261799c260e65561db570ec2f9d0509f9f73622e049e682cc722edbeb2d0d7c4

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_a287c4cf45e791e6ea1f74401888400c_elex_rhadamanthys_stop.exe
Size 243KB
Sample260709-vbge7sdy4r
SHA256 261799c260e65561db570ec2f9d0509f9f73622e049e682cc722edbeb2d0d7c4
MD5 a287c4cf45e791e6ea1f74401888400c
SHA1 da4ada5e63a77fe312ff962360cbc1ed2c8e0888
SHA512 bc3a2c7bea193fe38a20648ec7edaa3f75e778538335b8484b042444f54c7a6267ba8e6c3518be12ba614887fc48e6b459a6aa12ba1c44e726bb6539b23aca19
SSDEEP 3072:nCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:CvMsLaOa3lLNngoqRttA71
TLSH
T165345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1384	CP.exe
5024	bzupjhcwup.exe
3768	CP.exe
6068	CP.exe
2388	i_bzupjhcwup.exe
248	rmbwuomgez.sys
2624	CP.exe
2684	zwrpjhbzwr.exe
5804	CP.exe
4204	CP.exe
1580	i_zwrpjhbzwr.exe
2380	ojhbztrmjh.sys
5552	CP.exe
4908	wqojgbytrl.exe
2576	CP.exe
1688	CP.exe
1560	i_wqojgbytrl.exe
1644	lgdbwtomge.sys
596	CP.exe
4560	jgeywqoige.exe
1548	CP.exe
2140	CP.exe
5336	i_jgeywqoige.exe
6084	jdbytqlidb.sys
1940	CP.exe
5780	ysqlidbvtq.exe
5364	CP.exe
6132	CP.exe
2712	i_ysqlidbvtq.exe
3172	nigaysqnig.sys
5748	CP.exe
5232	fdxvqnigay.exe
848	CP.exe
6012	CP.exe
4640	i_fdxvqnigay.exe
3932	vsnlfdxvqn.sys
1496	CP.exe
1584	kicausnkfc.exe
5576	CP.exe
4836	CP.exe
4724	i_kicausnkfc.exe
508	sqkicauspn.sys
2008	CP.exe
4068	causmkfdxv.exe
4812	CP.exe
2972	CP.exe
5312	i_causmkfdxv.exe
2428	hfcxusmkec.sys
2800	CP.exe
3188	ausmkeczus.exe
6000	CP.exe
4152	CP.exe
3696	i_ausmkeczus.exe
2244	urmkecwupm.sys
3412	CP.exe
5448	mjeczurmje.exe
2896	CP.exe
4732	CP.exe
3652	i_mjeczurmje.exe
3784	wurmjebztr.sys
6100	CP.exe
4544	omgeywrojh.exe
3316	CP.exe
4372	CP.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1449354363\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1611743621\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_312955490\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1934934411\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1076450913\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1076450913\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1076450913\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1611743621\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_312955490\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1934934411\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1934934411\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1934934411\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1076450913\_metadata\verified_contents.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqlidbvtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjeczurmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nigaysqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nigaysqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkeczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrljebwtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrljebwtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dausqnifdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trmjwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgeywqoige.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgeywqoige.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicausnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkeczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljheywuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqlidbvtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjeczurmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dausqnifdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwrpjhbzwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqojgbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgdbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkhcaxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkhcaxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmkecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_a287c4cf45e791e6ea1f74401888400c_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzupjhcwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqojgbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgdbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmkecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trmjwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljheywuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzupjhcwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwrpjhbzwr.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5248	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5432	ipconfig.exe
4904	ipconfig.exe
5656	ipconfig.exe
1216	ipconfig.exe
4208	ipconfig.exe
3176	ipconfig.exe
248	ipconfig.exe
3340	ipconfig.exe
1544	ipconfig.exe
5692	ipconfig.exe
4868	ipconfig.exe
1040	ipconfig.exe
1200	ipconfig.exe
4468	ipconfig.exe
3176	ipconfig.exe
2040	ipconfig.exe
2528	ipconfig.exe
3900	ipconfig.exe
5284	ipconfig.exe
6140	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280893342160422"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1581435544-3586420778-2104125077-1000\{1D1BC147-2224-4366-AF5F-007221873901}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2388	i_bzupjhcwup.exe
Token: SeDebugPrivilege	1580	i_zwrpjhbzwr.exe
Token: SeDebugPrivilege	1560	i_wqojgbytrl.exe
Token: SeDebugPrivilege	5336	i_jgeywqoige.exe
Token: SeDebugPrivilege	2712	i_ysqlidbvtq.exe
Token: SeDebugPrivilege	4640	i_fdxvqnigay.exe
Token: SeDebugPrivilege	4724	i_kicausnkfc.exe
Token: SeDebugPrivilege	5312	i_causmkfdxv.exe
Token: SeDebugPrivilege	3696	i_ausmkeczus.exe
Token: SeDebugPrivilege	3652	i_mjeczurmje.exe
Token: SeDebugPrivilege	6060	i_omgeywrojh.exe
Token: SeDebugPrivilege	4832	i_ztrljebwtr.exe
Token: SeDebugPrivilege	5876	i_olgdbvtolg.exe
Token: SeDebugPrivilege	4364	i_nigaysqlid.exe
Token: SeDebugPrivilege	5344	i_dausqnifdx.exe
Token: SeDebugPrivilege	4724	i_avsnkfdxvp.exe
Token: SeDebugPrivilege	4972	i_smkhcaxspk.exe
Token: SeDebugPrivilege	4580	i_pmkecwuomh.exe
Token: SeDebugPrivilege	4760	i_trmjwuomge.exe
Token: SeDebugPrivilege	5528	i_trljheywuo.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6080	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 3504	1728	2026-07-09_a287c4cf45e791e6ea1f74401888400c_elex_rhadamanthys_stop.exe	88
PID 3504 wrote to memory of 6080	3504	iexplore.exe	89
PID 6080 wrote to memory of 1960	6080	msedge.exe	90
PID 6080 wrote to memory of 5248	6080	msedge.exe	92
PID 6080 wrote to memory of 4692	6080	msedge.exe	93
PID 6080 wrote to memory of 4692	6080	msedge.exe	93
PID 6080 wrote to memory of 4692	6080	msedge.exe	93
PID 6080 wrote to memory of 1296	6080	msedge.exe	94
PID 6080 wrote to memory of 1296	6080	msedge.exe	94
PID 6080 wrote to memory of 1072	6080	msedge.exe	96
PID 6080 wrote to memory of 4172	6080	msedge.exe	95
PID 6080 wrote to memory of 1072	6080	msedge.exe	96
PID 6080 wrote to memory of 1072	6080	msedge.exe	96
PID 6080 wrote to memory of 4172	6080	msedge.exe	95
PID 6080 wrote to memory of 4172	6080	msedge.exe	95
PID 6080 wrote to memory of 5540	6080	msedge.exe	97
PID 6080 wrote to memory of 5540	6080	msedge.exe	97
PID 6080 wrote to memory of 5540	6080	msedge.exe	97
PID 6080 wrote to memory of 3660	6080	msedge.exe	98
PID 6080 wrote to memory of 3660	6080	msedge.exe	98
PID 6080 wrote to memory of 3660	6080	msedge.exe	98
PID 6080 wrote to memory of 5780	6080	msedge.exe	99
PID 6080 wrote to memory of 5780	6080	msedge.exe	99
PID 1728 wrote to memory of 1384	1728	2026-07-09_a287c4cf45e791e6ea1f74401888400c_elex_rhadamanthys_stop.exe	101
PID 5024 wrote to memory of 3768	5024	bzupjhcwup.exe	104
PID 6080 wrote to memory of 1524	6080	msedge.exe	107
PID 6080 wrote to memory of 3080	6080	msedge.exe	108
PID 6080 wrote to memory of 1524	6080	msedge.exe	107
PID 6080 wrote to memory of 3080	6080	msedge.exe	108
PID 6080 wrote to memory of 4472	6080	msedge.exe	110
PID 6080 wrote to memory of 1608	6080	msedge.exe	111
PID 6080 wrote to memory of 1608	6080	msedge.exe	111
PID 6080 wrote to memory of 4632	6080	msedge.exe	114
PID 6080 wrote to memory of 4632	6080	msedge.exe	114
PID 1728 wrote to memory of 6068	1728	2026-07-09_a287c4cf45e791e6ea1f74401888400c_elex_rhadamanthys_stop.exe	115
PID 1728 wrote to memory of 2624	1728	2026-07-09_a287c4cf45e791e6ea1f74401888400c_elex_rhadamanthys_stop.exe	119
PID 2684 wrote to memory of 5804	2684	zwrpjhbzwr.exe	121
PID 1728 wrote to memory of 4204	1728	2026-07-09_a287c4cf45e791e6ea1f74401888400c_elex_rhadamanthys_stop.exe	124
PID 1728 wrote to memory of 5552	1728	2026-07-09_a287c4cf45e791e6ea1f74401888400c_elex_rhadamanthys_stop.exe	128
PID 4908 wrote to memory of 2576	4908	wqojgbytrl.exe	130
PID 1728 wrote to memory of 1688	1728	2026-07-09_a287c4cf45e791e6ea1f74401888400c_elex_rhadamanthys_stop.exe	133
PID 1728 wrote to memory of 596	1728	2026-07-09_a287c4cf45e791e6ea1f74401888400c_elex_rhadamanthys_stop.exe	137
PID 4560 wrote to memory of 1548	4560	jgeywqoige.exe	139
PID 1728 wrote to memory of 2140	1728	2026-07-09_a287c4cf45e791e6ea1f74401888400c_elex_rhadamanthys_stop.exe	143
PID 6080 wrote to memory of 5280	6080	msedge.exe	145
PID 6080 wrote to memory of 4968	6080	msedge.exe	146
PID 6080 wrote to memory of 4892	6080	msedge.exe	147
PID 1728 wrote to memory of 1940	1728	2026-07-09_a287c4cf45e791e6ea1f74401888400c_elex_rhadamanthys_stop.exe	150
PID 5780 wrote to memory of 5364	5780	ysqlidbvtq.exe	152
PID 1728 wrote to memory of 6132	1728	2026-07-09_a287c4cf45e791e6ea1f74401888400c_elex_rhadamanthys_stop.exe	155
PID 1728 wrote to memory of 5748	1728	2026-07-09_a287c4cf45e791e6ea1f74401888400c_elex_rhadamanthys_stop.exe	159
PID 5232 wrote to memory of 848	5232	fdxvqnigay.exe	161
PID 1728 wrote to memory of 6012	1728	2026-07-09_a287c4cf45e791e6ea1f74401888400c_elex_rhadamanthys_stop.exe	164
PID 1728 wrote to memory of 1496	1728	2026-07-09_a287c4cf45e791e6ea1f74401888400c_elex_rhadamanthys_stop.exe	168
PID 1584 wrote to memory of 5576	1584	kicausnkfc.exe	170
PID 1728 wrote to memory of 4836	1728	2026-07-09_a287c4cf45e791e6ea1f74401888400c_elex_rhadamanthys_stop.exe	173
PID 1728 wrote to memory of 2008	1728	2026-07-09_a287c4cf45e791e6ea1f74401888400c_elex_rhadamanthys_stop.exe	177
PID 4068 wrote to memory of 4812	4068	causmkfdxv.exe	179
PID 1728 wrote to memory of 2972	1728	2026-07-09_a287c4cf45e791e6ea1f74401888400c_elex_rhadamanthys_stop.exe	182
PID 6080 wrote to memory of 972	6080	msedge.exe	184
PID 6080 wrote to memory of 972	6080	msedge.exe	184
PID 1728 wrote to memory of 2800	1728	2026-07-09_a287c4cf45e791e6ea1f74401888400c_elex_rhadamanthys_stop.exe	190
PID 3188 wrote to memory of 6000	3188	ausmkeczus.exe	192
PID 1728 wrote to memory of 4152	1728	2026-07-09_a287c4cf45e791e6ea1f74401888400c_elex_rhadamanthys_stop.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-09_a287c4cf45e791e6ea1f74401888400c_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_a287c4cf45e791e6ea1f74401888400c_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ff9d6c3c188,0x7ff9d6c3c194,0x7ff9d6c3c1a0
      4⤵
      PID:1960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,13007684185471654992,666301239668563901,524288 --field-trial-handle=2252,i,1098214861519777944,17732871007794424816,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:11
      4⤵
      System Time Discovery
      PID:5248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,13658464580696211448,1987403733444086451,262144 --field-trial-handle=2252,i,1098214861519777944,17732871007794424816,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
      4⤵
      PID:4692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,7489514254608938416,12944267771461556730,524288 --field-trial-handle=2252,i,1098214861519777944,17732871007794424816,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:13
      4⤵
      PID:1296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,5694799078366052652,12793637829991306853,2097152 --field-trial-handle=2252,i,1098214861519777944,17732871007794424816,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      PID:4172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,10180903800234607380,14686193934452273819,2097152 --field-trial-handle=2252,i,1098214861519777944,17732871007794424816,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
      4⤵
      PID:1072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,4493521082167973996,9509348487019911963,2097152 --field-trial-handle=2252,i,1098214861519777944,17732871007794424816,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
      4⤵
      PID:5540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,16833898281442586988,7579995775154067058,2097152 --field-trial-handle=2252,i,1098214861519777944,17732871007794424816,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:9
      4⤵
      PID:3660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,8726822598508329519,59191857315976989,524288 --field-trial-handle=2252,i,1098214861519777944,17732871007794424816,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
      4⤵
      PID:5780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,4941665320627427242,9088273121304020810,524288 --field-trial-handle=2252,i,1098214861519777944,17732871007794424816,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
      4⤵
      PID:1524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,18390343268465742340,16728065537729183759,524288 --field-trial-handle=2252,i,1098214861519777944,17732871007794424816,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
      4⤵
      PID:3080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,8102398674699213649,13182146772583282667,524288 --field-trial-handle=2252,i,1098214861519777944,17732871007794424816,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
      4⤵
      PID:3220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,8102398674699213649,13182146772583282667,524288 --field-trial-handle=2252,i,1098214861519777944,17732871007794424816,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
      4⤵
      PID:4472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,4464948208651588669,496981930140840201,524288 --field-trial-handle=2252,i,1098214861519777944,17732871007794424816,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
      4⤵
      PID:1608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,8510286846167293927,15059491281060166659,524288 --field-trial-handle=2252,i,1098214861519777944,17732871007794424816,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
      4⤵
      PID:4632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,8115948950068675676,2505898714706341861,524288 --field-trial-handle=2252,i,1098214861519777944,17732871007794424816,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:14
      4⤵
      PID:5280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4788,i,7345311413670546605,2291828358820143347,524288 --field-trial-handle=2252,i,1098214861519777944,17732871007794424816,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
      4⤵
      PID:4968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,577258926421517199,4463251702914566812,524288 --field-trial-handle=2252,i,1098214861519777944,17732871007794424816,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
      4⤵
      PID:4892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,5788293389558478705,2302279288528256271,524288 --field-trial-handle=2252,i,1098214861519777944,17732871007794424816,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
      4⤵
      PID:972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,11436053794819642387,17462287290278326241,524288 --field-trial-handle=2252,i,1098214861519777944,17732871007794424816,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
      4⤵
      PID:6124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,17421775830410040657,16212164550538654943,524288 --field-trial-handle=2252,i,1098214861519777944,17732871007794424816,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
      4⤵
      PID:2368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,15908920057541678769,6170821586372287518,524288 --field-trial-handle=2252,i,1098214861519777944,17732871007794424816,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
      4⤵
      PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4392,i,14720128168549078764,4696289339701101244,262144 --field-trial-handle=2252,i,1098214861519777944,17732871007794424816,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,1135970082495291787,14480537778353737134,524288 --field-trial-handle=2252,i,1098214861519777944,17732871007794424816,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
      4⤵
      PID:5740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,17645293017085746134,1362446209282400328,524288 --field-trial-handle=2252,i,1098214861519777944,17732871007794424816,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
      4⤵
      PID:3080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bzupjhcwup.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1384
- - C:\Temp\bzupjhcwup.exe
    C:\Temp\bzupjhcwup.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5024
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3768
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bzupjhcwup.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6068
- - C:\Temp\i_bzupjhcwup.exe
    C:\Temp\i_bzupjhcwup.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2388
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwrpjhbzwr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2624
- - C:\Temp\zwrpjhbzwr.exe
    C:\Temp\zwrpjhbzwr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5804
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwrpjhbzwr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4204
- - C:\Temp\i_zwrpjhbzwr.exe
    C:\Temp\i_zwrpjhbzwr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqojgbytrl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5552
- - C:\Temp\wqojgbytrl.exe
    C:\Temp\wqojgbytrl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4908
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2576
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqojgbytrl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1688
- - C:\Temp\i_wqojgbytrl.exe
    C:\Temp\i_wqojgbytrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgeywqoige.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:596
- - C:\Temp\jgeywqoige.exe
    C:\Temp\jgeywqoige.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4560
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1548
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgeywqoige.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2140
- - C:\Temp\i_jgeywqoige.exe
    C:\Temp\i_jgeywqoige.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqlidbvtq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1940
- - C:\Temp\ysqlidbvtq.exe
    C:\Temp\ysqlidbvtq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5780
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5364
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqlidbvtq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6132
- - C:\Temp\i_ysqlidbvtq.exe
    C:\Temp\i_ysqlidbvtq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvqnigay.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5748
- - C:\Temp\fdxvqnigay.exe
    C:\Temp\fdxvqnigay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5232
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:848
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvqnigay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6012
- - C:\Temp\i_fdxvqnigay.exe
    C:\Temp\i_fdxvqnigay.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicausnkfc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1496
- - C:\Temp\kicausnkfc.exe
    C:\Temp\kicausnkfc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1584
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5576
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4208
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicausnkfc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4836
- - C:\Temp\i_kicausnkfc.exe
    C:\Temp\i_kicausnkfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\causmkfdxv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2008
- - C:\Temp\causmkfdxv.exe
    C:\Temp\causmkfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4068
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4812
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_causmkfdxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2972
- - C:\Temp\i_causmkfdxv.exe
    C:\Temp\i_causmkfdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausmkeczus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2800
- - C:\Temp\ausmkeczus.exe
    C:\Temp\ausmkeczus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3188
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6000
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausmkeczus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4152
- - C:\Temp\i_ausmkeczus.exe
    C:\Temp\i_ausmkeczus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjeczurmje.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3412
- - C:\Temp\mjeczurmje.exe
    C:\Temp\mjeczurmje.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5448
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2896
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjeczurmje.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4732
- - C:\Temp\i_mjeczurmje.exe
    C:\Temp\i_mjeczurmje.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgeywrojh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6100
- - C:\Temp\omgeywrojh.exe
    C:\Temp\omgeywrojh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4544
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3316
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgeywrojh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4372
- - C:\Temp\i_omgeywrojh.exe
    C:\Temp\i_omgeywrojh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrljebwtr.exe ups_run
  2⤵
  PID:1444
- - C:\Temp\ztrljebwtr.exe
    C:\Temp\ztrljebwtr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3288
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5172
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrljebwtr.exe ups_ins
  2⤵
  PID:900
- - C:\Temp\i_ztrljebwtr.exe
    C:\Temp\i_ztrljebwtr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\olgdbvtolg.exe ups_run
  2⤵
  PID:2996
- - C:\Temp\olgdbvtolg.exe
    C:\Temp\olgdbvtolg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:944
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1120
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_olgdbvtolg.exe ups_ins
  2⤵
  PID:4704
- - C:\Temp\i_olgdbvtolg.exe
    C:\Temp\i_olgdbvtolg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nigaysqlid.exe ups_run
  2⤵
  PID:5268
- - C:\Temp\nigaysqlid.exe
    C:\Temp\nigaysqlid.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3656
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3028
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nigaysqlid.exe ups_ins
  2⤵
  PID:3728
- - C:\Temp\i_nigaysqlid.exe
    C:\Temp\i_nigaysqlid.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dausqnifdx.exe ups_run
  2⤵
  PID:3524
- - C:\Temp\dausqnifdx.exe
    C:\Temp\dausqnifdx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5408
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5004
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dausqnifdx.exe ups_ins
  2⤵
  PID:5276
- - C:\Temp\i_dausqnifdx.exe
    C:\Temp\i_dausqnifdx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avsnkfdxvp.exe ups_run
  2⤵
  PID:5988
- - C:\Temp\avsnkfdxvp.exe
    C:\Temp\avsnkfdxvp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1992
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1328
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avsnkfdxvp.exe ups_ins
  2⤵
  PID:1700
- - C:\Temp\i_avsnkfdxvp.exe
    C:\Temp\i_avsnkfdxvp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkhcaxspk.exe ups_run
  2⤵
  PID:1160
- - C:\Temp\smkhcaxspk.exe
    C:\Temp\smkhcaxspk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4844
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5396
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkhcaxspk.exe ups_ins
  2⤵
  PID:1108
- - C:\Temp\i_smkhcaxspk.exe
    C:\Temp\i_smkhcaxspk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmkecwuomh.exe ups_run
  2⤵
  PID:904
- - C:\Temp\pmkecwuomh.exe
    C:\Temp\pmkecwuomh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5756
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5952
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmkecwuomh.exe ups_ins
  2⤵
  PID:2584
- - C:\Temp\i_pmkecwuomh.exe
    C:\Temp\i_pmkecwuomh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trmjwuomge.exe ups_run
  2⤵
  PID:4300
- - C:\Temp\trmjwuomge.exe
    C:\Temp\trmjwuomge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3460
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4104
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trmjwuomge.exe ups_ins
  2⤵
  PID:4532
- - C:\Temp\i_trmjwuomge.exe
    C:\Temp\i_trmjwuomge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljheywuo.exe ups_run
  2⤵
  PID:5000
- - C:\Temp\trljheywuo.exe
    C:\Temp\trljheywuo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4664
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1556
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljheywuo.exe ups_ins
  2⤵
  PID:704
- - C:\Temp\i_trljheywuo.exe
    C:\Temp\i_trljheywuo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5528

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3656

C:\Temp\rmbwuomgez.sys
C:\Temp\rmbwuomgez.sys
1⤵
- Executes dropped EXE
PID:248

C:\Temp\ojhbztrmjh.sys
C:\Temp\ojhbztrmjh.sys
1⤵
- Executes dropped EXE
PID:2380

C:\Temp\lgdbwtomge.sys
C:\Temp\lgdbwtomge.sys
1⤵
- Executes dropped EXE
PID:1644

C:\Temp\jdbytqlidb.sys
C:\Temp\jdbytqlidb.sys
1⤵
- Executes dropped EXE
PID:6084

C:\Temp\nigaysqnig.sys
C:\Temp\nigaysqnig.sys
1⤵
- Executes dropped EXE
PID:3172

C:\Temp\vsnlfdxvqn.sys
C:\Temp\vsnlfdxvqn.sys
1⤵
- Executes dropped EXE
PID:3932

C:\Temp\sqkicauspn.sys
C:\Temp\sqkicauspn.sys
1⤵
- Executes dropped EXE
PID:508

C:\Temp\hfcxusmkec.sys
C:\Temp\hfcxusmkec.sys
1⤵
- Executes dropped EXE
PID:2428

C:\Temp\urmkecwupm.sys
C:\Temp\urmkecwupm.sys
1⤵
- Executes dropped EXE
PID:2244

C:\Temp\wurmjebztr.sys
C:\Temp\wurmjebztr.sys
1⤵
- Executes dropped EXE
PID:3784

C:\Temp\bztrljebwu.sys
C:\Temp\bztrljebwu.sys
1⤵
PID:3304

C:\Temp\ywqoigdbvt.sys
C:\Temp\ywqoigdbvt.sys
1⤵
PID:3900

C:\Temp\lfdbvtnlfd.sys
C:\Temp\lfdbvtnlfd.sys
1⤵
PID:4428

C:\Temp\qnigdxvqni.sys
C:\Temp\qnigdxvqni.sys
1⤵
PID:1772

C:\Temp\davsnkfcxv.sys
C:\Temp\davsnkfcxv.sys
1⤵
PID:3600

C:\Temp\xrpmkfzxsp.sys
C:\Temp\xrpmkfzxsp.sys
1⤵
PID:5284

C:\Temp\ukhfzxuomk.sys
C:\Temp\ukhfzxuomk.sys
1⤵
PID:1748

C:\Temp\zurmkecwuo.sys
C:\Temp\zurmkecwuo.sys
1⤵
PID:3164

C:\Temp\urmjebzwuo.sys
C:\Temp\urmjebzwuo.sys
1⤵
PID:5512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bzupjhcwup.exe

Path C:\Temp\bzupjhcwup.exe
Size 243KB
SHA256 ce6bba13334842327a1b1cb7183d219a82401a7ce34071b0ba2b7831d235815f
MD5 497e9bca5ccc75c16531c371af132ea9
SHA1 09ae0430a651a276b1779441b51662030dfe2366
SHA512 c7e89bb1e8856d9ed2df7dbaeb2d118baee31bbf355408e9349280685b97ae1985adac7e2e329e20480fdd2892a6f9d26a94c8fcec4dc1ff6f8557cbf7d4e554
SSDEEP 3072:nCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:CvMsLaOa3lLNngoqRttA71
TLSH
T1DB345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvqnigay.exe

Path C:\Temp\fdxvqnigay.exe
Size 243KB
SHA256 b4e11ba3bc7cf2cd8570f29712c7c7fe6bdd8f87db1512578a44da65ce6225b3
MD5 9f8346b1b0aa2d452881eb15d1df2514
SHA1 afe32278376e2ec1aed12a45eb7f0601f7b74d4c
SHA512 0f2f502a0416f52b71e760030a7a4456cce4d09fd9e1d6b0ccc864162cd731ff441a099107bd3af5eb71077344297743e1b594e7d22eae9e5cddb6fe308b61ea
SSDEEP 3072:aCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:FvMsLaOa3lLNngoqRttA7Y
TLSH
T1D6345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bzupjhcwup.exe

Path C:\Temp\i_bzupjhcwup.exe
Size 243KB
SHA256 fa5df967056798040f0f06e8becc849e5132ac535ec6333b4b7e7e6e5fea4b10
MD5 d926d9e4bb55227796a5ce19a62e42e8
SHA1 4d703dbd167011d3f24227b9ff6a391c7225013c
SHA512 2d67eba43834ea7fa3b045aa05384971e533631078e941bdd71cbb01ce54555b166abf0ecbec0bc2d2d3c6ef3e6bbe660d1678655c0500b38df42135d0db9960
SSDEEP 3072:PCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:avMsLaOa3lLNngoqRttA71
TLSH
T19A345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdxvqnigay.exe

Path C:\Temp\i_fdxvqnigay.exe
Size 243KB
SHA256 0bad4a67ee68c002d91c215c73743f1dd85e7b8a3fa4c2e9550904da6e55a76c
MD5 174079c9775d04416e24e42aa2e4f1e8
SHA1 bfdf6a13232c9efc2d30119b6ed5abf89ce5ab06
SHA512 cd9af241f913c21a79a7983988e7aeee66c08a52657696039c678c52feb07bd3832301ca6626dd08b506b11cb648529bbac77212323865268417ffda841daed7
SSDEEP 3072:bCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7l:OvMsLaOa3lLNngoqRttA7l
TLSH
T1E1345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jgeywqoige.exe

Path C:\Temp\i_jgeywqoige.exe
Size 243KB
SHA256 606bcc050200849ebe9b8d0db0ba62fd732f18c0d1513aa18d55287f909b21d0
MD5 7509fa06277181853818d9d3853a5839
SHA1 4438b5f9805a1367496923dc2bf8f4c87da8e6fd
SHA512 37ced2a87816d5777018eb9ea3979364051ce5bc13a4ce7bedefcc3b4253be2c87e979273b7b12c360e11ae23cf85247eac5dcf12a91e037e2f543b488ac9105
SSDEEP 3072:+CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:xvMsLaOa3lLNngoqRttA7o
TLSH
T125345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wqojgbytrl.exe

Path C:\Temp\i_wqojgbytrl.exe
Size 243KB
SHA256 441b6d3081e6b8b9b9643c36d35cf6fff6e94b01afe86b27b01591a87d39df09
MD5 9dc1bb34938e264c1200bd0ffc3f80ea
SHA1 fa01536e32d558d76783a02c84c091974a2981d0
SHA512 d9d11357b80aaa37ea0952129ca4c98c508a56c7cce9619a4687bb9d96ce79f91ad4f7f74207a827c0cd1b622b8c2d406a8276676f6dff9f725d9fb8b4f7bd8c
SSDEEP 3072:tCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7X:gvMsLaOa3lLNngoqRttA7X
TLSH
T165345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ysqlidbvtq.exe

Path C:\Temp\i_ysqlidbvtq.exe
Size 243KB
SHA256 0d20afce42aff232f2bf9a0098f8642aced01c702927a18bf5bd131d163a65ae
MD5 aad8b071f5c5485de308cf87320cb8c7
SHA1 3e0f61ef69514e24947ad878fc17e8847311f6eb
SHA512 d9446c585630c1cc2aabc2600e77f55483d52cbe2d72ca4a90ad3843bd8e45cc2bf6e2a80085b73f0de0fdf1a17204443ee469b4711c817d605da0ebb0dd1a6b
SSDEEP 3072:gCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7y:bvMsLaOa3lLNngoqRttA7y
TLSH
T169345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zwrpjhbzwr.exe

Path C:\Temp\i_zwrpjhbzwr.exe
Size 243KB
SHA256 30b793b68fefe0d04714bfb791a18b1f83d329b5c623c361fe74f3f6954bcac1
MD5 d9c11358ea9a252126ed0748a7e76018
SHA1 443126aa689be13b14098725594213f61f069c34
SHA512 1ca252d3a374cfe1961535ab54c61e69c3c838d9646d212ed525733994566566956c14ede1b5e234c3dedb5d58442eb241b6646bea45e4e5bb5e78b73087bc8c
SSDEEP 3072:nCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7J:CvMsLaOa3lLNngoqRttA7J
TLSH
T12E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbytqlidb.sys

Path C:\Temp\jdbytqlidb.sys
Size 141KB
SHA256 ea8db2ca886055c2e652f9b41df532a0e283b92b8bf849faf599ce05309c13fb
MD5 e4f4281f61dfbe2018061d30e8f37665
SHA1 3a024a7d122e02d0e9b75d4a7f9f2320ffa8cadc
SHA512 69c6f8ddccd1cd893c40f8acd4db8758cd8429b7c88aa4cfba94dc4be13ea4938b91bae5dccd64fd052961d363b9b8ef6d36029b55824ccfad1104a1451ceff3
SSDEEP 1536:ha3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ha3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T108E37C12B2D2D172E4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgeywqoige.exe

Path C:\Temp\jgeywqoige.exe
Size 243KB
SHA256 b513644951a3422ec6810b2e166a92c929b0585f1089d9a2b816eb5e93233c88
MD5 8e3facc2bec08b209d2243797d3ba471
SHA1 167018e0b2176457047123488e987d87c150add2
SHA512 cbb3352c803394719c3f577774c332f4a28df5977d2168c5766abbb5f83b860665138d423ef6b5c7f2c79c16c054eb30f1584c2bd9d870ec6c176af13c92673b
SSDEEP 3072:DCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7R:GvMsLaOa3lLNngoqRttA7R
TLSH
T127345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdbwtomge.sys

Path C:\Temp\lgdbwtomge.sys
Size 141KB
SHA256 d1955271e3bb68914201be86c443df9805d5787d5524315a297fa8a30b8ff077
MD5 a3d3f2eb6e2eb2422e0bee1273c1d102
SHA1 5fdbe4b4a3cc57f14eab08cb838dea307f9637d2
SHA512 3b95be959dd395024bd75302cff20093562a3987264346b4350f5710665329e501d46a24a6958bd2f8465b08bd0cca1c1595e5faa15a7a497d359015a5b63862
SSDEEP 1536:7a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:7a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1AEE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nigaysqnig.sys

Path C:\Temp\nigaysqnig.sys
Size 141KB
SHA256 317efbbd595ffdd580d7b2968ec824dafec1bea60bcf972199242942a172b7e7
MD5 98b14760a91d8fe2035a7cac9a93c486
SHA1 5154811706d2a922c454178d437d636a7f866af8
SHA512 7423cde5896da79b613ff5b5930a5fb5a976fb17ed887c9239d67fa6ccfed6515bbc51e49f6073cc9791f23f484cb5110e2ae77bb8e03eea01876facb2184561
SSDEEP 1536:ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C6E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojhbztrmjh.sys

Path C:\Temp\ojhbztrmjh.sys
Size 141KB
SHA256 f886558611567530b97b773c74493cc3253ff2eea33ef0c0086f6b01906902c1
MD5 d62d21498fef66d2db0d1f18d861993f
SHA1 c9690082c22ee6de408965885583a0c408137559
SHA512 f45067af57ab22170ccea976fb885d028222978da0a6ab4bd92363800f035ef6ed35da3d8e5fdf7ab733be6cab58cb510ad27d20447881a2c0bac9e1a9d928e2
SSDEEP 1536:8a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:8a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T14BE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmbwuomgez.sys

Path C:\Temp\rmbwuomgez.sys
Size 141KB
SHA256 543756dc79de0464035312916b47266f5e35ddcd0f24b79e88c3756bace0a570
MD5 a60b55af36f3b4ab4c41f36209659e4a
SHA1 33a568d2eb6b4fbd849b05184a973ede7bf2e589
SHA512 b73ec8e75ce189181ae4afa600be5ea35ba6cfa0c2a821d329e61dcab215815964696aa9e1cd691a6db70cd0d4dc40d06459165b9a776aa15771be3762146888
SSDEEP 1536:4a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:4a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T197E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnlfdxvqn.sys

Path C:\Temp\vsnlfdxvqn.sys
Size 141KB
SHA256 1684b9bd8688838270c678645afc6e9f5c72f6d82bb5f4984a1db955cf09fd37
MD5 508c0a62c30978d2b8718b633ad8d657
SHA1 7ab16577f988e93b8a71c332566965ac5fbb35f2
SHA512 6b6439a0598beb9695b321ef6ad7edbfa03d7ecf3fd887856e009f4640b4d3406bd80d18ba378ae578d0e939d6eef884f4e70083e3ebf4a950c8da058d9d2c81
SSDEEP 1536:ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T140E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqojgbytrl.exe

Path C:\Temp\wqojgbytrl.exe
Size 243KB
SHA256 4b06a75400f18552aa6981f373523c38aaff09b433c1993df08cec2c515adfac
MD5 dc416b85d4060821334113077ddd1f0e
SHA1 09a07e36f03378e4751e54269eb3f1a82ca576ca
SHA512 22f520444b21f89fb0ab669ce871793a77dd08253391cbebb0ba5a051230d253cdb87de434e1cdd399c6627afe787d0bc7e59a89c944168a97d8a320c76ae2b8
SSDEEP 3072:dCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7f:QvMsLaOa3lLNngoqRttA7f
TLSH
T15F345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqlidbvtq.exe

Path C:\Temp\ysqlidbvtq.exe
Size 243KB
SHA256 18b0d213061ab87a9bd98cf897d0ae54515ebe7577a718acb8ab1dbb7a982d86
MD5 ad34095fe0b3b2b0a8fe982866d0c534
SHA1 e3b47e3da3ad7f58c3dc9e4eb6ada3798c795f79
SHA512 a55f577e8d23371d8dc982995b665ca5f51b06a74b2bb7a3dcece3712edb3043dc4d05a3cbca4826868194e4e70c0c5c5646931e79ad4c4b463b99663eb705b7
SSDEEP 3072:vCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7F:6vMsLaOa3lLNngoqRttA7F
TLSH
T176345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwrpjhbzwr.exe

Path C:\Temp\zwrpjhbzwr.exe
Size 243KB
SHA256 57215824b0dfc3567af1231e236b12eea7a1baa17d55a836cd7b317f71aaeabe
MD5 2ddf547af8a668de6ece3286d4a52c01
SHA1 fa92b993b50f35b69575b8423a2c4ba1b36b270f
SHA512 7ae4bd939617387c8f961c885e67163ee69f63a57c0a9185b0cd1b12e5199aa7a770297f48120f8933347555d93a7472ef044f50ce4b755a8c0b98186292afac
SSDEEP 3072:OCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:BvMsLaOa3lLNngoqRttA7Y
TLSH
T14B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27950d40a9551c84ad47cd8133b3dc2562d0cbfb9e6e2862e52b6ffc59465636
MD5 3cdef261498cc0a89a5099917822c668
SHA1 8386a4997ce2ae9e730585e5e657293325681cc6
SHA512 3a8de603951463432923081d35c238e0d798a1d4f2e6ccf76499aa997c2e7f6498ecd60523b96ebdec43384983d689dd047458813137f74e88aba315a69353a7
TLSH
T1F4D02B5932002D44C483383732502221E3209432082401084051B17C4C5C546066F4EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c6cefa1e36fc8c458c1103dc425dc7d4774e2a109aed9ce8254e2f005fb9cc99
MD5 ce6d65fb8c0c0020b2525439c0b95194
SHA1 a2e2e5c2fbd1d6df05e8e5aedb7fb4f66906627d
SHA512 5b2ae476b36e7a5d7be156e29405a78d59922fd34a87bb430ddc143f501f55bfeb3b0c1103f165ecc20fb18970c574188e4b078cfc4406a77b6c5f6c8c03c9ae
TLSH
T11AD02B5532102C44C483383B32512221E3109432042401084051F17C4C5C546066F4DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 5cec3443924f2330b47aa7a169f55068c80b98e297fb978c36d852002c3943c1
MD5 6ae3a821f76f17138402338791821af6
SHA1 21a71031f1d49e27ca913b99db7cbd1839458093
SHA512 56ba2eb44b979f58f52fb81a5964901ec79ec17616b92306f6bf4524488902606224da8af48f8d86dc3b4558881ffaf935ac6ddb6e34e03494f45da31526584e
TLSH
T18841D7E7C33B4BDAD7FC4DB2DEE985C5B63BF39E09032E009090B8B91826F419001595
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 492c9278db81975c5eef22346c74a7765d3f9a8b37e6bf85f45f5ca1a7192583
MD5 91e9ed322da12d956abe9320dbcfa0ee
SHA1 94c3dec7689059206081d76167b6193d61c4af2f
SHA512 fce38e8e453d638905da97098949830259661fe12600a89a250591802e38227301c81ea892c6865acf39cb8957818eeebc0f1460e3561086b6bb6dbd0220f5b6
TLSH
T16B41BEF3C3E4866E890156F4AA186E2BCE1D0A15432C3D5AC9E4EF5B93F3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 35b7eec04f3abb76bed2aeefe204f2f657e6debc327896773868642dc1613b0e
MD5 0b858ca2a4ee90042b500fcc9a1da838
SHA1 26e4f43606ae42d55bc9bf227d71c0a369029a71
SHA512 ddc8d6ccdfc88bfc2b7a8ebf41c505c4cd0f05c44c06372a718563f708f5fcb983453eaa0e26a22f953af56e56cf21f0ae9c92f23c46e80495e472d98b791af0
SSDEEP 192:sxRmRNPyM/jK1Ml8wC8/fwsTjalXZ/zoA8pi/g6+WNIYk0JH72DGlIgtJ:sxRm188/fwsTjwpWi/5I2H72g3
TLSH
T18A52E915AA24997BCCDBD219FA557F53D6F81573A3901E44AAFCDA0C00E76EC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 03c5b39b1df933c09668b84dff1915280ab72f3245162f9818865909d78ac0d9
MD5 6da14df7bf9cf753c59201806e624212
SHA1 071767ee022fb31453bc9b15de891f6e69652c3d
SHA512 22fe14f1ce973de6a838e695dd8095f69586310523b654986b85f34b1dd74577402125023ffd5950e5232be559fcaef09d4861187b5ade7e67ae685a93578a3a
SSDEEP 192:sxRRRNPyM/jK1Ml8wC8/fws7jalXZ/zoA8pi/g6+WNIYk0JH72DGlIgDuJ:sxRR188/fws7jwpWi/5I2H72gW
TLSH
T10952EA15AA24997BCCDBD219FA557F53D6F81572A3901E44AAFCDB0C00E76EC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 35c4b5ae62c6c847ecb85c6c2f8cf48186b5cede145ce02d3949a190c882123a
MD5 2023b777fc54635ef531a4a579394f94
SHA1 f03403900f2bedc8f00e08f40d4b92f64f596c16
SHA512 0bd7292ffc5858c39d5e248bf77b070c019a5054aca4776b8410ee855db799f7ac456367ee6496a4819d324ff78368b14866ea38d0d983c2091cb8937174b23c
SSDEEP 192:sxRRRNPyM/jK1Ml8wC8/fws7ja4XZXzoA8p9I/g6+WNCLp/Yk4JH72DGlIgDgJ:sxRRn88/fws7jFp+m/58/KH72gg
TLSH
T15362D915AA245D7B9CDBD219FA557F53D2F81572A3911E44AAFCCB0C00E7ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 26e58465f23718dfbccf195a31dfeafd425d29ab643f7edede853f71118f8e69
MD5 b8891cc9b0a9d49e013c26c963f07394
SHA1 f255d4cfae63b56d59485ca65cfed3789cb4d3a1
SHA512 761859f33a9560f5a52a2b8ea9ea40c495b8670b282c7166724800dc407a6da8b4425f629d7660b7940a920baf7466143b1ebc1565b4c3e5e8aedc477618feef
SSDEEP 192:sxRRRNPyM/jK1Ml8UQvC8/fws7ja4XZXzoA8prI/g6+WNCLp/Yk4JH72DGlIgDgJ:sxRRnq68/fws7jFp+E/58/KH72gg
TLSH
T1F862D816AA249D779CDBD219FA557F93D2F81572A3941E44AAFCCB0C00E76DC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 a906b8b6091b9a3d02ca74cc86f6f1449a6223e58ce298f392483cf62adf4df0
MD5 422c77f27489aec1013d09436b82f9c9
SHA1 b6909cbb1c5fde85a02a5ad41d19a68583945f41
SHA512 a9d7a156213dab37888c4e84b39a0137f045b292dc10a0114c2bf0e9389889567221cccbbcc0bdc845604df035bd4757af700e7d02a253d01cf511be3b386722
SSDEEP 768:ZUwifd7pLuL7aHWgRhf2r8F1+UoAYDCx9Tuqh0VfUC9xbog/OV89EnxeUrolRzMI:ZUwifLE7aHWgRhf2ru1jaP9Exe/7MI
TLSH
T1C1E2FC3B680CCB7E4F804ADCEC297D9AADA801CF96D8C95447FA854C03C66EF51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 015df0f009f686a9c938f596de73ae7baf550b8b14cb9d41c93e2e8f957b239d
MD5 f360d6919252a6a00a2dec7d921568ae
SHA1 56676874534e83d844dd2e86cf82b8f48fce9dc4
SHA512 8da8905f867bcc6f44aeeb9210419887358540795c8e8e5b0b442410fad39b851900756bca9cfaa9bf6112406aa4346cc6554d8d3ebbba2ce17012b3da9a3977
SSDEEP 96:KRuDSOowg2Ww19gO2K4TgM2cmut8unHgRkQiOCYWm7LgYYK49gKYcY4rKQS3eyEm:CuDSOowgBw1OOeTgMlmut8unHgRkQiOl
TLSH
T131C1179570370280397D6588C1E89C96B1C27066306EA57BBFAC11E32F67D06DEFE8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a0020.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a0020.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c291e85ebc9ab3be78bfb040c02cc805598f9dd04c5136bf189bfd3c07294762
MD5 0351bdb805022e879a0c15379b680abd
SHA1 e1c5841642e7d4234e23b704565eb9e1954ea0d1
SHA512 a0a96274043a8e4c3f41e388d9fae5937d95de78366643327b0d5edf17dda99d71a0b45aedb0908a504473d20730cdc11c5b23bfecb06323c07886ab4fbb3bbf
SSDEEP 768:Wj+923h7S/Q8WkImuc45YtR6/IpR5myymCbanb9MZ:F923m4+MIpGhlAb+Z
TLSH
T154F2C030BC558EB39DE6A3D9721B3A96EEF061B7D8C41F84E5E99F0D008378D074681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 fd66d7c10b38a66cd8ae79928cb98d1d8fcb8c9340edf04e4a956c661cda361b
MD5 7ebc1f4968c764c5b84bc3fb4f3408b2
SHA1 c862b6d39d4e90f4be0550f0b4da75e3204a3b63
SHA512 411b92b2c112a35e119f1f3648ca32e5b3311abd5e4e443219aed485bf158e3e1071ef39a4aa0be83ada1529614db0c36d136b52e10accab32130673d160d839
SSDEEP 768:5rv+4UNbdQ3s7S/W8WkImuc45YtR6/IpR5myymCbanb9M9:5bsb6314+MIpGhlAb+9
TLSH
T17313DF30BC288EB3ADF6A294B15B3997BEF460B7C8C40B94E5E94B0D05575CE170B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5e7f8a061b4608471a7d2633609ccfa12ca59a1be4efb6118d4c37a667f3af7b
MD5 00f0110baef0ef8758c1284e9891064a
SHA1 82257cc5d02280c9dbcdeca3ea81321aaa3f24e7
SHA512 5a4696887d61c75ca024883ee52112b4f77f7c1bf1542b711d74f08d66076b305f3c5a31a2f3f604bce6fd8ea36d0349700e2cf9dc21a0334677975f83fd0117
SSDEEP 768:Srv+4UNbdL3P88kImuNR6/IpR5myymCbejUiBf8j:SbsbZ3CIpGhlAUL
TLSH
T1F703D032B8588AB3DDF2A2C971477953BEB46063D9C40BD0D5ED2B0D42AB58E1307D67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 b003003ab43b861ad079b04b840490138924bafaf047146878402f12a5005364
MD5 411f059da8748af0b8caa3baff5901a9
SHA1 3c6b9a683380ec68484179fc87319edd89778e66
SHA512 b4cd3b4bd34bcfd716120e48732f29ef607bc70dc7289cfdf6c763920f5b757e06a9a34db9f7a3c469fab8b0d3321f7a4bf4e4f8c9e436578532e1fd9bdc9dcd
SSDEEP 768:IF1j+973hwg/7S/h8TtEc45YeR6/IpR5myymCbanb9MZ:l97314+5IpGhlAb+Z
TLSH
T19F1338F198D78A76E9AE5787633E2D469DFCD1A7B4881984B7D44E0CCC821BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6080_596710851\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-188-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/508-323-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1644-283-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1644-260-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1748-479-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1772-436-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2244-343-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2380-235-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2428-339-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2428-370-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3164-526-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3164-507-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3172-305-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3304-400-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3600-456-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3600-476-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3784-373-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3900-413-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3932-325-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3932-317-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4428-425-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5284-474-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5512-511-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6084-282-0x0000000000010000-0x0000000000083000-memory.dmp

Download