0ee3c9b0cd5bd9564a6ca16215b84480886c91916706770d34a80fc2deaf3bbe

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 12:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_e52d525fb615576b289fadedcf5bfc65_elex_rhadamanthys_stop.exe
Size 243KB
Sample260816-pvkn3sysax
SHA256 0ee3c9b0cd5bd9564a6ca16215b84480886c91916706770d34a80fc2deaf3bbe
MD5 e52d525fb615576b289fadedcf5bfc65
SHA1 df17731dc29139932730e85160fae10e88c80a71
SHA512 ca142198d2ea1e92bb9b57bcfdda61fb1245a5364fe21b30b4d55968665ae253c164c41e12fce38601d38627d47264954c0dcecee7ac108c9039611107ab7836
SSDEEP 3072:VCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:YvMsLaOa3lLNngoqRttA7b
TLSH
T13C345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1564	CP.exe
7028	bwuomhbzto.exe
1032	CP.exe
6892	CP.exe
6516	i_bwuomhbzto.exe
1132	mgezwrojhb.sys
4508	CP.exe
4316	bwromgeztr.exe
360	CP.exe
3448	CP.exe
2204	i_bwromgeztr.exe
2608	wtoljgbywq.sys
6608	CP.exe
5152	ztrljgbwto.exe
1548	CP.exe
4916	CP.exe
5820	i_ztrljgbwto.exe
4416	nljdbvtnlg.sys
2156	CP.exe
2756	qligbytqlg.exe
7080	CP.exe
4544	CP.exe
3960	i_qligbytqlg.exe
4456	wqnlidaysq.sys
7084	CP.exe
1072	qkifaysqli.exe
5148	CP.exe
6276	CP.exe
3652	i_qkifaysqli.exe
2064	qnigaxspni.sys
1552	CP.exe
6676	nidavsnlid.exe
916	CP.exe
4268	CP.exe
1608	i_nidavsnlid.exe
2664	icausnkfda.sys
6828	CP.exe
1384	fcausnkica.exe
6872	CP.exe
6064	CP.exe
6052	i_fcausnkica.exe
6104	cxusmkhczu.sys
2332	CP.exe
4572	ecxusmkhcz.exe
4956	CP.exe
5072	CP.exe
4872	i_ecxusmkhcz.exe
1332	hecwupmhec.sys
1636	CP.exe
5992	bzurmkeczu.exe
2632	CP.exe
3452	CP.exe
4876	i_bzurmkeczu.exe
3860	zurpmgecwu.sys
6976	CP.exe
2312	wrpjebzurm.exe
5008	CP.exe
1096	CP.exe
5184	i_wrpjebzurm.exe
4604	omgebwuomg.sys
1968	CP.exe
4952	ljhbzwqojg.exe
3260	CP.exe
6556	CP.exe

Loads dropped DLL 1 IoCs

pid	Process
5380	msedge.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5380_139432597\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5380_1175334613\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5380_6841665\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5380_6841665\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5380_139432597\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5380_1175334613\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5380_6841665\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5380_6841665\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5380_1305603829\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5380_1305603829\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qligbytqlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljhbzwqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqkidaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnicavsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkecxuspkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhezxromke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gebzwromge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qligbytqlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkifaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzurmkeczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrpjebzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigdytqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwuomhbzto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwromgeztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrljgbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nidavsnlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcausnkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecxusmkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzurmkeczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnicavsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkifaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nidavsnlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkecxuspkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gebzwromge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oljdbvtolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwromgeztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcausnkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eczupmhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eczupmhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oljdbvtolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljhbzwqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigdytqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlidyvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrpjebzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_e52d525fb615576b289fadedcf5bfc65_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwuomhbzto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrljgbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecxusmkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlidyvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqkidaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhezxromke.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
564	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2764	ipconfig.exe
1304	ipconfig.exe
248	ipconfig.exe
2856	ipconfig.exe
6496	ipconfig.exe
4556	ipconfig.exe
1976	ipconfig.exe
5716	ipconfig.exe
2288	ipconfig.exe
6524	ipconfig.exe
2640	ipconfig.exe
1580	ipconfig.exe
5480	ipconfig.exe
3096	ipconfig.exe
1572	ipconfig.exe
3520	ipconfig.exe
2088	ipconfig.exe
3740	ipconfig.exe
6732	ipconfig.exe
5172	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313575488335343"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{60E72B33-5947-4450-A44F-FD3AD5DA1B7A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1224	msedge.exe
1224	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	6516	i_bwuomhbzto.exe
Token: SeDebugPrivilege	2204	i_bwromgeztr.exe
Token: SeDebugPrivilege	5820	i_ztrljgbwto.exe
Token: SeDebugPrivilege	3960	i_qligbytqlg.exe
Token: SeDebugPrivilege	3652	i_qkifaysqli.exe
Token: SeDebugPrivilege	1608	i_nidavsnlid.exe
Token: SeDebugPrivilege	6052	i_fcausnkica.exe
Token: SeDebugPrivilege	4872	i_ecxusmkhcz.exe
Token: SeDebugPrivilege	4876	i_bzurmkeczu.exe
Token: SeDebugPrivilege	5184	i_wrpjebzurm.exe
Token: SeDebugPrivilege	6916	i_ljhbzwqojg.exe
Token: SeDebugPrivilege	704	i_oigdytqoig.exe
Token: SeDebugPrivilege	6416	i_nlidyvtnlf.exe
Token: SeDebugPrivilege	5980	i_vtqkidaysq.exe
Token: SeDebugPrivilege	5080	i_pnicavsqki.exe
Token: SeDebugPrivilege	5924	i_nkecxuspkh.exe
Token: SeDebugPrivilege	1868	i_eczupmhezx.exe
Token: SeDebugPrivilege	264	i_jhezxromke.exe
Token: SeDebugPrivilege	1736	i_gebzwromge.exe
Token: SeDebugPrivilege	4560	i_oljdbvtolj.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5380	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 4936	4360	2026-08-16_e52d525fb615576b289fadedcf5bfc65_elex_rhadamanthys_stop.exe	89
PID 4936 wrote to memory of 5380	4936	iexplore.exe	90
PID 5380 wrote to memory of 6628	5380	msedge.exe	91
PID 5380 wrote to memory of 4380	5380	msedge.exe	92
PID 5380 wrote to memory of 564	5380	msedge.exe	93
PID 5380 wrote to memory of 4380	5380	msedge.exe	92
PID 5380 wrote to memory of 4380	5380	msedge.exe	92
PID 5380 wrote to memory of 1792	5380	msedge.exe	94
PID 5380 wrote to memory of 1792	5380	msedge.exe	94
PID 5380 wrote to memory of 1116	5380	msedge.exe	96
PID 5380 wrote to memory of 1116	5380	msedge.exe	96
PID 5380 wrote to memory of 1116	5380	msedge.exe	96
PID 5380 wrote to memory of 3884	5380	msedge.exe	97
PID 5380 wrote to memory of 3884	5380	msedge.exe	97
PID 5380 wrote to memory of 3884	5380	msedge.exe	97
PID 5380 wrote to memory of 6388	5380	msedge.exe	98
PID 5380 wrote to memory of 6388	5380	msedge.exe	98
PID 5380 wrote to memory of 6388	5380	msedge.exe	98
PID 4360 wrote to memory of 1564	4360	2026-08-16_e52d525fb615576b289fadedcf5bfc65_elex_rhadamanthys_stop.exe	99
PID 5380 wrote to memory of 3480	5380	msedge.exe	101
PID 5380 wrote to memory of 3480	5380	msedge.exe	101
PID 5380 wrote to memory of 3480	5380	msedge.exe	101
PID 7028 wrote to memory of 1032	7028	bwuomhbzto.exe	103
PID 5380 wrote to memory of 6704	5380	msedge.exe	106
PID 5380 wrote to memory of 6332	5380	msedge.exe	107
PID 5380 wrote to memory of 6704	5380	msedge.exe	106
PID 5380 wrote to memory of 6332	5380	msedge.exe	107
PID 5380 wrote to memory of 364	5380	msedge.exe	109
PID 4360 wrote to memory of 6892	4360	2026-08-16_e52d525fb615576b289fadedcf5bfc65_elex_rhadamanthys_stop.exe	110
PID 4360 wrote to memory of 4508	4360	2026-08-16_e52d525fb615576b289fadedcf5bfc65_elex_rhadamanthys_stop.exe	116
PID 4316 wrote to memory of 360	4316	bwromgeztr.exe	118
PID 4360 wrote to memory of 3448	4360	2026-08-16_e52d525fb615576b289fadedcf5bfc65_elex_rhadamanthys_stop.exe	121
PID 4360 wrote to memory of 6608	4360	2026-08-16_e52d525fb615576b289fadedcf5bfc65_elex_rhadamanthys_stop.exe	125
PID 5152 wrote to memory of 1548	5152	ztrljgbwto.exe	127
PID 4360 wrote to memory of 4916	4360	2026-08-16_e52d525fb615576b289fadedcf5bfc65_elex_rhadamanthys_stop.exe	130
PID 4360 wrote to memory of 2156	4360	2026-08-16_e52d525fb615576b289fadedcf5bfc65_elex_rhadamanthys_stop.exe	134
PID 2756 wrote to memory of 7080	2756	qligbytqlg.exe	136
PID 4360 wrote to memory of 4544	4360	2026-08-16_e52d525fb615576b289fadedcf5bfc65_elex_rhadamanthys_stop.exe	139
PID 5380 wrote to memory of 1968	5380	msedge.exe	144
PID 5380 wrote to memory of 1164	5380	msedge.exe	145
PID 5380 wrote to memory of 2104	5380	msedge.exe	146
PID 4360 wrote to memory of 7084	4360	2026-08-16_e52d525fb615576b289fadedcf5bfc65_elex_rhadamanthys_stop.exe	147
PID 1072 wrote to memory of 5148	1072	qkifaysqli.exe	149
PID 4360 wrote to memory of 6276	4360	2026-08-16_e52d525fb615576b289fadedcf5bfc65_elex_rhadamanthys_stop.exe	152
PID 4360 wrote to memory of 1552	4360	2026-08-16_e52d525fb615576b289fadedcf5bfc65_elex_rhadamanthys_stop.exe	156
PID 6676 wrote to memory of 916	6676	nidavsnlid.exe	158
PID 4360 wrote to memory of 4268	4360	2026-08-16_e52d525fb615576b289fadedcf5bfc65_elex_rhadamanthys_stop.exe	161
PID 4360 wrote to memory of 6828	4360	2026-08-16_e52d525fb615576b289fadedcf5bfc65_elex_rhadamanthys_stop.exe	165
PID 1384 wrote to memory of 6872	1384	fcausnkica.exe	167
PID 4360 wrote to memory of 6064	4360	2026-08-16_e52d525fb615576b289fadedcf5bfc65_elex_rhadamanthys_stop.exe	170
PID 4360 wrote to memory of 2332	4360	2026-08-16_e52d525fb615576b289fadedcf5bfc65_elex_rhadamanthys_stop.exe	174
PID 4572 wrote to memory of 4956	4572	ecxusmkhcz.exe	176
PID 4360 wrote to memory of 5072	4360	2026-08-16_e52d525fb615576b289fadedcf5bfc65_elex_rhadamanthys_stop.exe	179
PID 5380 wrote to memory of 620	5380	msedge.exe	182
PID 5380 wrote to memory of 620	5380	msedge.exe	182
PID 4360 wrote to memory of 1636	4360	2026-08-16_e52d525fb615576b289fadedcf5bfc65_elex_rhadamanthys_stop.exe	186
PID 5992 wrote to memory of 2632	5992	bzurmkeczu.exe	188
PID 4360 wrote to memory of 3452	4360	2026-08-16_e52d525fb615576b289fadedcf5bfc65_elex_rhadamanthys_stop.exe	191
PID 4360 wrote to memory of 6976	4360	2026-08-16_e52d525fb615576b289fadedcf5bfc65_elex_rhadamanthys_stop.exe	195
PID 2312 wrote to memory of 5008	2312	wrpjebzurm.exe	197
PID 4360 wrote to memory of 1096	4360	2026-08-16_e52d525fb615576b289fadedcf5bfc65_elex_rhadamanthys_stop.exe	200
PID 5380 wrote to memory of 4340	5380	msedge.exe	202
PID 5380 wrote to memory of 4340	5380	msedge.exe	202
PID 4360 wrote to memory of 1968	4360	2026-08-16_e52d525fb615576b289fadedcf5bfc65_elex_rhadamanthys_stop.exe	205

C:\Users\Admin\AppData\Local\Temp\2026-08-16_e52d525fb615576b289fadedcf5bfc65_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_e52d525fb615576b289fadedcf5bfc65_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x35c,0x7ffc2000c188,0x7ffc2000c194,0x7ffc2000c1a0
      4⤵
      PID:6628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,4419551368380706068,5147088607936965715,262144 --field-trial-handle=2248,i,17916854126317650306,5871078087974363682,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
      4⤵
      PID:4380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,4867816709424203868,13728810536801171655,524288 --field-trial-handle=2248,i,17916854126317650306,5871078087974363682,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:11
      4⤵
      System Time Discovery
      PID:564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,5555550979129576805,7752741430664866258,524288 --field-trial-handle=2248,i,17916854126317650306,5871078087974363682,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:13
      4⤵
      PID:1792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,16639215352931036223,1080856989534655088,2097152 --field-trial-handle=2248,i,17916854126317650306,5871078087974363682,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:1116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,14534690170761974314,15242755026452975803,2097152 --field-trial-handle=2248,i,17916854126317650306,5871078087974363682,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:3884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5020,i,15241818047681761321,6110218408198516248,2097152 --field-trial-handle=2248,i,17916854126317650306,5871078087974363682,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:1
      4⤵
      PID:6388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3820,i,12439104623352809088,4949167880802770194,2097152 --field-trial-handle=2248,i,17916854126317650306,5871078087974363682,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:1
      4⤵
      PID:3480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,15129178609212019353,13456920776164725717,524288 --field-trial-handle=2248,i,17916854126317650306,5871078087974363682,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:14
      4⤵
      PID:6704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,7538791409876957851,15865282238256928628,524288 --field-trial-handle=2248,i,17916854126317650306,5871078087974363682,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:14
      4⤵
      PID:6332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,3585757232757301361,17775135670996535501,524288 --field-trial-handle=2248,i,17916854126317650306,5871078087974363682,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
      4⤵
      PID:5384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,3585757232757301361,17775135670996535501,524288 --field-trial-handle=2248,i,17916854126317650306,5871078087974363682,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
      4⤵
      PID:364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,808781005827270592,8004786367039242354,524288 --field-trial-handle=2248,i,17916854126317650306,5871078087974363682,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
      4⤵
      PID:1968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,14076284942811097746,15842657265366153536,524288 --field-trial-handle=2248,i,17916854126317650306,5871078087974363682,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
      4⤵
      PID:1164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,3971502146131979999,10686367986734651242,524288 --field-trial-handle=2248,i,17916854126317650306,5871078087974363682,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
      4⤵
      PID:2104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,10713643921366618745,12100191080132264563,524288 --field-trial-handle=2248,i,17916854126317650306,5871078087974363682,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
      4⤵
      PID:620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,4940024980445219995,5058621226951147231,524288 --field-trial-handle=2248,i,17916854126317650306,5871078087974363682,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:14
      4⤵
      PID:4340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,4084644278896881955,4340397163949567813,524288 --field-trial-handle=2248,i,17916854126317650306,5871078087974363682,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
      4⤵
      PID:476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,17161026549109498344,9735552790184529743,524288 --field-trial-handle=2248,i,17916854126317650306,5871078087974363682,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
      4⤵
      PID:1372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5896,i,4374560724073454036,2251173447771698747,262144 --field-trial-handle=2248,i,17916854126317650306,5871078087974363682,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1208,i,4130390024502577754,13858409809313242534,524288 --field-trial-handle=2248,i,17916854126317650306,5871078087974363682,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
      4⤵
      PID:2852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwuomhbzto.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1564
- - C:\Temp\bwuomhbzto.exe
    C:\Temp\bwuomhbzto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:7028
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1032
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwuomhbzto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6892
- - C:\Temp\i_bwuomhbzto.exe
    C:\Temp\i_bwuomhbzto.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwromgeztr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4508
- - C:\Temp\bwromgeztr.exe
    C:\Temp\bwromgeztr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4316
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:360
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3520
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwromgeztr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3448
- - C:\Temp\i_bwromgeztr.exe
    C:\Temp\i_bwromgeztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrljgbwto.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6608
- - C:\Temp\ztrljgbwto.exe
    C:\Temp\ztrljgbwto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5152
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1548
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrljgbwto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4916
- - C:\Temp\i_ztrljgbwto.exe
    C:\Temp\i_ztrljgbwto.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qligbytqlg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2156
- - C:\Temp\qligbytqlg.exe
    C:\Temp\qligbytqlg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2756
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:7080
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qligbytqlg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4544
- - C:\Temp\i_qligbytqlg.exe
    C:\Temp\i_qligbytqlg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkifaysqli.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:7084
- - C:\Temp\qkifaysqli.exe
    C:\Temp\qkifaysqli.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1072
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5148
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkifaysqli.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6276
- - C:\Temp\i_qkifaysqli.exe
    C:\Temp\i_qkifaysqli.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nidavsnlid.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1552
- - C:\Temp\nidavsnlid.exe
    C:\Temp\nidavsnlid.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6676
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:916
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nidavsnlid.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4268
- - C:\Temp\i_nidavsnlid.exe
    C:\Temp\i_nidavsnlid.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1608
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fcausnkica.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6828
- - C:\Temp\fcausnkica.exe
    C:\Temp\fcausnkica.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1384
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6872
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fcausnkica.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6064
- - C:\Temp\i_fcausnkica.exe
    C:\Temp\i_fcausnkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecxusmkhcz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2332
- - C:\Temp\ecxusmkhcz.exe
    C:\Temp\ecxusmkhcz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4572
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4956
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecxusmkhcz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5072
- - C:\Temp\i_ecxusmkhcz.exe
    C:\Temp\i_ecxusmkhcz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bzurmkeczu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1636
- - C:\Temp\bzurmkeczu.exe
    C:\Temp\bzurmkeczu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5992
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2632
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bzurmkeczu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3452
- - C:\Temp\i_bzurmkeczu.exe
    C:\Temp\i_bzurmkeczu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrpjebzurm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6976
- - C:\Temp\wrpjebzurm.exe
    C:\Temp\wrpjebzurm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2312
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5008
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrpjebzurm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1096
- - C:\Temp\i_wrpjebzurm.exe
    C:\Temp\i_wrpjebzurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljhbzwqojg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1968
- - C:\Temp\ljhbzwqojg.exe
    C:\Temp\ljhbzwqojg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4952
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3260
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljhbzwqojg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6556
- - C:\Temp\i_ljhbzwqojg.exe
    C:\Temp\i_ljhbzwqojg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigdytqoig.exe ups_run
  2⤵
  PID:5808
- - C:\Temp\oigdytqoig.exe
    C:\Temp\oigdytqoig.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4664
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5684
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigdytqoig.exe ups_ins
  2⤵
  PID:1620
- - C:\Temp\i_oigdytqoig.exe
    C:\Temp\i_oigdytqoig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlidyvtnlf.exe ups_run
  2⤵
  PID:4356
- - C:\Temp\nlidyvtnlf.exe
    C:\Temp\nlidyvtnlf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4652
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1484
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlidyvtnlf.exe ups_ins
  2⤵
  PID:4184
- - C:\Temp\i_nlidyvtnlf.exe
    C:\Temp\i_nlidyvtnlf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtqkidaysq.exe ups_run
  2⤵
  PID:5336
- - C:\Temp\vtqkidaysq.exe
    C:\Temp\vtqkidaysq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5492
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6492
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtqkidaysq.exe ups_ins
  2⤵
  PID:7104
- - C:\Temp\i_vtqkidaysq.exe
    C:\Temp\i_vtqkidaysq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnicavsqki.exe ups_run
  2⤵
  PID:6140
- - C:\Temp\pnicavsqki.exe
    C:\Temp\pnicavsqki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2608
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5016
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnicavsqki.exe ups_ins
  2⤵
  PID:5768
- - C:\Temp\i_pnicavsqki.exe
    C:\Temp\i_pnicavsqki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkecxuspkh.exe ups_run
  2⤵
  PID:1984
- - C:\Temp\nkecxuspkh.exe
    C:\Temp\nkecxuspkh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4756
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6896
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkecxuspkh.exe ups_ins
  2⤵
  PID:1904
- - C:\Temp\i_nkecxuspkh.exe
    C:\Temp\i_nkecxuspkh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eczupmhezx.exe ups_run
  2⤵
  PID:5188
- - C:\Temp\eczupmhezx.exe
    C:\Temp\eczupmhezx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3968
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6036
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3096
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eczupmhezx.exe ups_ins
  2⤵
  PID:4800
- - C:\Temp\i_eczupmhezx.exe
    C:\Temp\i_eczupmhezx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhezxromke.exe ups_run
  2⤵
  PID:7156
- - C:\Temp\jhezxromke.exe
    C:\Temp\jhezxromke.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6732
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3676
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhezxromke.exe ups_ins
  2⤵
  PID:4968
- - C:\Temp\i_jhezxromke.exe
    C:\Temp\i_jhezxromke.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gebzwromge.exe ups_run
  2⤵
  PID:2308
- - C:\Temp\gebzwromge.exe
    C:\Temp\gebzwromge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:976
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4404
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gebzwromge.exe ups_ins
  2⤵
  PID:6280
- - C:\Temp\i_gebzwromge.exe
    C:\Temp\i_gebzwromge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oljdbvtolj.exe ups_run
  2⤵
  PID:2068
- - C:\Temp\oljdbvtolj.exe
    C:\Temp\oljdbvtolj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4232
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2520
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oljdbvtolj.exe ups_ins
  2⤵
  PID:1444
- - C:\Temp\i_oljdbvtolj.exe
    C:\Temp\i_oljdbvtolj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4560

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:976

C:\Temp\mgezwrojhb.sys
C:\Temp\mgezwrojhb.sys
1⤵
- Executes dropped EXE
PID:1132

C:\Temp\wtoljgbywq.sys
C:\Temp\wtoljgbywq.sys
1⤵
- Executes dropped EXE
PID:2608

C:\Temp\nljdbvtnlg.sys
C:\Temp\nljdbvtnlg.sys
1⤵
- Executes dropped EXE
PID:4416

C:\Temp\wqnlidaysq.sys
C:\Temp\wqnlidaysq.sys
1⤵
- Executes dropped EXE
PID:4456

C:\Temp\qnigaxspni.sys
C:\Temp\qnigaxspni.sys
1⤵
- Executes dropped EXE
PID:2064

C:\Temp\icausnkfda.sys
C:\Temp\icausnkfda.sys
1⤵
- Executes dropped EXE
PID:2664

C:\Temp\cxusmkhczu.sys
C:\Temp\cxusmkhczu.sys
1⤵
- Executes dropped EXE
PID:6104

C:\Temp\hecwupmhec.sys
C:\Temp\hecwupmhec.sys
1⤵
- Executes dropped EXE
PID:1332

C:\Temp\zurpmgecwu.sys
C:\Temp\zurpmgecwu.sys
1⤵
- Executes dropped EXE
PID:3860

C:\Temp\omgebwuomg.sys
C:\Temp\omgebwuomg.sys
1⤵
- Executes dropped EXE
PID:4604

C:\Temp\gdbvtrlige.sys
C:\Temp\gdbvtrlige.sys
1⤵
PID:2676

C:\Temp\ytqoigaytq.sys
C:\Temp\ytqoigaytq.sys
1⤵
PID:4164

C:\Temp\vqnifdaysq.sys
C:\Temp\vqnifdaysq.sys
1⤵
PID:6816

C:\Temp\sqnifaxsqk.sys
C:\Temp\sqnifaxsqk.sys
1⤵
PID:3164

C:\Temp\mkicaxspkh.sys
C:\Temp\mkicaxspkh.sys
1⤵
PID:7056

C:\Temp\spkhcauspk.sys
C:\Temp\spkhcauspk.sys
1⤵
PID:5884

C:\Temp\jhfzxrpjhb.sys
C:\Temp\jhfzxrpjhb.sys
1⤵
PID:4744

C:\Temp\jgezwromjh.sys
C:\Temp\jgezwromjh.sys
1⤵
PID:6940

C:\Temp\ljgbytrljg.sys
C:\Temp\ljgbytrljg.sys
1⤵
PID:240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwromgeztr.exe

Path C:\Temp\bwromgeztr.exe
Size 243KB
SHA256 4840ce59b9b3c82448774325a0292aabaf262496a6518f299ed85c36df983aff
MD5 7847219723504dd51e5deecf4d96abac
SHA1 f7f07f22a5dc9e1f7abdb6b924a936b9f7ba7ddc
SHA512 fff2cc8a6a6c558e16ca6c545e4280b410c6e32f6f1e7d423ad0952ed9afb209e08eb977049ad3b8d657f5086b5c9d3355ec97745334107cc6753b2d471c52c4
SSDEEP 3072:XCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7J:yvMsLaOa3lLNngoqRttA7J
TLSH
T149345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwuomhbzto.exe

Path C:\Temp\bwuomhbzto.exe
Size 243KB
SHA256 801e3c78e1ce0f7ac08eaf534c816e0e5a8965e62efdce9973ab5ce5372c7243
MD5 40903207e17ae25e1d1aa71bc9fcde8c
SHA1 9248ffab63420d8025071a95c3076b7486e315ad
SHA512 c9ab736ba074819ab9c404e60c84ebe7b9e09987775ae837d52efd1074d398bafa9ff79df7eb04d57d2da5539f9876db3cf6b408ef8220546fe24c50f663f517
SSDEEP 3072:HCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7F:ivMsLaOa3lLNngoqRttA7F
TLSH
T136345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcausnkica.exe

Path C:\Temp\fcausnkica.exe
Size 243KB
SHA256 9727d22272bd692e1a171e38f836b28488ac1649c63b899d1a2fffe564905179
MD5 9ae71d92fc69adf98b2b94473978653f
SHA1 37d53a7829e22203f5c9cd058e176f21df6f93d0
SHA512 92297ac82202f07cac9d9299ccee65952442bfbd3d555fc4f31749764003b4518c87e830d4573de3953a2cf04ac96fee8a1099ea6d92d642f6db098a5473eb5f
SSDEEP 3072:ICvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA76:zvMsLaOa3lLNngoqRttA76
TLSH
T169345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bwromgeztr.exe

Path C:\Temp\i_bwromgeztr.exe
Size 243KB
SHA256 b3a1435a3db5d1e71624fd91c5ed164533d862ae38c56ba361b56c62163e696c
MD5 f152fb8101982d6ca424dd8d0fcf0cc0
SHA1 4106749b7958fa10b347e26e178795b042f337a7
SHA512 a5dbec98abe6649065d546f31453b5dad19152328ff584697ce76b09b31968b9e934f2bf88fad829d40d5be3573d030d2a66cdeac9046566ba9c3c7ab1fa37e9
SSDEEP 3072:1CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7n:4vMsLaOa3lLNngoqRttA7n
TLSH
T181345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bwuomhbzto.exe

Path C:\Temp\i_bwuomhbzto.exe
Size 243KB
SHA256 adc7199cd2d089eef96768d71e95f44bb930d7e7bd0b20daa253ba7c5b4f7dee
MD5 dfa228486b9b1e752500bea881fedbbf
SHA1 d083245fe1ffa6017a02f8cbf064db28225697cc
SHA512 ae01552bc9a5cad5ee674a95afd239354f85b5f416ba27c5205040f423ea77706332ef07dab0876ec5ba493a90ea27448b5f55a9472e6375d03e3bdf602d5399
SSDEEP 3072:0CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7q:HvMsLaOa3lLNngoqRttA7q
TLSH
T12B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nidavsnlid.exe

Path C:\Temp\i_nidavsnlid.exe
Size 243KB
SHA256 07ad5d1a03f9757559642b009e99ba2ec8e60991786a16a1e0225669ff83bd83
MD5 6c5e56850fe8afb44d7d6704da60549c
SHA1 70061282abc2724d8e1b83bca2ad2b9f0b1388f0
SHA512 5d27287eda6d095d4a462a0e6dd81857b441407d594682e0319d32d36d61d96339f2e17c9bf350ad5ed3605dfa7edf988df85dff4c5d84a2ed446462a59f2f43
SSDEEP 3072:nCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:CvMsLaOa3lLNngoqRttA71
TLSH
T1A0345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qkifaysqli.exe

Path C:\Temp\i_qkifaysqli.exe
Size 243KB
SHA256 7cb13aaf59f2a2139ea1bb82c3bdebb19ad54e94b106211ede3ad8ed8b1dd72a
MD5 41a37c9f1b68067bc46d7a22f02b6603
SHA1 aa7a70d897329fd2dc035437cbbedffc440cc6c0
SHA512 49ddc9e2569653aa175543dd55174b6ada71624bf74f21af82c32a0effa8f7d0d3f2ce4d80a574c237f1ed0d7f5564fa7c0cce3017c034b638f4746f14b566be
SSDEEP 3072:1CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7r:4vMsLaOa3lLNngoqRttA7r
TLSH
T177345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qligbytqlg.exe

Path C:\Temp\i_qligbytqlg.exe
Size 243KB
SHA256 0da0291519e403872978f22c825625ed0f68ca5c0110be4a56dcbef379500ade
MD5 59d475ac846d839d8072a2320703e316
SHA1 5288c4ecd2e126988cbe00a458289760b142972c
SHA512 a39d65fc9b23752dfaaa619c8590134c11b9faab000fe254c6f408e7bfc4044d06f3f941d93fe42980ab23f618704a89edeab6fb7e746e990444fbe39634e962
SSDEEP 3072:PCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7p:avMsLaOa3lLNngoqRttA7p
TLSH
T1D2345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ztrljgbwto.exe

Path C:\Temp\i_ztrljgbwto.exe
Size 243KB
SHA256 57acd2203c27cac2093945e79ba3fa0544bde315cda38c1d60dfd2872fba81a6
MD5 3e534b021cc6fe0792b54152ca6e3e4c
SHA1 a0c9ed2c4479fafef828b05ae0c63481416d7fc9
SHA512 d229777d41f0aa83fce43a685968a433361c6c45a4ee7d4de3e8600c9989d29bc3fa53904c65afb006d55bb06229f0f72a98c3cb2ac6d27cecc6ee32159dff6a
SSDEEP 3072:xCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7L:MvMsLaOa3lLNngoqRttA7L
TLSH
T10F345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icausnkfda.sys

Path C:\Temp\icausnkfda.sys
Size 141KB
SHA256 a8056e87fd8bf0be8232938316309bf166da00c13ec60aca080a8fd939b14fc5
MD5 33ef10630b5864f83dbdf64bf1f41bc8
SHA1 7b37106b0b121328421d087e95dbffc3160183d9
SHA512 979df4facd757ccc6d48b05b20d4f69fe938066a574e2bc02a24dd4d2b9f80ce12a45a1319a063e1cfaa1e0c0170dee534c9e4c92c61d7ea29750562052dc60e
SSDEEP 1536:fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D7E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgezwrojhb.sys

Path C:\Temp\mgezwrojhb.sys
Size 141KB
SHA256 864a61ac885905e29605ad2674b319e6157edc44c561c1493d9ffdbc2eaee2ee
MD5 a887e4c8a2b6180814cf13cd78d5ad09
SHA1 d274b70fd187cd74cd33bcef4651fc16ac3309ec
SHA512 0454f2ac73ffd0a56b7250e6f69736e065a3e16037b7ee2d14d982b2f43003af402688b8ed385711ea242b142ab97aafec9d5ef2d5867105eea5da738e5de209
SSDEEP 3072:ga3rV3dZPFvOAngoRUAFa1nxayHdXkbL:ga3lLNngoqRt
TLSH
T154E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nidavsnlid.exe

Path C:\Temp\nidavsnlid.exe
Size 243KB
SHA256 4faf325b03f3a5ab960f68c28736be63654d34446bfe4fff215bfd8f145503b0
MD5 7b7f62edc88ddd9dff75f385ede22787
SHA1 0ce992a6958aee9ebbf26e70ff5baeea3fbd3975
SHA512 e4202ab0d3bca7cabc028340cf4a7651894c4b5232d85837c0a93952e71ebb678514ade71c13e6b96a5cee6ba0712db79f62f0d72a1e32745e4a28ee7fb0c664
SSDEEP 3072:rCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7t:evMsLaOa3lLNngoqRttA7t
TLSH
T172345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nljdbvtnlg.sys

Path C:\Temp\nljdbvtnlg.sys
Size 141KB
SHA256 a8dc3b625821f45759ae376d290c40ee93d8909ab09ef788812f793b39eaca1d
MD5 5f4327846a806edb146fc98eb4026d6a
SHA1 664f4e4fbce9049b90ba2eb8dfb69924fb473f8c
SHA512 cdc929e41b7b0b7875c2a4fac91d23041a7190baa3fe0798cbaaad1a7d49f477a41e3facc2299624d7959f9d54efd527e9a4debd25e50261a7f945831822b875
SSDEEP 1536:Va3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXlt7:Va3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T111E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkifaysqli.exe

Path C:\Temp\qkifaysqli.exe
Size 243KB
SHA256 3883f85ec81edc2db69e57c8ae15ab1424a6a6a195f5e2bdc1c5ea6b31084402
MD5 16bf23667946663ddab44280e1675091
SHA1 3be878f79aeaf97c71ed8c17c23dfb5a3671e739
SHA512 047637ae25b69eac656bb42c28261a588c15918f9a84fb73fcbd2dde378799dfbe2f87302677737b37ea99a9b9ffe7d1039ba518e15a3eb3315949f921392919
SSDEEP 3072:2CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:ZvMsLaOa3lLNngoqRttA7Y
TLSH
T1FD345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qligbytqlg.exe

Path C:\Temp\qligbytqlg.exe
Size 243KB
SHA256 82fcdf8cddf302c99ffe0d16caa14b6348c5213c5432bec307b72a8fd27d11b2
MD5 87f90b52af272642a4ebf8969217aa50
SHA1 4a61b66fda58ccc535a54d16181ea7df1c5169a6
SHA512 e82b7cca70e52c43b03482ae81fc3ed442969e440c9dd9183f6826d16b2c0003adb50724cb019c8a611e13d1a72e9bc27a912aeb06d6c3f05327af2e56fd678a
SSDEEP 3072:ZCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:EvMsLaOa3lLNngoqRttA7b
TLSH
T12D345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnigaxspni.sys

Path C:\Temp\qnigaxspni.sys
Size 141KB
SHA256 8c5abad563e785f798e7a3e4c477cdf6dad3f5ace8b592b0dfb63d5c925f9994
MD5 66913339a97225cb3b906b66e18d53b1
SHA1 26a3df358b445b4980285b58004b3c93323f0a38
SHA512 6e6e2c43921e2a73f78b318a99839ee4af59129c14ffbb71b64b44327425c75514675d1f215792e35154a4512b5e40b75227c16a92ca9dcb26b9e92aa76c84d5
SSDEEP 1536:wa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:wa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T193E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqnlidaysq.sys

Path C:\Temp\wqnlidaysq.sys
Size 141KB
SHA256 7a2f5d4bcabae614ae209d8f872ae5e3631f4914d60a91318dfb161c992e6414
MD5 e6d4c951ba0ff1a0e6f75f7470860fbc
SHA1 2b58d521672f101510061cab4ef9c677928142e5
SHA512 da619d0f78e43aa9000577ac393762813e8fbe86e0c6002938917f98ac92dd042cc6f0b20d7bd9b8a529b2bcdb2c7cfad221f9ce58d454e9ae349512b225ef00
SSDEEP 1536:Xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1AAE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtoljgbywq.sys

Path C:\Temp\wtoljgbywq.sys
Size 141KB
SHA256 583c8ff8082e96afefb1a7311466449c58d18fb678615e2faf530704daaaa41d
MD5 c982a0073a52a6629c525752b67dc9ad
SHA1 ad4d18a4cf0ef379c43ee13c2d349121cd31652b
SHA512 65715481833354e57ec181d211c45a003c4fb9d87949a06417b6e870a31a66ac9e97c84b521438e2436e75e81ad74dc6bb4668d81a59312e5a1ed5d21d9147c0
SSDEEP 1536:Xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T111E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljgbwto.exe

Path C:\Temp\ztrljgbwto.exe
Size 243KB
SHA256 8b127d637441b0d1f19001c911df9b28699ea8a4aa2e3ab7f0560b094f997659
MD5 d3bd6710ecb53175103cfa4d4f7e1d74
SHA1 847eabfcee76b024ab105ce8f3144dd90052d1e8
SHA512 cb30809531861298224d04b6e2af416a824a0559b90da0dc6811a543e89eeb43d2cbb6bb2c9caf1a5b398de9e328b573a937789ce99798fec6f6e581e919abe3
SSDEEP 3072:lCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA73:ovMsLaOa3lLNngoqRttA73
TLSH
T1F5345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 27d9a9d0ec287bc50353cb4155848e7267d7b07da3d089bb959f89d6f9284138
MD5 774b37e2876e7df9301289575d7abd3f
SHA1 885b90721816479238cf87a2f391207106eae9db
SHA512 6bb735856bccc0a59c464a57fd4976ee7c7111ab62685a5dfc9696b68d1d0b3be9efaa409de721a421d6988224998005bfbd8ae23dbaf621f98bbbb8be761acd
TLSH
T167E0E555C920B82729F81B1C6155464BEB50135B3A50994F3A3C916C4FB06374786C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 066d78b2afdc33b21063eb7040fa230d7f9f81762db49ac539864002417f62c9
MD5 626f8258612087e3b6a1d3141e4cbe20
SHA1 7f6c7d4afcbcf5736490e5e078645dcc923fc84c
SHA512 013b13de978df25429b9d2acde01adb7454a7acdb168a28d5c204797bbc09e2b547ca75cd270d6a31a7e17ef2de5a7136390b500ed67d073e6049b37e52834dc
TLSH
T13741BFF783F4856ECA1195F0AA18BE2FCE2D0515432C7D9AC9E0AE2793E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 29ecba0b1b1ffac8a9c0eb2935d7ba42cedd68a438389e30acf9f39ace63ee4c
MD5 0eb18f5965e7afcba69a48bed4446398
SHA1 2a9de10298b256a50352f612f6a0e2ea56a27702
SHA512 cb966b08a73d154e76e49134a3f1327a04f592528753f69bbc0a433a34e5a701aa2845511ed745230f9f30229719ae0b8c9038ba560c27544eb3a74c1e1bafe1
SSDEEP 384:sxRM28W/fZmsXlzN/RIdqd/5d/W00sGQYojs:so7W/fZJfWC/5hW00sGQYt
TLSH
T15572E715AA289D7B9CDBD309FA557F93D3F81163A1945E44AAFC8A0C04E66ED2103C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 76b1607e361832c59fe01d7eeb135e75cd95378932db4e004002032fbad50a99
MD5 7e3739e5dd47b1192e5cd8e0582c7e72
SHA1 b4d266affe766f64c819b290f37fd0e8a3c5506e
SHA512 fd2579ffa59eb16669d64d6ca3732c62c8a2bdf93c314eb302b4d0f7c6b819fa1ebc8077cbb3c609c7247c84c5216666d93a6963abc18321bd41ed6968185634
SSDEEP 384:sxRM2q/W/fZms9lkN/RIdqd/5d/W0hqsGQYoUA:soZ/W/fZXcWC/5hW0hqsGQYc
TLSH
T17172F815AA349D779CDBE609FA557F93D3F82173A1941E44AAFC9A0C00E66ED2103C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 79b61325c40edce613bda42feed2d5ffb60939a7d78b8001ffd6de1db3ec5578
MD5 1aef7b0ccc9b456a3d486041679d0b25
SHA1 6c6001259e3f31394e626fe859f605ebc02b444a
SHA512 12cedee28571f7cb5ec9bfaad10599fe938dc8c74e3b7cce9cd6147716864e6874bec609aa6f25c4e9b890b5acc6d16227be4517f7b4cf510d1f1a9a1de242a7
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVnobbDwzroO140:Ob4YZnE7yTWg1NfwBu1jakobHwAOq0
TLSH
T13CE2FB3B280CCB7E4F804ADDEC29BD9A6DA801CF56D8C95447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 dc25500285ffdadba0ad6bd086abcdf3d7c0854d6171ad01c00fdfa34b1727a4
MD5 072fdb135f55e0c091b5c2e0c085cd97
SHA1 0515c5956e5261496d76526c17a8aedb9f0f8e28
SHA512 62f082d0123af18d77f21ae0d92d127584468ba6ecd338ae81aaf21d34aa0e20cc70a202306d13b96785d1b27852beb135e2372f2387bb8956a1fc7af5b4b2bb
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9EExiWESiNG/SOoQBUHMU3eipvIE:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDR3
TLSH
T115B25F51713F4680387EB90C81B8982F96C2B4637519E53F7B6802A65F67E039DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 6392e9a25ea196695f00662f5f6d61ee3dd15162fff57bf50d7ea7dee0a67687
MD5 9fe70b7d6c4b94716c16af4d15ce7424
SHA1 9351fcedbf0215901967927b75978aeac225e1fc
SHA512 05e827adeae7336d68bc608125692992af2c96a78f2575e97f6f34ea50908ff38e95a074eaae10c803625e834bcf530a1952955abd90a4caa0a24ab385677ca7
SSDEEP 384:nNiF1tNn/s3n9Sn8NgO8TUNTUlIRiPvuTuhREqf+GGECXcMsLEOObjI9G6w7m98M:EF1j+9SXOwgUuAZGEPhE29Mm
TLSH
T187C25A36E865CEB7EDE64FE9B74A7A46EEE0516785DC59C8DAD85E0C00C31AD0303C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 cf0b3d463d3deb73874ea3183a7415d1b654361aea18eb9bf13c5cdbcc7e25ec
MD5 99ce2a91776937384481929044ff3a55
SHA1 f066e4ed60980766643a052fe988092fbfbf8e28
SHA512 2f50f68808f36984a896b12c495c0edf68717010d68295287e32c3aa1ee400c05a2e0757f118fdd35cf97e37f5323c1975ef166e09553828449b5787b575e09a
SSDEEP 384:nrLiFiZcIz8NLE8TUNTUlIR1PvuTzOeEqf+GGECXcMlZA4m4OOPrXLpe8C/4BO8C:rmFQzQEwg7u2aGEPP4Oi9Pbw
TLSH
T12ED24B31E8A4CDA7ECEB9FD5A6497642DEF45163D8CC9AD4DAD89E0C00C719E070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 fc979c2c7ba27a9ea06dbc00ecf290ecac019b2c339bc094b3e060e286ae6376
MD5 1d15ccbe54dabb43a68ae68a769ffeb3
SHA1 fd452b4ed1c41d42bec7b6cfac3a310501b67f13
SHA512 7aefdd31ba5d361aeb05354935080136f96260543b89f6d1f3d58abbf4b9c1c9b6ff7de54262e5725c15f596d8e8c573015804a551f61a2b33426255f51d903f
SSDEEP 384:noiF1tNn/s3n9Sn8NgE8TUNTUlIRiPvuTDqeEqf+GGECXcMlZA4k4OObjI9G6w7m:zF1j+9SXEwgUuyaGEPn429Mm
TLSH
T15BC24B36E855CE77EDE74FE9B64A3686EEE051A788CC5AC4EAC85E4C00C719D070781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 5a62ab22747c9ad94743d31a683bccca9596fd67733b45ba58dcb95f8446e3a9
MD5 ed1eee383b31fac5ff4d1fb5a6d51ffc
SHA1 b8e7080d57aeae4c04cb56f2ff69fad4baf9343d
SHA512 65baae6751c9d24572057efcdaeb4e4f8c516d3ba37865e4dd70c43718a5fe43a0043fddb7b2e4a825e7e6d00bf405afd2471053534cdb08a00e58f148c0e56d
SSDEEP 384:n2LiFiZcIz8NLE8TUNTUlIR1PvuTzOeEqf+GGECXcMlZA4m4OOPrXLpe8C/4BO8C:2mFQzQEwg7u2aGEPP4Oi9Pbw
TLSH
T171D24B31E8A4CDA7ECEA9FD5A6497642DEF45163D8CC9AD4DAD89E0C00C719E070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 7e215bac0bac2c562a913d9bdb5e31a8292e7f1c0dd4689bce082df5b6c2ab6a
MD5 e856f6b16c5e5b79d4ac65774df36375
SHA1 da5413ea9b53c7061d60ab88c2ed33efd1f87035
SHA512 cf83f9be14a8bc10707e57da4d3c196bdf7ddf0f9b4d2b773d55b7b0c6fd78057737a648796bff294205f3d384695556577efd80f380cf854b5982ba4a088f8a
SSDEEP 384:n2LiF1tNn/s3n9Sp8NLE8TUNTUlIR1PvuTzOeEqf+GGECXcMlZA4m4348LEEIzSM:2mF1j+9AQEwg7u2aGEPP43o
TLSH
T17FB23A32EC95CD77ECE64BD9B74A7682DEE051A388CC9AD8DAD85D4C00C729D070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 fe1e77817dfce144a0b1e045d8a84e9a71738c2fc4cb39e12759a864284cd37d
MD5 58c4ac349bdb964e6079e45e6c7b20c5
SHA1 b6d365650b32fdbc0a0a5ef32212428905254dfd
SHA512 279fe65b07e73eafadb06ab18b82e13f32b4841c5867cce646ab1cd0916999cd3a68ddd9345699f8b3856153dab3056147565e6c370e053bcffa5b11b14e94fd
SSDEEP 384:nrViFiZcIk8NLE8TUNTUlIR1PvuTzveEqf+GGECXcMlZAje4OOPrXLpe8C/4BO8C:rcFQkQEwg7uXaGEPQ4Oi9Pbw
TLSH
T125E2C3F198D78977E8AE5B97677D2E429AFCD163B4884984B7C84D0CCC821BFC706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 17d7b0dcac2d20112db1f6fe04c4a946828d0ec4a53d1da5ff39d525ca565ec3
MD5 d748eda12748f82e0651fc8a8a940327
SHA1 272fbf2f9036535341f389af7b9d7454af923654
SHA512 438edad34791b701756d6dbe0bf5ee09c309788d5a2e9382f9977fb69ac9f71b1bf0ee4c031f0c7f47a22fa93276e41b9da616c51d87cc7f6991ceca4d03dd58
TLSH
T10D412FE04C392AD1D0FD0E7EB58739FC94ECD726F8A434786898E95855BA21E258083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 462d7e808963e2604c30ade17e2177d755e533a3d5aafcfbd2a338e44dc14cbc
MD5 4f68dd1a44247528a0d6d45f87ce7cac
SHA1 915377a893f8c5ecd5719a8c912769fc0dcc13d7
SHA512 a6b09d5a431c47f0a1fa3a5c33b691431b8ae6599019bd7234d89ea7c4b0db1b23099541e7816a87f856c0237ad1af9b703afe90f4f88c203704e09c67a9d5bd
TLSH
T1724163D04C391AC1D4BD0E6FB45B29FC94ECD726F490347C2858EA98567E65E314083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c588967d7a6416eedcbfa0801806f5137d43ab27f0332710af7b137709088910
MD5 6e4314d23ac9bbe9614361c4c2dc5d04
SHA1 3d7404c1699514585b6dcc32e43886e2a93d28ea
SHA512 af0923e802a16a8e4c7cfa65f5b3bd606658c9a17b58f76112dfce332c51c30cbbf0cb82d3a89400a309a27650a73dc340968b7acd8923e05fb0a69e3101d43c
TLSH
T1D04120D04C392AD1D4BD0E3EB45729FC94EC9726F89434386859EA58967E60D355083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a3278f957234771d848a4b3ee9901aeec341d2434b924c995300d2e0713b1b7b
MD5 893e4b2373eda936d6ab8fb4a1e8c47b
SHA1 5dfe17ef2f135c6fe6fcf58b53b0628e776e1f54
SHA512 1a716a864fce6b95f1feb9176544c1cf943db5897e41d0030e0c9ace03815ee6a21880b6a9211f32946768874b0c281da0606c7d4c602fd416ce3f6e05c06a5e
TLSH
T119412FE04C391AD1D4BE0E6EB45729FC94EC9726F89434382858EA98967A65E358083F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/240-430-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1132-146-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1332-273-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2064-227-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2608-181-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2664-263-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2676-313-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3164-369-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3860-277-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4164-345-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4416-201-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4456-213-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4604-301-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4604-328-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4744-406-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4744-427-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5884-384-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6104-269-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6816-357-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6940-418-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/7056-380-0x0000000000010000-0x0000000000083000-memory.dmp

Download