c025bdf087764dae24d4a845a9dd697de86f4f7ea787d41676cfd8c70ea5032a

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 04:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_24ade4c59dbf5d950b19168ec177a34b_elex_rhadamanthys_stop.exe
Size 243KB
Sample260721-ew9dqaey2j
SHA256 c025bdf087764dae24d4a845a9dd697de86f4f7ea787d41676cfd8c70ea5032a
MD5 24ade4c59dbf5d950b19168ec177a34b
SHA1 b7b13c919d95c3e44da9d16e847321ea2a8324c0
SHA512 10c2fca9eecd54f81e5b089b2c5d6d9ca6027a88b421c5cb9d50f791242f8eb4f37e18ce4653a5108d5b7f1dce19a12d32429b23dd33b1002946d81cab2d8afd
SSDEEP 3072:1MaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7f:BGii9IL8Xa3lLNngoqRttA7f
TLSH
T15334490272818031E71A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2944	CP.exe
612	caupkicavs.exe
4228	CP.exe
5168	CP.exe
4604	i_caupkicavs.exe
3736	zurmkecxuo.sys
1496	CP.exe
5736	xrpmhfcwur.exe
2444	CP.exe
2584	CP.exe
2424	i_xrpmhfcwur.exe
1880	mjebztrmjh.sys
1692	CP.exe
3664	ecwuojhbzt.exe
4988	CP.exe
4132	CP.exe
2172	i_ecwuojhbzt.exe
2836	zwuomgebwt.sys
4396	CP.exe
1824	uoljdbwtrl.exe
4828	CP.exe
6016	CP.exe
980	i_uoljdbwtrl.exe
984	ywrljdbvto.sys
4088	CP.exe
3016	vtolgdyvto.exe
3372	CP.exe
2596	CP.exe
3320	i_vtolgdyvto.exe
5436	olgdyvtnlg.sys
3012	CP.exe
1516	nlfdaywqnl.exe
3404	CP.exe
4332	CP.exe
5696	i_nlfdaywqnl.exe
1820	lidaysqkid.sys
2884	CP.exe
3636	dyvqnigays.exe
4484	CP.exe
3904	CP.exe
1904	i_dyvqnigays.exe
4448	icaysqkida.sys
1244	CP.exe
996	usqnifzxus.exe
3252	CP.exe
980	CP.exe
1124	i_usqnifzxus.exe
1472	fcaxspnhfz.sys
5420	CP.exe
3360	vpnhfzxvpk.exe
5624	CP.exe
4352	CP.exe
2604	i_vpnhfzxvpk.exe
4156	pmhecausmk.sys
5428	CP.exe
1144	pnhczxrpkh.exe
2456	CP.exe
5036	CP.exe
3408	i_pnhczxrpkh.exe
2020	mkebzxrpmk.sys
3396	CP.exe
3728	pjhezxrpke.exe
4320	CP.exe
4164	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1468_5652977\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1468_5652977\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1468_5652977\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1468_5652977\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1468_2036595068\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1468_1686666840\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1468_1686666840\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1468_327177562\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1468_327177562\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uoljdbwtrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usqnifzxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnhfzxvpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnkfcavsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkfcausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpmhfcwur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uoljdbwtrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqnigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvqnigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnhfzxvpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caupkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usqnifzxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhczxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgeywqojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdaywqnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqkigaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgeywqojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqkigaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljebztrmge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhczxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhezxrpke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nljdbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhecwurpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_24ade4c59dbf5d950b19168ec177a34b_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpmhfcwur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdaywqnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhezxrpke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywtomgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnkfcavsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhecwurpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtolgdyvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtolgdyvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywtomgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nljdbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkfcausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljebztrmge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caupkicavs.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4284	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3312	ipconfig.exe
5880	ipconfig.exe
5548	ipconfig.exe
5904	ipconfig.exe
3808	ipconfig.exe
1256	ipconfig.exe
468	ipconfig.exe
700	ipconfig.exe
2860	ipconfig.exe
2712	ipconfig.exe
5428	ipconfig.exe
3736	ipconfig.exe
1484	ipconfig.exe
1208	ipconfig.exe
2572	ipconfig.exe
2988	ipconfig.exe
4680	ipconfig.exe
5428	ipconfig.exe
2760	ipconfig.exe
2836	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290811244374241"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{70F3C6F1-5459-4EBF-A4CD-E5815733655E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5304	msedge.exe
5304	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4604	i_caupkicavs.exe
Token: SeDebugPrivilege	2424	i_xrpmhfcwur.exe
Token: SeDebugPrivilege	2172	i_ecwuojhbzt.exe
Token: SeDebugPrivilege	980	i_uoljdbwtrl.exe
Token: SeDebugPrivilege	3320	i_vtolgdyvto.exe
Token: SeDebugPrivilege	5696	i_nlfdaywqnl.exe
Token: SeDebugPrivilege	1904	i_dyvqnigays.exe
Token: SeDebugPrivilege	1124	i_usqnifzxus.exe
Token: SeDebugPrivilege	2604	i_vpnhfzxvpk.exe
Token: SeDebugPrivilege	3408	i_pnhczxrpkh.exe
Token: SeDebugPrivilege	3828	i_pjhezxrpke.exe
Token: SeDebugPrivilege	860	i_mgeywtomgb.exe
Token: SeDebugPrivilege	4836	i_olgeywqojh.exe
Token: SeDebugPrivilege	5456	i_nljdbvtnlg.exe
Token: SeDebugPrivilege	5924	i_tqkigaysql.exe
Token: SeDebugPrivilege	2848	i_vsnkfcavsq.exe
Token: SeDebugPrivilege	4316	i_usmkfcausn.exe
Token: SeDebugPrivilege	3148	i_pnhfzxrpkh.exe
Token: SeDebugPrivilege	788	i_jhecwurpjh.exe
Token: SeDebugPrivilege	5000	i_ljebztrmge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1468	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5888 wrote to memory of 1588	5888	2026-07-21_24ade4c59dbf5d950b19168ec177a34b_elex_rhadamanthys_stop.exe	88
PID 1588 wrote to memory of 1468	1588	iexplore.exe	90
PID 1468 wrote to memory of 2340	1468	msedge.exe	91
PID 1468 wrote to memory of 4308	1468	msedge.exe	92
PID 1468 wrote to memory of 4284	1468	msedge.exe	94
PID 1468 wrote to memory of 4308	1468	msedge.exe	92
PID 1468 wrote to memory of 4308	1468	msedge.exe	92
PID 1468 wrote to memory of 2136	1468	msedge.exe	95
PID 1468 wrote to memory of 2136	1468	msedge.exe	95
PID 1468 wrote to memory of 6116	1468	msedge.exe	96
PID 1468 wrote to memory of 6116	1468	msedge.exe	96
PID 1468 wrote to memory of 6116	1468	msedge.exe	96
PID 1468 wrote to memory of 3608	1468	msedge.exe	97
PID 1468 wrote to memory of 3608	1468	msedge.exe	97
PID 1468 wrote to memory of 3608	1468	msedge.exe	97
PID 1468 wrote to memory of 4180	1468	msedge.exe	98
PID 1468 wrote to memory of 468	1468	msedge.exe	99
PID 1468 wrote to memory of 4180	1468	msedge.exe	98
PID 1468 wrote to memory of 4180	1468	msedge.exe	98
PID 1468 wrote to memory of 468	1468	msedge.exe	99
PID 1468 wrote to memory of 468	1468	msedge.exe	99
PID 1468 wrote to memory of 2444	1468	msedge.exe	101
PID 1468 wrote to memory of 2444	1468	msedge.exe	101
PID 5888 wrote to memory of 2944	5888	2026-07-21_24ade4c59dbf5d950b19168ec177a34b_elex_rhadamanthys_stop.exe	102
PID 1468 wrote to memory of 4720	1468	msedge.exe	104
PID 1468 wrote to memory of 4868	1468	msedge.exe	105
PID 1468 wrote to memory of 4720	1468	msedge.exe	104
PID 1468 wrote to memory of 4868	1468	msedge.exe	105
PID 612 wrote to memory of 4228	612	caupkicavs.exe	107
PID 1468 wrote to memory of 5220	1468	msedge.exe	111
PID 1468 wrote to memory of 4280	1468	msedge.exe	112
PID 1468 wrote to memory of 4280	1468	msedge.exe	112
PID 1468 wrote to memory of 1824	1468	msedge.exe	115
PID 1468 wrote to memory of 1824	1468	msedge.exe	115
PID 5888 wrote to memory of 5168	5888	2026-07-21_24ade4c59dbf5d950b19168ec177a34b_elex_rhadamanthys_stop.exe	116
PID 5888 wrote to memory of 1496	5888	2026-07-21_24ade4c59dbf5d950b19168ec177a34b_elex_rhadamanthys_stop.exe	120
PID 5736 wrote to memory of 2444	5736	xrpmhfcwur.exe	122
PID 5888 wrote to memory of 2584	5888	2026-07-21_24ade4c59dbf5d950b19168ec177a34b_elex_rhadamanthys_stop.exe	125
PID 5888 wrote to memory of 1692	5888	2026-07-21_24ade4c59dbf5d950b19168ec177a34b_elex_rhadamanthys_stop.exe	129
PID 3664 wrote to memory of 4988	3664	ecwuojhbzt.exe	131
PID 5888 wrote to memory of 4132	5888	2026-07-21_24ade4c59dbf5d950b19168ec177a34b_elex_rhadamanthys_stop.exe	134
PID 5888 wrote to memory of 4396	5888	2026-07-21_24ade4c59dbf5d950b19168ec177a34b_elex_rhadamanthys_stop.exe	138
PID 1824 wrote to memory of 4828	1824	uoljdbwtrl.exe	140
PID 5888 wrote to memory of 6016	5888	2026-07-21_24ade4c59dbf5d950b19168ec177a34b_elex_rhadamanthys_stop.exe	143
PID 1468 wrote to memory of 5936	1468	msedge.exe	146
PID 1468 wrote to memory of 5964	1468	msedge.exe	147
PID 1468 wrote to memory of 3020	1468	msedge.exe	148
PID 5888 wrote to memory of 4088	5888	2026-07-21_24ade4c59dbf5d950b19168ec177a34b_elex_rhadamanthys_stop.exe	151
PID 3016 wrote to memory of 3372	3016	vtolgdyvto.exe	153
PID 5888 wrote to memory of 2596	5888	2026-07-21_24ade4c59dbf5d950b19168ec177a34b_elex_rhadamanthys_stop.exe	156
PID 5888 wrote to memory of 3012	5888	2026-07-21_24ade4c59dbf5d950b19168ec177a34b_elex_rhadamanthys_stop.exe	160
PID 1516 wrote to memory of 3404	1516	nlfdaywqnl.exe	162
PID 5888 wrote to memory of 4332	5888	2026-07-21_24ade4c59dbf5d950b19168ec177a34b_elex_rhadamanthys_stop.exe	165
PID 5888 wrote to memory of 2884	5888	2026-07-21_24ade4c59dbf5d950b19168ec177a34b_elex_rhadamanthys_stop.exe	169
PID 3636 wrote to memory of 4484	3636	dyvqnigays.exe	171
PID 5888 wrote to memory of 3904	5888	2026-07-21_24ade4c59dbf5d950b19168ec177a34b_elex_rhadamanthys_stop.exe	174
PID 5888 wrote to memory of 1244	5888	2026-07-21_24ade4c59dbf5d950b19168ec177a34b_elex_rhadamanthys_stop.exe	178
PID 996 wrote to memory of 3252	996	usqnifzxus.exe	180
PID 5888 wrote to memory of 980	5888	2026-07-21_24ade4c59dbf5d950b19168ec177a34b_elex_rhadamanthys_stop.exe	183
PID 1468 wrote to memory of 3952	1468	msedge.exe	185
PID 1468 wrote to memory of 3952	1468	msedge.exe	185
PID 5888 wrote to memory of 5420	5888	2026-07-21_24ade4c59dbf5d950b19168ec177a34b_elex_rhadamanthys_stop.exe	191
PID 3360 wrote to memory of 5624	3360	vpnhfzxvpk.exe	193
PID 5888 wrote to memory of 4352	5888	2026-07-21_24ade4c59dbf5d950b19168ec177a34b_elex_rhadamanthys_stop.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-07-21_24ade4c59dbf5d950b19168ec177a34b_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_24ade4c59dbf5d950b19168ec177a34b_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5888
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ff9cda4c188,0x7ff9cda4c194,0x7ff9cda4c1a0
      4⤵
      PID:2340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,14414600392996429255,10185389148993074418,262144 --field-trial-handle=2760,i,1540876581929775273,11466322086203515286,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:2
      4⤵
      PID:4308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,12347734499626490021,16068009016593011044,524288 --field-trial-handle=2760,i,1540876581929775273,11466322086203515286,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:11
      4⤵
      System Time Discovery
      PID:4284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,6551470951777240706,6778902529027383613,524288 --field-trial-handle=2760,i,1540876581929775273,11466322086203515286,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:13
      4⤵
      PID:2136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3628,i,2711955633944986484,9742221632392308994,2097152 --field-trial-handle=2760,i,1540876581929775273,11466322086203515286,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
      4⤵
      PID:6116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3632,i,3815981734345875585,10420610335577512186,2097152 --field-trial-handle=2760,i,1540876581929775273,11466322086203515286,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:3608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,839008754906683288,17095651713068811694,2097152 --field-trial-handle=2760,i,1540876581929775273,11466322086203515286,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
      4⤵
      PID:4180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,8552188642254299438,8530486558555277401,2097152 --field-trial-handle=2760,i,1540876581929775273,11466322086203515286,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:9
      4⤵
      PID:468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,16611731529584884917,14783557539694073426,524288 --field-trial-handle=2760,i,1540876581929775273,11466322086203515286,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:14
      4⤵
      PID:2444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,12177720392035869916,16506702245992764347,524288 --field-trial-handle=2760,i,1540876581929775273,11466322086203515286,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
      4⤵
      PID:4720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,14618437977064655857,17801766935398972737,524288 --field-trial-handle=2760,i,1540876581929775273,11466322086203515286,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
      4⤵
      PID:4868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,14700782795568727131,13364415299802741082,524288 --field-trial-handle=2760,i,1540876581929775273,11466322086203515286,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
      4⤵
      PID:1880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,14700782795568727131,13364415299802741082,524288 --field-trial-handle=2760,i,1540876581929775273,11466322086203515286,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
      4⤵
      PID:5220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,13927311885740183757,5135521172921849470,524288 --field-trial-handle=2760,i,1540876581929775273,11466322086203515286,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
      4⤵
      PID:4280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,11939356722828360398,13454297271399329389,524288 --field-trial-handle=2760,i,1540876581929775273,11466322086203515286,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
      4⤵
      PID:1824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,3193001703307801326,9835647488619127477,524288 --field-trial-handle=2760,i,1540876581929775273,11466322086203515286,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:14
      4⤵
      PID:5936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,2861878410747462895,14601194561964443313,524288 --field-trial-handle=2760,i,1540876581929775273,11466322086203515286,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
      4⤵
      PID:5964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,9633915655675200124,1145075490377067435,524288 --field-trial-handle=2760,i,1540876581929775273,11466322086203515286,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
      4⤵
      PID:3020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,18410169943748572983,3589655005734338239,524288 --field-trial-handle=2760,i,1540876581929775273,11466322086203515286,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
      4⤵
      PID:3952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,11659806050750556898,3068985163188158505,524288 --field-trial-handle=2760,i,1540876581929775273,11466322086203515286,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
      4⤵
      PID:1648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=928,i,15377017294020306485,3601633251454421920,524288 --field-trial-handle=2760,i,1540876581929775273,11466322086203515286,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:14
      4⤵
      PID:2428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,6495971667753177341,6877059872333972806,524288 --field-trial-handle=2760,i,1540876581929775273,11466322086203515286,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
      4⤵
      PID:4616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5112,i,1042177524353035157,13381923146677203280,262144 --field-trial-handle=2760,i,1540876581929775273,11466322086203515286,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,1463203268443930750,13879273112121993000,524288 --field-trial-handle=2760,i,1540876581929775273,11466322086203515286,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:14
      4⤵
      PID:2868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\caupkicavs.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2944
- - C:\Temp\caupkicavs.exe
    C:\Temp\caupkicavs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:612
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4228
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_caupkicavs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5168
- - C:\Temp\i_caupkicavs.exe
    C:\Temp\i_caupkicavs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpmhfcwur.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1496
- - C:\Temp\xrpmhfcwur.exe
    C:\Temp\xrpmhfcwur.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5736
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2444
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpmhfcwur.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2584
- - C:\Temp\i_xrpmhfcwur.exe
    C:\Temp\i_xrpmhfcwur.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwuojhbzt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1692
- - C:\Temp\ecwuojhbzt.exe
    C:\Temp\ecwuojhbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3664
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4988
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwuojhbzt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4132
- - C:\Temp\i_ecwuojhbzt.exe
    C:\Temp\i_ecwuojhbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uoljdbwtrl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4396
- - C:\Temp\uoljdbwtrl.exe
    C:\Temp\uoljdbwtrl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1824
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4828
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uoljdbwtrl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6016
- - C:\Temp\i_uoljdbwtrl.exe
    C:\Temp\i_uoljdbwtrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtolgdyvto.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4088
- - C:\Temp\vtolgdyvto.exe
    C:\Temp\vtolgdyvto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3016
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3372
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtolgdyvto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2596
- - C:\Temp\i_vtolgdyvto.exe
    C:\Temp\i_vtolgdyvto.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlfdaywqnl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3012
- - C:\Temp\nlfdaywqnl.exe
    C:\Temp\nlfdaywqnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1516
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3404
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlfdaywqnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4332
- - C:\Temp\i_nlfdaywqnl.exe
    C:\Temp\i_nlfdaywqnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dyvqnigays.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2884
- - C:\Temp\dyvqnigays.exe
    C:\Temp\dyvqnigays.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3636
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4484
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dyvqnigays.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3904
- - C:\Temp\i_dyvqnigays.exe
    C:\Temp\i_dyvqnigays.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usqnifzxus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1244
- - C:\Temp\usqnifzxus.exe
    C:\Temp\usqnifzxus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:996
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3252
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usqnifzxus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:980
- - C:\Temp\i_usqnifzxus.exe
    C:\Temp\i_usqnifzxus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnhfzxvpk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5420
- - C:\Temp\vpnhfzxvpk.exe
    C:\Temp\vpnhfzxvpk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3360
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5624
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnhfzxvpk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4352
- - C:\Temp\i_vpnhfzxvpk.exe
    C:\Temp\i_vpnhfzxvpk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhczxrpkh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5428
- - C:\Temp\pnhczxrpkh.exe
    C:\Temp\pnhczxrpkh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1144
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2456
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhczxrpkh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5036
- - C:\Temp\i_pnhczxrpkh.exe
    C:\Temp\i_pnhczxrpkh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhezxrpke.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3396
- - C:\Temp\pjhezxrpke.exe
    C:\Temp\pjhezxrpke.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3728
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4320
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhezxrpke.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4164
- - C:\Temp\i_pjhezxrpke.exe
    C:\Temp\i_pjhezxrpke.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgeywtomgb.exe ups_run
  2⤵
  PID:3944
- - C:\Temp\mgeywtomgb.exe
    C:\Temp\mgeywtomgb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4156
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4208
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgeywtomgb.exe ups_ins
  2⤵
  PID:1336
- - C:\Temp\i_mgeywtomgb.exe
    C:\Temp\i_mgeywtomgb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\olgeywqojh.exe ups_run
  2⤵
  PID:1648
- - C:\Temp\olgeywqojh.exe
    C:\Temp\olgeywqojh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4896
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5964
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_olgeywqojh.exe ups_ins
  2⤵
  PID:3640
- - C:\Temp\i_olgeywqojh.exe
    C:\Temp\i_olgeywqojh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nljdbvtnlg.exe ups_run
  2⤵
  PID:4720
- - C:\Temp\nljdbvtnlg.exe
    C:\Temp\nljdbvtnlg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2028
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5680
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nljdbvtnlg.exe ups_ins
  2⤵
  PID:5904
- - C:\Temp\i_nljdbvtnlg.exe
    C:\Temp\i_nljdbvtnlg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tqkigaysql.exe ups_run
  2⤵
  PID:1344
- - C:\Temp\tqkigaysql.exe
    C:\Temp\tqkigaysql.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2356
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2808
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tqkigaysql.exe ups_ins
  2⤵
  PID:1424
- - C:\Temp\i_tqkigaysql.exe
    C:\Temp\i_tqkigaysql.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsnkfcavsq.exe ups_run
  2⤵
  PID:1748
- - C:\Temp\vsnkfcavsq.exe
    C:\Temp\vsnkfcavsq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1800
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5704
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1208
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsnkfcavsq.exe ups_ins
  2⤵
  PID:4428
- - C:\Temp\i_vsnkfcavsq.exe
    C:\Temp\i_vsnkfcavsq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkfcausn.exe ups_run
  2⤵
  PID:1668
- - C:\Temp\usmkfcausn.exe
    C:\Temp\usmkfcausn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2388
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1984
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkfcausn.exe ups_ins
  2⤵
  PID:1724
- - C:\Temp\i_usmkfcausn.exe
    C:\Temp\i_usmkfcausn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfzxrpkh.exe ups_run
  2⤵
  PID:5876
- - C:\Temp\pnhfzxrpkh.exe
    C:\Temp\pnhfzxrpkh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5728
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5576
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfzxrpkh.exe ups_ins
  2⤵
  PID:4864
- - C:\Temp\i_pnhfzxrpkh.exe
    C:\Temp\i_pnhfzxrpkh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhecwurpjh.exe ups_run
  2⤵
  PID:3000
- - C:\Temp\jhecwurpjh.exe
    C:\Temp\jhecwurpjh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:720
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4936
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhecwurpjh.exe ups_ins
  2⤵
  PID:3020
- - C:\Temp\i_jhecwurpjh.exe
    C:\Temp\i_jhecwurpjh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljebztrmge.exe ups_run
  2⤵
  PID:5796
- - C:\Temp\ljebztrmge.exe
    C:\Temp\ljebztrmge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5580
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5424
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljebztrmge.exe ups_ins
  2⤵
  PID:4748
- - C:\Temp\i_ljebztrmge.exe
    C:\Temp\i_ljebztrmge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5000

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4232

C:\Temp\zurmkecxuo.sys
C:\Temp\zurmkecxuo.sys
1⤵
- Executes dropped EXE
PID:3736

C:\Temp\mjebztrmjh.sys
C:\Temp\mjebztrmjh.sys
1⤵
- Executes dropped EXE
PID:1880

C:\Temp\zwuomgebwt.sys
C:\Temp\zwuomgebwt.sys
1⤵
- Executes dropped EXE
PID:2836

C:\Temp\ywrljdbvto.sys
C:\Temp\ywrljdbvto.sys
1⤵
- Executes dropped EXE
PID:984

C:\Temp\olgdyvtnlg.sys
C:\Temp\olgdyvtnlg.sys
1⤵
- Executes dropped EXE
PID:5436

C:\Temp\lidaysqkid.sys
C:\Temp\lidaysqkid.sys
1⤵
- Executes dropped EXE
PID:1820

C:\Temp\icaysqkida.sys
C:\Temp\icaysqkida.sys
1⤵
- Executes dropped EXE
PID:4448

C:\Temp\fcaxspnhfz.sys
C:\Temp\fcaxspnhfz.sys
1⤵
- Executes dropped EXE
PID:1472

C:\Temp\pmhecausmk.sys
C:\Temp\pmhecausmk.sys
1⤵
- Executes dropped EXE
PID:4156

C:\Temp\mkebzxrpmk.sys
C:\Temp\mkebzxrpmk.sys
1⤵
- Executes dropped EXE
PID:2020

C:\Temp\uomjezwroj.sys
C:\Temp\uomjezwroj.sys
1⤵
PID:5596

C:\Temp\mgebwtrojg.sys
C:\Temp\mgebwtrojg.sys
1⤵
PID:2716

C:\Temp\olgdywqoig.sys
C:\Temp\olgdywqoig.sys
1⤵
PID:4936

C:\Temp\vqnlfdxvqn.sys
C:\Temp\vqnlfdxvqn.sys
1⤵
PID:3440

C:\Temp\davtnlfdxv.sys
C:\Temp\davtnlfdxv.sys
1⤵
PID:1192

C:\Temp\axvpnicaxv.sys
C:\Temp\axvpnicaxv.sys
1⤵
PID:2292

C:\Temp\rpnhfzxspk.sys
C:\Temp\rpnhfzxspk.sys
1⤵
PID:5332

C:\Temp\mhfzxuomke.sys
C:\Temp\mhfzxuomke.sys
1⤵
PID:5932

C:\Temp\urmjecwuom.sys
C:\Temp\urmjecwuom.sys
1⤵
PID:4932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

caupkicavs.exe

Path C:\Temp\caupkicavs.exe
Size 243KB
SHA256 ba2e22643838666e4c33bbff358cea147faa9b5dff53efc4efb68f579294322e
MD5 aad58af0f130668df80b054ba8ce026a
SHA1 507321f4a9f7f72824b1204aa49fb3a09add98fe
SHA512 7255604ecdbc7071fccb2902cdc77273025974d00dc12bd8eda8c4dbfc0dbed66b29f81eafc12286e09ca36132ff741d1ce34b0db5a972b0acb643db06fba689
SSDEEP 3072:5MaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA77:9Gii9IL8Xa3lLNngoqRttA77
TLSH
T18E34490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwuojhbzt.exe

Path C:\Temp\ecwuojhbzt.exe
Size 243KB
SHA256 1a38fe56ae1ab72195d5631cd4e98bc6206922eacfe00f87326b5f384061a7a9
MD5 5f8274eb211b0db8822e24d4daa40608
SHA1 be980d438a302e3c00d16151170a5f83aa29f4ef
SHA512 5dfd708ce576b4a43c3501835a45e680704306b9a4530d86d2369659d302c1ac09202102147c532e78eb6cfbeb7571de13bfa41451613e1aad036432793128bc
SSDEEP 3072:3MaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Z:jGii9IL8Xa3lLNngoqRttA7Z
TLSH
T15134490272818031E75A0B74046AE7A046BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_caupkicavs.exe

Path C:\Temp\i_caupkicavs.exe
Size 243KB
SHA256 df3b69f097a47c6c671989b4e939dc6bfaf1172b4aef8ef70a59df3b00a4ffee
MD5 6d164762f7af7ef23520b645afb0c891
SHA1 931f51057b5c474d20e6cf484087ec0c3e712ec1
SHA512 2338ea76ab9e8ab9da854651f5ca865bea7d5c21766041676692b7262df05bd374dd3063187db20445c7f760090c15eaad79c76c6b01fc2856c2db3d14708b13
SSDEEP 3072:aMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:cGii9IL8Xa3lLNngoqRttA7g
TLSH
T1E734490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ecwuojhbzt.exe

Path C:\Temp\i_ecwuojhbzt.exe
Size 243KB
SHA256 f1dd2d4d93d77e1ca2b8f525a62e0983e4cb13452a26a163eaec258ac4d79270
MD5 03b6ddf7fce1192cb7e41570ba14afb4
SHA1 194e13b97cde2d52a0cc0f77ebbdb76c9c2e4515
SHA512 b96ae105b875a365dfd9902fde1bffb0822a2a35f2a2a2d68b991b563722378daa2de759b0c96515b4b4588d78b1bb7a6c8de8e655a7e33c9818b22f3e8c51c6
SSDEEP 3072:DMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7J:3Gii9IL8Xa3lLNngoqRttA7J
TLSH
T1EB34490272818031E71A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlfdaywqnl.exe

Path C:\Temp\i_nlfdaywqnl.exe
Size 243KB
SHA256 4fefb141aeaf4b67252fa562db160c5fe6bdd517b9a6ad0d2b5dd5e8f154f31c
MD5 91ab705a37c3dcd51018fba1ca9f5771
SHA1 6c03ebed988902be4534e86b0a2193fbd3c102b8
SHA512 fc2a43b57526e2fba3b07c960e51178ce45a4dd456cd99b26ba7b3302d78c74d8d12bc4438f4a57f561ecef9d75b1f0e2cdf44af798edb7a3bc961566d7bc2c3
SSDEEP 3072:zMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7l:HGii9IL8Xa3lLNngoqRttA7l
TLSH
T14E34490272818031E71A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uoljdbwtrl.exe

Path C:\Temp\i_uoljdbwtrl.exe
Size 243KB
SHA256 d99eb426d511a889111b06195cd2fe9980b464abeeb2363a2ad510e2117b419b
MD5 a09d851c9d38ad62f39a41a9d489a7db
SHA1 719f63d3b1a38a834dcf3e1302a2be3604715727
SHA512 4f69e183684a186c31a33bd2e37a5229c120291ee021b59f3b58e22f21b1e9d4bf4abaf77d0e05c91661d5347c6cbed43531ff01def1f679ecd4904b22d75a16
SSDEEP 3072:WMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7U:gGii9IL8Xa3lLNngoqRttA7U
TLSH
T1F134490272818031E75A0B74046AE7A046BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtolgdyvto.exe

Path C:\Temp\i_vtolgdyvto.exe
Size 243KB
SHA256 3810289a5cf99191c52eadf8d1a7aea2b7f3d543a05b56e4d77b68efd3a8f233
MD5 d4cd0afb01050ef316da7d7109701aa9
SHA1 a3803b70306ad0c44a1e59748210a52f6f495192
SHA512 5b7dce9c57e65e2402f7e9fbad5c95af0403af3198113f1402556c9530468c97dbfb59b881d03461bf893f6f9ae0d33c639e43abb7b4ac01b4da4a278567e0ab
SSDEEP 3072:oMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:iGii9IL8Xa3lLNngoqRttA7W
TLSH
T1C834490272818031E71A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xrpmhfcwur.exe

Path C:\Temp\i_xrpmhfcwur.exe
Size 243KB
SHA256 d81e8e7c57ff9f913e8b1d38d7cab6bad3e05c961b605bfcc0f13bbd8e8ac073
MD5 2c4d4f6f7e407ffa7e958bf78faea624
SHA1 6470ab212f4028cf50b537c92a854b6287f8a3ae
SHA512 c1ae08068e1e73b011ebd77d9d6b18cf6f5bc2e84cbdb759d480475ed2ece51654605cb3a79825d63be330b91180ff0e80e78e5253221badef864e39415576b2
SSDEEP 3072:SMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:kGii9IL8Xa3lLNngoqRttA7o
TLSH
T15534490272818031E71A0B78046AE7A046BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidaysqkid.sys

Path C:\Temp\lidaysqkid.sys
Size 141KB
SHA256 895b739d1e10d41367adb34a3994de51dc2cb0eca40a5192a8b13adaf71b7bea
MD5 83686dd87304376242faac9b623294a2
SHA1 f8faad7d358d7aab0d8df9bd40b0eab87a063da5
SHA512 8e763809ac12fd1bae6ddc1b414c089681d5905625208a530b82a5c4285686d1be27538576ff86c6e29961048bbf630f509280ccbe54e736f70b6d992816e9a9
SSDEEP 1536:Ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T18FE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjebztrmjh.sys

Path C:\Temp\mjebztrmjh.sys
Size 141KB
SHA256 2be7e94eac47833401c5b7cbf5e5e9b2efc34f34e6cdf3566189df04a120d9b2
MD5 be1f0b120093c3a4b4d4d0e482faf777
SHA1 5de99e1663f7f7b0a349e5dfa2abe1f43c6f6f1c
SHA512 7fe0c6883e99898c5b90778ef3a621e55763c16fd0ffae1af543e05e86bf729c94d3b8d786bf94a66602a4cde826cf9fb238ecabb1030b80228e39bc46d3d47f
SSDEEP 1536:oa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:oa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A7E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdaywqnl.exe

Path C:\Temp\nlfdaywqnl.exe
Size 243KB
SHA256 0e05e9d241f9a4dd40474bcd8abc6e370a7d8f0a425027d4cf149e215881dce5
MD5 f2afd4dc56c23043aad0315b5dafc4b9
SHA1 33fa5fcf0c72628b66f10c3d4f762df7b324a6e9
SHA512 6b52bcf0cc9e13c40c5e9fb44940711b71c26b06864fe818a4eeeb90caf18d904158160511c9b7f6610329260196cc88288aabdcc390db7add776e544bec7a5f
SSDEEP 3072:4MaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA72:SGii9IL8Xa3lLNngoqRttA72
TLSH
T1F034490272818031E71A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgdyvtnlg.sys

Path C:\Temp\olgdyvtnlg.sys
Size 141KB
SHA256 fbe7c4849bfd803baff53ada37d0bdda152033fc003bf17038b7880bd4097b68
MD5 7fc350a1f1eb511398f90823ceebb6f6
SHA1 f2cffd4500a318fec9eec31a66d8c9a735d074c5
SHA512 74f369fac01cbf37399ab489d5d87283de58fde378215cbcfb7aa2dab074740a0bbdae062aafbb16ff489eb4a6d7b904f0df08bc30e4436b1f03798fd78e0dc1
SSDEEP 1536:5a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:5a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A8E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uoljdbwtrl.exe

Path C:\Temp\uoljdbwtrl.exe
Size 243KB
SHA256 739672b8bca8fa8da4ff4c61336dd144b5e750ebf0acfe4c167c48d58695f2b1
MD5 fb85f32a2ffc5ff458e338b87ac7f1eb
SHA1 8cab1477674aaa61dd7cb0eed53328e931ddab73
SHA512 c3ff5de1ddfc128a271e009f246d1232be448add3fe8585d1b47d3893ff4f75167ca889aaa0d4a00e8e5fba175e1492fc474b57126d71889fc6a616ebac9e183
SSDEEP 3072:gMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7q:KGii9IL8Xa3lLNngoqRttA7q
TLSH
T14634490272818031E75A0B74046AE7A046BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtolgdyvto.exe

Path C:\Temp\vtolgdyvto.exe
Size 243KB
SHA256 a66fe95ae3a4e7d34332f37cf43f15bf02055dbde5115cc9b7fbcb1936607023
MD5 b0bff9a53960fa76cdc5c02fcfedeac2
SHA1 4f5dbc31733984259e4ce4c8127712872e97bd6b
SHA512 027db8f11d175f197f789eea2a88ff662bbe8571f205d716e025b2eaf0d51a2199ae6f2921508a90cb3f4f91b5de4f1dbc7ceaf666fddc66e9716caa5b3b7c83
SSDEEP 3072:lMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:RGii9IL8Xa3lLNngoqRttA7D
TLSH
T13F34490272818031E75A0B74046AE7A046BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpmhfcwur.exe

Path C:\Temp\xrpmhfcwur.exe
Size 243KB
SHA256 03e5d89965b80b36949653c2245e5deb426d521969350fb88215e814b1a0f64f
MD5 daaf204e3c75038e98ee9b110a02055e
SHA1 6b3b2e4c32b8bc098c3e53d33dcf4e9fe43ce007
SHA512 ca875c520158d8e2d9fa61850af31e9982a43686786b74872c00e6a91b7f91354193c64ca5658481ef07e422406f35559580eab66f948cca1676915a9497c585
SSDEEP 3072:qMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA78:MGii9IL8Xa3lLNngoqRttA78
TLSH
T19B34490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywrljdbvto.sys

Path C:\Temp\ywrljdbvto.sys
Size 141KB
SHA256 d03d658fce5a91341ce9a3f7bd3596e9597eee9b1ed6338dd46e01e01103fe4e
MD5 68bef91b84c20b78d5155d16890ad84f
SHA1 5c142522c0a892ee69c116c78f2b1615c663e9f7
SHA512 d41bdccc273255484fd6995a253399f1f1e9ac550868f92f264f98c49202af71ef30d33a91029edf1572152cfcd087a64198bdd1afd93c63682235d5cae764ca
SSDEEP 1536:ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T14FE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zurmkecxuo.sys

Path C:\Temp\zurmkecxuo.sys
Size 141KB
SHA256 baf73505252da300fc300978dbca5c45dcd113687f5aa136f490d3cfb617037b
MD5 3143bc1bda6a8c7bfe8c0542bdb4e226
SHA1 6044a75b877cc571c0a2479b2b1d749e47240ca5
SHA512 48e20aa6f65b57a56a8b579647958659e697c8ab6cea316576de1cf6b30c733f2f009b6136f2b56c8eb3cb9bfb638780288cb59239af4f0c758e4b9bab749f12
SSDEEP 1536:la3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:la3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E9E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwuomgebwt.sys

Path C:\Temp\zwuomgebwt.sys
Size 141KB
SHA256 7e4503dc16bf16985bde1dff694891c6844d4cf619f9fec70e031a5d51a39c65
MD5 998979f10ac4d2f6b11cd3f6ab6b672c
SHA1 6210b5dae99dbf81dd07e6c2defce9f78715c09b
SHA512 65fd0c2b1ebb30e1f640713721ddef3b75c6156b2519491933e97fda941a389f2ad2ceabfba91e45f6cccb55126d36251aa590d79730f33855cbcd9cb4a97759
SSDEEP 1536:Da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T112E38C12B2D2D172D8A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fe539a73c7ca86d3619f977f03928961ea251e0316a39aebfdb1381a86a7d29a
MD5 29925fcc91411e910fb236885e82154a
SHA1 fae4fd6893c7d40f1bbf74daa4c4908f05d770c0
SHA512 b0f59c49efe190b435a2f92f85da9f0d6ffcd2ae1fbdba98ec4c910ef44f4756a1cb3ce9d739c9c00fb635b0b33f5258f5c4c13ad6092fefe69ecd6c52c3af6d
TLSH
T1AC613E10C32119D1FF67F570B6D1489935FA524601F72E012CA82DF1404AF62FADC39B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594caf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594caf.TMP
Size 3KB
SHA256 f4c32643f8d9bef0c8e3ff405d531bdd595e2f8344662d1ccac186c41d863c38
MD5 7b11d7a75240521d0498b3616544a1c4
SHA1 714fb6b678127d9722c662a9ee34a9e7f26b658c
SHA512 d221de79aba490c0fb26db0be78ae20e4e94ab933a022255285aa873ea62e69bdbe6fd0d3325a1126af6677f5edbde5c85ee3bfd22c79bf4bc293337008bb0d2
TLSH
T11B613D10C32519D1FF67F570B6D1489931EA924A01F72E012CA82DF1404AF22FACC39B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5b7e1c5873f8dca87d28fc18f7f84446aefb11f3acc744e3f19697165c452182
MD5 cbabdac04486a7bf841ab18e166831ea
SHA1 cfab92e84b45e6743e4099c8d5f1fdb8eadc184c
SHA512 85f9380c35a11c6971e4c2b549373c7f3fd127692f94b20a6c776335a51b46be2d1429e079bbcfd7df18e6f052596a2fde1f2c309c89d15ab9e5c4e67973f5e0
TLSH
T1CE419EF3C7E8866E890156F0AB187E2BCE2D0915832C3D5AC9E4AF1B93E2471D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e92456c2d9e237f03f3f8f7c59ed1d052d22b03764c3f35b65856a4e37b9df01
MD5 632e745bf8f882532dd7f8f01b40ebee
SHA1 cb2f4186d73a823acf99545e6c6292351c622809
SHA512 b059956b4a409d9b6f871b013921b33f4a0a14b83c10de2e0b65cd184291a9f1715ae8c33848f0fae084547462b56bd1a983ec08713d715df5085f2baf636bf5
SSDEEP 192:sxRTR+C//fisORkwgZHlTzoA8p9e/g6+WNC07/YoFCY3+GgIgDmJ:sxRTz//fisAkw+s4/5h/QWy2
TLSH
T1BB42A81A7E289D7B5CC7D21DBA65BF53D2F95032A1A12E48B6FC8A0C04E67DD630740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 26516bdb6df207a5ca9394b5816cb4c880bc4750977b6be81f45fc756190d6a7
MD5 a9818e08388981baabe6d197c44f4d29
SHA1 ed2b257bef46d0ec2c37799bc38d59e39a09ae5d
SHA512 04bea97cc8e98a40823f895bd9b6fc9e17aa0f911e9d5f88f2cd2c9feaf31be0f91aa5e231d522b981cf003129f47f0dfe7a5e11dbe41e17c5f80a60885fe3bc
SSDEEP 192:sxRAR+C//fis6RkwgZHlTzoA8p9e/g6+WNC07/YoFCY3+GgIgtJ:sxRAz//fisMkw+s4/5h/QWy3
TLSH
T10932A71A7E289D7B5CC7D21DBA65BF53D2F95032A1A12E48B6FC8A0C04E67DD530740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 db7d921d26b31cd49fed7ee0f8f388527f1c0cbaff0898cce0b623d366a8c5b5
MD5 3222d906ac17ca784634b3e53deea638
SHA1 bff2f4b75a747a4f65d960e917db1ab07159bdf1
SHA512 ef481bffc0ecb0461b8144e0b48dd025c788af0d89a6184ca7dc51bfc089b9003ee8dea64f419bb2e2d918526710eeb37751bcf1a1c7cddbd71994a033f4b5f1
SSDEEP 192:sxRTR+C//fisORkTgZHlTzoA8p9e/g6+WNC07/Yo0CY3+GgIgDoJ:sxRTz//fisAkT+s4/5h/TWyA
TLSH
T17B42971A7E289D7B5CC7D219BA65BF53D2F95022A1A12E48A6FC8A0C04E67DD630740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 b3027cb7501ea9711e2e3850750e3399fc4f865809dd7412f5dfe039ad075e03
MD5 8be035a32ebbaab7c690ab78b80bdffa
SHA1 5ec6d5d2f86c019c26f499cc78dc8af7a7f45f5a
SHA512 57629be70c9c0c2f752c1fab088ea6bbad6bb6539210489409932eafafb224187897773c007de654eac228c0446192b560409189142907209c01ddb99256e33e
SSDEEP 768:j26HRo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmBVuw1ro9le0g:j26HRUE7MRWgs2f02u1ja1mB4wOwb
TLSH
T1C4D2DB7B740DCABE4F800ADDED297E9F6D6802CB9698CD8047FD851C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59e788.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59e788.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 acb6742368cec5a5998aeb8d0c29f7ac3ea4f88da0f982fefc8a2b103c9b5d37
MD5 2951b75e7da61157e18e307abc03fcac
SHA1 6e6fe1852e66e5af08e6ca9e219d412263b63c0b
SHA512 c6dbb2a8d4078a03deab9cf6d7455242a5cc09ed2e25a01839fdb3c54c3e67073e2c7f10c78bc79839f4434379fea1e05b7e4ac579ce43506a32bb56c2a09c69
SSDEEP 768:0rv+4UNbd13Zf7/TBOW+vDONXyer1IRCzni9dBGM:0bsb33ZT2SIqnWBN
TLSH
T12F03BF31E0699E338DE6A395B14777937FF8206799800B60EDDA1F8E058769E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4a65c7d4b59593fe786b57960b60ef28111c6a776d1d6fac992f2ed6deed4f8c
MD5 0e4488263e427fa20d7ba1df8b33c1dd
SHA1 8c11772405d871b4d9af0c91f585f53268640bea
SHA512 964ecbaa52cdf906e04577d6d0042614a3cc5d298fea2235eb2544198f87c6611e39bbcac6eba4d592830f040a74fbc50fbc5cc24bdb68eecbc1b6a040033e42
SSDEEP 768:hrv+4UNbdz3fV/TBOW+pONXyer1IRCzniBIeVH1SK7:hbsbV3NsSIqnLEH1l
TLSH
T19703BF36E4A89E338CE2A3D6B147B6437FB86057C6800790EDDE1F4E069B59E130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 aa61530c876d30381a84b650311b31bf83327b542a1fda550e48060cfe731460
MD5 280165648bc8b94aa2c2c414807693bf
SHA1 547e9fd0cccd8f983cd709ea854c9c48c2d002db
SHA512 a26cf4cdff3f60d8c77395699bdad4529579418f69b899685d40c1e7584082ed9dbc1924bf82154a20f514c5759e400b0d40388d961eb712235a8a8132a08fc3
SSDEEP 768:Kj+973s07/TBOW+vxONXyer1IRCzni9db9ME:p973sYMSIqnWb+E
TLSH
T127F2BF35E4569E238CD2A396B2473793BFF9216BC9840E54EED95F4E06C3B6D030B41A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 b7211538d7f339378f2c31f2a8e8657e62b6642372fe1af82c4c3af2cee4f2d6
MD5 8d4db80553097260225ac017bc8ee14b
SHA1 1d9dcd778e8348a6d8baf7cb7ff571a15596fc95
SHA512 6dbbe4c1e96e738fa031769df5e5aca1b08822e671a96e193bbca3d2bcd46e6283564fce73d97b07cbd9da87dd79469eed4ed0ded28950e0d242053422ff3f8d
SSDEEP 768:PF1j+9J3KwgfTcxsOW+vaONXyer1IRCzni9db9ME:m9J3KYCSIqnWb+E
TLSH
T1671316F594D78A36D89E4393B33D2E529AFDD167B5844980BBC45E4CCC822BFC30A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

8f50b2f0-99ac-4275-9f67-b7e1a9d5c738.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8f50b2f0-99ac-4275-9f67-b7e1a9d5c738.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1468_878105942\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/984-271-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1192-439-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1472-331-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1820-312-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1880-228-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2020-364-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2292-444-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2716-397-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2836-257-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3440-428-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3736-181-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3736-234-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4156-335-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4448-316-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4932-485-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4936-408-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5332-465-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5436-292-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5596-376-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5932-487-0x0000000000010000-0x0000000000083000-memory.dmp

Download