02d453f06f906c85efaef7bdf6d3941b3edb43d17ad8cbdc57c0ff78fd4d91df

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 00:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_7c13f5f46703728c9d6524a66cb23343_elex_rhadamanthys_stop.exe
Size 243KB
Sample260816-an1pdswelf
SHA256 02d453f06f906c85efaef7bdf6d3941b3edb43d17ad8cbdc57c0ff78fd4d91df
MD5 7c13f5f46703728c9d6524a66cb23343
SHA1 db23d15df80ca81d258962b60e6c107e02148e57
SHA512 3b3185a475799ae2fa6efdf4239e18a202743aaf0e68a82115f3f65006a1003d30444c50db45cf069d87ad838d49d250403edbe8fb3b2a0ea7079bf58fae3679
SSDEEP 3072:DCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7B:GvMsLaOa3lLNngoqRttA7B
TLSH
T186345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1868	CP.exe
3468	olgeywqljd.exe
2460	CP.exe
4924	CP.exe
5004	i_olgeywqljd.exe
1148	ljdbztroig.sys
2140	CP.exe
4892	vtqligdbvt.exe
6060	CP.exe
5988	CP.exe
408	i_vtqligdbvt.exe
2412	gayvqoigay.sys
1940	CP.exe
4768	yvtoigaysq.exe
2744	CP.exe
5452	CP.exe
2388	i_yvtoigaysq.exe
4880	tqlicaxvqn.sys
4488	CP.exe
4836	qkifaxvtnk.exe
5472	CP.exe
2392	CP.exe
3812	i_qkifaxvtnk.exe
5868	xvpnkfdxvp.sys
5464	CP.exe
4912	pnkfdxvsnh.exe
4932	CP.exe
3460	CP.exe
2040	i_pnkfdxvsnh.exe
4640	spkhfcxusn.sys
4448	CP.exe
3196	khczxusmkh.exe
4864	CP.exe
4548	CP.exe
5944	i_khczxusmkh.exe
2584	spkhczurpj.sys
3088	CP.exe
5704	rpkhcaurmk.exe
912	CP.exe
5476	CP.exe
5432	i_rpkhcaurmk.exe
5204	zwrpjhbztr.sys
6012	CP.exe
5268	zwuomgeztr.exe
2440	CP.exe
3172	CP.exe
5756	i_zwuomgeztr.exe
1620	hezwujhbzw.sys
4848	CP.exe
4536	wtojgeywrl.exe
1724	CP.exe
4868	CP.exe
2988	i_wtojgeywrl.exe
3576	geywrojhbz.sys
1840	CP.exe
4808	bwtomywqol.exe
2752	CP.exe
4760	CP.exe
3488	i_bwtomywqol.exe
5424	vtnlgdyvto.sys
1232	CP.exe
4656	olgdywqoig.exe
4120	CP.exe
1236	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4944_2062855555\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4944_1587951130\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4944_2062855555\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4944_2062855555\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4944_1003491586\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4944_1003491586\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4944_1836113357\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4944_1836113357\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4944_2062855555\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgeywqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkifaxvtnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpkhcaurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtojgeywrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtomywqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzurljebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqligdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnkfdxvsnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khczxusmkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtomywqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgdywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xusnkfdxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfcxurpmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlidaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnkfdxvsnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpkhcaurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwuomgeztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupnhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgeywqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfcxurpmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xusnkfdxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkifaxvtnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwuomgeztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idavtnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzurljebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqligdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvtoigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgdywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idavtnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupnhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_7c13f5f46703728c9d6524a66cb23343_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvtoigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtojgeywrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khczxusmkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlidaysql.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1412	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3060	ipconfig.exe
892	ipconfig.exe
2980	ipconfig.exe
916	ipconfig.exe
5440	ipconfig.exe
996	ipconfig.exe
2216	ipconfig.exe
1136	ipconfig.exe
1840	ipconfig.exe
2188	ipconfig.exe
2932	ipconfig.exe
5024	ipconfig.exe
3788	ipconfig.exe
4332	ipconfig.exe
2956	ipconfig.exe
2268	ipconfig.exe
4584	ipconfig.exe
5980	ipconfig.exe
4880	ipconfig.exe
1128	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313133435607990"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{E9791409-EAE6-4C78-9B3A-55B0BCCA20F4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5924	msedge.exe
5924	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5004	i_olgeywqljd.exe
Token: SeDebugPrivilege	408	i_vtqligdbvt.exe
Token: SeDebugPrivilege	2388	i_yvtoigaysq.exe
Token: SeDebugPrivilege	3812	i_qkifaxvtnk.exe
Token: SeDebugPrivilege	2040	i_pnkfdxvsnh.exe
Token: SeDebugPrivilege	5944	i_khczxusmkh.exe
Token: SeDebugPrivilege	5432	i_rpkhcaurmk.exe
Token: SeDebugPrivilege	5756	i_zwuomgeztr.exe
Token: SeDebugPrivilege	2988	i_wtojgeywrl.exe
Token: SeDebugPrivilege	3488	i_bwtomywqol.exe
Token: SeDebugPrivilege	1136	i_olgdywqoig.exe
Token: SeDebugPrivilege	1548	i_idavtnlfdx.exe
Token: SeDebugPrivilege	956	i_xusnkfdxsq.exe
Token: SeDebugPrivilege	3324	i_xupnhfzxrp.exe
Token: SeDebugPrivilege	3148	i_nkfcxurpmh.exe
Token: SeDebugPrivilege	1112	i_pmkecwupmh.exe
Token: SeDebugPrivilege	3820	i_bzurljebwu.exe
Token: SeDebugPrivilege	1492	i_dbolgeywqo.exe
Token: SeDebugPrivilege	1972	i_trljdbvtol.exe
Token: SeDebugPrivilege	3124	i_tnlidaysql.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4944	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 5052	1432	2026-08-15_7c13f5f46703728c9d6524a66cb23343_elex_rhadamanthys_stop.exe	89
PID 5052 wrote to memory of 4944	5052	iexplore.exe	90
PID 4944 wrote to memory of 3644	4944	msedge.exe	91
PID 4944 wrote to memory of 5608	4944	msedge.exe	92
PID 4944 wrote to memory of 1412	4944	msedge.exe	93
PID 4944 wrote to memory of 5608	4944	msedge.exe	92
PID 4944 wrote to memory of 5608	4944	msedge.exe	92
PID 4944 wrote to memory of 5224	4944	msedge.exe	94
PID 4944 wrote to memory of 5224	4944	msedge.exe	94
PID 4944 wrote to memory of 5692	4944	msedge.exe	96
PID 4944 wrote to memory of 5692	4944	msedge.exe	96
PID 4944 wrote to memory of 5692	4944	msedge.exe	96
PID 4944 wrote to memory of 956	4944	msedge.exe	97
PID 4944 wrote to memory of 956	4944	msedge.exe	97
PID 4944 wrote to memory of 956	4944	msedge.exe	97
PID 4944 wrote to memory of 2452	4944	msedge.exe	98
PID 4944 wrote to memory of 4576	4944	msedge.exe	99
PID 4944 wrote to memory of 2452	4944	msedge.exe	98
PID 4944 wrote to memory of 2452	4944	msedge.exe	98
PID 4944 wrote to memory of 4576	4944	msedge.exe	99
PID 4944 wrote to memory of 4576	4944	msedge.exe	99
PID 4944 wrote to memory of 2748	4944	msedge.exe	100
PID 4944 wrote to memory of 2748	4944	msedge.exe	100
PID 4944 wrote to memory of 5572	4944	msedge.exe	102
PID 4944 wrote to memory of 5572	4944	msedge.exe	102
PID 4944 wrote to memory of 2556	4944	msedge.exe	103
PID 4944 wrote to memory of 2556	4944	msedge.exe	103
PID 1432 wrote to memory of 1868	1432	2026-08-15_7c13f5f46703728c9d6524a66cb23343_elex_rhadamanthys_stop.exe	104
PID 4944 wrote to memory of 2960	4944	msedge.exe	107
PID 3468 wrote to memory of 2460	3468	olgeywqljd.exe	109
PID 4944 wrote to memory of 3572	4944	msedge.exe	112
PID 4944 wrote to memory of 3572	4944	msedge.exe	112
PID 4944 wrote to memory of 2884	4944	msedge.exe	115
PID 4944 wrote to memory of 2884	4944	msedge.exe	115
PID 1432 wrote to memory of 4924	1432	2026-08-15_7c13f5f46703728c9d6524a66cb23343_elex_rhadamanthys_stop.exe	116
PID 1432 wrote to memory of 2140	1432	2026-08-15_7c13f5f46703728c9d6524a66cb23343_elex_rhadamanthys_stop.exe	120
PID 4892 wrote to memory of 6060	4892	vtqligdbvt.exe	122
PID 1432 wrote to memory of 5988	1432	2026-08-15_7c13f5f46703728c9d6524a66cb23343_elex_rhadamanthys_stop.exe	125
PID 1432 wrote to memory of 1940	1432	2026-08-15_7c13f5f46703728c9d6524a66cb23343_elex_rhadamanthys_stop.exe	129
PID 4768 wrote to memory of 2744	4768	yvtoigaysq.exe	131
PID 1432 wrote to memory of 5452	1432	2026-08-15_7c13f5f46703728c9d6524a66cb23343_elex_rhadamanthys_stop.exe	134
PID 1432 wrote to memory of 4488	1432	2026-08-15_7c13f5f46703728c9d6524a66cb23343_elex_rhadamanthys_stop.exe	138
PID 4836 wrote to memory of 5472	4836	qkifaxvtnk.exe	140
PID 1432 wrote to memory of 2392	1432	2026-08-15_7c13f5f46703728c9d6524a66cb23343_elex_rhadamanthys_stop.exe	143
PID 4944 wrote to memory of 5756	4944	msedge.exe	146
PID 4944 wrote to memory of 1532	4944	msedge.exe	147
PID 4944 wrote to memory of 3672	4944	msedge.exe	148
PID 1432 wrote to memory of 5464	1432	2026-08-15_7c13f5f46703728c9d6524a66cb23343_elex_rhadamanthys_stop.exe	151
PID 4912 wrote to memory of 4932	4912	pnkfdxvsnh.exe	153
PID 1432 wrote to memory of 3460	1432	2026-08-15_7c13f5f46703728c9d6524a66cb23343_elex_rhadamanthys_stop.exe	156
PID 1432 wrote to memory of 4448	1432	2026-08-15_7c13f5f46703728c9d6524a66cb23343_elex_rhadamanthys_stop.exe	160
PID 3196 wrote to memory of 4864	3196	khczxusmkh.exe	162
PID 1432 wrote to memory of 4548	1432	2026-08-15_7c13f5f46703728c9d6524a66cb23343_elex_rhadamanthys_stop.exe	165
PID 1432 wrote to memory of 3088	1432	2026-08-15_7c13f5f46703728c9d6524a66cb23343_elex_rhadamanthys_stop.exe	169
PID 5704 wrote to memory of 912	5704	rpkhcaurmk.exe	171
PID 1432 wrote to memory of 5476	1432	2026-08-15_7c13f5f46703728c9d6524a66cb23343_elex_rhadamanthys_stop.exe	174
PID 1432 wrote to memory of 6012	1432	2026-08-15_7c13f5f46703728c9d6524a66cb23343_elex_rhadamanthys_stop.exe	178
PID 5268 wrote to memory of 2440	5268	zwuomgeztr.exe	180
PID 1432 wrote to memory of 3172	1432	2026-08-15_7c13f5f46703728c9d6524a66cb23343_elex_rhadamanthys_stop.exe	183
PID 4944 wrote to memory of 576	4944	msedge.exe	185
PID 4944 wrote to memory of 576	4944	msedge.exe	185
PID 1432 wrote to memory of 4848	1432	2026-08-15_7c13f5f46703728c9d6524a66cb23343_elex_rhadamanthys_stop.exe	191
PID 4536 wrote to memory of 1724	4536	wtojgeywrl.exe	193
PID 1432 wrote to memory of 4868	1432	2026-08-15_7c13f5f46703728c9d6524a66cb23343_elex_rhadamanthys_stop.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-15_7c13f5f46703728c9d6524a66cb23343_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_7c13f5f46703728c9d6524a66cb23343_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x338,0x7ff8bc19c188,0x7ff8bc19c194,0x7ff8bc19c1a0
      4⤵
      PID:3644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,17155297480129136452,11162577762170872340,262144 --field-trial-handle=2628,i,5406944392755581656,12397113448900780711,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:2
      4⤵
      PID:5608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,14314147920697570976,15944163450461913060,524288 --field-trial-handle=2628,i,5406944392755581656,12397113448900780711,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:11
      4⤵
      System Time Discovery
      PID:1412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2368,i,6627147164810001561,14409798203755341065,524288 --field-trial-handle=2628,i,5406944392755581656,12397113448900780711,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:13
      4⤵
      PID:5224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,13697720075428899401,16832543640149005725,2097152 --field-trial-handle=2628,i,5406944392755581656,12397113448900780711,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:5692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,14778027161448301497,11243445671920488251,2097152 --field-trial-handle=2628,i,5406944392755581656,12397113448900780711,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,6847038968074142410,15605670890752818441,2097152 --field-trial-handle=2628,i,5406944392755581656,12397113448900780711,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:9
      4⤵
      PID:2452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,5566054845493662173,13504741820521063348,2097152 --field-trial-handle=2628,i,5406944392755581656,12397113448900780711,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:1
      4⤵
      PID:4576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3848,i,7433435192262813758,5514147561808391863,524288 --field-trial-handle=2628,i,5406944392755581656,12397113448900780711,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
      4⤵
      PID:2748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,11295817031376672501,8201843913831121607,524288 --field-trial-handle=2628,i,5406944392755581656,12397113448900780711,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:14
      4⤵
      PID:5572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3804,i,7179722376444482652,9749389395636119729,524288 --field-trial-handle=2628,i,5406944392755581656,12397113448900780711,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
      4⤵
      PID:2556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,9251973047788337112,15053754003111149737,524288 --field-trial-handle=2628,i,5406944392755581656,12397113448900780711,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
      4⤵
      PID:3984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,9251973047788337112,15053754003111149737,524288 --field-trial-handle=2628,i,5406944392755581656,12397113448900780711,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
      4⤵
      PID:2960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,16229840088347612813,9893589391253753065,524288 --field-trial-handle=2628,i,5406944392755581656,12397113448900780711,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
      4⤵
      PID:3572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,7897804623128523622,16576135567848655158,524288 --field-trial-handle=2628,i,5406944392755581656,12397113448900780711,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
      4⤵
      PID:2884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4780,i,4970504510799454486,14357227177231164819,524288 --field-trial-handle=2628,i,5406944392755581656,12397113448900780711,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
      4⤵
      PID:5756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3480,i,10370888674943153326,13345318216307696163,524288 --field-trial-handle=2628,i,5406944392755581656,12397113448900780711,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
      4⤵
      PID:1532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,10798186269086376052,3079409307061336767,524288 --field-trial-handle=2628,i,5406944392755581656,12397113448900780711,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
      4⤵
      PID:3672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,14884867640658118167,14063151663680953287,524288 --field-trial-handle=2628,i,5406944392755581656,12397113448900780711,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
      4⤵
      PID:576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,10851189995602952939,14825891311834426561,524288 --field-trial-handle=2628,i,5406944392755581656,12397113448900780711,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
      4⤵
      PID:1740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,15452270469577926842,16259612177925542858,524288 --field-trial-handle=2628,i,5406944392755581656,12397113448900780711,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:14
      4⤵
      PID:4852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,14194333438584988200,4601469128725547801,524288 --field-trial-handle=2628,i,5406944392755581656,12397113448900780711,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
      4⤵
      PID:5076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6284,i,10708512432482831358,2925616275866545033,262144 --field-trial-handle=2628,i,5406944392755581656,12397113448900780711,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,15977700648692520498,10439731188137517370,524288 --field-trial-handle=2628,i,5406944392755581656,12397113448900780711,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:14
      4⤵
      PID:824
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\olgeywqljd.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1868
- - C:\Temp\olgeywqljd.exe
    C:\Temp\olgeywqljd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3468
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2460
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_olgeywqljd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4924
- - C:\Temp\i_olgeywqljd.exe
    C:\Temp\i_olgeywqljd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtqligdbvt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2140
- - C:\Temp\vtqligdbvt.exe
    C:\Temp\vtqligdbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4892
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6060
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtqligdbvt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5988
- - C:\Temp\i_vtqligdbvt.exe
    C:\Temp\i_vtqligdbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\yvtoigaysq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1940
- - C:\Temp\yvtoigaysq.exe
    C:\Temp\yvtoigaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4768
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2744
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_yvtoigaysq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5452
- - C:\Temp\i_yvtoigaysq.exe
    C:\Temp\i_yvtoigaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2388
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkifaxvtnk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4488
- - C:\Temp\qkifaxvtnk.exe
    C:\Temp\qkifaxvtnk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4836
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5472
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1840
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkifaxvtnk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2392
- - C:\Temp\i_qkifaxvtnk.exe
    C:\Temp\i_qkifaxvtnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnkfdxvsnh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5464
- - C:\Temp\pnkfdxvsnh.exe
    C:\Temp\pnkfdxvsnh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4912
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4932
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnkfdxvsnh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3460
- - C:\Temp\i_pnkfdxvsnh.exe
    C:\Temp\i_pnkfdxvsnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\khczxusmkh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4448
- - C:\Temp\khczxusmkh.exe
    C:\Temp\khczxusmkh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3196
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4864
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_khczxusmkh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4548
- - C:\Temp\i_khczxusmkh.exe
    C:\Temp\i_khczxusmkh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpkhcaurmk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3088
- - C:\Temp\rpkhcaurmk.exe
    C:\Temp\rpkhcaurmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5704
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:912
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpkhcaurmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5476
- - C:\Temp\i_rpkhcaurmk.exe
    C:\Temp\i_rpkhcaurmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwuomgeztr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6012
- - C:\Temp\zwuomgeztr.exe
    C:\Temp\zwuomgeztr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5268
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2440
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4584
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwuomgeztr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3172
- - C:\Temp\i_zwuomgeztr.exe
    C:\Temp\i_zwuomgeztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtojgeywrl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4848
- - C:\Temp\wtojgeywrl.exe
    C:\Temp\wtojgeywrl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4536
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1724
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtojgeywrl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4868
- - C:\Temp\i_wtojgeywrl.exe
    C:\Temp\i_wtojgeywrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwtomywqol.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1840
- - C:\Temp\bwtomywqol.exe
    C:\Temp\bwtomywqol.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4808
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2752
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwtomywqol.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4760
- - C:\Temp\i_bwtomywqol.exe
    C:\Temp\i_bwtomywqol.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3488
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\olgdywqoig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1232
- - C:\Temp\olgdywqoig.exe
    C:\Temp\olgdywqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4656
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4120
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_olgdywqoig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1236
- - C:\Temp\i_olgdywqoig.exe
    C:\Temp\i_olgdywqoig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\idavtnlfdx.exe ups_run
  2⤵
  PID:4872
- - C:\Temp\idavtnlfdx.exe
    C:\Temp\idavtnlfdx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5416
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:892
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_idavtnlfdx.exe ups_ins
  2⤵
  PID:1200
- - C:\Temp\i_idavtnlfdx.exe
    C:\Temp\i_idavtnlfdx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xusnkfdxsq.exe ups_run
  2⤵
  PID:4356
- - C:\Temp\xusnkfdxsq.exe
    C:\Temp\xusnkfdxsq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4400
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xusnkfdxsq.exe ups_ins
  2⤵
  PID:5424
- - C:\Temp\i_xusnkfdxsq.exe
    C:\Temp\i_xusnkfdxsq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xupnhfzxrp.exe ups_run
  2⤵
  PID:4176
- - C:\Temp\xupnhfzxrp.exe
    C:\Temp\xupnhfzxrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4244
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3044
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xupnhfzxrp.exe ups_ins
  2⤵
  PID:5444
- - C:\Temp\i_xupnhfzxrp.exe
    C:\Temp\i_xupnhfzxrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkfcxurpmh.exe ups_run
  2⤵
  PID:708
- - C:\Temp\nkfcxurpmh.exe
    C:\Temp\nkfcxurpmh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3264
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:820
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkfcxurpmh.exe ups_ins
  2⤵
  PID:200
- - C:\Temp\i_nkfcxurpmh.exe
    C:\Temp\i_nkfcxurpmh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmkecwupmh.exe ups_run
  2⤵
  PID:2424
- - C:\Temp\pmkecwupmh.exe
    C:\Temp\pmkecwupmh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5060
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2308
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmkecwupmh.exe ups_ins
  2⤵
  PID:3508
- - C:\Temp\i_pmkecwupmh.exe
    C:\Temp\i_pmkecwupmh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bzurljebwu.exe ups_run
  2⤵
  PID:3448
- - C:\Temp\bzurljebwu.exe
    C:\Temp\bzurljebwu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2128
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6100
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bzurljebwu.exe ups_ins
  2⤵
  PID:1108
- - C:\Temp\i_bzurljebwu.exe
    C:\Temp\i_bzurljebwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbolgeywqo.exe ups_run
  2⤵
  PID:1072
- - C:\Temp\dbolgeywqo.exe
    C:\Temp\dbolgeywqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2980
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5828
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbolgeywqo.exe ups_ins
  2⤵
  PID:2136
- - C:\Temp\i_dbolgeywqo.exe
    C:\Temp\i_dbolgeywqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljdbvtol.exe ups_run
  2⤵
  PID:1080
- - C:\Temp\trljdbvtol.exe
    C:\Temp\trljdbvtol.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1448
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1844
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljdbvtol.exe ups_ins
  2⤵
  PID:2444
- - C:\Temp\i_trljdbvtol.exe
    C:\Temp\i_trljdbvtol.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlidaysql.exe ups_run
  2⤵
  PID:5024
- - C:\Temp\tnlidaysql.exe
    C:\Temp\tnlidaysql.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3488
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3788
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4332
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlidaysql.exe ups_ins
  2⤵
  PID:5096
- - C:\Temp\i_tnlidaysql.exe
    C:\Temp\i_tnlidaysql.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3124

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1768

C:\Temp\ljdbztroig.sys
C:\Temp\ljdbztroig.sys
1⤵
- Executes dropped EXE
PID:1148

C:\Temp\gayvqoigay.sys
C:\Temp\gayvqoigay.sys
1⤵
- Executes dropped EXE
PID:2412

C:\Temp\tqlicaxvqn.sys
C:\Temp\tqlicaxvqn.sys
1⤵
- Executes dropped EXE
PID:4880

C:\Temp\xvpnkfdxvp.sys
C:\Temp\xvpnkfdxvp.sys
1⤵
- Executes dropped EXE
PID:5868

C:\Temp\spkhfcxusn.sys
C:\Temp\spkhfcxusn.sys
1⤵
- Executes dropped EXE
PID:4640

C:\Temp\spkhczurpj.sys
C:\Temp\spkhczurpj.sys
1⤵
- Executes dropped EXE
PID:2584

C:\Temp\zwrpjhbztr.sys
C:\Temp\zwrpjhbztr.sys
1⤵
- Executes dropped EXE
PID:5204

C:\Temp\hezwujhbzw.sys
C:\Temp\hezwujhbzw.sys
1⤵
- Executes dropped EXE
PID:1620

C:\Temp\geywrojhbz.sys
C:\Temp\geywrojhbz.sys
1⤵
- Executes dropped EXE
PID:3576

C:\Temp\vtnlgdyvto.sys
C:\Temp\vtnlgdyvto.sys
1⤵
- Executes dropped EXE
PID:5424

C:\Temp\qoifdyvtnl.sys
C:\Temp\qoifdyvtnl.sys
1⤵
PID:4340

C:\Temp\axvpnkicay.sys
C:\Temp\axvpnkicay.sys
1⤵
PID:3056

C:\Temp\qnhfaxsqki.sys
C:\Temp\qnhfaxsqki.sys
1⤵
PID:4272

C:\Temp\mkecaxspnh.sys
C:\Temp\mkecaxspnh.sys
1⤵
PID:5128

C:\Temp\pmkecwuomh.sys
C:\Temp\pmkecwuomh.sys
1⤵
PID:6140

C:\Temp\omzwrpjhez.sys
C:\Temp\omzwrpjhez.sys
1⤵
PID:3304

C:\Temp\bztromgbzt.sys
C:\Temp\bztromgbzt.sys
1⤵
PID:4540

C:\Temp\wtojgeywqo.sys
C:\Temp\wtojgeywqo.sys
1⤵
PID:5188

C:\Temp\nlfdbvtqoi.sys
C:\Temp\nlfdbvtqoi.sys
1⤵
PID:4804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gayvqoigay.sys

Path C:\Temp\gayvqoigay.sys
Size 141KB
SHA256 d97fb9726eb5896cf7e7428571e00f3b60eeabbd18d2905a640b3904c8fd1cd5
MD5 9d1892427348b9a8edaff0ee3905183f
SHA1 49a3f183b174ce67cb97f4332a93798184b2a66e
SHA512 95e535e66e562a63128ec74d035ac53d13c788e3ac008b41bf86a7d13a5ed164182cd27c49bb107854de7f6d958cb55969cb0ae66fd0b72d2c64701ab9ae7cc3
SSDEEP 1536:/a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:/a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D5E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_khczxusmkh.exe

Path C:\Temp\i_khczxusmkh.exe
Size 243KB
SHA256 93c553fe03da825ea1cf66ccacc364694470394a302c947996a2d0036ab89cca
MD5 d0be0f1ce8c2c8ffa305b94217c8b9c8
SHA1 7f390836f52095fe6dc07ade546181416bc3825f
SHA512 cbf95d86d4450ec25e0295b1007f17e0a6a20e420648caa33b0c1aed60aec70ba6029d4ebef65a4cda3f018aa8ed1ed43e4bef11c227c7d7bf47cfaae4947338
SSDEEP 3072:ICvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7y:zvMsLaOa3lLNngoqRttA7y
TLSH
T17F345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_olgeywqljd.exe

Path C:\Temp\i_olgeywqljd.exe
Size 243KB
SHA256 2eeccdaf9d3dc8efcefa8e3d549e934b8e305c8d7e3f60a2231ae092e1086a49
MD5 3d635d26fd2a3c84efa22896047bba97
SHA1 fac3da0bb93e870275da8925919b5dacc4292c73
SHA512 6bf4a62cb7d0bb741bb5982d1e8927918165273bcbb99f19fb6588de117328dba153c408c531489fa098b64ffd7d479706c7768e01d1029f9381b538c50328ed
SSDEEP 3072:xCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7z:MvMsLaOa3lLNngoqRttA7z
TLSH
T1BC345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnkfdxvsnh.exe

Path C:\Temp\i_pnkfdxvsnh.exe
Size 243KB
SHA256 05a0bfdcc00d10ca3cac70cf8375dbb5217ad3ae7e4219522e6c17f4ece3415e
MD5 792f74ab44d51cce40d26364cbdd7d09
SHA1 41cd9c475920180075552bfb2c90325667d9739c
SHA512 d0d2ebf2d5ebfc06372d993c68a87eb797f21e732e294703685d63c06eaa9fdb694207e7e3fe52baedb6c64507bc8f6968d6b9a6c845f654efb0d30334e27e3f
SSDEEP 3072:ICvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:zvMsLaOa3lLNngoqRttA7W
TLSH
T140345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qkifaxvtnk.exe

Path C:\Temp\i_qkifaxvtnk.exe
Size 243KB
SHA256 68603d73d6f7990b345993cc54dc94d4968b371063550a4ae947d417046a53c2
MD5 95980e2c8ba09b0655bb33c2fffc5361
SHA1 f5a118b809948ed83289a677a355205d2de67bbb
SHA512 7c9336954467e6e970a6adaab123fbf15a0561e850693cfd98058120c24bcfc091748ea15b553694f5930fecace88f0a22970edd7c35f94177ea2027f7888929
SSDEEP 3072:bCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7N:OvMsLaOa3lLNngoqRttA7N
TLSH
T103345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtqligdbvt.exe

Path C:\Temp\i_vtqligdbvt.exe
Size 243KB
SHA256 8f840330dd1128b7507e2c9bd00d531d9283aabe552539268bc551a010788143
MD5 596e12a23acafba36bdc48c5e615f112
SHA1 87caf3643cf0db5e64eddebdd653bccee06871ea
SHA512 b342ba18565665f8c82b37c7da4e9d732761349cfd506a102d0913a0eb2153c81ac5efc6a256fa839861fb4268c89a4b924a9988145a779033f2ad15e19d41f1
SSDEEP 3072:VCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7v:YvMsLaOa3lLNngoqRttA7v
TLSH
T19A345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_yvtoigaysq.exe

Path C:\Temp\i_yvtoigaysq.exe
Size 243KB
SHA256 ef2c34ae959c0f7370bdda51d090af5334379d8cc772d581877865e2eb87dcd8
MD5 9788e1299cfe1accd87173edaf995826
SHA1 7eee844f86a5c88dab6de5b10d772e6f848dccfe
SHA512 df1488baa2ecb6d29de6b0feaf8a23b3d1c1c3da013a443fe0ed6b867ca184f858db4b35823560db73065747a62b477ee500771f7b941e16ae8e72f7171c6428
SSDEEP 3072:6CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7E:lvMsLaOa3lLNngoqRttA7E
TLSH
T1FE345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khczxusmkh.exe

Path C:\Temp\khczxusmkh.exe
Size 243KB
SHA256 9b1e5f989f43346a68c8cbbf8f0163e36262a750ffca570fd5e2fd2b996dde6b
MD5 752fff862644aab440d13e2c2a78db7a
SHA1 6f59479024b123acde2d19fe3146d374ae122b11
SHA512 c2508a7bbb6f2381b3dfd5a1663961d38f2a2255ad1d4a28f4913f3b32e83494fda5c205a6ae5575ca684e39a6e7a71307b04acda01d738dacc9e2e5ccc967f2
SSDEEP 3072:2CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:ZvMsLaOa3lLNngoqRttA7o
TLSH
T141345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbztroig.sys

Path C:\Temp\ljdbztroig.sys
Size 141KB
SHA256 c8ee052b0b9359a68d21e94523ae10f587c2d99f57ec57f0df443e9e2cbc5328
MD5 1d2dd5664dccabc6ea6cc365966e180d
SHA1 39b8b31ef80cb5aca093c8387b8664991a101e15
SHA512 4957875283e679d5a8712482783fef89aee2e014614425990bf14bcec8b1502bfa93e966251e698132691b20fa3333df769ac3a97d62258afca96b59cf56097d
SSDEEP 1536:Ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1ABE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgeywqljd.exe

Path C:\Temp\olgeywqljd.exe
Size 243KB
SHA256 4f3792bd4567adcd0ecde0ae7168471ab0d315549e1585a04d3ffedd32f1c672
MD5 8a10dc96b010028b7e75bfaa670b1086
SHA1 842736564882183939d5f2caaaa9d00f82f95751
SHA512 df6d21cc2b6e6a5377ef9f8a0ee433c7d586c3969021c877f46d088f3335f18b1f337b93750a689f181e016e0ced68f875d6a3e77eb1d5e77bf98bd741a8fcbd
SSDEEP 3072:iCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7U:dvMsLaOa3lLNngoqRttA7U
TLSH
T13B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnkfdxvsnh.exe

Path C:\Temp\pnkfdxvsnh.exe
Size 243KB
SHA256 aa912453206ba80a8f278cd667b8ee480ef79d6728f9fe05f0e6d9e45b22239e
MD5 87d52fe64a59866ccbbc1ff0979adc39
SHA1 914f247ff8d5c9cdb5f3486b591f5ee1e3860632
SHA512 d4f79d3a418ab22d5c44df2c88cb5163c975ab1a16f9e33d5acde1b2d0f14702109564abbec916686e57aed4712f2c18a3347c0b0757601004e44fd8d5cf1b58
SSDEEP 3072:ICvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7K:zvMsLaOa3lLNngoqRttA7K
TLSH
T123345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkifaxvtnk.exe

Path C:\Temp\qkifaxvtnk.exe
Size 243KB
SHA256 f7e0cbf10c01307cf413e1a2c117514c85a8a952bc6b99e76c7065106837b173
MD5 7a135925981506ee446cfea685c6937a
SHA1 4535ba9cdc48989a0e0cfe92ad6e2ce3997c796f
SHA512 6cd1c8f4f8e50b9c396ed76e4956c47d4e8ba3f022928aabe33ff2571248f0f70a7b1a3db30b8320a925fafb4b9ebd77e42ac182bd38157423e3c42722cc056b
SSDEEP 3072:BCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:cvMsLaOa3lLNngoqRttA7b
TLSH
T154345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spkhfcxusn.sys

Path C:\Temp\spkhfcxusn.sys
Size 141KB
SHA256 36db8efdac03276d485fc7e8cace2db568feb43c1da78059a150ef69e38f5b30
MD5 7fe767a55b98997ce4717571d963920f
SHA1 42e1708f212ac1c90dc87a385240f3f085c3d663
SHA512 c4e51b97e88f97849bdceed867fbd116789c53b78fa497872ca569b9bc58ff4fc26c1e422778fef0b4815b7fffcb4d49dede4ea62addba7996293960a0877ca7
SSDEEP 1536:za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T182E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqlicaxvqn.sys

Path C:\Temp\tqlicaxvqn.sys
Size 141KB
SHA256 1cc4d3eae10dabfc265cc716c9b6e4fca7a88b0163d7559098e691db5edbe73c
MD5 e8ff0a49fd7239033e0fae77b2087052
SHA1 68b0fee7999c2381c3972c61ca7db27bf7bd6e7f
SHA512 b1903a9731113c4b5b7d39722028ad8b6942bf0f37b095beca90331d0edd074845e967a627042c5f94395ea9e1c001de131fa985aa516353fc425f0d4ab5e1e6
SSDEEP 1536:ga3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ga3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T12FE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtqligdbvt.exe

Path C:\Temp\vtqligdbvt.exe
Size 243KB
SHA256 20c87031383722dc3cb5e7fa333cebb1c2cf5ca51c13e2cc63ad75574b87c166
MD5 1f49b111849de78113608ad026bddaeb
SHA1 d5ec6cf0e2dd1ec95d5d516068e1e2a887f7b25e
SHA512 00fabce94fc1771313b76a5391ac0042389ea473a345535c01c7596561a778101b7fba7ab979f8c90eed15715c52697b9870959a575f0cab010e17f33e3bcde6
SSDEEP 3072:eCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:RvMsLaOa3lLNngoqRttA7o
TLSH
T10D345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnkfdxvp.sys

Path C:\Temp\xvpnkfdxvp.sys
Size 141KB
SHA256 c947a4924d7e906448d66fc8aa36f60030e49bbafab8b589a887547f4bc22fe2
MD5 64c2d88a1525b6453c57eca43cfda8dc
SHA1 ceebd0ed444ed8a1bb8e11dcbd01d9ef8cbaa652
SHA512 f2423b8d6ab011480fc71dcf520f22b7d34d9eddd74e1dfc3c7b362269fc6feaacfaae25c66bf980545ac4103d7927bea37fbbc5cebfd702f8ee506fdc8f4510
SSDEEP 1536:ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T106E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvtoigaysq.exe

Path C:\Temp\yvtoigaysq.exe
Size 243KB
SHA256 ae30762f04a086b50ecbbae389ab1a8f5775d56636dfeeb9138a7577d37b0f74
MD5 64e5c7f2c00aceb0294e95e9f79188d0
SHA1 dcd72ddac224d093566d640671d67b5460db269f
SHA512 4795e42d4282e583d94eecd6e8a61ff2d921ebb0b1e7733e0f58f6c7f48163d13169a999dc563589cbe06184885e942ceddee43b1476be24c4aa60f9e31300c8
SSDEEP 3072:yCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:tvMsLaOa3lLNngoqRttA7A
TLSH
T16C345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 18a82136548884171ea35cdf234f3af2a9f946d752422e58d855805ed41b92ef
MD5 98c4e0127ca9e958575c0b9b218ac0ba
SHA1 a41ccbdd7d5e4f4f1bb7aaa2a9f18f00feb4d3ff
SHA512 32ebcd1c5318f44d9509e02c708b9a6337318f881be5cbeff14fce27ae2f63ba33dd64e12dc40395a9434245a423909db8fe418e90815f7bd7e56a4b433e39b4
TLSH
T10C613C18B31ADAF3FB25C9BA68E0D0D97BF064D1018B1A21F4703FB82816F6410E07A7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ac24.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59ac24.TMP
Size 3KB
SHA256 f9f5445f5582186aa0deec3a14f93ae3a123ec8ec4775f659e53828addab6794
MD5 fe0bdf1b44acd85bbc8d36dff86a865a
SHA1 469154aeefc5139736196df1d97a4be669a4ff84
SHA512 d2ee01a261ec28129b670e15e645a725bafb86ccad34fedd2a3fbaca18cadd4c55197518b2a908081ac2c7802da4129d85061d3a99bc4497f25569afae1aa74c
TLSH
T193612B18B31ADAF3FB25C9BA68E0D0D97BF064D4018B1A21F4743FB86816F6410E07A7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 0568754bfeec3804eee82ed0e966402c525217b37df87ea2ab8d420d3337c0ee
MD5 391d66e897b7034730e56ec75730d711
SHA1 b1fb18ddcf0b21b022fc796191195dd24bf5ee8d
SHA512 021d8cb75f2f758b2b59a22df7fb9a295e2f60f5af4c712168d8c4378b02a94068b8edda29b3acc82bfe2c12cc02ef09cfe04e6b0e0641e72fe94b71a917b112
TLSH
T10741ADF383F4856E8A0196F0AA186E1FDE2D0511432C7C5AC9E4AE2B93E3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 59caa911b6fb39664ddd8b7254252172346ec94b91520cf9cd71be52c5d1e4e0
MD5 723eb84ed64f197778d393d6c5857cf6
SHA1 edfeafdcc37d93f95c5dc9fac3647734d5e96c9c
SHA512 a6156915394d2dbf6a61a9ff1d4e4548d47b26a472af7236109e03e82665e0181457307967373d198933bdff1f3a8bdaf3f03f5668a81e82bf44687360ed7ae5
SSDEEP 192:sxR2yRRCVo/fgsytnoZX5rajzoD8p9E/g6+WNC17/Y3w2pvGUoIgVL6J:sxRpii/fgsytnWXc+/5M/fqkV2
TLSH
T17642C9166D28A93B9CC7E219FB657F53D3F9213260D01E49EAFC861C04E6ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 21f1953fbd564a7d802c7a21f4963320041ca8b7d81bd42dcdd75594995d91e3
MD5 869a1a8ecb22b1c6a446efa3bdc24499
SHA1 712f5970f89aa8005d205853b01371f188e3013f
SHA512 5865e2cd048c8bae56e4caede0db1d01d9e799dc6da6c22fd35523e5192bb43ba9bf708006b0c2162801f82cf8044836d20486f1bc721279f80bd2f4a276daea
SSDEEP 192:sxRvyRRCVo/fgsatnoZX5rajzoD8p9E/g6+WNC17/Y3w2pvGUoIgDXL6J:sxRaii/fgsatnWXc+/5M/fqkX2
TLSH
T1E742C9166D28A93B9CC7E219FB55BF53D7F9213261D01E49AAFC861C04E6ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8f665d4c5fe84e9489536bdd95c2fe41c8118af9d4e288029fa33dbe7f6cf5c4
MD5 19e3470e515f54fc143abe93ed968184
SHA1 b41d9f30c02e87898aa84a4f1a9fbeac9b5628e1
SHA512 a3026613332f92a6ec1e034c2c4b082a4a61565d46bf4e7d6d2a32dfb9ebf9ab89bbea4926211dd5ff6947922bb7fddb63b16527f58390460040f347a5aa02ec
SSDEEP 192:sxRvyRRCVo/fgsatsoZX5rajzoD8p9E/g6+WNC17/Y3PVvGUoIgDVL6J:sxRaii/fgsatsWXc+/5M/kkh2
TLSH
T15A42C8166D28693B9CC7F219BB557F53E3F9613361D11E49AAFC861C00E6ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 15c384e0c40e97a75694ef879d36568fadf9c1d112621aec3f5dd7edb36727a5
MD5 5b282661d376bafde15b3064a5165767
SHA1 2ebad152f4804547571f2481e8e176ab6d43aadd
SHA512 3c1c374af88bb67d4c318cb303faaa7bfebe2a56a9d2ff90abe8f673a96fb22cd06130689b703c141b8e8cdb41d7a97dbdd59ff678cfef1bc698b607d5da10eb
SSDEEP 768:GTEbSo7pLuL7lkWg0CfKs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsegMWcMCroTOiV:GTEbSUE7lkWg0CfKsu1ja/egFcMZThV
TLSH
T101D2EA7B640DCB7E4F804A9DAC1ABE9B6D6802CB9698CD4047FE841C02C6BFE51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 99e7cf094a2fbab7fe615e82674e684cab8a9e5f9a103031cd58d2fdf8ef75c7
MD5 ba428d9989935e5df645ad45b04dbcab
SHA1 55a52cb7a03f6f72c09b821b08aa5e1f45e822aa
SHA512 389015c3ca54cc47e1fbc1a51a02384ec606024cd5ff5ccfdb51aff8caeee3541af674b53c6f34362aa57a3195f7ed95a9033f9cc0d52fa063bffce54bf0f185
SSDEEP 96:KR1i7PF/DnWrw+gXnK4mgpnct1o7zsH3gPr31lpWRekgJpK4ggHpcvHG5FaHzc5T:C1i7PF/DWrwfX9mgpct1o7zsH3gPr31H
TLSH
T1D2914447313B0250393DAD4C96B9D85E92C2B8633059B52F3FE855A20F66E039CFE4D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c511f49a-4da8-42c0-ab0c-f42e666c55df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c511f49a-4da8-42c0-ab0c-f42e666c55df.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c22126b4979a171195b98c06e04c8123d153f21bdda252aee7a9b3b26d5925a6
MD5 2dacc2899bfd965cae82b345d0dd9fd8
SHA1 487ac6f9d349a8a07299385e6bac6ce5b4a429d0
SHA512 ce1a304893c97503691a371860677dbc2b808d16cf67f2459c2b34a815345aba5316233910c385b08aa1d0dc44a9712cb16757efaca760486825dd7592ef0d45
SSDEEP 768:Rrv+4UNbd43jwkc+wfZOOffgvShCQtO2bwWV:RbsbO3jlwf9fIvS60wO
TLSH
T1CB03CF32E86899339DE792487646BB637EB86173C8C54784DACD4B0D029369F370BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e63bd0529e50f4e97f7d6f611a3d71831896c06938e1afa6f442f3039154fa1a
MD5 723822db3e5c1e677f0faa400aa9fde8
SHA1 1bf4effffdfffa1f28376f1a3b706962941f6c5d
SHA512 d037dc3f3352e241137a86ebde40afa409ab36a9031fd48c882767fb8f5705344e418a0520a8f2e5b33dbc2345fdc48b346f5c5f7a5a6370702a311ed8246988
SSDEEP 384:nHZcI638Nw/vvFYcTcHGfd+UJfRXOVyS5cffX8tgffXT+E9vShCiDBTayppFJlm0:v63Boc+wfZOOfffff7vShCQR7Pi9PjQ
TLSH
T1F5F2AEB1D8746A739DE2EB8577452B13BEE56123E5C44A48DEDC8B0D01836AE131BC3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 33de9731269f06f424e88a70a8a35f20180bd49da2ef62458e419530644c7d11
MD5 5dcfa0f5c5075da7c3d4efce9d99b35d
SHA1 724a15ac1874263ba0ad407e1efba19300bb961e
SHA512 d7d52b7b4db4d0955ea2ed431440d1c47a31f5bfbc3d66dfc9b3effeb168ef45d8b0c8b17945938841782f2dcd3e12884a646fc0561ed9322c9c4d7268de5b2a
SSDEEP 768:Irv+4UNbd53yoc+wfZOOfffffvvShCQR7Pi9PjT:Ibsbv3bwf9fnfnvSvPM
TLSH
T13D13BF71E8786A739DF29784B3467B13BFA46163D4C50A54DED84B0D02C35AE231BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e7fa27e9a7bfd9d5972a4514574be23c3ca8d34ae5de897874438b0bd8a6e54e
MD5 9c7efa8bb1df1f7e16d92aa751472368
SHA1 b166208802bc25b50b6d677fc1a3dd687c63936a
SHA512 7aa3329a67fa257d2489c7cd5be6a08f1631c52eb3db52941f07215272a77c4dc50e1edc33a649acaa1f5282264d1dbcade4e77cec0133042cb854e78b774502
SSDEEP 384:n2ZcI638NwOvvFYcTcHGfd+UJfRXOVyS5cffX8tgffXT+E9vShCiDBTayppFJlm0:k638oc+wfZOOfffff7vShCQR7Pi9PjQ
TLSH
T126F2AEB1D8746A739DE2AB8567452B13BFE56123E5C44A48DEDC8B0D01836AE131BC3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 3a324f98c9f0e6924e0d8e53a50925d7839cc6754eb7cd69ef1e9f12fefddccd
MD5 490b6d0a6a74e0259a66282733fca806
SHA1 cbcf30f6389e6a1ddbab2c6fcdbdeb28cedb0c0b
SHA512 c9004e2596186148c0501a3fe022f3563f7f30a871114ba133922b0931251d0e485392357b21c311e06b499fa02b688425395a7a75b07c79332f3c8191013989
SSDEEP 768:6FQp3vwg+sAtfZOOfffffMvShCQR7Pi9PjQ:hp3Yf9fnf0vSvPP
TLSH
T1E11329F198E79577E9AE5787673D2E02AEBDD123B5845584BBC84D0CCC821BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 4261ecac4253f0b9892f305a3ae11ea8b344dddd2e43b70cad7709fc2fda3993
MD5 735008538d1d841f3157c9276406104c
SHA1 618af20b1c20923468be15e7c06897c9be3bf85c
SHA512 ba6861108dea14c17c0bf7e68c46a0b592f4a15645cc2b48c9331fc8e79f89175ba42835ecfc1063103135515161ed15a6a30ae2b0b70967eae4a7ddb173cd84
SSDEEP 768:Frv+4UNbd43PCc+wfZOOfffffxvShCQs72bwWV:FbsbO3owf9fnf5vSM0wO
TLSH
T15C03BF71E87865739EE39648764ABB13BFB56163C4C54644DAD90F0D018369F231BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

05d8c4c2-9d19-4930-bbdb-67b79777f16b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\05d8c4c2-9d19-4930-bbdb-67b79777f16b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4944_1953260903\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1148-175-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1620-309-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2412-222-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2584-301-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3056-393-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3304-433-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3576-324-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4272-397-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4340-373-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4540-454-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4640-274-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4804-475-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4880-250-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5128-417-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5188-458-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5204-305-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5424-353-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5868-262-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6140-428-0x0000000000010000-0x0000000000083000-memory.dmp

Download