxvpnif.exe
Size 243KB
SHA256 db57fe81d2d4ba886997b7d46cd535630760c2ba34a56302f48e472328b29a36
MD5 c357ea339d12577966a0414e51a8c4ee
SHA1 98accfde06e9d969ffc48bb66d08fd786ed8adbf
SHA512 5f0bf00382a662216d36012c7ad61dc98427bf5a6696b48b3f8be5f1baddca128feff3eb09d197e7d038e65ba57a82f7fd71c9c51308020cf5df75f3cbb50a2a
SSDEEP 3072:ZCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7z:EvMsLaOa3lLNngoqRttA7z
TLSH
T102345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kiczxspfzx.exe

Path C:\Temp\i_kiczxspfzx.exe
Size 243KB
SHA256 e4ceccb664e8b59ba4b7edfa85ad18732046b6ab4caa48523ec8e6339467035b
MD5 53f2e988b50ee24e7d123ef6bdfe53ce
SHA1 5f01aeb323fc9beef99084725c883bf318f29ae3
SHA512 1a42a1517633cd56f39c6d121b4d766d2bba3b4acd552f838817fd1d0cdf1e5d57e061f6a484850da0cad47c0aae63c8daaae6fd2962db9b970477f4a32c3b97
SSDEEP 3072:GCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA78:pvMsLaOa3lLNngoqRttA78
TLSH
T134345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mjhfzxrpnh.exe

Path C:\Temp\i_mjhfzxrpnh.exe
Size 243KB
SHA256 25302208d8d5708c80bbaa102986cdc6e756cbad7a2f33e6d77de1b4d80a2593
MD5 74ccc41b3abbfd52fdb4fcdfbb7051b8
SHA1 39a6f9c06f1e63590ff01b76b033d8823a942226
SHA512 8e71363a55912e727e51e5ac20e22eafe6bb87293b76362741ed5650414574b91435583be92fa38f3e8de304188effef4fe27650d3113c019eb35d5fd21075c1
SSDEEP 3072:+CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7E:xvMsLaOa3lLNngoqRttA7E
TLSH
T185345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vsqkicavsn.exe

Path C:\Temp\i_vsqkicavsn.exe
Size 243KB
SHA256 8b9a1444d9411196d40fbcb8a3f5c10173085bd19c87b6102a7349021049376a
MD5 52017e20c24c5f6a5a56d1205828c742
SHA1 fe4e404da2d7a4cc0b8eca9ed7330509af05251e
SHA512 21dcd2086aad14dbc196d406f2b5c4e5c184fa6bc73a152bd4a56d8775ffb9f15e85e9741579e2a1dd7e3f7636b495f6da710030d9f8e2bb15e24f47d69df978
SSDEEP 3072:ZCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:EvMsLaOa3lLNngoqRttA7b
TLSH
T17B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbzurmjhe.sys

Path C:\Temp\jhbzurmjhe.sys
Size 141KB
SHA256 5eed636d779bdcfb9f9b9a915b3239976e16a75917486c0b3c9902e58fe76bf6
MD5 9af74288299731d5037d6a08371286c1
SHA1 25ee0150aa47289e9e7f101c38db62ce58256438
SHA512 ea8f244369f82def871109e209c426d180b835d5647dcc4558d883d6c0b960fa394cbb51a62964ada869d94c0ff0b1a51d05a4b4850debc2b8b384d79990d1df
SSDEEP 1536:za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T14EE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khfaxvpnif.exe

Path C:\Temp\khfaxvpnif.exe
Size 243KB
SHA256 6254d4460495b409f05a34679bc9778a10f6e22840a2a3177cb662b8483a1fde
MD5 12d9c6f4b69ceceb9ca12967f7adeb9b
SHA1 0e76acd859a67be529688ec313b86767fec0a7a8
SHA512 4effb10d7458c22721273e08cc73c69029803bb8a839c93a7bb18f73514d75bc114a091b53696b5e7fa959ed728ae769ba314cca5fa2329d52dbfc66a3b15cd8
SSDEEP 3072:VCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7H:YvMsLaOa3lLNngoqRttA7H
TLSH
T152345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kiczxspfzx.exe

Path C:\Temp\kiczxspfzx.exe
Size 243KB
SHA256 848264d71568121209708e979af96a78aefdf72c5536f3ad54d68b395eac0a8f
MD5 e3fb801cfb896a9bc997960e4df68558
SHA1 e4228a1788be99a9832003679aa7596ee93a5441
SHA512 c255b30820f3dccf46fdedb56afc6ded193f4eb7e98ef3990e221266f27f1f7b49aaa9bd2cba8dc637305d277632d5d874cbb58e5830598df32fc701f623b9d8
SSDEEP 3072:CCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7I:9vMsLaOa3lLNngoqRttA7I
TLSH
T123345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjhbztrmjh.sys

Path C:\Temp\mjhbztrmjh.sys
Size 141KB
SHA256 da89c08630854679cc5fa206c0e0260aaf8e6b58654bb829ceddf3ff73d6faa6
MD5 e836063469e763970bf1458e18e1faeb
SHA1 9af5441a6a40a4ec142eb4706a08612dfc0eecd6
SHA512 e5f7d132349713ef9a1448c064e2ebbf7ad0bae030f431dd643d38276f41bc208ddb94d9a8856d1bf621301d10adde69f9b3950a687024355271ac86ab2c585b
SSDEEP 1536:ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A9E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjhfzxrpnh.exe

Path C:\Temp\mjhfzxrpnh.exe
Size 243KB
SHA256 66fbe95ded07d98ecf9e8a207bca22ac71a8689eea3771547bbccc98a4a9fe55
MD5 22b9862c0507f29a9535a4216445be2e
SHA1 5b36ef40bbdadc601b9e02a715449963397fa5c1
SHA512 077c30ac6a070d1324a79301d7579d4dd32a2edf54d7d6911169a34f2537d2d3156a2b39ab269adf97dcc5f80c6065450bf8da0c3f241205d1301674a182406e
SSDEEP 3072:nCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7t:CvMsLaOa3lLNngoqRttA7t
TLSH
T1D5345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkicaxvpnh.sys

Path C:\Temp\nkicaxvpnh.sys
Size 141KB
SHA256 3e8e2501eec7c51ebceaec0670c72c055ab3b2cb4429ad36ba6459a694994180
MD5 97c2d52e931cd3e71db47fcb4e2d920a
SHA1 02a2346de144afa4a6ae9a095aa3a82b32d86d5e
SHA512 4188f0f3db83505833ae85fe44be1a1e957fd5281e8b60d64caa97951e4886b6ec874fc6dc262c5779e9dd87db4e1b1019cc731e657e0e0257de77fc09522e95
SSDEEP 1536:Ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T115E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oljebzwrol.sys

Path C:\Temp\oljebzwrol.sys
Size 141KB
SHA256 ffc5d33b61a743cf3a12eb0626fc369c27454693ce5ef473f60313268e5d5ce0
MD5 db7285c48ac957fd66aea667d8d5d3a5
SHA1 9268de77179874bce7e1322660af811bd11362fa
SHA512 83edf45cc9f45cf2620596de35774c65f602326dd33f625779a2407ecac5c491c5e8377c9c36170909f426b3ee1d4ae7a858fa132ab7c4e607488b4144c8718a
SSDEEP 1536:Sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T125E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkhczxrpkh.sys

Path C:\Temp\pkhczxrpkh.sys
Size 141KB
SHA256 c82131d75acbf0a90fce25a5231c0cf98f936fa75dc360b5ece91fb861e76435
MD5 5ff992a0bb3a67455633fe21da1776ad
SHA1 500e45b0313b30fb2fa93a3e10de65a46f808716
SHA512 f35a63e387285446fa6dc5a4fcaa36efd2883e2c59ec6960a9507f65e8bd18ef1647d92e1dc818258c202d83d0625da80268171dff26cef0a6aa221fa58ca789
SSDEEP 1536:va3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:va3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T186E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsqkicavsn.exe

Path C:\Temp\vsqkicavsn.exe
Size 243KB
SHA256 8d03b2958cf5ef0e11b2b2d4dbd1833772c6a0e575318cf32e73f583d33b0107
MD5 4d25b6b9c98a2d633fd156ff89506289
SHA1 eab76a3a28edc25570970d99f82cab93f8abd839
SHA512 46c038bfa3a3133ee33c86ef7bdb617abe8f8555631db5bcf20cec853715bbfe7b95093aa0b16a21bce5b75b5dde8a7c326387a6939a60af0355d46cbd2a379c
SSDEEP 3072:5CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:kvMsLaOa3lLNngoqRttA7D
TLSH
T133345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a54d1be6da491be16ecc22dac3ad8cfbe4eabb017451e32c26f2904977fde58e
MD5 9daa45ac0383b3b978ad8da2d5000b62
SHA1 f52083ce5d095366a6fa9406b8b49000fcb53bc0
SHA512 ac55ccfd63460f712cd2ffb1ff656349475683b1ec07abd198254ac469a634f7129cf280de184340d8314fe2b8f7e955f7a112deb1511d52de882ae801a7c1af
TLSH
T17DD09B9D6686AE54DD80343134A1E34B9A18F522642C464880177054CCA464246571FF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3f51b0e24e52d8511f72e348c132f84b6b8edb54027a5c8c4fbe2a976322a690
MD5 e32f775acc5ed08adf9d5f6678c2bc4d
SHA1 bd5f4d60c6c8f97a1fed276a8c02ca345e30bb2a
SHA512 2b2fef021516ee5e90b192840780767fff5c147cfb2dfe5b900a8b298d542111707f16c28e265447d090c61e8e091b3529eb29ff376abe03cd34315206805eba
TLSH
T1DAD09B996686AD54DD80343534A1E34B9A18F522102C46488117B064CCA464246561FF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 e2b7727e0e60f5b689210e6ba04fc83e0709d341d5474f9159999041e2da51ae
MD5 e63a1b3064e37dfbd184af4e5f20bb7e
SHA1 4931a8d7f48951635782140f93136b2977cb583b
SHA512 48c40791282ad89d7e063bc251d7ec0150b7191e0405c4caa1c19b16689dcd465c39cc80aebbd4784b4d22f9eef4e8a77a80514e00cecc004ea09a809963a848
TLSH
T1CB613C6713323992DB7476F292E21488FEB04E1E95C76A101055A7B6DD3678FABC2328
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ffb3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59ffb3.TMP
Size 3KB
SHA256 b32c788928cbe3e07bac500e4203b3081e04d545dfa24c4c918901f95acde0eb
MD5 3aa9209726bdd2a516b1bbf06e1285cb
SHA1 b4ebc21f03f5366aba6e687103085aa507770f92
SHA512 c9cdbc5adbee384e5541b8d609db222359039de2eb3867bad0c6dba3dac7096ab27eddfbfe87a29b2268dc149ac85943901ee93c81830c154c6af49aeee25157
TLSH
T1B6614C6703323992DB3476F292E21488FEB04E1E95C79E101045A7B6DD3678FABC2328
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 440c58ee0d80cd554df934b08f9df913eb43258137c19db0e0847d1204426b26
MD5 395b5f3a283df722b0d588786a2be854
SHA1 8297fac5abf3e3fc61951671eb881340563e3655
SHA512 1f22b673302dd9291eb21b523099c408bc5c26f4c65d4f0a8b2a662bcb1e25a1344167872729a5339a22a8d36a7906b733488f013b2ecebf55dedf0cebda252b
TLSH
T11A41BDF7C3E4856DC90196F0AB187E1BCE1D0915832C3D5A89E4EE1BA3E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1fcd627ec2f6d1ffb5d932ac7ce9e815eb4f5499445a9d889e09ac1e46fa52c4
MD5 234c6ea7065326b32f244b35c02c141a
SHA1 0a932e2827d1937bc0956dabd1194380256d7bbd
SHA512 d91eb8ca28d63af208427bb059c0b1bb11e5709557a7b3243d9935ab102e535f6dd9d6d76f505341cd469b2d9c9cbeb333bd2bc6df1f3200e44bb425c723d857
SSDEEP 192:sxRzR0yM/jK1Ml8wCP/fUs7LAJZ3l8xozoA8pi/g6+WNIYDM3GcIgtJ:sxRzS8P/fUs70H3l8xxi/5Il3
TLSH
T19C52D8156A38997BCCDBD209FA557F53D6F81572A2901E04AAFCCA0C05E7AED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4c867ff1978882dd14bf6b176425bfe517c07d306efe8ec8b453071f1e5bdc30
MD5 e4cb29553cde9e194ead5de7d58a5bce
SHA1 591263a0513bc28eae0cbdbde83e18a34595322e
SHA512 cb8b5f7d5dd01b7f8619b7306136239155651d0745aece222f81e2bd2305a8ad1e70010774fa8ba626339a043b8cc8a3c87db375c67f7a1047a5cb578ba38471
SSDEEP 192:sxRYR0yM/jK1Ml8wCP/fUsjLAJZ3R8xozoA8p9V/g6+WNCFIa/YDc93GcIgDFJ:sxRYa8P/fUsj0H3R8xx3/5m/pT
TLSH
T1C362D816AA38597B8CDBD209FA557F53D6F81572A2901E04AAFCCA0C05E7BDD2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 37414ab55a1fc511ca96e9a14c0a2c176e4b667204c9287249f872f213a48d64
MD5 501a61119f72c29c2468a12733f6dec8
SHA1 3b19df8282ebe9946fb6579d3e7a9e99380d7ac5
SHA512 199bf5c16a82248b4647b480f83be0926c4bbc58d74881f5a006f85745cc6cc768c5388045a20dbbce1f0337bd7696530d6b49e2e3eb181d3f61b5e7a6814fab
SSDEEP 192:sxRYR0yM/jK1Ml8UQrCP/fUsjL5JZ3R8xozoA8prV/g6+WNCFIa/YDcg3GcIgDXJ:sxRYaqeP/fUsjNH3R8xxZ/5m/S9
TLSH
T1AB62D816AA2859779CDBE209FA517F53D6F81572A2501E04AAFCCB0C05E7ADD2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 c3a620a3dff52c2170f729d76ef7522978ceecfe685b90f3770abbbb32201247
MD5 89f97fbb6edcfeb98f66cdb41bec2e91
SHA1 b1aac81904cff32b3295562c5cc8b31af569d251
SHA512 731de27f3b5815711bfeb736fb6dd36237a11faa36d04dbcec23042c683a4a011616f893d90b9ad276e4d34ecaef66398ff10a9fd81cd4a3ab23e3a470a7d5f0
SSDEEP 768:f+4+zH7pLuL7eDWgb/fPI8F1+UoAYDCx9Tuqh0VfUC9xbog/OVw6kIn2rro7NC:f+4+zBE7eDWgb/fPIu1ja/6kw2Y7NC
TLSH
T153E2EB7B680CCB7E4F404A9DEC29BD9A6DE801CB96D8C95447FA880C03C6AEB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 83a7761fe54a87a173e01719c3caaf7f910e78734fccccbcdb7746bca07a6975
MD5 151ae8b257830180d34c5babc7580b0c
SHA1 2ec2930e1da35842a9d2704d17a40a120a61719c
SHA512 d668df2b7021357c1a24594f49e5dd51ea7a933fe9f812ed78cad7dde1fc0b647e9968c83472ecdff20b31116f46d793d1ae711a41271322ae5ad27835ebb40e
SSDEEP 96:KRGbqGAoouWYN1gmuK4bgUucumFE2vHxOf7JrvbWf8qgjbK4igtbcx50HPQh0gS+:CGbqGAoopYN2mGbgUdumFE2vHxOf7Jru
TLSH
T153910314753706C07D3E35898455D99A82C172A3311A742B7BE802F2AF67E168DFFCD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f4325cf-ec4c-4a90-81fb-ac8c7d5ec33e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5f4325cf-ec4c-4a90-81fb-ac8c7d5ec33e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0139016777b1099192b95f33b37b355059247780f941554306fbd5b0e983cf82
MD5 2ca6e79705c5c1c51c981267de88ab7c
SHA1 69b41134bd25605b2e41642c0a9375ac96552f73
SHA512 0f81a38c39b77d866e6fa6c4753deb9ed60fc44d7f728f18a63f7b570c06ffa20a2d8b3666400ef26e0f1347ae6fee89a1e4e52ee97e580ab83d15675f25a8b6
SSDEEP 768:0rv+4UNbdC3kOFwifimmaHuVboPzkZLNx9OZjUik4K:0bsbs3kvAHOawZLNqlUVr
TLSH
T1D503B035A8649C37DDE7D289B18B3A477FF41153C5840B88C9EC2B4D46AB4AD170BE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 698b03e3e10d5ed31f842735d4e09db82900b5a5161561c613d5fe5dc27a25ad
MD5 51ad96482e2abe0659a362c99f96f2e6
SHA1 ad4ff6194e84bd037f236056cf9eff8c66de3a20
SHA512 c0dad740fb8bc066f1cf5dbbd1679f11eda86c547f8acf415f5996a412678611129b78b82e2b033a64b9722a362867dc1e3de6b27b95c1e8fa338d4b9a9dced8
SSDEEP 768:Mj+9E342xwifimuyaHuVboPzkZLNx9OFOb9MR:L9E34XDHOawZLNqYb+R
TLSH
T1BDF2BF34B8268C278C97C799B24A3A9BBFF01167C4841F88DDE86F0D05D72AD1B07D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 7b8b5a5a9ae81c37285bf664d5c9fd73d906a3c38de5c16f95d47dce59c88454
MD5 23a7f8b0d318a0563e4b1ce381c88593
SHA1 7b3eb3e6813037d6df73d125747e1fdbc75cc029
SHA512 28a583118f398f4a13f2073194b5e77651598394f639d9ed962e7b013c2abdcb30aeffca337d55346ee48df729c68a3910cbe19d4803b0d4634107cec82574df
SSDEEP 768:hF1j+953HwgF8gpmuuaHuVboPzkZLNx9OFOb9MR:g953LxHOawZLNqYb+R
TLSH
T1AF1317F598D38937D89E8787A33D2E46AEBCC163B4881984BBD45E0CCC961BFC706811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

8654438b-241a-4f48-a146-0e27ecee92e8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8654438b-241a-4f48-a146-0e27ecee92e8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1712_1893420140\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1292-375-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1292-397-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1336-505-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1408-476-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1900-322-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2268-480-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2320-440-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2360-456-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2544-451-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2700-420-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2928-387-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2944-278-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3064-416-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3724-326-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3936-238-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4040-284-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4040-266-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4104-346-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5176-191-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5520-293-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5604-341-0x0000000000010000-0x0000000000083000-memory.dmp

Download