377e9a87993b6ce9c6aa99b39e9504f0d9907294df6953d07dc19afc56345120

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 00:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_b2ea5a561a693a566ee6369eb9c705f6_elex_rhadamanthys_stop.exe
Size 243KB
Sample260816-ac3plswyet
SHA256 377e9a87993b6ce9c6aa99b39e9504f0d9907294df6953d07dc19afc56345120
MD5 b2ea5a561a693a566ee6369eb9c705f6
SHA1 d5118696905ae863a3bd7e4baca2b53064e18bbf
SHA512 03d2fac4595ba3d9f0f057d5844d4316b7cdd73cbc3cf95691902cfb2fbce9a732093cbe1f9a15773722000c54c739ed7af84dd43f210e31f20bd5c467a0e5cc
SSDEEP 3072:ECvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7S:XvMsLaOa3lLNngoqRttA7S
TLSH
T12E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4300	CP.exe
4652	rmgebwroje.exe
4964	CP.exe
4168	CP.exe
476	i_rmgebwroje.exe
3036	trljdbwtom.sys
4976	CP.exe
3552	gdbwqoigby.exe
5888	CP.exe
3536	CP.exe
4848	i_gdbwqoigby.exe
2720	wtnlgdbvtn.sys
1564	CP.exe
108	tqljdbvtqo.exe
204	CP.exe
4860	CP.exe
5252	i_tqljdbvtqo.exe
1860	ytqljdbvtn.sys
3840	CP.exe
1488	licavsqlid.exe
5968	CP.exe
4840	CP.exe
6128	i_licavsqlid.exe
3028	vpnlfdxvqn.sys
2868	CP.exe
4284	lfdxvpnifd.exe
4724	CP.exe
3556	CP.exe
3612	i_lfdxvpnifd.exe
5668	dausmkicax.sys
5016	CP.exe
6096	zxvpnkfcau.exe
3728	CP.exe
3176	CP.exe
2972	i_zxvpnkfcau.exe
1192	jhfcxupnhf.sys
5560	CP.exe
4164	mkecxrpnhe.exe
700	CP.exe
5140	CP.exe
1020	i_mkecxrpnhe.exe
4544	uspkecausm.sys
580	CP.exe
5908	hcztrpjhec.exe
936	CP.exe
3652	CP.exe
4800	i_hcztrpjhec.exe
1860	rpmgecwurm.sys
1148	CP.exe
1736	jgezwrpjhb.exe
4720	CP.exe
3136	CP.exe
4740	i_jgezwrpjhb.exe
3404	jebztrljeb.sys
5676	CP.exe
4600	geywqojgbz.exe
5780	CP.exe
6088	CP.exe
3560	i_geywqojgbz.exe
788	ytrljdbytq.sys
2760	CP.exe
1784	trljdayvtn.exe
5256	CP.exe
3952	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4116_2077702569\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4116_361856194\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4116_361856194\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4116_361856194\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4116_1051525744\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4116_361856194\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4116_1144668736\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4116_1051525744\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4116_2077702569\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdayvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvtqlidavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmgebwroje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqljdbvtqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxvpnkfcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgezwrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcxupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvtnlgdywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdbwqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	licavsqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgezwrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkidavsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czurpmhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfdxvpkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxvpnifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvtqlidavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcxupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eczuomkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_b2ea5a561a693a566ee6369eb9c705f6_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdbwqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecxrpnhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqojgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czurpmhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljhecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljhecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxvpnifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxvpnkfcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecxrpnhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcztrpjhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkidavsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfdxvpkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvtnlgdywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqljdbvtqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcztrpjhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqojgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eczuomkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmgebwroje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_licavsqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdayvtn.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4956	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3356	ipconfig.exe
2664	ipconfig.exe
5240	ipconfig.exe
4612	ipconfig.exe
4648	ipconfig.exe
1192	ipconfig.exe
5520	ipconfig.exe
5804	ipconfig.exe
5796	ipconfig.exe
4272	ipconfig.exe
1232	ipconfig.exe
1736	ipconfig.exe
4200	ipconfig.exe
3192	ipconfig.exe
2580	ipconfig.exe
6108	ipconfig.exe
4776	ipconfig.exe
2100	ipconfig.exe
5012	ipconfig.exe
2596	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313123022887043"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{3BF55AEB-0BE2-4BA5-A8BA-9AE4B07212B2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1548	msedge.exe
1548	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	476	i_rmgebwroje.exe
Token: SeDebugPrivilege	4848	i_gdbwqoigby.exe
Token: SeDebugPrivilege	5252	i_tqljdbvtqo.exe
Token: SeDebugPrivilege	6128	i_licavsqlid.exe
Token: SeDebugPrivilege	3612	i_lfdxvpnifd.exe
Token: SeDebugPrivilege	2972	i_zxvpnkfcau.exe
Token: SeDebugPrivilege	1020	i_mkecxrpnhe.exe
Token: SeDebugPrivilege	4800	i_hcztrpjhec.exe
Token: SeDebugPrivilege	4740	i_jgezwrpjhb.exe
Token: SeDebugPrivilege	3560	i_geywqojgbz.exe
Token: SeDebugPrivilege	6036	i_trljdayvtn.exe
Token: SeDebugPrivilege	5840	i_ysqkidavsq.exe
Token: SeDebugPrivilege	4660	i_xvtqlidavs.exe
Token: SeDebugPrivilege	1680	i_nkfdxvpkic.exe
Token: SeDebugPrivilege	4764	i_kfcxupnhfz.exe
Token: SeDebugPrivilege	2500	i_czurpmhfzx.exe
Token: SeDebugPrivilege	5336	i_eczuomkecw.exe
Token: SeDebugPrivilege	2188	i_bztrljhecw.exe
Token: SeDebugPrivilege	756	i_bywqoigbyt.exe
Token: SeDebugPrivilege	2696	i_yvtnlgdywq.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4116	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 2128	5020	2026-08-15_b2ea5a561a693a566ee6369eb9c705f6_elex_rhadamanthys_stop.exe	89
PID 2128 wrote to memory of 4116	2128	iexplore.exe	90
PID 4116 wrote to memory of 2460	4116	msedge.exe	91
PID 4116 wrote to memory of 4668	4116	msedge.exe	92
PID 4116 wrote to memory of 4956	4116	msedge.exe	94
PID 4116 wrote to memory of 4668	4116	msedge.exe	92
PID 4116 wrote to memory of 4668	4116	msedge.exe	92
PID 4116 wrote to memory of 3112	4116	msedge.exe	95
PID 4116 wrote to memory of 3112	4116	msedge.exe	95
PID 4116 wrote to memory of 3208	4116	msedge.exe	97
PID 4116 wrote to memory of 3432	4116	msedge.exe	96
PID 4116 wrote to memory of 3208	4116	msedge.exe	97
PID 4116 wrote to memory of 3208	4116	msedge.exe	97
PID 4116 wrote to memory of 3432	4116	msedge.exe	96
PID 4116 wrote to memory of 3432	4116	msedge.exe	96
PID 4116 wrote to memory of 3352	4116	msedge.exe	98
PID 4116 wrote to memory of 3352	4116	msedge.exe	98
PID 4116 wrote to memory of 3352	4116	msedge.exe	98
PID 4116 wrote to memory of 4684	4116	msedge.exe	99
PID 4116 wrote to memory of 4684	4116	msedge.exe	99
PID 4116 wrote to memory of 4684	4116	msedge.exe	99
PID 4116 wrote to memory of 1140	4116	msedge.exe	100
PID 4116 wrote to memory of 1140	4116	msedge.exe	100
PID 4116 wrote to memory of 3096	4116	msedge.exe	102
PID 4116 wrote to memory of 4800	4116	msedge.exe	103
PID 4116 wrote to memory of 3096	4116	msedge.exe	102
PID 4116 wrote to memory of 4800	4116	msedge.exe	103
PID 5020 wrote to memory of 4300	5020	2026-08-15_b2ea5a561a693a566ee6369eb9c705f6_elex_rhadamanthys_stop.exe	104
PID 4116 wrote to memory of 2608	4116	msedge.exe	107
PID 4652 wrote to memory of 4964	4652	rmgebwroje.exe	109
PID 4116 wrote to memory of 5732	4116	msedge.exe	114
PID 4116 wrote to memory of 5732	4116	msedge.exe	114
PID 4116 wrote to memory of 3144	4116	msedge.exe	115
PID 4116 wrote to memory of 3144	4116	msedge.exe	115
PID 5020 wrote to memory of 4168	5020	2026-08-15_b2ea5a561a693a566ee6369eb9c705f6_elex_rhadamanthys_stop.exe	116
PID 5020 wrote to memory of 4976	5020	2026-08-15_b2ea5a561a693a566ee6369eb9c705f6_elex_rhadamanthys_stop.exe	120
PID 3552 wrote to memory of 5888	3552	gdbwqoigby.exe	122
PID 5020 wrote to memory of 3536	5020	2026-08-15_b2ea5a561a693a566ee6369eb9c705f6_elex_rhadamanthys_stop.exe	125
PID 5020 wrote to memory of 1564	5020	2026-08-15_b2ea5a561a693a566ee6369eb9c705f6_elex_rhadamanthys_stop.exe	129
PID 108 wrote to memory of 204	108	tqljdbvtqo.exe	131
PID 5020 wrote to memory of 4860	5020	2026-08-15_b2ea5a561a693a566ee6369eb9c705f6_elex_rhadamanthys_stop.exe	134
PID 5020 wrote to memory of 3840	5020	2026-08-15_b2ea5a561a693a566ee6369eb9c705f6_elex_rhadamanthys_stop.exe	138
PID 1488 wrote to memory of 5968	1488	licavsqlid.exe	140
PID 5020 wrote to memory of 4840	5020	2026-08-15_b2ea5a561a693a566ee6369eb9c705f6_elex_rhadamanthys_stop.exe	143
PID 4116 wrote to memory of 3964	4116	msedge.exe	146
PID 4116 wrote to memory of 4784	4116	msedge.exe	147
PID 4116 wrote to memory of 2396	4116	msedge.exe	148
PID 5020 wrote to memory of 2868	5020	2026-08-15_b2ea5a561a693a566ee6369eb9c705f6_elex_rhadamanthys_stop.exe	151
PID 4284 wrote to memory of 4724	4284	lfdxvpnifd.exe	153
PID 5020 wrote to memory of 3556	5020	2026-08-15_b2ea5a561a693a566ee6369eb9c705f6_elex_rhadamanthys_stop.exe	156
PID 5020 wrote to memory of 5016	5020	2026-08-15_b2ea5a561a693a566ee6369eb9c705f6_elex_rhadamanthys_stop.exe	160
PID 6096 wrote to memory of 3728	6096	zxvpnkfcau.exe	162
PID 5020 wrote to memory of 3176	5020	2026-08-15_b2ea5a561a693a566ee6369eb9c705f6_elex_rhadamanthys_stop.exe	165
PID 5020 wrote to memory of 5560	5020	2026-08-15_b2ea5a561a693a566ee6369eb9c705f6_elex_rhadamanthys_stop.exe	169
PID 4164 wrote to memory of 700	4164	mkecxrpnhe.exe	171
PID 5020 wrote to memory of 5140	5020	2026-08-15_b2ea5a561a693a566ee6369eb9c705f6_elex_rhadamanthys_stop.exe	174
PID 5020 wrote to memory of 580	5020	2026-08-15_b2ea5a561a693a566ee6369eb9c705f6_elex_rhadamanthys_stop.exe	178
PID 5908 wrote to memory of 936	5908	hcztrpjhec.exe	180
PID 5020 wrote to memory of 3652	5020	2026-08-15_b2ea5a561a693a566ee6369eb9c705f6_elex_rhadamanthys_stop.exe	183
PID 4116 wrote to memory of 4092	4116	msedge.exe	185
PID 4116 wrote to memory of 4092	4116	msedge.exe	185
PID 5020 wrote to memory of 1148	5020	2026-08-15_b2ea5a561a693a566ee6369eb9c705f6_elex_rhadamanthys_stop.exe	191
PID 1736 wrote to memory of 4720	1736	jgezwrpjhb.exe	193
PID 5020 wrote to memory of 3136	5020	2026-08-15_b2ea5a561a693a566ee6369eb9c705f6_elex_rhadamanthys_stop.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-15_b2ea5a561a693a566ee6369eb9c705f6_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_b2ea5a561a693a566ee6369eb9c705f6_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffea42dc188,0x7ffea42dc194,0x7ffea42dc1a0
      4⤵
      PID:2460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,9231527470939774925,7680761513787675743,262144 --field-trial-handle=2636,i,8683816733150134561,12826067014472656461,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:2
      4⤵
      PID:4668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,12239405177468085511,15601492284060893055,524288 --field-trial-handle=2636,i,8683816733150134561,12826067014472656461,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:11
      4⤵
      System Time Discovery
      PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,7079416326180485158,2648270145515925689,524288 --field-trial-handle=2636,i,8683816733150134561,12826067014472656461,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:13
      4⤵
      PID:3112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,6806311530993679124,2598844612000997333,2097152 --field-trial-handle=2636,i,8683816733150134561,12826067014472656461,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:3432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,1553701782902841983,10442975516005650258,2097152 --field-trial-handle=2636,i,8683816733150134561,12826067014472656461,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:3208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,662893080216235215,6229148285634757110,2097152 --field-trial-handle=2636,i,8683816733150134561,12826067014472656461,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:9
      4⤵
      PID:3352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,320621044353910421,10575049105963884850,2097152 --field-trial-handle=2636,i,8683816733150134561,12826067014472656461,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
      4⤵
      PID:4684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,9112932777885250741,6584501465127084763,524288 --field-trial-handle=2636,i,8683816733150134561,12826067014472656461,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
      4⤵
      PID:1140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,12842095770583102671,17721371098846100632,524288 --field-trial-handle=2636,i,8683816733150134561,12826067014472656461,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
      4⤵
      PID:3096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3820,i,8732986714360650618,10935337784494925082,524288 --field-trial-handle=2636,i,8683816733150134561,12826067014472656461,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:14
      4⤵
      PID:4800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,5606140995414813613,9617123534805260923,524288 --field-trial-handle=2636,i,8683816733150134561,12826067014472656461,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
      4⤵
      PID:1960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,5606140995414813613,9617123534805260923,524288 --field-trial-handle=2636,i,8683816733150134561,12826067014472656461,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
      4⤵
      PID:2608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,12789875399688909684,3422308195264531273,524288 --field-trial-handle=2636,i,8683816733150134561,12826067014472656461,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
      4⤵
      PID:5732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,12208525294221906149,7790501684642645409,524288 --field-trial-handle=2636,i,8683816733150134561,12826067014472656461,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
      4⤵
      PID:3144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,2618213770717810005,9660903960046493932,524288 --field-trial-handle=2636,i,8683816733150134561,12826067014472656461,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
      4⤵
      PID:3964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,14831842902457405152,7086404678658353799,524288 --field-trial-handle=2636,i,8683816733150134561,12826067014472656461,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
      4⤵
      PID:4784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,4754847065272514351,7788854815479413324,524288 --field-trial-handle=2636,i,8683816733150134561,12826067014472656461,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
      4⤵
      PID:2396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,1140375933808989754,17396953209375358541,524288 --field-trial-handle=2636,i,8683816733150134561,12826067014472656461,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
      4⤵
      PID:4092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,9436809848420489984,2451964840129814339,524288 --field-trial-handle=2636,i,8683816733150134561,12826067014472656461,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
      4⤵
      PID:1232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,8773132704071002711,18293683636990581802,524288 --field-trial-handle=2636,i,8683816733150134561,12826067014472656461,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
      4⤵
      PID:2488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,6877533732592491902,11961852943933043944,524288 --field-trial-handle=2636,i,8683816733150134561,12826067014472656461,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
      4⤵
      PID:3692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6600,i,1599781964325727866,16409547900852383547,262144 --field-trial-handle=2636,i,8683816733150134561,12826067014472656461,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,15851428236096587252,17880620492439351480,524288 --field-trial-handle=2636,i,8683816733150134561,12826067014472656461,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
      4⤵
      PID:5932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmgebwroje.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4300
- - C:\Temp\rmgebwroje.exe
    C:\Temp\rmgebwroje.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4652
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4964
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1232
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmgebwroje.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4168
- - C:\Temp\i_rmgebwroje.exe
    C:\Temp\i_rmgebwroje.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdbwqoigby.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4976
- - C:\Temp\gdbwqoigby.exe
    C:\Temp\gdbwqoigby.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3552
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5888
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdbwqoigby.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3536
- - C:\Temp\i_gdbwqoigby.exe
    C:\Temp\i_gdbwqoigby.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tqljdbvtqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1564
- - C:\Temp\tqljdbvtqo.exe
    C:\Temp\tqljdbvtqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:108
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:204
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3356
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tqljdbvtqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4860
- - C:\Temp\i_tqljdbvtqo.exe
    C:\Temp\i_tqljdbvtqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\licavsqlid.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3840
- - C:\Temp\licavsqlid.exe
    C:\Temp\licavsqlid.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1488
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5968
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_licavsqlid.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4840
- - C:\Temp\i_licavsqlid.exe
    C:\Temp\i_licavsqlid.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdxvpnifd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2868
- - C:\Temp\lfdxvpnifd.exe
    C:\Temp\lfdxvpnifd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4284
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4724
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5520
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdxvpnifd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3556
- - C:\Temp\i_lfdxvpnifd.exe
    C:\Temp\i_lfdxvpnifd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxvpnkfcau.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5016
- - C:\Temp\zxvpnkfcau.exe
    C:\Temp\zxvpnkfcau.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6096
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3728
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxvpnkfcau.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3176
- - C:\Temp\i_zxvpnkfcau.exe
    C:\Temp\i_zxvpnkfcau.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkecxrpnhe.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5560
- - C:\Temp\mkecxrpnhe.exe
    C:\Temp\mkecxrpnhe.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4164
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:700
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkecxrpnhe.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5140
- - C:\Temp\i_mkecxrpnhe.exe
    C:\Temp\i_mkecxrpnhe.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1020
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hcztrpjhec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:580
- - C:\Temp\hcztrpjhec.exe
    C:\Temp\hcztrpjhec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5908
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:936
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2664
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hcztrpjhec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3652
- - C:\Temp\i_hcztrpjhec.exe
    C:\Temp\i_hcztrpjhec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgezwrpjhb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1148
- - C:\Temp\jgezwrpjhb.exe
    C:\Temp\jgezwrpjhb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1736
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4720
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgezwrpjhb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3136
- - C:\Temp\i_jgezwrpjhb.exe
    C:\Temp\i_jgezwrpjhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywqojgbz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5676
- - C:\Temp\geywqojgbz.exe
    C:\Temp\geywqojgbz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4600
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5780
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywqojgbz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6088
- - C:\Temp\i_geywqojgbz.exe
    C:\Temp\i_geywqojgbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljdayvtn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2760
- - C:\Temp\trljdayvtn.exe
    C:\Temp\trljdayvtn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1784
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5256
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljdayvtn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3952
- - C:\Temp\i_trljdayvtn.exe
    C:\Temp\i_trljdayvtn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6036
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqkidavsq.exe ups_run
  2⤵
  PID:4504
- - C:\Temp\ysqkidavsq.exe
    C:\Temp\ysqkidavsq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3404
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1252
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqkidavsq.exe ups_ins
  2⤵
  PID:4176
- - C:\Temp\i_ysqkidavsq.exe
    C:\Temp\i_ysqkidavsq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5840
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvtqlidavs.exe ups_run
  2⤵
  PID:4220
- - C:\Temp\xvtqlidavs.exe
    C:\Temp\xvtqlidavs.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1156
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4932
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvtqlidavs.exe ups_ins
  2⤵
  PID:2644
- - C:\Temp\i_xvtqlidavs.exe
    C:\Temp\i_xvtqlidavs.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkfdxvpkic.exe ups_run
  2⤵
  PID:5948
- - C:\Temp\nkfdxvpkic.exe
    C:\Temp\nkfdxvpkic.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5848
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3688
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkfdxvpkic.exe ups_ins
  2⤵
  PID:2504
- - C:\Temp\i_nkfdxvpkic.exe
    C:\Temp\i_nkfdxvpkic.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfcxupnhfz.exe ups_run
  2⤵
  PID:4348
- - C:\Temp\kfcxupnhfz.exe
    C:\Temp\kfcxupnhfz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1128
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2772
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfcxupnhfz.exe ups_ins
  2⤵
  PID:3996
- - C:\Temp\i_kfcxupnhfz.exe
    C:\Temp\i_kfcxupnhfz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\czurpmhfzx.exe ups_run
  2⤵
  PID:5072
- - C:\Temp\czurpmhfzx.exe
    C:\Temp\czurpmhfzx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3528
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2100
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_czurpmhfzx.exe ups_ins
  2⤵
  PID:3024
- - C:\Temp\i_czurpmhfzx.exe
    C:\Temp\i_czurpmhfzx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eczuomkecw.exe ups_run
  2⤵
  PID:5680
- - C:\Temp\eczuomkecw.exe
    C:\Temp\eczuomkecw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2884
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1396
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eczuomkecw.exe ups_ins
  2⤵
  PID:5636
- - C:\Temp\i_eczuomkecw.exe
    C:\Temp\i_eczuomkecw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrljhecw.exe ups_run
  2⤵
  PID:2972
- - C:\Temp\bztrljhecw.exe
    C:\Temp\bztrljhecw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3800
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4272
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2596
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrljhecw.exe ups_ins
  2⤵
  PID:296
- - C:\Temp\i_bztrljhecw.exe
    C:\Temp\i_bztrljhecw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bywqoigbyt.exe ups_run
  2⤵
  PID:4900
- - C:\Temp\bywqoigbyt.exe
    C:\Temp\bywqoigbyt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4276
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2140
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4648
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bywqoigbyt.exe ups_ins
  2⤵
  PID:2040
- - C:\Temp\i_bywqoigbyt.exe
    C:\Temp\i_bywqoigbyt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\yvtnlgdywq.exe ups_run
  2⤵
  PID:2788
- - C:\Temp\yvtnlgdywq.exe
    C:\Temp\yvtnlgdywq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1212
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6064
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_yvtnlgdywq.exe ups_ins
  2⤵
  PID:1560
- - C:\Temp\i_yvtnlgdywq.exe
    C:\Temp\i_yvtnlgdywq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2696

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:256

C:\Temp\trljdbwtom.sys
C:\Temp\trljdbwtom.sys
1⤵
- Executes dropped EXE
PID:3036

C:\Temp\wtnlgdbvtn.sys
C:\Temp\wtnlgdbvtn.sys
1⤵
- Executes dropped EXE
PID:2720

C:\Temp\ytqljdbvtn.sys
C:\Temp\ytqljdbvtn.sys
1⤵
- Executes dropped EXE
PID:1860

C:\Temp\vpnlfdxvqn.sys
C:\Temp\vpnlfdxvqn.sys
1⤵
- Executes dropped EXE
PID:3028

C:\Temp\dausmkicax.sys
C:\Temp\dausmkicax.sys
1⤵
- Executes dropped EXE
PID:5668

C:\Temp\jhfcxupnhf.sys
C:\Temp\jhfcxupnhf.sys
1⤵
- Executes dropped EXE
PID:1192

C:\Temp\uspkecausm.sys
C:\Temp\uspkecausm.sys
1⤵
- Executes dropped EXE
PID:4544

C:\Temp\rpmgecwurm.sys
C:\Temp\rpmgecwurm.sys
1⤵
- Executes dropped EXE
PID:1860

C:\Temp\jebztrljeb.sys
C:\Temp\jebztrljeb.sys
1⤵
- Executes dropped EXE
PID:3404

C:\Temp\ytrljdbytq.sys
C:\Temp\ytrljdbytq.sys
1⤵
- Executes dropped EXE
PID:788

C:\Temp\gdywqoigay.sys
C:\Temp\gdywqoigay.sys
1⤵
PID:3272

C:\Temp\davtnlfdyv.sys
C:\Temp\davtnlfdyv.sys
1⤵
PID:4260

C:\Temp\snkicausnk.sys
C:\Temp\snkicausnk.sys
1⤵
PID:3152

C:\Temp\khcauspkhc.sys
C:\Temp\khcauspkhc.sys
1⤵
PID:2188

C:\Temp\khczxrpkhf.sys
C:\Temp\khczxrpkhf.sys
1⤵
PID:5632

C:\Temp\mkecwuomhe.sys
C:\Temp\mkecwuomhe.sys
1⤵
PID:472

C:\Temp\bztrmjebwu.sys
C:\Temp\bztrmjebwu.sys
1⤵
PID:5956

C:\Temp\bytrojgbyt.sys
C:\Temp\bytrojgbyt.sys
1⤵
PID:1492

C:\Temp\gdywqoigdb.sys
C:\Temp\gdywqoigdb.sys
1⤵
PID:1540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dausmkicax.sys

Path C:\Temp\dausmkicax.sys
Size 141KB
SHA256 0702f76ceff89395f48984cf8066f3f292d3e5ce7a4c11c3d9010fdfc3d71467
MD5 1f5113a5ccf02cc50655029657ef01e9
SHA1 0340df20039ee63639ad38a316239996d1a7c690
SHA512 c2b472fc20917c479f3b5613d4a9e0cbca3235bada822b4a85cba736a3fb3a1740ef85d23864b5253f7d1fb795bf72504c341979588e74404d3428fd5890b9e7
SSDEEP 1536:+a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:+a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T13DE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdbwqoigby.exe

Path C:\Temp\gdbwqoigby.exe
Size 243KB
SHA256 9e0715b6145d83857fffc086013a076e4d9f7f681a92f9d5a706a86d5805a585
MD5 6a94a73be8d445eac49ea36cc0f46fee
SHA1 5024146d9565d145513d3c6ae468e87a58830a9e
SHA512 479e7b5fcef421da3ceeec459991edb08c0a842d21ceee8b928887a074ede991a35e9f11aede4dc99b2c86cebaa83a73c759a34cb70d14c79927552a3b06d0f7
SSDEEP 3072:ACvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA72:7vMsLaOa3lLNngoqRttA72
TLSH
T1E2345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gdbwqoigby.exe

Path C:\Temp\i_gdbwqoigby.exe
Size 243KB
SHA256 eb76028dc61a012baf7ba356f3d7c1abf562bffc43d278602bd480c6f176582c
MD5 f2b19e4a80bc9e4d74c6341e69fc167f
SHA1 4f5db75e9925582351a55d7cbec7b06f1a053b0d
SHA512 ab4fadb8aff49dbc1c1583986bbf59e0c8dc6ab56fa48faa0beb3d4014ddcd96070b9576efbd12eac0acb57d1453d34a02e641dad83d90616d3cd517ecee713c
SSDEEP 3072:TCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA79:WvMsLaOa3lLNngoqRttA79
TLSH
T10E345A017281C031E7160B78045AE7A1467EBC384BA9E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lfdxvpnifd.exe

Path C:\Temp\i_lfdxvpnifd.exe
Size 243KB
SHA256 80694135c2fe474307632dda4b567afdad3baeb9602dd4623e9e68976d2b49e5
MD5 beda0aac724a64d8cc614e5987a401fc
SHA1 fac929e66ab57f96997e302939153dff0e6dc24c
SHA512 0597a2a4f9d561daf5dc41aadcacb24cc98e17e8f0fccda3a6676162cf36ff03d670efd86fa9cf19d33b42d517e4da6ece7f1491807adc4770ec6be38ce6220a
SSDEEP 3072:yCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7E:tvMsLaOa3lLNngoqRttA7E
TLSH
T1A9345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_licavsqlid.exe

Path C:\Temp\i_licavsqlid.exe
Size 243KB
SHA256 204bc03b25b55e349bf80af426ced965a3f70ccc3c663d5fc1daf63679dc763d
MD5 285408b8fba1b4c0f3ed45f44e160495
SHA1 998bee51175b664696a52413753d73aedc0f9bca
SHA512 2f40383005424e54625930db1453bc2a09fe9ac288adf34d3260723f6d7989b416249087b6cab5f73d857ad4508dd1ecf75eebd65928c10a578d7f420d7c9a7a
SSDEEP 3072:PCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7J:avMsLaOa3lLNngoqRttA7J
TLSH
T148345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rmgebwroje.exe

Path C:\Temp\i_rmgebwroje.exe
Size 243KB
SHA256 f1d3a7795906a711906d8c525d45c1750f94543e7adcb6f15049e576b0b4a0ee
MD5 6c231d6ea73e927a2d840d8dfd9c936c
SHA1 599c521be38f847f287d2ef067c940253bb8583b
SHA512 4bb2eab4774c6e0ea18f06381a01833d8c4654f89becb9f0a79ca0b02e43673f0239a2897dfd630b10faa44cb50072714cb615d85e3c41e38e53942f78f58753
SSDEEP 3072:oCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7S:TvMsLaOa3lLNngoqRttA7S
TLSH
T168345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tqljdbvtqo.exe

Path C:\Temp\i_tqljdbvtqo.exe
Size 243KB
SHA256 c5c12964d8cbc0ca81c5b70a39007f08c7e196065e4dd3889a22288f7f070c78
MD5 f52236e5cb06c990b25e6caaef1713a0
SHA1 5b25b3ba75730a03d53fbee0815d10a5070d2f2f
SHA512 e2b5a520cecf3e1543b3cceaf3ecdfe35e4dd916655ec58d0dc36e7fb738b3b701a23bb556c41b9d25fd84773323fa338d91760192d62a534647653699811e64
SSDEEP 3072:CCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7s:9vMsLaOa3lLNngoqRttA7s
TLSH
T1A1345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxvpnkfcau.exe

Path C:\Temp\i_zxvpnkfcau.exe
Size 243KB
SHA256 587df136bd02caa6d17cbe6a75fb3c405fae63aa1d0fa317c022f3f3c5f83704
MD5 18474b8214b36b106b83c70b14089d4d
SHA1 ad9b53fd6a85056474658fbb4c09b8cd9e84deb4
SHA512 f818d9e8bb0bd218b9ff8af8c112c47a9c146921c3f6b0daba48625a976099ea7c98285d23f66463dd4d839cdd5ed98dc5918a35c53ccc6eb031b5e868b1ab08
SSDEEP 3072:iCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7I:dvMsLaOa3lLNngoqRttA7I
TLSH
T1BF345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhfcxupnhf.sys

Path C:\Temp\jhfcxupnhf.sys
Size 141KB
SHA256 08df00948fdeaae7e984d8dfcb5aee8082022be2b548c829d269c5ce2bc95a27
MD5 a28583ef37812990d838f2d639548ffe
SHA1 fe39f21214170349f713c292cb8ec79312f9bcb0
SHA512 3a6420c592e2c336111984e5591c38d059cea1d4d8736dd48d99f2d6834ddeb050e235dc5cc768b4fac1c99685166a898645c3ba218c1baadfeb18bb7ce189a6
SSDEEP 1536:8a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:8a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T19DE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdxvpnifd.exe

Path C:\Temp\lfdxvpnifd.exe
Size 243KB
SHA256 5ed6ebf54eaf1f177c22e405ad605f56a993d8e712ba97f1e4a20d53c918381a
MD5 ae7a6b9294cb244c631a8dae13cf2598
SHA1 83f84b6584a4b31951b1b541ba6797b9e178d73a
SHA512 db4874f97459e0177da1ede4b0f112532f4a27f7a07295fd75231a60f5a39f8431ac4a60ae8d898d41482dfc0c2d284a030b2d537a8a81f46c434d443f73edde
SSDEEP 3072:GCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7w:pvMsLaOa3lLNngoqRttA7w
TLSH
T1E5345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

licavsqlid.exe

Path C:\Temp\licavsqlid.exe
Size 243KB
SHA256 0ef419b5de431f605c6aea8954803347e6788d70d24108632252b5f71a71a593
MD5 66d25c7fe347189ff316bf76420a3227
SHA1 dd3498eacda761cc7bb3e555b11a8559b367d231
SHA512 12528cc27697749efa107b17c34ffe3f563a72bd07c30fc0caccdd555d36dde4fc164dd42e0a73f523d08cd1493d2ac9ab6d0cdcb9d7ae0cf7d76ca36c9cf641
SSDEEP 3072:0CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7S:HvMsLaOa3lLNngoqRttA7S
TLSH
T14A345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmgebwroje.exe

Path C:\Temp\rmgebwroje.exe
Size 243KB
SHA256 fbd0b2b82c258189336f1d2fa531fed7041596a63dc751efcf34b6bf866c2d34
MD5 4703053fc6f7116456e7fd89cd63d5bd
SHA1 b497f16a0077bf492f7a57612bd50806bd6a15ca
SHA512 eecb7035a0669a04efd6166c17924bbec9e234b5e9ba2c9dfbc8be3c012bdb43fd7677c14a266f15e9f1581c179ea130c0a43a48f2d9c811e1a5530c684b42a9
SSDEEP 3072:uCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:hvMsLaOa3lLNngoqRttA7o
TLSH
T1E2345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqljdbvtqo.exe

Path C:\Temp\tqljdbvtqo.exe
Size 243KB
SHA256 10eb32670e54f207baa59f56cbec50fafd344cc730b639fc7ff86871d52f21d9
MD5 4ca7b2e002f010be9efd03c994fb47e6
SHA1 0339c876779ddad8a0bbe628383231b0f80fea1d
SHA512 2a9bad029b544076e10f11aa3651f690d636a3ff6ce33fa10a61cd2618ae9be7cd0131f360ab1d53f747125e9bbd6b0ace117feb0c3986981c4aa372caa65d0d
SSDEEP 3072:XCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7V:yvMsLaOa3lLNngoqRttA7V
TLSH
T1B6345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbwtom.sys

Path C:\Temp\trljdbwtom.sys
Size 141KB
SHA256 ee7186a487a94dd644a60607764fc00bb797d59b3b7abfef5bc40fb108bb408f
MD5 07d8aabe0e2efdc845543754bc41d3ef
SHA1 7bcd114ae3a182bd98fa66b79b30856ba6f39c0f
SHA512 3f3e6b1472031ddea4c6179f8e9bf68b35be08d6defd0daa372725653ad43997be17a48faad145edf2a23b5dd8bb202ee68e4e39a9341470b8fec771e8022684
SSDEEP 1536:da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T125E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnlfdxvqn.sys

Path C:\Temp\vpnlfdxvqn.sys
Size 141KB
SHA256 13c62fd234a297116e987a2cd04b3ead90b6103b9a3b771ecc7bc76b7e68d63c
MD5 309aa440062bb237e51c28842f136e07
SHA1 92d3d86e15613a7668ed25c69e98ed6c96f99848
SHA512 26b8800d49d76111d07312da7141d1d2f6585d4c2d5fe24c26ccc5ae22eb283333b3990bfdd0816b6ef56b84b41ac766a4989dc82914dbae8a021ed4a8bb272f
SSDEEP 1536:3a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:3a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T11DE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtnlgdbvtn.sys

Path C:\Temp\wtnlgdbvtn.sys
Size 141KB
SHA256 70339acda0b47459b06663ee4b401a4150029b2f362997d85602a9014df7e5f3
MD5 7b953ddedcb96de70699687b156fcbf3
SHA1 4edcae23f685fedb108eaa281748e17ac439f927
SHA512 c879bebea0c439ea558981fe570efa153fbb70749540da35732b759b7415b44116b7b8207faf6ca421f18d3509fcc09c837c324bd1b4653be468068d4d48c4d2
SSDEEP 1536:Ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T197E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytqljdbvtn.sys

Path C:\Temp\ytqljdbvtn.sys
Size 141KB
SHA256 7bd461eb3d77ca73c80d1be3449b562028941aad54fe8ea8fff7549617e45ab2
MD5 0d37ce48c832ce2c61d3b114cba0caf8
SHA1 bc1a200102596abef0a3da04b6938850b2be5763
SHA512 da87cee65db845532bef1321725a6dc1b236c118d64e5044a069e3ef30cce1eb0523352981c45f80dc5d8580e320453e4d4ee6cfb74e08ada8a4cab54f75893b
SSDEEP 1536:Ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1FAE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxvpnkfcau.exe

Path C:\Temp\zxvpnkfcau.exe
Size 243KB
SHA256 b710631c5823ed6ee15a8f037e71cbb2cab26bc4bff6b54f9fabd2f54da45b85
MD5 a92e932949ec92d9c12d9bf7b0db59a2
SHA1 ec203d828d51505a3a5f62014a3409ba4431a628
SHA512 c205419a45f5dc05353607d7d04c1761319b397ce4532121c1e7ed3870464ad616726616e07a2227a228d189e1d1e7051f2d23cec91372f69177116a899a0611
SSDEEP 3072:jCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7F:mvMsLaOa3lLNngoqRttA7F
TLSH
T15E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 bcc4e631b9c7f77a61bbba0e175d6b83bc7e9b32c82d5df0e097483d43a79e37
MD5 9dd8f93772abb01b5b072b06721c450c
SHA1 f997ab113cf46211e5f7261b0bdef886a2cf7dcc
SHA512 77cbbb02169d62731220b6356b8d217903ff1430e7fc7e6c67e8301cff89e5e0ccb6ee04b22878cc3516ff35c5153c752aa849c02bd5273b9d623b4c020b4c5b
TLSH
T16C5152A8CB2F0ED2D370D2B15CED45EDB27E4896C6076B1593F162B49B1230F2391861
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599c94.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599c94.TMP
Size 2KB
SHA256 02891ac720f98d85c69ff2700549200b43d2b410c6845741f41560ac943476c1
MD5 7f2af7efda3167aa7d9aa9909940ea31
SHA1 d8fdd8f3f30dfa61a29a2788b4d8360c82a16c45
SHA512 78bb08fed10be2aa07f78449fa4d110dc0039acfff94b3c718503522d10953d46b522c36f7076dfda95c6cf3dc9c5e87a7789051d904955b68930a7ff8a9d26c
TLSH
T1275152A8CB2F0ED2D374D2B15CED46EDB27E48D6C6076B1593F222B49B1230F2391461
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 4138917a0ad75f1f76a9714dbd17da99f2ff634f3d0222fa0fcc57078eb49e7d
MD5 0c4774731f826deb4454d24845a1326e
SHA1 072231f14c8c9b0909101e62841cd3c3046e0a1d
SHA512 c97d5cd513643ccd6c59507f2e94132420352142368e9827979e1848a29dd903821aacf239da287fd909523950a2d8b6115f071e71fa09502efa2ccca584b732
TLSH
T1CE419DF383F4856E9D0156F0AB186E2FCE2D0915432C7D5AC9E4AE2B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 32ff277e7e3c301827ec610cebe9c9da7745b528f14e3e461da8d87ff1358c4b
MD5 a0f1a87986b8b53dc8af14dd42095bf3
SHA1 f35d9e907f7e4c047e403e6c1be3547acde8e276
SHA512 8ab3182e3e9be1e6cbc1f3d19c7f1267f150c183f68faf1f7b33d1ee70aab440a08f96370490a3e7b6e9e7b75e7863e3a5dd6af28d0aff66042bbfc8d4e36ffc
SSDEEP 192:sxRxRsCh/fVsCudPpZATjOVszoA8p9Y/g6+WNCUp/YZ7TqVs6G3IgVZJ:sxRxJh/fVsCqPnijqda/5H/89x
TLSH
T1B542C9156D28A93B5CCBE21DBB557F53D3F92032A1D11E48AAFC8A1C04E76CD221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ab303d6d8f9f89b383504707a7741273715d3955a8fbb5bd0cc293c99fcc9896
MD5 24a31264b051ef259732c907581ac651
SHA1 0c43c403b99e885489383f170366a22595d33c2f
SHA512 5a8e7b34fe5d5b5746693bad6bb9b9f628779dd380c3ece250fa3d8acfb5bb5ff8cf3eef1111ef9e119a4e3b4ee9e68d60d480dbda7dcfd3bca3df5b223fe487
SSDEEP 192:sxRCRsCh/fVsRudPpZATjOVszoA8p9Y/g6+WNCUp/YZ7TqVs6G3IgDpZJ:sxRCJh/fVsRqPnijqda/5H/89B
TLSH
T17842C9156D68A93B5CCBE21DBB557F53E3F92072A1D11E48AAFC8A1C04E76CD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 fdab4daf28f3ab6fce56b98faf45a0b5a92fbcfb09949af98102e4965becf503
MD5 fe6ce91b68cde0e9adcdfa9ba0253095
SHA1 d56019e61cc328f0d62a51fce1baee1286f9a40f
SHA512 8cd6a4cf58dbd6037e9ead3f0fc6d5deb1ca61a15839b7d38e40133bacdeb1009085512c08cdf83b367b22ec09a8541d93e92735003fb6fb3100b78e658a7b1e
SSDEEP 192:sxRCRsCh/fVsRudspZATjOVszoA8p9Y/g6+WNCUp/YZ7T6bs6G3IgDDZJ:sxRCJh/fVsRqsnijqda/5H/W9r
TLSH
T13942B7156968A93B9CCBF21DBB557F53E3F9207290D11E48AAFC8A1C04E76CD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 dbbc5bc52868fb37baa373a5cada0ef51f79f8e5cc8c5d2e74ca601ff82c372c
MD5 95704cf4438c30e9cd28df2a7976abee
SHA1 617af6202872923b5e46eaba63949e578bf29b32
SHA512 a29f8ab7853b73cbdcaa25133d6593157df3b473c87f3f0f2d5a03e24176ad47187516a8c8dcc59fceeba9941e82eaead70d122f6f33eb27e58de12e07a6d014
SSDEEP 768:ky2S9S7pLuL7evWgd5f/b8F1+UoAYDCx9Tuqh0VfUC9xbog/OVySuSV4AroZ+BN:ky2S9qE7evWgd5f/bu1jaxSuU4LU/
TLSH
T183D2D93B640DCB7F4F804ADDAC197E9E6DA802CB96D8C98047FA951C03C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 89d8d2f289b29e6b6e084d0439c97411e157027d85add9c165c072676ab45734
MD5 f1763787eb55399dc7d030956dcb2df3
SHA1 712ef835954ee940811132b2267d11d6942d7211
SHA512 0d2fca229732b52066d6a56ceb340770ea4edaecbde70af44a7e7a824e50469d65283e380d2c294ed46e384798cb24107453f085662a578de6d2be196195dc22
SSDEEP 96:Knob8YmCO8myBn0w8K8p0u8YIYh2IhhsfocSmCAmeVT0UAK8V0aAYEUl6W2ZCmQk:6ob8YmCOVyB0wUp0uVIYh2IhhsfocSmz
TLSH
T17C911282757A42017C7E695C9299CA6686937073701CA43F7BF908B15FABF014EFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1eab89a2-69f0-4bab-b959-ff86cd10c858.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1eab89a2-69f0-4bab-b959-ff86cd10c858.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 2bf97dbd0f4b4c5d41640c818c686e019656bd966a4eafa072c79a5496b695a4
MD5 f4442c51f3425f7c8028d9285abe649f
SHA1 06479b24e97b6cdf80eb7e5a32f2e38c6dc9195c
SHA512 6c2cb00d53205ed730fbeacd8641a2a1a3a957bc26bdb015579f10d64b299f21273d3325f9e67cd5a868eebe6b6e1f2e1c7563110d70ca0c1ec3b5be5dfdb2b0
SSDEEP 384:nOZcIX38NlvOZsnimivnLKpd+dfYbRAvpOPWmkA1QiZh6vPqQMQYeJfjWca4G2K2:sX3BZrxqzeAam6aQMGdjWca4Ghf96Gq
TLSH
T143E29F705CA49D739CE7A296B71B2783BEF461B388C84E44D9DD9B0D069358E270BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7cf29a987507b950eed41a9bc47ac561ed9ed92a539937d854c51afed163e10d
MD5 9f245cf176ab4e6130254f52ca45df7b
SHA1 24be6bd656ab83524df85be9b954a4ce8bf80ad2
SHA512 ba6f272c537383b3731cae76ccd593610875e412da7ab55bef9ac51738097747b39b98a643299cb19167dfe41f029d8006110414943717a6f379b2bf82e39386
SSDEEP 768:krv+4UNbdq3D/qz0Aam6aQMGdjWca4Ghfw6PeU/:kbsbc3UWmaME6p9H
TLSH
T110F2BF31A86CD9739CF7A295F21B6683BEB421A388C44E94D9C95B0D43974CE370BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 6e769d08b22f98150ba6ef368bfb5e31ce012c46be2866bba5796856361d170c
MD5 239c93ae8ea8b8df22f2a9fb130bac24
SHA1 dabd2eee21ff12986dceafc9380835345ce5da6d
SHA512 7c1d81e1d3aaa03d25d2742a277deebd1367a4815bc54904c7fd3d11311a21f8a4a2ecd1f235890cd1760753ddb0b117204cd619b3e08b714a9ecb196e8029b3
SSDEEP 384:nYZcIX38NlQOZsnimivnLKpd+dfYbRAvpOPWmkA1QiZh6vPqQMQYeJfjWca4G2K2:mX3KZrxqzeAam6aQMGdjWca4Ghf96Gq
TLSH
T138E29F705CA49D739CE7A296B71B2783BEF061B388C84E44D5DD9B0D069358E270BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 3873ddbdf496f6505524cdaf1d1322d9b0fc3d1252f97236432b531f164f1e7b
MD5 788d36dbbdc0af9984a842a477d7c4cd
SHA1 fa9270fc9199d6625fddc3f361bda3a4d754b6c0
SHA512 5409ecc59b422afabb61ab7d48503a51d67a8644f1d2270818d808c5ed99aa02fdf2e06cb94cf0b7b8b64a2d6c83b55e6046efb32a71fe1e9438338bc71edccb
SSDEEP 768:CFQ+3Ewg0ZbRbAam6aQMGdjWca4Ghf96Gq:Z+3ZfmaME6p6h
TLSH
T1570306F198D78937E8AE5783A33D6E429DBCD1A3B4884984B7C95D0CCD820BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 f93b171d49c07682d9597d677057e9b4af0c7dc00bbd3ec38b379ac33f775d05
MD5 0e3d6af05c07b3b4e9559f74f96ee6ff
SHA1 c3e9e6a4b81ce6d08643363d2fdfde28ada1cb93
SHA512 3eaa3e1b33ed3b6d30890aa0c51d5f94b98bd3d5498716c107938e5ea98cb7462e46d6fcb0c09acee9bd3ab4817cd1584e5083bc60eb828188829ec8fd6b5e00
SSDEEP 768:/rv+4UNbdq3/wqGAAam6aQMGdjWca4GhfBgPeU/:/bsbc38KmaME6pIH
TLSH
T1FEF2BE31A8689973DDB79A99F21B6B83BEF021A385D40E84C9D95B0D43974CE3307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 bfe98dd3aa1d3933fd696260b7f41b43a935d37b600f5b21b7ddbf1ce1a37516
MD5 fa168377b5b83c5b249575948af3befe
SHA1 d69f4d671f916411314fc3f5a571cd580dfc8405
SHA512 8e93aef8f60d3a144182a1c9f06b9fe6e0234538954378242c71ebc1944e80668682e4a1627f822d7f0c578760d310c8fd0abaa9f9a2127df00b490f3a3cee67
SSDEEP 768:Crv+4UNbdc3pZkxqzBAam6aQMGdjWca4Ghf96PxUQ:Cbsbq3LzDmaME6p6x
TLSH
T19BF2BF31A868D9739CF7A695F21B7A83BEB421A388C40E54D9D95B0D07970CE370BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 484B
SHA256 9fd2b7fae87c2d863b486a425834283f19b1444749c84650d5a48c9eadb12e2b
MD5 e9289cc1f579fdfa9d46acfae9b38330
SHA1 7eac8e241d8c35d873280d6b9dbc1cca7a9b2231
SHA512 b1f37da50e387c8408a960ef5276a51336510286c1db7eaea4cde65af4efc343f8ac1d9de65df1fd0818513823a485733e5c155da615344bc044f46021ecf586
TLSH
T134F0543C33D821A4F08C46B23596ED8B88BF313247DC2631CA50F550315387701B5095
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

d75140d8-c534-4bfc-b8b5-65bac573722e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d75140d8-c534-4bfc-b8b5-65bac573722e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4116_1037567963\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/472-454-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/788-373-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1192-320-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1492-480-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1540-497-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1860-267-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1860-339-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1860-366-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2188-437-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2720-234-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3028-279-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3036-183-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3152-417-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3152-439-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3272-385-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3404-343-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4260-413-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4544-324-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5632-449-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5632-472-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5668-292-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5956-476-0x0000000000010000-0x0000000000083000-memory.dmp

Download