855c3edf9c96d0e0e0f0693033cbb8ef58224bb0623f9784b003582f0ea1d459

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 10:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_3781c9afd78366ab3bdb8046c3080049_elex_rhadamanthys_stop.exe
Size 243KB
Sample260814-mm5cea1eqd
SHA256 855c3edf9c96d0e0e0f0693033cbb8ef58224bb0623f9784b003582f0ea1d459
MD5 3781c9afd78366ab3bdb8046c3080049
SHA1 65ef23deef67a6f08ca68ab1f753dc0f5a9e6786
SHA512 981560d4db8f23ab34ea9702ca75a77a86648c61aca540702afde285593be45299310a607ab7b4bd8e8871b65fe368236410a05cce9affd1aef06122050a5cf8
SSDEEP 3072:uCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA78:hvMsLaOa3lLNngoqRttA78
TLSH
T1DF345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1488	CP.exe
5456	oidavtnlfd.exe
3916	CP.exe
5316	CP.exe
2956	i_oidavtnlfd.exe
4172	vtnlfdyvqn.sys
4464	CP.exe
3092	fdayvqnlig.exe
5248	CP.exe
5420	CP.exe
5404	i_fdayvqnlig.exe
2984	dxvqnifays.sys
980	CP.exe
3896	pnigaysqki.exe
2692	CP.exe
1136	CP.exe
1568	i_pnigaysqki.exe
5696	icaxspkhfd.sys
928	CP.exe
4420	hfcauspnkf.exe
4544	CP.exe
5580	CP.exe
2956	i_hfcauspnkf.exe
3736	kecausmkec.sys
2300	CP.exe
5636	cxupmkfcxu.exe
1840	CP.exe
3904	CP.exe
4280	i_cxupmkfcxu.exe
3040	fzxrpmhecz.sys
6072	CP.exe
5004	wurmjhbzwu.exe
4808	CP.exe
2140	CP.exe
5228	i_wurmjhbzwu.exe
2520	jhezwuomge.sys
2296	CP.exe
2232	omgezxrpjh.exe
5960	CP.exe
5884	CP.exe
5832	i_omgezxrpjh.exe
5900	omgeywrojh.sys
2620	CP.exe
5364	omgeywrojh.exe
1692	CP.exe
4080	CP.exe
2848	i_omgeywrojh.exe
5928	jgbywqoigd.sys
2968	CP.exe
936	yvtoljgbyt.exe
3408	CP.exe
1400	CP.exe
2736	i_yvtoljgbyt.exe
3552	yvqoigaytq.sys
1280	CP.exe
5012	lidbytqlid.exe
3084	CP.exe
3500	CP.exe
6140	i_lidbytqlid.exe
2216	nlfdaysqki.sys
4788	CP.exe
8	nifdxvsqni.exe
4908	CP.exe
3104	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_1063300211\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_1063300211\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_479765314\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_774129539\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_1699060976\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_1699060976\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_479765314\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_479765314\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_479765314\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidbytqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwupmhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwupmhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oidavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvtoljgbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrmjebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifdxvsqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfaxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfcauspnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvtoljgbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvsnkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidbytqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oidavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdayvqnlig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxupmkfcxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvsnkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfcauspnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wurmjhbzwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wurmjhbzwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrmjebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdayvqnlig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqnlgdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqnlgdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxupmkfcxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifdxvsqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhezxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfaxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhezxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_3781c9afd78366ab3bdb8046c3080049_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnigaysqki.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5716	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1272	ipconfig.exe
4112	ipconfig.exe
4952	ipconfig.exe
1968	ipconfig.exe
4480	ipconfig.exe
5928	ipconfig.exe
6024	ipconfig.exe
1220	ipconfig.exe
2412	ipconfig.exe
5900	ipconfig.exe
1032	ipconfig.exe
2600	ipconfig.exe
4132	ipconfig.exe
5320	ipconfig.exe
4088	ipconfig.exe
4516	ipconfig.exe
1312	ipconfig.exe
5488	ipconfig.exe
6104	ipconfig.exe
4612	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311773609470610"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{236F2724-32C2-4BCE-A85C-31477D2D11EC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5436	msedge.exe
5436	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2956	i_oidavtnlfd.exe
Token: SeDebugPrivilege	5404	i_fdayvqnlig.exe
Token: SeDebugPrivilege	1568	i_pnigaysqki.exe
Token: SeDebugPrivilege	2956	i_hfcauspnkf.exe
Token: SeDebugPrivilege	4280	i_cxupmkfcxu.exe
Token: SeDebugPrivilege	5228	i_wurmjhbzwu.exe
Token: SeDebugPrivilege	5832	i_omgezxrpjh.exe
Token: SeDebugPrivilege	2848	i_omgeywrojh.exe
Token: SeDebugPrivilege	2736	i_yvtoljgbyt.exe
Token: SeDebugPrivilege	6140	i_lidbytqlid.exe
Token: SeDebugPrivilege	1620	i_nifdxvsqni.exe
Token: SeDebugPrivilege	1032	i_nhfaxspkic.exe
Token: SeDebugPrivilege	2536	i_nhezxupnhf.exe
Token: SeDebugPrivilege	5556	i_ecwupmhezx.exe
Token: SeDebugPrivilege	4660	i_pmhezxrpjh.exe
Token: SeDebugPrivilege	5812	i_hbztrmjebw.exe
Token: SeDebugPrivilege	4856	i_ywqojgbztr.exe
Token: SeDebugPrivilege	2848	i_wqnlgdyvqo.exe
Token: SeDebugPrivilege	2056	i_qnigaysqki.exe
Token: SeDebugPrivilege	1148	i_dxvsnkidav.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3176	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5976 wrote to memory of 2360	5976	2026-08-14_3781c9afd78366ab3bdb8046c3080049_elex_rhadamanthys_stop.exe	88
PID 2360 wrote to memory of 3176	2360	iexplore.exe	90
PID 3176 wrote to memory of 2256	3176	msedge.exe	91
PID 3176 wrote to memory of 5716	3176	msedge.exe	92
PID 3176 wrote to memory of 4616	3176	msedge.exe	93
PID 3176 wrote to memory of 4616	3176	msedge.exe	93
PID 3176 wrote to memory of 1216	3176	msedge.exe	94
PID 3176 wrote to memory of 1216	3176	msedge.exe	94
PID 3176 wrote to memory of 1216	3176	msedge.exe	94
PID 3176 wrote to memory of 3528	3176	msedge.exe	95
PID 3176 wrote to memory of 3528	3176	msedge.exe	95
PID 3176 wrote to memory of 3528	3176	msedge.exe	95
PID 3176 wrote to memory of 2692	3176	msedge.exe	96
PID 3176 wrote to memory of 2692	3176	msedge.exe	96
PID 3176 wrote to memory of 2692	3176	msedge.exe	96
PID 3176 wrote to memory of 4628	3176	msedge.exe	99
PID 3176 wrote to memory of 2924	3176	msedge.exe	98
PID 3176 wrote to memory of 4628	3176	msedge.exe	99
PID 3176 wrote to memory of 4628	3176	msedge.exe	99
PID 3176 wrote to memory of 2924	3176	msedge.exe	98
PID 3176 wrote to memory of 2924	3176	msedge.exe	98
PID 3176 wrote to memory of 4608	3176	msedge.exe	100
PID 3176 wrote to memory of 4608	3176	msedge.exe	100
PID 3176 wrote to memory of 4908	3176	msedge.exe	103
PID 3176 wrote to memory of 4680	3176	msedge.exe	102
PID 3176 wrote to memory of 4908	3176	msedge.exe	103
PID 3176 wrote to memory of 4680	3176	msedge.exe	102
PID 5976 wrote to memory of 1488	5976	2026-08-14_3781c9afd78366ab3bdb8046c3080049_elex_rhadamanthys_stop.exe	104
PID 3176 wrote to memory of 5148	3176	msedge.exe	107
PID 5456 wrote to memory of 3916	5456	oidavtnlfd.exe	109
PID 3176 wrote to memory of 5016	3176	msedge.exe	112
PID 3176 wrote to memory of 5016	3176	msedge.exe	112
PID 3176 wrote to memory of 3340	3176	msedge.exe	113
PID 3176 wrote to memory of 3340	3176	msedge.exe	113
PID 5976 wrote to memory of 5316	5976	2026-08-14_3781c9afd78366ab3bdb8046c3080049_elex_rhadamanthys_stop.exe	117
PID 5976 wrote to memory of 4464	5976	2026-08-14_3781c9afd78366ab3bdb8046c3080049_elex_rhadamanthys_stop.exe	121
PID 3092 wrote to memory of 5248	3092	fdayvqnlig.exe	123
PID 5976 wrote to memory of 5420	5976	2026-08-14_3781c9afd78366ab3bdb8046c3080049_elex_rhadamanthys_stop.exe	126
PID 5976 wrote to memory of 980	5976	2026-08-14_3781c9afd78366ab3bdb8046c3080049_elex_rhadamanthys_stop.exe	130
PID 3896 wrote to memory of 2692	3896	pnigaysqki.exe	132
PID 5976 wrote to memory of 1136	5976	2026-08-14_3781c9afd78366ab3bdb8046c3080049_elex_rhadamanthys_stop.exe	135
PID 5976 wrote to memory of 928	5976	2026-08-14_3781c9afd78366ab3bdb8046c3080049_elex_rhadamanthys_stop.exe	139
PID 4420 wrote to memory of 4544	4420	hfcauspnkf.exe	141
PID 5976 wrote to memory of 5580	5976	2026-08-14_3781c9afd78366ab3bdb8046c3080049_elex_rhadamanthys_stop.exe	144
PID 3176 wrote to memory of 5364	3176	msedge.exe	147
PID 3176 wrote to memory of 5900	3176	msedge.exe	148
PID 3176 wrote to memory of 1848	3176	msedge.exe	149
PID 5976 wrote to memory of 2300	5976	2026-08-14_3781c9afd78366ab3bdb8046c3080049_elex_rhadamanthys_stop.exe	152
PID 5636 wrote to memory of 1840	5636	cxupmkfcxu.exe	154
PID 5976 wrote to memory of 3904	5976	2026-08-14_3781c9afd78366ab3bdb8046c3080049_elex_rhadamanthys_stop.exe	157
PID 5976 wrote to memory of 6072	5976	2026-08-14_3781c9afd78366ab3bdb8046c3080049_elex_rhadamanthys_stop.exe	161
PID 5004 wrote to memory of 4808	5004	wurmjhbzwu.exe	163
PID 5976 wrote to memory of 2140	5976	2026-08-14_3781c9afd78366ab3bdb8046c3080049_elex_rhadamanthys_stop.exe	166
PID 5976 wrote to memory of 2296	5976	2026-08-14_3781c9afd78366ab3bdb8046c3080049_elex_rhadamanthys_stop.exe	170
PID 2232 wrote to memory of 5960	2232	omgezxrpjh.exe	172
PID 5976 wrote to memory of 5884	5976	2026-08-14_3781c9afd78366ab3bdb8046c3080049_elex_rhadamanthys_stop.exe	175
PID 5976 wrote to memory of 2620	5976	2026-08-14_3781c9afd78366ab3bdb8046c3080049_elex_rhadamanthys_stop.exe	179
PID 5364 wrote to memory of 1692	5364	omgeywrojh.exe	181
PID 5976 wrote to memory of 4080	5976	2026-08-14_3781c9afd78366ab3bdb8046c3080049_elex_rhadamanthys_stop.exe	184
PID 3176 wrote to memory of 1028	3176	msedge.exe	186
PID 3176 wrote to memory of 1028	3176	msedge.exe	186
PID 5976 wrote to memory of 2968	5976	2026-08-14_3781c9afd78366ab3bdb8046c3080049_elex_rhadamanthys_stop.exe	192
PID 936 wrote to memory of 3408	936	yvtoljgbyt.exe	194
PID 5976 wrote to memory of 1400	5976	2026-08-14_3781c9afd78366ab3bdb8046c3080049_elex_rhadamanthys_stop.exe	197

C:\Users\Admin\AppData\Local\Temp\2026-08-14_3781c9afd78366ab3bdb8046c3080049_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_3781c9afd78366ab3bdb8046c3080049_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5976
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffbe17bc188,0x7ffbe17bc194,0x7ffbe17bc1a0
      4⤵
      PID:2256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1700,i,13146095802892977200,16691696231756768707,524288 --field-trial-handle=2192,i,14509885912330946813,8691357441030087221,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:11
      4⤵
      System Time Discovery
      PID:5716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,3702635235970937270,11469153233535761195,524288 --field-trial-handle=2192,i,14509885912330946813,8691357441030087221,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:13
      4⤵
      PID:4616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,6977850333298325700,9411674059420778627,262144 --field-trial-handle=2192,i,14509885912330946813,8691357441030087221,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
      4⤵
      PID:1216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,14856595455995593186,16477973967422938101,2097152 --field-trial-handle=2192,i,14509885912330946813,8691357441030087221,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:3528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,5035303106022601179,13828435881127226744,2097152 --field-trial-handle=2192,i,14509885912330946813,8691357441030087221,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:2692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4408,i,12783159228995382148,11964080716716738817,2097152 --field-trial-handle=2192,i,14509885912330946813,8691357441030087221,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:9
      4⤵
      PID:2924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4380,i,5467841546681273969,7801621093810181912,2097152 --field-trial-handle=2192,i,14509885912330946813,8691357441030087221,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
      4⤵
      PID:4628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,8863896534749737664,628007695823231842,524288 --field-trial-handle=2192,i,14509885912330946813,8691357441030087221,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
      4⤵
      PID:4608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3864,i,5010920449355506432,15242322620559902268,524288 --field-trial-handle=2192,i,14509885912330946813,8691357441030087221,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:14
      4⤵
      PID:4680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,1282975969958670253,15741101105310026306,524288 --field-trial-handle=2192,i,14509885912330946813,8691357441030087221,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:14
      4⤵
      PID:4908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,14251079545014648817,7497744030826570952,524288 --field-trial-handle=2192,i,14509885912330946813,8691357441030087221,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
      4⤵
      PID:2492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,14251079545014648817,7497744030826570952,524288 --field-trial-handle=2192,i,14509885912330946813,8691357441030087221,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
      4⤵
      PID:5148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,11165015046232900502,13398713021869709224,524288 --field-trial-handle=2192,i,14509885912330946813,8691357441030087221,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
      4⤵
      PID:5016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,1881420380430616968,17509376188086294000,524288 --field-trial-handle=2192,i,14509885912330946813,8691357441030087221,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:3340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,11160282626934590400,5577393594072595362,524288 --field-trial-handle=2192,i,14509885912330946813,8691357441030087221,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
      4⤵
      PID:5364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,12931815187308083183,1060569303065354541,524288 --field-trial-handle=2192,i,14509885912330946813,8691357441030087221,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
      4⤵
      PID:5900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,9487856135192172610,8650125830600942243,524288 --field-trial-handle=2192,i,14509885912330946813,8691357441030087221,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
      4⤵
      PID:1848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,13489495458581286148,8314615247066995405,524288 --field-trial-handle=2192,i,14509885912330946813,8691357441030087221,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
      4⤵
      PID:1028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,14481680951644486079,15075505885889673534,524288 --field-trial-handle=2192,i,14509885912330946813,8691357441030087221,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
      4⤵
      PID:4768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=944,i,6931981164146176210,8861327652231842468,524288 --field-trial-handle=2192,i,14509885912330946813,8691357441030087221,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
      4⤵
      PID:3428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,3362474123086704758,9968563557442321519,524288 --field-trial-handle=2192,i,14509885912330946813,8691357441030087221,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:14
      4⤵
      PID:3452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6072,i,6424457443380018883,391650946325068253,262144 --field-trial-handle=2192,i,14509885912330946813,8691357441030087221,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3040,i,17405425825101388891,6197226951259908939,524288 --field-trial-handle=2192,i,14509885912330946813,8691357441030087221,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:14
      4⤵
      PID:552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oidavtnlfd.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1488
- - C:\Temp\oidavtnlfd.exe
    C:\Temp\oidavtnlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5456
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3916
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oidavtnlfd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5316
- - C:\Temp\i_oidavtnlfd.exe
    C:\Temp\i_oidavtnlfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdayvqnlig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4464
- - C:\Temp\fdayvqnlig.exe
    C:\Temp\fdayvqnlig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3092
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5248
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdayvqnlig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5420
- - C:\Temp\i_fdayvqnlig.exe
    C:\Temp\i_fdayvqnlig.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnigaysqki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:980
- - C:\Temp\pnigaysqki.exe
    C:\Temp\pnigaysqki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3896
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2692
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnigaysqki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1136
- - C:\Temp\i_pnigaysqki.exe
    C:\Temp\i_pnigaysqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfcauspnkf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:928
- - C:\Temp\hfcauspnkf.exe
    C:\Temp\hfcauspnkf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4420
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4544
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2600
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfcauspnkf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5580
- - C:\Temp\i_hfcauspnkf.exe
    C:\Temp\i_hfcauspnkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxupmkfcxu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2300
- - C:\Temp\cxupmkfcxu.exe
    C:\Temp\cxupmkfcxu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5636
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1840
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxupmkfcxu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3904
- - C:\Temp\i_cxupmkfcxu.exe
    C:\Temp\i_cxupmkfcxu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4280
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wurmjhbzwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6072
- - C:\Temp\wurmjhbzwu.exe
    C:\Temp\wurmjhbzwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5004
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4808
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wurmjhbzwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2140
- - C:\Temp\i_wurmjhbzwu.exe
    C:\Temp\i_wurmjhbzwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgezxrpjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2296
- - C:\Temp\omgezxrpjh.exe
    C:\Temp\omgezxrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2232
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5960
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5488
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgezxrpjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5884
- - C:\Temp\i_omgezxrpjh.exe
    C:\Temp\i_omgezxrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgeywrojh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2620
- - C:\Temp\omgeywrojh.exe
    C:\Temp\omgeywrojh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5364
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1692
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgeywrojh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4080
- - C:\Temp\i_omgeywrojh.exe
    C:\Temp\i_omgeywrojh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\yvtoljgbyt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2968
- - C:\Temp\yvtoljgbyt.exe
    C:\Temp\yvtoljgbyt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:936
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3408
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_yvtoljgbyt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1400
- - C:\Temp\i_yvtoljgbyt.exe
    C:\Temp\i_yvtoljgbyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lidbytqlid.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1280
- - C:\Temp\lidbytqlid.exe
    C:\Temp\lidbytqlid.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5012
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3084
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lidbytqlid.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3500
- - C:\Temp\i_lidbytqlid.exe
    C:\Temp\i_lidbytqlid.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nifdxvsqni.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4788
- - C:\Temp\nifdxvsqni.exe
    C:\Temp\nifdxvsqni.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:8
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4908
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nifdxvsqni.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3104
- - C:\Temp\i_nifdxvsqni.exe
    C:\Temp\i_nifdxvsqni.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1620
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfaxspkic.exe ups_run
  2⤵
  PID:1192
- - C:\Temp\nhfaxspkic.exe
    C:\Temp\nhfaxspkic.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1492
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:760
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfaxspkic.exe ups_ins
  2⤵
  PID:5020
- - C:\Temp\i_nhfaxspkic.exe
    C:\Temp\i_nhfaxspkic.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhezxupnhf.exe ups_run
  2⤵
  PID:2464
- - C:\Temp\nhezxupnhf.exe
    C:\Temp\nhezxupnhf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3456
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4624
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhezxupnhf.exe ups_ins
  2⤵
  PID:4756
- - C:\Temp\i_nhezxupnhf.exe
    C:\Temp\i_nhezxupnhf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwupmhezx.exe ups_run
  2⤵
  PID:5292
- - C:\Temp\ecwupmhezx.exe
    C:\Temp\ecwupmhezx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2760
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4636
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwupmhezx.exe ups_ins
  2⤵
  PID:2216
- - C:\Temp\i_ecwupmhezx.exe
    C:\Temp\i_ecwupmhezx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmhezxrpjh.exe ups_run
  2⤵
  PID:1228
- - C:\Temp\pmhezxrpjh.exe
    C:\Temp\pmhezxrpjh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3204
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1088
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmhezxrpjh.exe ups_ins
  2⤵
  PID:1620
- - C:\Temp\i_pmhezxrpjh.exe
    C:\Temp\i_pmhezxrpjh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbztrmjebw.exe ups_run
  2⤵
  PID:2348
- - C:\Temp\hbztrmjebw.exe
    C:\Temp\hbztrmjebw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:124
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5232
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbztrmjebw.exe ups_ins
  2⤵
  PID:5388
- - C:\Temp\i_hbztrmjebw.exe
    C:\Temp\i_hbztrmjebw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqojgbztr.exe ups_run
  2⤵
  PID:4844
- - C:\Temp\ywqojgbztr.exe
    C:\Temp\ywqojgbztr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6032
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2604
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqojgbztr.exe ups_ins
  2⤵
  PID:3752
- - C:\Temp\i_ywqojgbztr.exe
    C:\Temp\i_ywqojgbztr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqnlgdyvqo.exe ups_run
  2⤵
  PID:2860
- - C:\Temp\wqnlgdyvqo.exe
    C:\Temp\wqnlgdyvqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4164
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5880
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqnlgdyvqo.exe ups_ins
  2⤵
  PID:5928
- - C:\Temp\i_wqnlgdyvqo.exe
    C:\Temp\i_wqnlgdyvqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnigaysqki.exe ups_run
  2⤵
  PID:1200
- - C:\Temp\qnigaysqki.exe
    C:\Temp\qnigaysqki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2736
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5176
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnigaysqki.exe ups_ins
  2⤵
  PID:4720
- - C:\Temp\i_qnigaysqki.exe
    C:\Temp\i_qnigaysqki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dxvsnkidav.exe ups_run
  2⤵
  PID:2260
- - C:\Temp\dxvsnkidav.exe
    C:\Temp\dxvsnkidav.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5832
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3584
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dxvsnkidav.exe ups_ins
  2⤵
  PID:5260
- - C:\Temp\i_dxvsnkidav.exe
    C:\Temp\i_dxvsnkidav.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1148

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3084

C:\Temp\vtnlfdyvqn.sys
C:\Temp\vtnlfdyvqn.sys
1⤵
- Executes dropped EXE
PID:4172

C:\Temp\dxvqnifays.sys
C:\Temp\dxvqnifays.sys
1⤵
- Executes dropped EXE
PID:2984

C:\Temp\icaxspkhfd.sys
C:\Temp\icaxspkhfd.sys
1⤵
- Executes dropped EXE
PID:5696

C:\Temp\kecausmkec.sys
C:\Temp\kecausmkec.sys
1⤵
- Executes dropped EXE
PID:3736

C:\Temp\fzxrpmhecz.sys
C:\Temp\fzxrpmhecz.sys
1⤵
- Executes dropped EXE
PID:3040

C:\Temp\jhezwuomge.sys
C:\Temp\jhezwuomge.sys
1⤵
- Executes dropped EXE
PID:2520

C:\Temp\omgeywrojh.sys
C:\Temp\omgeywrojh.sys
1⤵
- Executes dropped EXE
PID:5900

C:\Temp\jgbywqoigd.sys
C:\Temp\jgbywqoigd.sys
1⤵
- Executes dropped EXE
PID:5928

C:\Temp\yvqoigaytq.sys
C:\Temp\yvqoigaytq.sys
1⤵
- Executes dropped EXE
PID:3552

C:\Temp\nlfdaysqki.sys
C:\Temp\nlfdaysqki.sys
1⤵
- Executes dropped EXE
PID:2216

C:\Temp\snkfdxvpnh.sys
C:\Temp\snkfdxvpnh.sys
1⤵
PID:2876

C:\Temp\pkicaxrpkh.sys
C:\Temp\pkicaxrpkh.sys
1⤵
PID:3000

C:\Temp\mhecausmke.sys
C:\Temp\mhecausmke.sys
1⤵
PID:2604

C:\Temp\pmhezwrpjh.sys
C:\Temp\pmhezwrpjh.sys
1⤵
PID:1664

C:\Temp\mgeywurpjh.sys
C:\Temp\mgeywurpjh.sys
1⤵
PID:2736

C:\Temp\jgbztrljdb.sys
C:\Temp\jgbztrljdb.sys
1⤵
PID:3584

C:\Temp\gdyvtolgdb.sys
C:\Temp\gdyvtolgdb.sys
1⤵
PID:3848

C:\Temp\sqoigaysql.sys
C:\Temp\sqoigaysql.sys
1⤵
PID:5560

C:\Temp\fdxvpnlfdx.sys
C:\Temp\fdxvpnlfdx.sys
1⤵
PID:3568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxupmkfcxu.exe

Path C:\Temp\cxupmkfcxu.exe
Size 243KB
SHA256 d0ce33bdcca44e21a2cdffc78768bd2c6166a1123ef4f3cd3cf667563af8a6db
MD5 38d95c9c13af8a9db6dbc0a73838ef3c
SHA1 85d96b1d6ec3804feafca6359c60692c0d36e56a
SHA512 419db1ec745fcc0f8ae93a784893c30490c320236cab5e9fb60e6d02238ce7642c1979e65c2817a654f0912dbfc80faea2ff349849e5d44eeb45c57ec2717e95
SSDEEP 3072:tCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7L:gvMsLaOa3lLNngoqRttA7L
TLSH
T12A345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvqnifays.sys

Path C:\Temp\dxvqnifays.sys
Size 141KB
SHA256 b83aa003af05675ecb0eb06a5f976755707ce0abcb5732999d06599a5d5e8a10
MD5 676d03ff0d4efd0e51adbb230de3dec7
SHA1 243f1658441b55c969afcd23c98185bc3624b849
SHA512 fdd8f53ee43ad56224dd502a8d89ef13020cee7c9ef57debee28e4d6983ce8d437b0a055466ed7c4e9ac4976e393ed5f32dfc491075b4dea800a8a7c1153e6c9
SSDEEP 1536:ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CBE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdayvqnlig.exe

Path C:\Temp\fdayvqnlig.exe
Size 243KB
SHA256 bfa0556b84ef4ea9fb25256b604ce50d3b7713539d10cdfc22b2206df04b07d6
MD5 17563631cd4cf3b2fa462554853b71cb
SHA1 eddbce9e6e8af4e4555156bfb90f52b82b436c22
SHA512 ca9fbf37f2469ac4559fdf5c235d0c0441aa7913707eff802cc44dad4251778b80d02796682c521ed7532318a5557ebaa1d2eaa948221f92db6919e9eedce428
SSDEEP 3072:YCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA76:DvMsLaOa3lLNngoqRttA76
TLSH
T12A345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxrpmhecz.sys

Path C:\Temp\fzxrpmhecz.sys
Size 141KB
SHA256 595b8cf40db1913b9119d7d0bc30381a6f6c8b9e885c376060c3ad44a0b36eb8
MD5 8108ea5e9552e16eec8b2902ccece4dd
SHA1 0f82db14ec57d695b403b039b9e3993565d3c05e
SHA512 845f5402673a279bfbc25578c1c1b1e0b6b5459d8f27c958050962858309694a0c560cf24c883cb5b38e80e4a1b40167d003b084d3b720ae57f0522545f00240
SSDEEP 1536:ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltV:ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T151E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfcauspnkf.exe

Path C:\Temp\hfcauspnkf.exe
Size 243KB
SHA256 3c06d941ede3da70084d32acafc364449e9a9b55a959c452e8dd816a565321d1
MD5 e95271e38a06cf9a57642faaebb662ef
SHA1 6babb41ec0468b985dce8ad9f8a16b97f7b610a0
SHA512 fd461aeefe35fe02873e68744e9a2c0d759797b3f3ee3126dfac81a5438dbd7581860fe1f7ee1b5e1fcf584d0dc30818960b15a0549de473d6e1735c407a1ccc
SSDEEP 3072:pCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7n:UvMsLaOa3lLNngoqRttA7n
TLSH
T12E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cxupmkfcxu.exe

Path C:\Temp\i_cxupmkfcxu.exe
Size 243KB
SHA256 b84d802df12fd6117e15b5569782cfdbd4aa64efe33d4a881ccd576ddbb3b01a
MD5 a73ba399418781eaa3e6e6222755dc78
SHA1 bb65060f58a3092c845c662d44115a22ce68220d
SHA512 d5c51244aa0657e5e35e28ca1ebfe7d61570d8714493f904aa08231ee79eb2de3baa8c64c4e1d224b384df174257a6c56e16f6a9ea51057e255a9781300933f7
SSDEEP 3072:ZCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7z:EvMsLaOa3lLNngoqRttA7z
TLSH
T113345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdayvqnlig.exe

Path C:\Temp\i_fdayvqnlig.exe
Size 243KB
SHA256 5ea5be0674cd237699a1888f8bb85936a8d1f5c6abd84ba9f1d9540e04587e87
MD5 c1107266a4a588b8b33ba7440124e0f4
SHA1 377da587c078719474d630811475e35dba2258f4
SHA512 6ee6263d467cb4763a3fa8674e6f069d919b7d3a3649c77fdce2ac5cfe1b5b500383fedd3f83aa1217513eeec5836805d362dc78936ad2442f7bb4a33f9c438a
SSDEEP 3072:PCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA79:avMsLaOa3lLNngoqRttA79
TLSH
T19B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hfcauspnkf.exe

Path C:\Temp\i_hfcauspnkf.exe
Size 243KB
SHA256 31316bcfaaa894c99b3fc6a1c8dd728793af90c2f3842943c5962099d7a71813
MD5 72965f0d93d6c14b50f950fb60a89150
SHA1 92438973c48fe7e3a8db670f1cfbb32faafcd8be
SHA512 7a746cce2c1b42b481eec2ec1b15d8ac72ce78eeb7e4c2c4be2f3ac07ba5d52709256955efe9499c9a75ba9d376f6e82dbb699ba77e1799a32eb4e793a533c26
SSDEEP 3072:fCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7B:qvMsLaOa3lLNngoqRttA7B
TLSH
T10E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oidavtnlfd.exe

Path C:\Temp\i_oidavtnlfd.exe
Size 243KB
SHA256 8478f43083aae00e5e6e1a0bab1495cfc10e70089447a0b90af1234500c93ed7
MD5 909edfe976e5b4f0ba70fbcd532dab9a
SHA1 75747b9417d69930886eda7fb0bb46c1008e3fd8
SHA512 e4b36a4cba6f3ae4de2938eb3acd11ea0f39f667a6f810e4e709e1565a11390583571b6ebf206ddf9cc4d104971f01db18e52679bc6b86a8080bc3d2123c278f
SSDEEP 3072:PCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7l:avMsLaOa3lLNngoqRttA7l
TLSH
T1A9345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnigaysqki.exe

Path C:\Temp\i_pnigaysqki.exe
Size 243KB
SHA256 247669dc1b08faa12cf2f72bee1e540382795ea67b0b86291de3ee2531f311f5
MD5 4b808b3f802cc43cc864beb0b59bcb01
SHA1 d4df46329a0ecda8ce76ba8011a17be7a367768a
SHA512 018b9f4991d8c4c5f956531e1ea0dd18b3a6e04bc12afb1df172e534e589fcced20f85cab4ba6aed85584448346e040b0437d7afa876f6eecf0b40e6118d4305
SSDEEP 3072:pCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7L:UvMsLaOa3lLNngoqRttA7L
TLSH
T1E7345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wurmjhbzwu.exe

Path C:\Temp\i_wurmjhbzwu.exe
Size 243KB
SHA256 e12b8b957f56e26397b8a3257f817048c6052955c5b624b91013fc967b691edd
MD5 a804bd11bc816efe45d7624adc813feb
SHA1 0e06bf6b3d46aedaa373ed56b191f927f0788e82
SHA512 cdf1acf96064d6c8a31947f3bb7d07640f8c76847955e10fc7b44cc4bdfaed5a52f6afd339f0ee31c6cdeecdc2f84f6bca92079ce3a6cc0ceca140cfbacaaefc
SSDEEP 3072:sCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7K:PvMsLaOa3lLNngoqRttA7K
TLSH
T1CC345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icaxspkhfd.sys

Path C:\Temp\icaxspkhfd.sys
Size 141KB
SHA256 46f9082ce89feecf7d75b67f0854474b2e667e29a21d7ff97c401bb8a451496e
MD5 d02c89c1fbe3c884f60a362c4ef3d650
SHA1 336433273a94791f3d2a2fbf16e3afb1461c396b
SHA512 9d8c986b646d6ac507036360ee93ba61e5fab88ef080f4cf84b047f101eee6d288e4f0f62c194d89772015d7dd8b281084cd9ccc84d1e6dc4ecb7b2f6d71b3eb
SSDEEP 1536:Ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T154E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhezwuomge.sys

Path C:\Temp\jhezwuomge.sys
Size 141KB
SHA256 e4e11d0aead3407cfb1c41afbffd8a986f6b78951bd74a6b1f4546e77a5d01b4
MD5 cb83da5c3f898da3db4c82c0c0e1ca10
SHA1 4eb2b6b1f0bc9cd6f0bdf4b891dbe1cded259ad4
SHA512 a38b9edff1edc557af08d85ecb7261d92d78a6d563551c1e4e94da38fc10c250c808ad9b06d6048610cc43be74e65e950b4e6ecc404f9c3467b6bd8ec076df2b
SSDEEP 1536:Pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T105E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecausmkec.sys

Path C:\Temp\kecausmkec.sys
Size 141KB
SHA256 8fcb503a540a898c77c84ee2e7cf61cbf9ad06c6dbc79c3136279cbd15098998
MD5 c983dd1b7033947df2ec034f18efae74
SHA1 90edc3050ef2594f33b68584d6bc22868dc2be02
SHA512 1b1b2e2cfab280be39e2a8e7f002d1701b4aead6320a3d2ca379797d84df2991ac6d324d91dc1d4520dcc633d529a7f6179caae59d49dad4a6767bc9f336814e
SSDEEP 1536:7a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:7a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T183E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oidavtnlfd.exe

Path C:\Temp\oidavtnlfd.exe
Size 243KB
SHA256 79a55ced7ce8073389fb7d30e1aa8ccf7cafee35ff5d45e4aed689597976c0b0
MD5 8b0758b9f06ba6b6db7582f0ddd89705
SHA1 eabe9e0d44751216a9c2a7cec049435540575568
SHA512 0243e3765a09366dec4e1295c8c4ad74c83bc0b16cc3aa9ea8d6a96c5f79cd2e0aa023eff178193989463fc4c92cf7256086ab8489ab6d46af01797047878e7f
SSDEEP 3072:wCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7+:rvMsLaOa3lLNngoqRttA7+
TLSH
T1C2345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnigaysqki.exe

Path C:\Temp\pnigaysqki.exe
Size 243KB
SHA256 ce37c05aaf0cfbbba78f1142dd51dc357d70cfbf36481699ab5ab66f9765efb4
MD5 52141cb8f6fb15501de3737f6b0257d8
SHA1 9bf34c175b0cf1b5250a5edf6aeca05239235d68
SHA512 60e0c9f141a7ba3d40533fa3d04b6fbf507e4b989ffddf36947bc85cbfa3f684dc5a5ebb8d6ba1363c4f67ccaef344b6b4c65beed40b8aa36fd704c73eecd91d
SSDEEP 3072:zCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:2vMsLaOa3lLNngoqRttA71
TLSH
T111345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdyvqn.sys

Path C:\Temp\vtnlfdyvqn.sys
Size 141KB
SHA256 638e066a976030ab1973c5620bba4de701b240f8d84e182a67802da610394cf8
MD5 37fb939ab716df3e448751964c40b897
SHA1 04016227f740dede788fb906b7d8606a913c7de9
SHA512 45fa712f926b247d5cb73e741f328d13de00c0a7f2df9b52edf9304483c32479ecd869387b9eb1be39b20d4c6a1ce399a9cfc9e069638d723ab279742719f3c0
SSDEEP 1536:Aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1FFE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wurmjhbzwu.exe

Path C:\Temp\wurmjhbzwu.exe
Size 243KB
SHA256 d2aa6f4ac63f399e976808bc3a597883d01fd4f10e7de04a6f600976d98affa5
MD5 2bcb9fcce7bf4f77a88c1f270bd414e0
SHA1 81e4e5196e750eb2f35cb2152a844c632755e3a8
SHA512 5bb89c95fa68e55d24492d05d3b49a50a1eca6cc2a8bdb5de7f7cc0adb496d123290e9613f6a9f3b4fee5e5d383c884884c3088dfe1cfca31f9c349cafe1c96e
SSDEEP 3072:pCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7L:UvMsLaOa3lLNngoqRttA7L
TLSH
T147345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 816ae04dc04aec9132d11169c1d018e96753856bb63c48169ee171f3513a5ac0
MD5 2fa1e242c6ac4f3f9dcf1c1b3e6a43ba
SHA1 ef9121773da7536222d2f7126e2a58d17bde893b
SHA512 6c1ae095e32ac29530e00e2e2f1e093f900591547f4f1c2d0bc7b605e2b861a6315752f226d3734022ee1961d46c962798c649a58483c3a5dcd9321732b38e00
TLSH
T1D751608D433B2BC9D36549B55CE0D78A3FB8DB9D018B3E136C546E7C2A9234851100F3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 76ef66ac7e681c131fe6c3c1899cf649ad9a56513b72cc353024b7ddbee5bd95
MD5 65959f714e08e8e2b3df3f1c330d37d8
SHA1 f4f3254386c4664ec8ccabf55dd33a9848aec845
SHA512 c846b65b0443e2e3f353cbf22a19c978cb879e2bc48a1d6b8c26612fcacf2d3fe98730deffefa69b809d85b8fb6d32a5f53da7dbeeca345648276202c04c5211
TLSH
T1E7418DF383F4856E990156F0AA14AE2FCE2C0915432C7D9AC9E4EE2793E3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4eba83a01544bc718b4a9890ba80e92bb42e8607a7105ebc973553b635e1349a
MD5 a09d800e4bb4485d01a82d84d5860f27
SHA1 4281a9862dbee3b75527ae4daa30b7635c7a9c2e
SHA512 5d4a05d0942f7f0b69fc5616edb546f4b35d165b96ba1826a09f3d92aaf76e46f95b8a6613811bcc7f3ea4cd4b602ddf7cc94fdfede2c8a2fb18fc49da71dd5e
SSDEEP 192:sxRjRSCU/fGsLaBZcTnpVKR7zoA8p9i/g6+WNCfT4/YnpUOVSGdIgVYJ:sxRjjU/fGsLaP4npVKRaE/5q4/kFbW
TLSH
T1EF42A9166D68A93B4CC7D21DFB55BF53E7F92032A1D51E48AAFC8A1C04E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7391958154de0d723d5e69d3e6e70497419b28575e152ebb51ec826ef63db7ef
MD5 9f9b12af5620047342358f4051a7382e
SHA1 ec0d4b436d0695ceda02d489565c75bf6262f2c7
SHA512 8d0c9a743ef9d3cbb23cbe7c374fb5e68f57ee2d8866406e0588470d4c00e1b7f57ff7a4d745d554c38fa5eb8da7e33c91897c31e0d1e2d7b183bd65c11b0f99
SSDEEP 192:sxRsRSCU/fGsuaBZcTnpVKR7zoA8p9i/g6+WNCfT4/YnpUOVSGdIgDOYJ:sxRsjU/fGsuaP4npVKRaE/5q4/kFbv
TLSH
T14242A8166D68A93B4CC7D21DFB55BF53E7F92032A1D51E48AAFC8A1C04E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d0f704e72ee40b82d285bb50efaaac6328ca19c6dcca00859a9a98a4de3b8152
MD5 629dc8bad1e4d6a60aa38d624d3ee621
SHA1 ab0881c8ca580c61fa8b00a4a232514e6b56be74
SHA512 971f7b3ea1eea69b1fc111616033597dc4acc09b66f08177c433ef00cf2ca375942c4a81be25422eb57b2645ce99ebcf96a73c84bb1013cdd3831fc69a25b39c
SSDEEP 192:sxRsRSCU/fGsu/BZcTnpVKR7zoA8p9i/g6+WNCfT4/Ynpi0VSGdIgD0YJ:sxRsjU/fGsu/P4npVKRaE/5q4/k3bh
TLSH
T1E242B8166D686D3B5CC7E21DBB55BF53E3F92032A1D11E44AAFC8A1C04E66DD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 80c112236472a1d38a8b9cfda3122bdd2f3379df0313a93f91af38846fde02f3
MD5 6c5b61908d696f14fd1aa9e1bfb09b1e
SHA1 ffc7e391d85286ac2f41fca5b5067874d5c2cb5c
SHA512 b5bdc89ddcb76e6ce1da5a70dbb636413bf3363406bb3da4c3ff066b81722662b8adb03df643956690ec8539cc89a41b1379ee52501351e1646a97515439ddb9
SSDEEP 768:wb8dJg7pLuL7r6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVl+Imu46Qrohbhw:wb8dJsE7r6Wgouf6Mu1jai+ImV67hp0
TLSH
T139D2EA7B744CCB7E4F800ADDEC19BE9F6D6802CB96D8C94047FA841C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1aad1bfacf12a9bdc9a916d67d3d6035c6740c38e196fa7531127c604caeae98
MD5 3829b200e444883acdab3a8a036533e4
SHA1 def0032ddb108631c8f6cda9fbd00bf9b0a68db2
SHA512 fae13a9d8741f8b8ebcbbcd4d4c34e500359262e0b4ccfd2c5a96944d2355aee5571e5c4d64e07a03e57ec2330b1dd9a49f10a6e19d8aa41cdc02e6bbac0a6eb
SSDEEP 96:KR4Jco6GKQWOTDgQQK4FgyQcAQjS49HdqjXNn7vWj4mgfvK4+gBvcldQz2MgK9SM:C4Jco6GK3OT8QkFgyvAQjS49HdqjXNnL
TLSH
T1FF915E51757B03413D7F684C82AE8A1B869170A77048BA3B7BE841E99F67E424CFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

28272a9c-deaa-45a5-9982-ffd57f53a56a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\28272a9c-deaa-45a5-9982-ffd57f53a56a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a6c9b4ce50024c94fb57c6a9057e7431148fa72565e992994ca3abb004cb2d4c
MD5 a0bd0fe70ff84a5928c107de3b72ad7d
SHA1 7e7e1d6de737eaa2d72f94f0e2318a90081a449e
SHA512 77b05c63e233c5f0e0d90d96cade5f938eba2a7d5e8bd9cc26115b3ae13528bd22a9ea19a7e64c80f6c431e4f95ff7063c15ff186480e29b15ac15871156114a
SSDEEP 768:6rv+4UNbds3CLDZIO0VJNzc4ReyIsXoeVH1S5D:6bsbS3Htc44bs4EH1Y
TLSH
T17603CF32E8788977ACF66786B14B75137EF8912782D81B90C9DE1F0C4A4B1DD135B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1dea887cbba80f50ab64a6e151e2a1299219ac5607f95a355dc0dc3df9a1a2bf
MD5 9faab92007b3902769d7d1f133067967
SHA1 cb9cd6f379fe54086c347a19e7aa78ab73982a6b
SHA512 0a2a59e5230a9e42fc3fcb8589c3742dfa71c432120d72ac00a815071381ff3c5f8fd5c033b96644d3cc58e14cddd4756f26fdb7e1634afea6957a93b516a126
SSDEEP 384:naZcIj38NhQne8b+JDZNfNoXOVSUU1XaFaXFi2ETRzcoXfK86sfxEZxxsIj4lBo/:Yj3jQDZIO0VvYRNzc4ReyIsPoPi9P0
TLSH
T1DDF2BF71A9789C63ACFAB346F6163652BEF45177C0C41F84DAED9B0C094329E171B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 117b1196e9401d884973e3b13d9338bd73ecdd1714dfc30d42bae8e9d7e4efb9
MD5 93e59d9ec814cd78bdc90af51abc81bf
SHA1 41c725672543b1825510d0d59452764bdca40acf
SHA512 873d9d8ad881e0723bd39f0a97b2e143b1ce6041fa9980b77a165a693a5102059a6138df41d787f6fe48bd83f22c78920780981f9b0ed9baecf9e66c8a35ee9d
SSDEEP 384:nSZcIj38Nhfnv8b+JDZNfNoXOVSUU1XaFaXFirETRzcoXfK86sfxEZxxsIj4lBo/:gj3pQDZIO0VvYoNzc4ReyIsPoPi9P0
TLSH
T17EF2BF31B8789C63ACFAA346F6163652BDF45177C1C45F84D9ED9B0C094329E171B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 3754f9b45b98a9bb7ae7db341d974ac98e237023c3dec7fb9cb95472096cabe9
MD5 6e7a9a078f4a6460f73ca594d3139e6b
SHA1 a2217b3124774850d6ca1365352b35849a2f72c2
SHA512 96ccc1347eb59301d137b39680fb118aec2b819aa5d7d52783c9aefaf6ec59565c769b7f49cabf91374428e8970cdc7dd4dccea297bea8a276cf2b0a8f1a67c0
SSDEEP 768:/rv+4UNbds3P6DZIO0VvYoNzc4ReyIs2oeVH1S5D:/bsbS3btc44bsPEH1Y
TLSH
T14003CF32A878CD37ACEA6286B14772933EF8616B81C50F90D9E95F0C4A471DE171F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 065122bed6831de3ecb7eb4f8fea3fe232542bcddc62801bfc00ed4f83e56235
MD5 fd8eb13e6701dd9de4a1bd6cab409ea7
SHA1 bf930e3e57c0387127a6337c2b198ad3b1d4801a
SHA512 f6cb87c0de5e7f73a4056f7549249394a237d848ce02dd7fdb28c9c11d24a45c99cdb35ff5e938a660bc8f8377382410dea71c17e9332c8045fc3a4d976c83c8
SSDEEP 768:GFQ138wgC5Zw5O0VvYsNzc4ReyIsPoPi9P0:N13Otc44bsQPX
TLSH
T1BC1307F198D78976ECAE5783A73D2E42ADFCD167B1885984BB985D0CCC421BFC70A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

fce3141e-52df-43e5-b687-d3228a1f4160.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fce3141e-52df-43e5-b687-d3228a1f4160.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_32616166\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1664-428-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2216-364-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2520-315-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2520-309-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2604-430-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2604-408-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2736-440-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2876-376-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2984-230-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3000-397-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3040-281-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3552-335-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3568-487-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3584-445-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3736-268-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3848-466-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4172-183-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4172-236-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5560-470-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5560-489-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5696-256-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5900-330-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5900-313-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5928-329-0x0000000000010000-0x0000000000083000-memory.dmp

Download