401882171aeca59d1698b05403a5e089f2780e72007618161e8e29b0e37f1518

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 01:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_e47336bcf47f013dd73e7e846451c4ee_elex_rhadamanthys_stop.exe
Size 243KB
Sample260718-b36pmab19m
SHA256 401882171aeca59d1698b05403a5e089f2780e72007618161e8e29b0e37f1518
MD5 e47336bcf47f013dd73e7e846451c4ee
SHA1 ee1af6d40862ecb56dd0cb073540b70bc89b1eb4
SHA512 c0db4c59034f146e7c56daaee216be61f7aaf01ea11b57d9c3ce0385f8fd7b00590ee56f672f738676893435dbf42442581d33fef739fa392975c50c2de7927a
SSDEEP 3072:S+615lUSLx+Jhf7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7w:EDlUSLMQa3lLNngoqRttA7w
TLSH
T183345A0172818031E75A0B78046AE7A1467E7D344BA5E5CFF7A83B7A5E312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
5836	CP.exe
2224	eczusmkezw.exe
2460	CP.exe
1968	CP.exe
4916	i_eczusmkezw.exe
1900	jecwuomkec.sys
5500	CP.exe
2504	cwurljhezw.exe
2872	CP.exe
3592	CP.exe
2348	i_cwurljhezw.exe
6088	hbywurmjec.sys
4828	CP.exe
2652	trljebwtol.exe
4120	CP.exe
4568	CP.exe
2708	i_trljebwtol.exe
2828	ebwtomgeyw.sys
956	CP.exe
5592	ztrligbytr.exe
4668	CP.exe
1212	CP.exe
1832	i_ztrligbytr.exe
4368	tqligdbvto.sys
3400	CP.exe
3912	ligaytqlid.exe
4152	CP.exe
1576	CP.exe
4232	i_ligaytqlid.exe
3100	kigaysqkid.sys
1232	CP.exe
1204	fdxvtnlfdy.exe
5068	CP.exe
1812	CP.exe
1248	i_fdxvtnlfdy.exe
4172	qkifdavsqn.sys
2840	CP.exe
4132	nkicavsnki.exe
2696	CP.exe
5964	CP.exe
2032	i_nkicavsnki.exe
2764	caxspnhfzx.sys
1176	CP.exe
4560	axspkhcaus.exe
1244	CP.exe
3564	CP.exe
5288	i_axspkhcaus.exe
4728	causmkecxu.sys
3708	CP.exe
3232	wupmhczusm.exe
2196	CP.exe
4912	CP.exe
4928	i_wupmhczusm.exe
484	rpjhezwurm.sys
4508	CP.exe
5524	pjhezwrpjh.exe
4620	CP.exe
4984	CP.exe
960	i_pjhezwrpjh.exe
4076	cwuomgezwr.sys
2060	CP.exe
4488	cwugeywroj.exe
4228	CP.exe
6136	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2208_371828069\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2208_1235570178\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2208_664656810\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2208_664656810\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2208_1697974230\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2208_1697974230\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2208_1697974230\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2208_1235570178\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2208_1697974230\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkicavsnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wupmhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzwrmjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebztromgeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eczusmkezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eczusmkezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljebwtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnkidayvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupnhfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzwrmjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwurljhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwurljhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrligbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvtnlfdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgeywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupnhfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljebwtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ligaytqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ligaytqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkicavsnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwugeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwugeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_e47336bcf47f013dd73e7e846451c4ee_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrligbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgeywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdxvqnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpjhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvtnlfdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axspkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wupmhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdxvqnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnkidayvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausnkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebztromgeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axspkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausnkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpjhfzxrp.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1016	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5980	ipconfig.exe
4380	ipconfig.exe
2548	ipconfig.exe
5612	ipconfig.exe
4136	ipconfig.exe
576	ipconfig.exe
5648	ipconfig.exe
4136	ipconfig.exe
4076	ipconfig.exe
5612	ipconfig.exe
4916	ipconfig.exe
5996	ipconfig.exe
5068	ipconfig.exe
5180	ipconfig.exe
2008	ipconfig.exe
4676	ipconfig.exe
5196	ipconfig.exe
5356	ipconfig.exe
4728	ipconfig.exe
5564	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288124777302967"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{C8EDB73D-4F77-4EA8-A55C-FA3BC20AA940}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5288	msedge.exe
5288	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4916	i_eczusmkezw.exe
Token: SeDebugPrivilege	2348	i_cwurljhezw.exe
Token: SeDebugPrivilege	2708	i_trljebwtol.exe
Token: SeDebugPrivilege	1832	i_ztrligbytr.exe
Token: SeDebugPrivilege	4232	i_ligaytqlid.exe
Token: SeDebugPrivilege	1248	i_fdxvtnlfdy.exe
Token: SeDebugPrivilege	2032	i_nkicavsnki.exe
Token: SeDebugPrivilege	5288	i_axspkhcaus.exe
Token: SeDebugPrivilege	4928	i_wupmhczusm.exe
Token: SeDebugPrivilege	960	i_pjhezwrpjh.exe
Token: SeDebugPrivilege	1572	i_cwugeywroj.exe
Token: SeDebugPrivilege	5612	i_jgeywqojgb.exe
Token: SeDebugPrivilege	4992	i_lgeywqoigb.exe
Token: SeDebugPrivilege	4720	i_nlfdxvqnlf.exe
Token: SeDebugPrivilege	4684	i_tnkidayvpn.exe
Token: SeDebugPrivilege	4368	i_ausnkfcxvp.exe
Token: SeDebugPrivilege	1116	i_xupnhfcxvp.exe
Token: SeDebugPrivilege	4720	i_urpjhfzxrp.exe
Token: SeDebugPrivilege	1312	i_bzwrmjhbzu.exe
Token: SeDebugPrivilege	2672	i_ebztromgeb.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 560	4544	2026-07-17_e47336bcf47f013dd73e7e846451c4ee_elex_rhadamanthys_stop.exe	89
PID 560 wrote to memory of 2208	560	iexplore.exe	90
PID 2208 wrote to memory of 5456	2208	msedge.exe	91
PID 2208 wrote to memory of 2844	2208	msedge.exe	92
PID 2208 wrote to memory of 1016	2208	msedge.exe	93
PID 2208 wrote to memory of 2844	2208	msedge.exe	92
PID 2208 wrote to memory of 2844	2208	msedge.exe	92
PID 2208 wrote to memory of 1648	2208	msedge.exe	94
PID 2208 wrote to memory of 1648	2208	msedge.exe	94
PID 2208 wrote to memory of 1212	2208	msedge.exe	95
PID 2208 wrote to memory of 1212	2208	msedge.exe	95
PID 2208 wrote to memory of 1212	2208	msedge.exe	95
PID 2208 wrote to memory of 6092	2208	msedge.exe	96
PID 2208 wrote to memory of 6092	2208	msedge.exe	96
PID 2208 wrote to memory of 6092	2208	msedge.exe	96
PID 2208 wrote to memory of 4232	2208	msedge.exe	98
PID 2208 wrote to memory of 4232	2208	msedge.exe	98
PID 2208 wrote to memory of 4232	2208	msedge.exe	98
PID 2208 wrote to memory of 716	2208	msedge.exe	99
PID 2208 wrote to memory of 716	2208	msedge.exe	99
PID 2208 wrote to memory of 716	2208	msedge.exe	99
PID 2208 wrote to memory of 5060	2208	msedge.exe	100
PID 2208 wrote to memory of 5060	2208	msedge.exe	100
PID 2208 wrote to memory of 4176	2208	msedge.exe	102
PID 2208 wrote to memory of 4176	2208	msedge.exe	102
PID 2208 wrote to memory of 2456	2208	msedge.exe	103
PID 2208 wrote to memory of 2456	2208	msedge.exe	103
PID 2208 wrote to memory of 3452	2208	msedge.exe	105
PID 4544 wrote to memory of 5836	4544	2026-07-17_e47336bcf47f013dd73e7e846451c4ee_elex_rhadamanthys_stop.exe	106
PID 2208 wrote to memory of 4080	2208	msedge.exe	108
PID 2208 wrote to memory of 4080	2208	msedge.exe	108
PID 2224 wrote to memory of 2460	2224	eczusmkezw.exe	110
PID 2208 wrote to memory of 5624	2208	msedge.exe	113
PID 2208 wrote to memory of 5624	2208	msedge.exe	113
PID 4544 wrote to memory of 1968	4544	2026-07-17_e47336bcf47f013dd73e7e846451c4ee_elex_rhadamanthys_stop.exe	116
PID 4544 wrote to memory of 5500	4544	2026-07-17_e47336bcf47f013dd73e7e846451c4ee_elex_rhadamanthys_stop.exe	120
PID 2504 wrote to memory of 2872	2504	cwurljhezw.exe	122
PID 4544 wrote to memory of 3592	4544	2026-07-17_e47336bcf47f013dd73e7e846451c4ee_elex_rhadamanthys_stop.exe	125
PID 4544 wrote to memory of 4828	4544	2026-07-17_e47336bcf47f013dd73e7e846451c4ee_elex_rhadamanthys_stop.exe	129
PID 2652 wrote to memory of 4120	2652	trljebwtol.exe	131
PID 4544 wrote to memory of 4568	4544	2026-07-17_e47336bcf47f013dd73e7e846451c4ee_elex_rhadamanthys_stop.exe	134
PID 4544 wrote to memory of 956	4544	2026-07-17_e47336bcf47f013dd73e7e846451c4ee_elex_rhadamanthys_stop.exe	138
PID 5592 wrote to memory of 4668	5592	ztrligbytr.exe	140
PID 4544 wrote to memory of 1212	4544	2026-07-17_e47336bcf47f013dd73e7e846451c4ee_elex_rhadamanthys_stop.exe	143
PID 2208 wrote to memory of 4380	2208	msedge.exe	146
PID 2208 wrote to memory of 1772	2208	msedge.exe	147
PID 2208 wrote to memory of 3564	2208	msedge.exe	148
PID 4544 wrote to memory of 3400	4544	2026-07-17_e47336bcf47f013dd73e7e846451c4ee_elex_rhadamanthys_stop.exe	151
PID 3912 wrote to memory of 4152	3912	ligaytqlid.exe	153
PID 4544 wrote to memory of 1576	4544	2026-07-17_e47336bcf47f013dd73e7e846451c4ee_elex_rhadamanthys_stop.exe	156
PID 4544 wrote to memory of 1232	4544	2026-07-17_e47336bcf47f013dd73e7e846451c4ee_elex_rhadamanthys_stop.exe	160
PID 1204 wrote to memory of 5068	1204	fdxvtnlfdy.exe	162
PID 4544 wrote to memory of 1812	4544	2026-07-17_e47336bcf47f013dd73e7e846451c4ee_elex_rhadamanthys_stop.exe	165
PID 4544 wrote to memory of 2840	4544	2026-07-17_e47336bcf47f013dd73e7e846451c4ee_elex_rhadamanthys_stop.exe	169
PID 4132 wrote to memory of 2696	4132	nkicavsnki.exe	171
PID 4544 wrote to memory of 5964	4544	2026-07-17_e47336bcf47f013dd73e7e846451c4ee_elex_rhadamanthys_stop.exe	174
PID 4544 wrote to memory of 1176	4544	2026-07-17_e47336bcf47f013dd73e7e846451c4ee_elex_rhadamanthys_stop.exe	178
PID 4560 wrote to memory of 1244	4560	axspkhcaus.exe	180
PID 4544 wrote to memory of 3564	4544	2026-07-17_e47336bcf47f013dd73e7e846451c4ee_elex_rhadamanthys_stop.exe	183
PID 2208 wrote to memory of 5328	2208	msedge.exe	185
PID 2208 wrote to memory of 5328	2208	msedge.exe	185
PID 4544 wrote to memory of 3708	4544	2026-07-17_e47336bcf47f013dd73e7e846451c4ee_elex_rhadamanthys_stop.exe	191
PID 3232 wrote to memory of 2196	3232	wupmhczusm.exe	193
PID 4544 wrote to memory of 4912	4544	2026-07-17_e47336bcf47f013dd73e7e846451c4ee_elex_rhadamanthys_stop.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-07-17_e47336bcf47f013dd73e7e846451c4ee_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_e47336bcf47f013dd73e7e846451c4ee_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffcd35ac188,0x7ffcd35ac194,0x7ffcd35ac1a0
      4⤵
      PID:5456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,11692510301490158510,17747012421803924129,262144 --field-trial-handle=2612,i,13532022114590454685,4398264125212634252,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:2
      4⤵
      PID:2844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,4459519399543918470,11749702434435414071,524288 --field-trial-handle=2612,i,13532022114590454685,4398264125212634252,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:11
      4⤵
      System Time Discovery
      PID:1016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,1337710553477574000,14638788795813851354,524288 --field-trial-handle=2612,i,13532022114590454685,4398264125212634252,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:13
      4⤵
      PID:1648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,16593436973399381387,4779785789028114135,2097152 --field-trial-handle=2612,i,13532022114590454685,4398264125212634252,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:1212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3616,i,17505539565945777027,14018995292114249683,2097152 --field-trial-handle=2612,i,13532022114590454685,4398264125212634252,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
      4⤵
      PID:6092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,8086913535018069046,12499764706630922550,2097152 --field-trial-handle=2612,i,13532022114590454685,4398264125212634252,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:9
      4⤵
      PID:4232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4336,i,6282729798601960498,5004526981444666811,2097152 --field-trial-handle=2612,i,13532022114590454685,4398264125212634252,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:1
      4⤵
      PID:716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,6311394991404414462,1775821541599557691,524288 --field-trial-handle=2612,i,13532022114590454685,4398264125212634252,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:14
      4⤵
      PID:5060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,15603557796112746826,10788442229270042541,524288 --field-trial-handle=2612,i,13532022114590454685,4398264125212634252,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
      4⤵
      PID:4176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,6717471090332681334,14889926378910553904,524288 --field-trial-handle=2612,i,13532022114590454685,4398264125212634252,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:14
      4⤵
      PID:2456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,10580245230114561936,974760262953550877,524288 --field-trial-handle=2612,i,13532022114590454685,4398264125212634252,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:4368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,10580245230114561936,974760262953550877,524288 --field-trial-handle=2612,i,13532022114590454685,4398264125212634252,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:3452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,8272212879206185726,17444325042397181438,524288 --field-trial-handle=2612,i,13532022114590454685,4398264125212634252,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:4080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,4325521467533032584,11341637432159853453,524288 --field-trial-handle=2612,i,13532022114590454685,4398264125212634252,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
      4⤵
      PID:5624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,3330331867874536919,267743613032389259,524288 --field-trial-handle=2612,i,13532022114590454685,4398264125212634252,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
      4⤵
      PID:4380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,4225103497075545028,14617617124863886565,524288 --field-trial-handle=2612,i,13532022114590454685,4398264125212634252,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
      4⤵
      PID:1772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,11340524012115634201,4570365367355628809,524288 --field-trial-handle=2612,i,13532022114590454685,4398264125212634252,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:3564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,2484635511228251459,9095771586517609979,524288 --field-trial-handle=2612,i,13532022114590454685,4398264125212634252,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
      4⤵
      PID:5328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,10353306610899494592,10904857548759110989,524288 --field-trial-handle=2612,i,13532022114590454685,4398264125212634252,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
      4⤵
      PID:1220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,1143838200154397887,3357296438758641271,524288 --field-trial-handle=2612,i,13532022114590454685,4398264125212634252,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
      4⤵
      PID:1312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3916,i,10647289398964083792,7427680999930146640,524288 --field-trial-handle=2612,i,13532022114590454685,4398264125212634252,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
      4⤵
      PID:5788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6232,i,301457018986307124,7822448984183517584,262144 --field-trial-handle=2612,i,13532022114590454685,4398264125212634252,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,17147719893511037119,1833223251457327844,524288 --field-trial-handle=2612,i,13532022114590454685,4398264125212634252,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:14
      4⤵
      PID:4796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eczusmkezw.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5836
- - C:\Temp\eczusmkezw.exe
    C:\Temp\eczusmkezw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2224
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2460
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eczusmkezw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1968
- - C:\Temp\i_eczusmkezw.exe
    C:\Temp\i_eczusmkezw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwurljhezw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5500
- - C:\Temp\cwurljhezw.exe
    C:\Temp\cwurljhezw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2504
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2872
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwurljhezw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3592
- - C:\Temp\i_cwurljhezw.exe
    C:\Temp\i_cwurljhezw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljebwtol.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4828
- - C:\Temp\trljebwtol.exe
    C:\Temp\trljebwtol.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4120
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljebwtol.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4568
- - C:\Temp\i_trljebwtol.exe
    C:\Temp\i_trljebwtol.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrligbytr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:956
- - C:\Temp\ztrligbytr.exe
    C:\Temp\ztrligbytr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5592
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4668
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrligbytr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1212
- - C:\Temp\i_ztrligbytr.exe
    C:\Temp\i_ztrligbytr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ligaytqlid.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3400
- - C:\Temp\ligaytqlid.exe
    C:\Temp\ligaytqlid.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3912
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4152
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ligaytqlid.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1576
- - C:\Temp\i_ligaytqlid.exe
    C:\Temp\i_ligaytqlid.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4232
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvtnlfdy.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1232
- - C:\Temp\fdxvtnlfdy.exe
    C:\Temp\fdxvtnlfdy.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1204
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5068
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5180
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvtnlfdy.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1812
- - C:\Temp\i_fdxvtnlfdy.exe
    C:\Temp\i_fdxvtnlfdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkicavsnki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2840
- - C:\Temp\nkicavsnki.exe
    C:\Temp\nkicavsnki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4132
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2696
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5648
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkicavsnki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5964
- - C:\Temp\i_nkicavsnki.exe
    C:\Temp\i_nkicavsnki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axspkhcaus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1176
- - C:\Temp\axspkhcaus.exe
    C:\Temp\axspkhcaus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4560
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1244
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axspkhcaus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3564
- - C:\Temp\i_axspkhcaus.exe
    C:\Temp\i_axspkhcaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wupmhczusm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3708
- - C:\Temp\wupmhczusm.exe
    C:\Temp\wupmhczusm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3232
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2196
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wupmhczusm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4912
- - C:\Temp\i_wupmhczusm.exe
    C:\Temp\i_wupmhczusm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhezwrpjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4508
- - C:\Temp\pjhezwrpjh.exe
    C:\Temp\pjhezwrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5524
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4620
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5356
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhezwrpjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4984
- - C:\Temp\i_pjhezwrpjh.exe
    C:\Temp\i_pjhezwrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwugeywroj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2060
- - C:\Temp\cwugeywroj.exe
    C:\Temp\cwugeywroj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4488
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4228
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwugeywroj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6136
- - C:\Temp\i_cwugeywroj.exe
    C:\Temp\i_cwugeywroj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgeywqojgb.exe ups_run
  2⤵
  PID:1248
- - C:\Temp\jgeywqojgb.exe
    C:\Temp\jgeywqojgb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3016
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2892
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgeywqojgb.exe ups_ins
  2⤵
  PID:2124
- - C:\Temp\i_jgeywqojgb.exe
    C:\Temp\i_jgeywqojgb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgeywqoigb.exe ups_run
  2⤵
  PID:1772
- - C:\Temp\lgeywqoigb.exe
    C:\Temp\lgeywqoigb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:960
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1400
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4076
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgeywqoigb.exe ups_ins
  2⤵
  PID:3848
- - C:\Temp\i_lgeywqoigb.exe
    C:\Temp\i_lgeywqoigb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlfdxvqnlf.exe ups_run
  2⤵
  PID:5760
- - C:\Temp\nlfdxvqnlf.exe
    C:\Temp\nlfdxvqnlf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:812
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2412
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlfdxvqnlf.exe ups_ins
  2⤵
  PID:4952
- - C:\Temp\i_nlfdxvqnlf.exe
    C:\Temp\i_nlfdxvqnlf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnkidayvpn.exe ups_run
  2⤵
  PID:200
- - C:\Temp\tnkidayvpn.exe
    C:\Temp\tnkidayvpn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4532
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1000
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnkidayvpn.exe ups_ins
  2⤵
  PID:6132
- - C:\Temp\i_tnkidayvpn.exe
    C:\Temp\i_tnkidayvpn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausnkfcxvp.exe ups_run
  2⤵
  PID:1580
- - C:\Temp\ausnkfcxvp.exe
    C:\Temp\ausnkfcxvp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1160
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5084
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4676
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausnkfcxvp.exe ups_ins
  2⤵
  PID:4232
- - C:\Temp\i_ausnkfcxvp.exe
    C:\Temp\i_ausnkfcxvp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xupnhfcxvp.exe ups_run
  2⤵
  PID:1732
- - C:\Temp\xupnhfcxvp.exe
    C:\Temp\xupnhfcxvp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1608
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3360
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xupnhfcxvp.exe ups_ins
  2⤵
  PID:5656
- - C:\Temp\i_xupnhfcxvp.exe
    C:\Temp\i_xupnhfcxvp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1116
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urpjhfzxrp.exe ups_run
  2⤵
  PID:3356
- - C:\Temp\urpjhfzxrp.exe
    C:\Temp\urpjhfzxrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5048
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5196
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urpjhfzxrp.exe ups_ins
  2⤵
  PID:1788
- - C:\Temp\i_urpjhfzxrp.exe
    C:\Temp\i_urpjhfzxrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bzwrmjhbzu.exe ups_run
  2⤵
  PID:4184
- - C:\Temp\bzwrmjhbzu.exe
    C:\Temp\bzwrmjhbzu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5388
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1288
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bzwrmjhbzu.exe ups_ins
  2⤵
  PID:5096
- - C:\Temp\i_bzwrmjhbzu.exe
    C:\Temp\i_bzwrmjhbzu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebztromgeb.exe ups_run
  2⤵
  PID:2920
- - C:\Temp\ebztromgeb.exe
    C:\Temp\ebztromgeb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3452
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3304
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebztromgeb.exe ups_ins
  2⤵
  PID:4776
- - C:\Temp\i_ebztromgeb.exe
    C:\Temp\i_ebztromgeb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2672

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1832

C:\Temp\jecwuomkec.sys
C:\Temp\jecwuomkec.sys
1⤵
- Executes dropped EXE
PID:1900

C:\Temp\hbywurmjec.sys
C:\Temp\hbywurmjec.sys
1⤵
- Executes dropped EXE
PID:6088

C:\Temp\ebwtomgeyw.sys
C:\Temp\ebwtomgeyw.sys
1⤵
- Executes dropped EXE
PID:2828

C:\Temp\tqligdbvto.sys
C:\Temp\tqligdbvto.sys
1⤵
- Executes dropped EXE
PID:4368

C:\Temp\kigaysqkid.sys
C:\Temp\kigaysqkid.sys
1⤵
- Executes dropped EXE
PID:3100

C:\Temp\qkifdavsqn.sys
C:\Temp\qkifdavsqn.sys
1⤵
- Executes dropped EXE
PID:4172

C:\Temp\caxspnhfzx.sys
C:\Temp\caxspnhfzx.sys
1⤵
- Executes dropped EXE
PID:2764

C:\Temp\causmkecxu.sys
C:\Temp\causmkecxu.sys
1⤵
- Executes dropped EXE
PID:4728

C:\Temp\rpjhezwurm.sys
C:\Temp\rpjhezwurm.sys
1⤵
- Executes dropped EXE
PID:484

C:\Temp\cwuomgezwr.sys
C:\Temp\cwuomgezwr.sys
1⤵
- Executes dropped EXE
PID:4076

C:\Temp\geywqomjhb.sys
C:\Temp\geywqomjhb.sys
1⤵
PID:2412

C:\Temp\olgdbywqoi.sys
C:\Temp\olgdbywqoi.sys
1⤵
PID:3732

C:\Temp\ytqljdbvtn.sys
C:\Temp\ytqljdbvtn.sys
1⤵
PID:5260

C:\Temp\sqkigayvqn.sys
C:\Temp\sqkigayvqn.sys
1⤵
PID:1064

C:\Temp\xvsnlfdxsq.sys
C:\Temp\xvsnlfdxsq.sys
1⤵
PID:5808

C:\Temp\causmkhczx.sys
C:\Temp\causmkhczx.sys
1⤵
PID:5036

C:\Temp\jhczurmjec.sys
C:\Temp\jhczurmjec.sys
1⤵
PID:1496

C:\Temp\geywrojgez.sys
C:\Temp\geywrojgez.sys
1⤵
PID:4876

C:\Temp\ljgbztrljd.sys
C:\Temp\ljgbztrljd.sys
1⤵
PID:5632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwurljhezw.exe

Path C:\Temp\cwurljhezw.exe
Size 243KB
SHA256 c7128d9f8652e6a5916f26f2f019c8284aacbe7031b232c448c77eeac8a58c62
MD5 d037596b1bacaddf9b44e8fb9129f8b6
SHA1 4daae8ce533e61231ba7f5c7e6e9436c700350f1
SHA512 69597422dfe5bcc2bed4c0af8159858e0baf53d91396b80a4000fa62c87a8c42cbf1d1ec84512c43e1ebcf64790f66cf3e9b3b6e44f9dc92e0b6c17331cf5497
SSDEEP 3072:u+615lUSLx+Jhf7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA74:ADlUSLMQa3lLNngoqRttA74
TLSH
T194345A0172818071E75A0B78046AE7A1467E7C344BA5E5CFF7A83B7A5E312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebwtomgeyw.sys

Path C:\Temp\ebwtomgeyw.sys
Size 141KB
SHA256 1b123a1e709bc92d7ece64c8ee5a0bcebad979a68279fc1882a8e60440559ec4
MD5 7c55246d01e2a9b0c90773faae8e0373
SHA1 4c5288952c0f635bd9f4ce5b3732befcc15d6108
SHA512 ea2696d973e44fa88f9d4f8c0f039cc0652517ae8cd0d7b1ded1ac896bb2c650500861fc5fdfa1a0943fa834ccdd8d29ee24f6e6d3e0a3c184831d71abd4e317
SSDEEP 1536:7a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:7a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T187E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eczusmkezw.exe

Path C:\Temp\eczusmkezw.exe
Size 243KB
SHA256 ab1a3e50aef58b426caae382974eeeadb66fb4e25baaf1bf424f1622c38b44a8
MD5 89bb50ea9bb445d3351934b91e0da14e
SHA1 ee23cda79032c7e5921f7b8d4f72fde6dc7e57d3
SHA512 92dd9e31d6c66805ca82b0eb8e537f5d7467379f87d9e2d393f878c331ccf509aacb78d1792d059587ffa3a073eb55092a0353f7e5446d1b36bac42cf4fd5d14
SSDEEP 3072:p+615lUSLx+Jhf7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7f:VDlUSLMQa3lLNngoqRttA7f
TLSH
T108345A0172818071E75A0B78046AE7A1467E7C344BA5E5CFF7A83B7A5E312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvtnlfdy.exe

Path C:\Temp\fdxvtnlfdy.exe
Size 243KB
SHA256 e9038dd630c596fdd8b4e3790883ae4256cfbe27701a72dec8bd221945973a85
MD5 649280e73f1702f3101bde1329112c78
SHA1 6afffdb4d6135dd33177a2504c9767e373e2d34d
SHA512 1016a040881fd436deb95e06053731d1dbe4423d0be177dca1888f0a6a2d7eb9af96d28ae1e13fbab1c0d0781f8ea0bab819af4768fde01b0beecd71b46a2dad
SSDEEP 3072:F+615lUSLx+Jhf7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:hDlUSLMQa3lLNngoqRttA7D
TLSH
T1CD345A0172818031E75A0B78046AE7A1467E7C344BA5E5CFF7A83B7A5E312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbywurmjec.sys

Path C:\Temp\hbywurmjec.sys
Size 141KB
SHA256 40acf39e19f3f983daa0cec4ba048578b51dfc0178c88735c4f4e826806073aa
MD5 8bfa4b290aac26466db27d25ec44fa8d
SHA1 99aa24319dab1d1e75c2c2d85a4883a5299c6f8f
SHA512 0fb36b8d1ef3a855ff716360557c7239d05063898b518329f9cf3f43f6ddcdf7c457c3c354645ac5d44d1070239e2bab332645b3028639c6b066304518cc938a
SSDEEP 3072:oa3rV3dZPFvOAngoRUAFa1nxayHdXkbP:oa3lLNngoqRt
TLSH
T11CE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cwurljhezw.exe

Path C:\Temp\i_cwurljhezw.exe
Size 243KB
SHA256 fca7aa9fd642f1ef4aecdbd362a0e61c95aa80a91b5b51478894fa8dc67ee175
MD5 3e6c8f1eaf9d99f2590e1b91b6f9b6cd
SHA1 4a4914fec8206335442b272ec97d905f8f94787a
SHA512 8f3597eae7ffe66a59eea38133a27c148aa490d57ca4e9c16f82fc64be04eb0c11d7f32dc9e7749026db1de0c5409f1f7c5459209cf1ac16891f250505fe12b8
SSDEEP 3072:q+615lUSLx+Jhf7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:MDlUSLMQa3lLNngoqRttA7o
TLSH
T1A9345A0172818071E75A0B78046AE7A1467E7C344BA5E5CFF7A83B7A5E312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eczusmkezw.exe

Path C:\Temp\i_eczusmkezw.exe
Size 243KB
SHA256 a7c00b718e4c51ba1d9f6561bb01ef37962cd76c0e3fba3c0ce65562f594cfb9
MD5 d469f256e5346d6f675ebc3f1de72ab4
SHA1 7d1ffc3aa09ad18731a88219ceef596382d041ec
SHA512 4323a535fd10e537fb80cfcd943c904bf8e595f9341e6e52fdd204d026b054e37ad6f30291d0b575cc017201a5a8a5cdb6d0f2ab4061adde50e1ef7abfbe659d
SSDEEP 3072:y+615lUSLx+Jhf7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7U:kDlUSLMQa3lLNngoqRttA7U
TLSH
T189345A0172818071E75A0B78046AE7A1467E7C344BA5E5CFF7A83B7A5E312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdxvtnlfdy.exe

Path C:\Temp\i_fdxvtnlfdy.exe
Size 243KB
SHA256 464a3fb2ca9e02548fcb27ac4188b4e267438be0eee240a6c6639ff62a1b9c62
MD5 d495353bdb3ea010f4fd5e9c9fbb6b8b
SHA1 e09860ad1c2ddd35ecdcc6f8324989758e81fe9c
SHA512 52ef80c3b1cb782847f1fd8762826344cae8b3294e64090f0ed81ac7371f44ddb72aee0287985ab9152bc0fefd1a5eae63dc33abaed37e5c179de8316caaa010
SSDEEP 3072:T+615lUSLx+Jhf7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7B:HDlUSLMQa3lLNngoqRttA7B
TLSH
T184345A0172818031E75A0B78046AE7A1467E7D344BA5E5CFF7A83B7A5E312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ligaytqlid.exe

Path C:\Temp\i_ligaytqlid.exe
Size 243KB
SHA256 7e91a3a832d9e5f2697df9257a6e70191a203c9f162c5c67b3ddd1ab5cc3d218
MD5 accd0e0bb63dbc172298006231fb5370
SHA1 b388ba0166629a314689bc88b804233128b7bb9a
SHA512 788fcf3d0ebbc7da01659da63d4ea86adcc5390193fa466c0dc0c19a39c418c04d959bf583cda4ffe05c6087744ec76ed36563ae0ad48f6dabb7de106eac2759
SSDEEP 3072:O+615lUSLx+Jhf7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7M:gDlUSLMQa3lLNngoqRttA7M
TLSH
T11F345A0172818031E75A0B78046AE7A1467E7C344BA5E5CFF7A83B7A5E312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trljebwtol.exe

Path C:\Temp\i_trljebwtol.exe
Size 243KB
SHA256 c29d1373694e9c8650160d2ae1e29f3c60c6670472998b94d3970f94e545aa67
MD5 cf98a76f6847e38a2f87425fa1d0820b
SHA1 1366c0fa5d9ba81dd4c6c87dc377b63e58fe18cc
SHA512 7d09dfa8f52900ca569b62314e1ff4f0e72278f360a2b3e2ec7cbaaa8444ca3d71b5883e9224c516ad19bd86665f416e4d1bc0938476c3f7b92888d2051797b7
SSDEEP 3072:a+615lUSLx+Jhf7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7U:cDlUSLMQa3lLNngoqRttA7U
TLSH
T12B345A0172818071E75A0B78046AE7A1467E7C344BA5E5CFF7A83B7A5E312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ztrligbytr.exe

Path C:\Temp\i_ztrligbytr.exe
Size 243KB
SHA256 1a7df512d4e33f32a0b5b90b320dc5948372e8f483704de80050e66393a35651
MD5 8563264ba53182669fa5e6df24f17f7d
SHA1 82d3a316129eacbfb5c0d3f4d2eb44e132338a72
SHA512 b70dc2f7fd44061658b32b233330acef49c030e6ae9497b4c9d6a7de11ea779a55b5c6f3f26ef889677be262dac2cb660ac400d7054c2c7fb48f1e8502152047
SSDEEP 3072:K+615lUSLx+Jhf7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Q:sDlUSLMQa3lLNngoqRttA7Q
TLSH
T184345A0172818071E75A0B78046AE7A1467E7C344BA5E5CFF7A83B7A5E312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jecwuomkec.sys

Path C:\Temp\jecwuomkec.sys
Size 141KB
SHA256 b26a9b7205fd2077d681f71e3eb520e12bc254ffe4a8e6023ffa33d101505873
MD5 8944d81c03d005227def9f4a2018fc59
SHA1 68e057bfcd445b4939bcbb53bc4749f9d36b723a
SHA512 08bcd5c42f57fd7418d673d3b39ac150ae68bb80ed903df9984d76f021e4d8cc5c4733ccaec90f18e03400e8bdb8afcde2ffc88c129fe929026b7a7d9aabb340
SSDEEP 1536:ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T165E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kigaysqkid.sys

Path C:\Temp\kigaysqkid.sys
Size 141KB
SHA256 cf918bbe40f87b01e55e3632b27792acef0ad4ecf6990dd76a31adb039da1c97
MD5 a1cdf7bbe1b80008bccc62a6ebbde448
SHA1 424d1ab5a041d77333fcdbf1ffc06dea6716ce4a
SHA512 50ca0c65a864822bbfe6524052e46a4e17a466fcdf2370e1e262b3a2cfd8ae8b464ed2f85317f624b020788b1a0b3d71057b464a79be668b5373954b3973d67c
SSDEEP 1536:+a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:+a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T148E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ligaytqlid.exe

Path C:\Temp\ligaytqlid.exe
Size 243KB
SHA256 2e806e20a36b4037dc89ca4f476612dec7f593ab33b2d09f7c799193b52f6cf4
MD5 75a150da9a49880a6a31b989e4c2a182
SHA1 ead27548cc64da4ff97753a8455af871fec2924b
SHA512 435bce8dd7ba66c26a394ee9edab917487cdf6cf70b2c30d38963383ba0c136336af904191dcf4c02ea938da0e484e3316dc7c87a10e404afc963f9bf88794af
SSDEEP 3072:R+615lUSLx+Jhf7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:NDlUSLMQa3lLNngoqRttA7D
TLSH
T1D4345A0172818071E75A0B78046AE7A1467E7C344BA5E5CFF7A83B7A5E312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkifdavsqn.sys

Path C:\Temp\qkifdavsqn.sys
Size 141KB
SHA256 371f50f32e5482c8fcd6205db059598221cbaffa18806295e6f70ef1d24ed314
MD5 01c4b7fd6a1a0036a2fc53b0feafa799
SHA1 1c70adaac0f84e7c82a7e8a679ea52b8894823a8
SHA512 9b661287a98ade703e8161a77699fcc36280fb00be8313353a6b4c233992ed71519f53831b04d93920daeb367ee0bf51c4c6f100212a9845c87e2a1c1e2ecf90
SSDEEP 1536:ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DFE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqligdbvto.sys

Path C:\Temp\tqligdbvto.sys
Size 141KB
SHA256 91a7418f4b0f922ade9fcac3ab1b463c2f25b80e8facfe5ddb7f54f8f64aa117
MD5 611dc0cbdea979a3b1c61438cb9fb686
SHA1 3a9c090aa1b89a8221fc9635f0c6be8a4881127e
SHA512 2aa72956cc24d217fae2857e687c28406731bc62726c150fb6be65bc772bffaf45e6bcd09e004c36de4a1a5383e1a92e9fe162ab84590175aa07a1541cb8a4eb
SSDEEP 1536:/a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:/a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CBE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljebwtol.exe

Path C:\Temp\trljebwtol.exe
Size 243KB
SHA256 643793ae47175c6e6abeec553c5811a4f6bdebbe41f8c2bd01dd4825fd1746c4
MD5 2802e48b0d1f5930420d36b978c8eac7
SHA1 885d11b44c93d7af66474b51fda54e08abd149d6
SHA512 feb8b9a102cb97af011be8e56b8bbb8f18b09d9de61fb3a07541253aa17e8c1a473e480e2cad65ff7451ac9caf11da3c2115f9634e34f7dc8138cfe41f6ca8d0
SSDEEP 3072:Y+615lUSLx+Jhf7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7y:iDlUSLMQa3lLNngoqRttA7y
TLSH
T1FC344A0172818071E75A0B78046AE7A1467E7C344BA5E5CFF7A83B7A5E312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrligbytr.exe

Path C:\Temp\ztrligbytr.exe
Size 243KB
SHA256 03b62739304b284ea9bef733d9bd6dccbddaa754c07d5b49101000a2108afcdf
MD5 0d72079181e9d591385c5d4ce13cd709
SHA1 3c447d3cd50a2c5db1405a2729a258082dbce8ee
SHA512 4553d18990dfb545243a30e0279011830ce59bd9f9aea1dfed42bdbab96e773747d3dd00606883a78a2b0d3900f4d6b73da8c165ee8499f2d14a7f9e0e12bf77
SSDEEP 3072:M+615lUSLx+Jhf7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7i:mDlUSLMQa3lLNngoqRttA7i
TLSH
T1AB345A0172818071E75A0B78046AE7A1467E7C344BA5E5CFF7A83B7A5E312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 034f24de689a7def9772f2639a5ddbbedb0b28137b49c19b71158018eda66f27
MD5 0acd876b7d1df982e21737cea2b433e0
SHA1 4140711d8b0f6bfa111e8d306d1aed5aaa07860f
SHA512 c4ee3c53bfa042ccd288fcee194acae6059cefcd97d740ba908b0c0c3fcd94e2172fd30319909d9418fe2ab0a9a03d8e3ef9a058a540b973c3f203e2a0bceb01
TLSH
T187D02334753977D6D53925B2C8305700767400B275B5474561614D0DCE744D77BCBBD6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 08a3eccff4cd9b05162ffe0d083662ea8cd60457899147f42dbbf95a0a97d97e
MD5 394c25b8b347a39d61b9cf28babb5c77
SHA1 c7334bcf8642ac580d30cf31659724fe1ab323c9
SHA512 8e5c09dada01bf020bbf53884d65940c521dc62e17d9ce99fe6c571edde4b95c7c7716f2eda97b70568b2cbac8823e7afed5a9bac7be39d1acc6fc95c23a4b1c
TLSH
T1F6D0C038762962C2C92725B2CC3063007330007030B587425071440C8E3489667CF3C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 168dc438fa355b9b84e416f9d4caca14da218ad190d72da09fe489277625815d
MD5 39064a84dfec9bbd8c4b789b6d7a7c62
SHA1 5d817a4df5ed7bd1eac0c4bc0464a76007ad0c46
SHA512 3a4f32a1ad3eb6c391e6d11f4f6ba07c4d21cc935ddd8fd93306857b9e0cfda06c39786a872cae88f394320921a63296ad4df0e61334710db192febec2f48618
TLSH
T1B5D0C034763961C2C92725B2CC3163007320007030B587425171840C8E3489667CF3C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 f5e17c0444d8ea0ca7d440dd66658436dcccefb75a5b9f00df44bdfce710bd39
MD5 9ff75cf5704fa5afaa71734412bd46e6
SHA1 d4353423aa5e783f109fbfe38818860698935023
SHA512 2b4393e4b5e5f1ffcf18487188a5d1560702e4e88007f9cb7463aca0253a798f73f3ab2a3587297a31b783b78b2cca38a4d2ee5acbc8b858d3f5e6c78fc695eb
TLSH
T1E3310890336408F7CB909DF215F84AC7313C97BC06076E11D584A33F58B3725BC12029
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f44a09410c8fee810812aa472ff7b9e2842aca5242b2adb7a8fc08b0182521d3
MD5 2cf1d7f878cbd18700c95c8121b73195
SHA1 ac01c18dcb8d994f4a53b56a817fd5d04a582736
SHA512 39fec76c5ad07253b2e687db1408bb4d1e6a63b88646d9d5c492a2a297ac608c89597bb746eaf3af715c0dfc40c479a514c1e1e84fac989556f9a558b0eb4014
TLSH
T1FA417DF3C3E8866EC90196F0AB186E2BCE1D0915832C7D5AC9E4AF1B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6a20bc357310f850e8c0e5d9125db90ba42fa5e0c4fc64e78f44189a1d8b370d
MD5 d1d70c410933a01e338f6f9a6dc7dd4a
SHA1 2611f96f85f850aa64ef5fc19ecd2d600711a685
SHA512 79082a033c74dce40085803b2a22a8e8a273dbee0a89c0145a81b3408f6b4c4edb888f08a9e1504db1d8461df405f1c5046d3a3d3294d528def804f3a8d3808a
SSDEEP 192:sxRaR9yM/jK1Ml8wCG/fPss4SZRo2zoA8p92/g6+WNCFV/YZ7WKsfG6IgtJ:sxRaL8G/fPss40RorM/5a/Hn3
TLSH
T13E62C9056A34997BCCDBD20DFA557B53D6F81473E2901E44AAFC8A1C04E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d1270f7e8c96b1dd76637ec85a397121b7f5bd93e6635ceb31f1e431d0c42bfd
MD5 0e4956136fc8bf9f6e3ebc3bd8f22e75
SHA1 745fbc08418a383b063085483b1c7a6f8c5d3069
SHA512 06ec6d453913f839cb2d0817ed5e7c3197b2f51fb56dd7430f778773f03bb0fb16e73133ecce34d4a30a71dedde7c0dcc251a1a0e1e43c45328aba7eeab06f85
SSDEEP 192:sxR9R9yM/jK1Ml8wCG/fPsop4SZRo2zoA8p92/g6+WNCFV/YZ7WKsfG6IgD7J:sxR9L8G/fPsop40RorM/5a/HnJ
TLSH
T19462CA066A34597BDCDBD20DFA957B93D6F8147392901E44AAFC8A1C04E76ED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 cc73bf2a4379b5cc5b26b07c0710173f850c50583f6cdfe55cbcc79bdad001b9
MD5 26f5094c7a10aac9385bb8f947ab07b9
SHA1 9a0f5c670157aa61bd53542c14ffbfc4f9acf480
SHA512 72c0e2f8bc2a2a4774f6d33d4e35fa4bbd973086c3faea1f7d9ae609ab7a895fb61faa59ae28d4fbe6b06694332bb913f90e1e07834c5aaa3a541464645edf23
SSDEEP 192:sxR9R9yM/jK1Ml8UQICG/fPsopZSZRo2zoA8pr2/g6+WNCFV/YZ7WSsfG6IgDxJ:sxR9LqvG/fPsopZ0RorC/5a/Lnn
TLSH
T10662B9166A24997BDCDBD20DF6957F93E6F8147392901E44AAFC8B0C00E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 1ea15cd5ee5f9cd027e9730fb36078bf869ce828845b2d51b84be2a9e97633e3
MD5 aec5795290f51dd82e0760bff06dcbf4
SHA1 bc35f2751cb535c2bad50070a74f83b2ab3af54c
SHA512 1412868fa24f6d2d5e1fd40bae914532e95e549ec451236cda08a7f2cde27893b170c3a4e8ee0b05afe1a6d45a484182de602e763d84370b4aa68c9030fac2c0
SSDEEP 768:kfISGS7pLuL7CvWgd5fWb8F1+UoAYDCx9Tuqh0VfUC9xbog/OVvStSV20roHh0wR:kfISGqE7CvWgd5fWbu1ja4StU2fHh0wR
TLSH
T17BE2DC3B680CCB7F4F8049DCEC297E9AADA801CF96D8C99447FA850C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2205f61b9587249392d67cdea5e2d6fc45a825c6e2c357d98ee675e5ffd84b07
MD5 8ef0cf29457bf25b762876c628b1f4f4
SHA1 06c0420f317eac5b711e3af7a52c6f0ea4b4b3de
SHA512 f5014faed6e51b9f99c08ff35c6772c3097f47f55fff93375791b24c9a99274558040dfef420dd6d31d714d94fcd8c09e469d0b918ca9db3f5cb68174dcc9952
SSDEEP 48:Kc2IfKbiIzytPIVKckoi5Ed5DjDK97W5IkJKKX/PPKDZaSOXpjytLiP71hj:Kc20Kbim+PmKckvCAKvaGX
TLSH
T12491FF95713B824138BF2918A0B0CA17DAC670B37058A42B7FE855F24FA7E021EFC4D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bb67fbef-5d1d-4041-a87e-56ac5b773298.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\bb67fbef-5d1d-4041-a87e-56ac5b773298.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 77dff13ea073fcb4b5b562abce93b0fd6d36b05c5369cf9d26a12be588e0c806
MD5 ac43ef3ad8d1f44d2dced72edf11b6b2
SHA1 7463c75da0e5d0b4bce94a5b2bc8073208b56aef
SHA512 855551df8f82a33425a19ec146d8186710240c260e95e23e1f68984db057bd0dd94e52d1befa246bc080610216cfa86b6c5fe094f10dc38741c456117ec31f6d
SSDEEP 768:3j+9f3rTjq9LLHLcEAam6aQMGdjWca4Ghf9O9a:69f3rJmmaME6pOI
TLSH
T1D1D28D316C6999239CA79699F72B27C7BEF052B388C80E84D9D95F0D06C718E2707D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 d11178cee14f4c1791ede0b9ff6eca30c6c0a855f202d13009131e0b8cfceb77
MD5 1ed238fa0d2bfcbaf9b43dd601aa1fff
SHA1 338e8ac27d221f1aea43258c2bb39b759e03ab77
SHA512 8ce51dae27a50345e448ff8bded984d68a89debd915651de85b112ce34baaaef19fa779ab58855a322f487e5693f496ed4702230338231e959b8157debe9ba8d
SSDEEP 768:/rv+4UNbdq3ZJq9LLsAAam6aQMGdjWca4GhfBWPeU/:/bsbc35KmaME6pOH
TLSH
T11CF2BF31A86C9573DDB79A99F21B6787BFF021A385D40A80D9D92B0D439748E3307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 006af2e2471c2de860391cbe85656de2359b3ee7eae2eb8ee5b2a816c2a10993
MD5 c9b4f19d5e70fb4d823caef7228f2ccc
SHA1 d44298f6615ebadb2c449b41b67aa998b05ec6d2
SHA512 c99420b46b31b35fd0346334283eefde55d51e69ae7b3a5a568cb791b21b6cc9b7e6c8d46dc94cd40ee57941c8bb86b5e8f0afd68cd93396b8b0ca2caaab1109
SSDEEP 768:1rv+4UNbdt38Ejq9LLHLc0Aam6aQMGdjWca4Ghf9OJd:1bsbb38wWmaME6pOb
TLSH
T1FB03AE31686CD9339CA7A295F25B6687BFB421B388C80E84D9D95B0D42D748E370BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 09c6039d002dc715649a4a89b0f084c933fdefb1b57323da5c7ead416a199818
MD5 2845d801eaf74d2315fd87a6792c6c9c
SHA1 16dc4fbe3bdcdd221c3010756c6d5509a109eccf
SHA512 838c55be37bede37870ae13810b88e3895cfe7f3dd6baf931c0f33ce1f92483bc11786223cef9283dfd2022f4b03aebfc356352427a9767128a383009f0ab4b2
SSDEEP 768:VF1j+9y3IwgePzzLLHL5Aam6aQMGdjWca4Ghf9O9a:89y3tXmaME6pOI
TLSH
T1220307F198D78937ECAE4787A33D2E86A9BCD163B4885984F7C45D0CCD861BFD206816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 479B
SHA256 df971de1d83c4ec8d8a5317c7da912d8feaad9129307ead7cac91d8819c039d1
MD5 60aeec055cd3bd04b686b14115275140
SHA1 226ad5a7a3c53e4dbc2166906cae70250583b691
SHA512 0567a6078a9f2c06a9054f75a9bf6b745ad3e3735d4b341e44089627a2e31febb2df182dfc3b521cc3bc180bae5d381bff6248f2806a7339a8f3037dff530336
TLSH
T115F0544E8C2EC994FE0955F500D5C3732415AC408EB55E7D6D0856D364861684CC9752
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2208_568259590\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/484-341-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1064-434-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1496-481-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1900-183-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2412-382-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2764-322-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2828-257-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3100-297-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3100-319-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3732-394-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4076-370-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4172-317-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4368-271-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4728-326-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4876-498-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5036-469-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5260-414-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5632-519-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5808-445-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6088-232-0x0000000000010000-0x0000000000083000-memory.dmp

Download