b5ea1b5bb8f73d965ee9348ee77d195272bd341ca3992777322e0fc9c364bee1

Analysis

max time kernel
149s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 12:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_e42d6a7c7ced777a29c99c6659f41a82_elex_rhadamanthys_stop.exe
Size 243KB
Sample260816-pvw24syscs
SHA256 b5ea1b5bb8f73d965ee9348ee77d195272bd341ca3992777322e0fc9c364bee1
MD5 e42d6a7c7ced777a29c99c6659f41a82
SHA1 2eb7f168f417c3a9fab0b776ee7eea127bf6718a
SHA512 7e9e4be01c85544e597df80db52a27e01f976cd173a0193ed89ef1af0cb879b52b4066a1b84817e7bbc1bd520943c27eed6f601a984085d26eab5a64822ac70c
SSDEEP 3072:SCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Q:NvMsLaOa3lLNngoqRttA7Q
TLSH
T171345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
636	CP.exe
3220	ausnhezxrp.exe
5812	CP.exe
2536	CP.exe
5968	i_ausnhezxrp.exe
2416	keczurpjec.sys
3608	CP.exe
4224	eczxrpjhcw.exe
4768	CP.exe
4252	CP.exe
1312	i_eczxrpjhcw.exe
3116	zwuomhbztr.sys
4448	CP.exe
2980	rmjhebwtrm.exe
5292	CP.exe
1996	CP.exe
3108	i_rmjhebwtrm.exe
1968	zwrojebwuo.sys
3780	CP.exe
2972	mgeywqojgb.exe
3356	CP.exe
3480	CP.exe
1844	i_mgeywqojgb.exe
2148	rljdbywqoj.sys
3764	CP.exe
2508	ojgbvtolge.exe
4528	CP.exe
5660	CP.exe
5896	i_ojgbvtolge.exe
2456	dyvtolgdys.sys
5280	CP.exe
5784	yvqoigayvq.exe
1740	CP.exe
4724	CP.exe
3352	i_yvqoigayvq.exe
2416	kigavtnlfd.sys
1480	CP.exe
5944	davtnlicay.exe
3452	CP.exe
1452	CP.exe
1280	i_davtnlicay.exe
2520	kidaysnlid.sys
5228	CP.exe
2148	daupnkfaxs.exe
5080	CP.exe
796	CP.exe
1616	i_daupnkfaxs.exe
3008	icausqkica.sys
4492	CP.exe
1988	avpnhfzxsp.exe
5104	CP.exe
4660	CP.exe
2568	i_avpnhfzxsp.exe
6108	upmkecxusm.sys
5848	CP.exe
2008	pmkfcxupmh.exe
784	CP.exe
1152	CP.exe
5576	i_pmkfcxupmh.exe
3296	omhezwuojh.sys
3692	CP.exe
1488	jhezwrpjeb.exe
1448	CP.exe
6008	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_678246358\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_678246358\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_2131857535\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_768031873\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_768031873\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_482727097\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_2131857535\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_768031873\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_768031873\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnifzxvsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spnhfzxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhezwrpjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljebzwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztomjeywto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnkfdxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omhezxromh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_e42d6a7c7ced777a29c99c6659f41a82_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausnhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eczxrpjhcw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmkfcxupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqnifda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpmgeywtrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davtnlicay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eczxrpjhcw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjhebwtrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_daupnkfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avpnhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljebzwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spnhfzxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqoigayvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztomjeywto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eyvtnlgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnkfdxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpmgeywtrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqoigayvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avpnhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhezwrpjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omhezxromh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjhebwtrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgbvtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgbvtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daupnkfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eyvtnlgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqnifda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnifzxvsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausnhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davtnlicay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmkfcxupmh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5540	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1152	ipconfig.exe
4960	ipconfig.exe
2496	ipconfig.exe
3144	ipconfig.exe
5056	ipconfig.exe
5052	ipconfig.exe
1988	ipconfig.exe
5112	ipconfig.exe
1852	ipconfig.exe
4188	ipconfig.exe
4888	ipconfig.exe
5572	ipconfig.exe
2500	ipconfig.exe
3304	ipconfig.exe
2312	ipconfig.exe
5904	ipconfig.exe
2496	ipconfig.exe
5912	ipconfig.exe
5284	ipconfig.exe
4908	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313575817450070"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{D8431899-062F-4B3F-B1A8-798B3EE753B1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3204	msedge.exe
3204	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5968	i_ausnhezxrp.exe
Token: SeDebugPrivilege	1312	i_eczxrpjhcw.exe
Token: SeDebugPrivilege	3108	i_rmjhebwtrm.exe
Token: SeDebugPrivilege	1844	i_mgeywqojgb.exe
Token: SeDebugPrivilege	5896	i_ojgbvtolge.exe
Token: SeDebugPrivilege	3352	i_yvqoigayvq.exe
Token: SeDebugPrivilege	1280	i_davtnlicay.exe
Token: SeDebugPrivilege	1616	i_daupnkfaxs.exe
Token: SeDebugPrivilege	2568	i_avpnhfzxsp.exe
Token: SeDebugPrivilege	5576	i_pmkfcxupmh.exe
Token: SeDebugPrivilege	5948	i_jhezwrpjeb.exe
Token: SeDebugPrivilege	1580	i_rljebzwuom.exe
Token: SeDebugPrivilege	3368	i_ztomjeywto.exe
Token: SeDebugPrivilege	5112	i_eyvtnlgdyw.exe
Token: SeDebugPrivilege	5524	i_gaysqnifda.exe
Token: SeDebugPrivilege	6024	i_vpnkfdxsqk.exe
Token: SeDebugPrivilege	3324	i_pnifzxvsqk.exe
Token: SeDebugPrivilege	236	i_spnhfzxupn.exe
Token: SeDebugPrivilege	4544	i_omhezxromh.exe
Token: SeDebugPrivilege	948	i_rpmgeywtrp.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4100	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 2524	4884	2026-08-16_e42d6a7c7ced777a29c99c6659f41a82_elex_rhadamanthys_stop.exe	89
PID 2524 wrote to memory of 4100	2524	iexplore.exe	90
PID 4100 wrote to memory of 1568	4100	msedge.exe	91
PID 4100 wrote to memory of 680	4100	msedge.exe	92
PID 4100 wrote to memory of 5540	4100	msedge.exe	94
PID 4100 wrote to memory of 680	4100	msedge.exe	92
PID 4100 wrote to memory of 680	4100	msedge.exe	92
PID 4100 wrote to memory of 2228	4100	msedge.exe	95
PID 4100 wrote to memory of 2228	4100	msedge.exe	95
PID 4100 wrote to memory of 5356	4100	msedge.exe	96
PID 4100 wrote to memory of 5860	4100	msedge.exe	97
PID 4100 wrote to memory of 5356	4100	msedge.exe	96
PID 4100 wrote to memory of 5356	4100	msedge.exe	96
PID 4100 wrote to memory of 5860	4100	msedge.exe	97
PID 4100 wrote to memory of 5860	4100	msedge.exe	97
PID 4100 wrote to memory of 120	4100	msedge.exe	99
PID 4100 wrote to memory of 348	4100	msedge.exe	98
PID 4100 wrote to memory of 120	4100	msedge.exe	99
PID 4100 wrote to memory of 120	4100	msedge.exe	99
PID 4100 wrote to memory of 348	4100	msedge.exe	98
PID 4100 wrote to memory of 348	4100	msedge.exe	98
PID 4100 wrote to memory of 1580	4100	msedge.exe	100
PID 4100 wrote to memory of 1580	4100	msedge.exe	100
PID 4884 wrote to memory of 636	4884	2026-08-16_e42d6a7c7ced777a29c99c6659f41a82_elex_rhadamanthys_stop.exe	102
PID 3220 wrote to memory of 5812	3220	ausnhezxrp.exe	105
PID 4100 wrote to memory of 3904	4100	msedge.exe	108
PID 4100 wrote to memory of 3904	4100	msedge.exe	108
PID 4100 wrote to memory of 1204	4100	msedge.exe	109
PID 4100 wrote to memory of 1204	4100	msedge.exe	109
PID 4100 wrote to memory of 944	4100	msedge.exe	111
PID 4100 wrote to memory of 4968	4100	msedge.exe	112
PID 4100 wrote to memory of 4968	4100	msedge.exe	112
PID 4100 wrote to memory of 1740	4100	msedge.exe	113
PID 4100 wrote to memory of 1740	4100	msedge.exe	113
PID 4884 wrote to memory of 2536	4884	2026-08-16_e42d6a7c7ced777a29c99c6659f41a82_elex_rhadamanthys_stop.exe	116
PID 4884 wrote to memory of 3608	4884	2026-08-16_e42d6a7c7ced777a29c99c6659f41a82_elex_rhadamanthys_stop.exe	120
PID 4224 wrote to memory of 4768	4224	eczxrpjhcw.exe	122
PID 4884 wrote to memory of 4252	4884	2026-08-16_e42d6a7c7ced777a29c99c6659f41a82_elex_rhadamanthys_stop.exe	125
PID 4884 wrote to memory of 4448	4884	2026-08-16_e42d6a7c7ced777a29c99c6659f41a82_elex_rhadamanthys_stop.exe	129
PID 2980 wrote to memory of 5292	2980	rmjhebwtrm.exe	131
PID 4884 wrote to memory of 1996	4884	2026-08-16_e42d6a7c7ced777a29c99c6659f41a82_elex_rhadamanthys_stop.exe	134
PID 4884 wrote to memory of 3780	4884	2026-08-16_e42d6a7c7ced777a29c99c6659f41a82_elex_rhadamanthys_stop.exe	138
PID 2972 wrote to memory of 3356	2972	mgeywqojgb.exe	140
PID 4884 wrote to memory of 3480	4884	2026-08-16_e42d6a7c7ced777a29c99c6659f41a82_elex_rhadamanthys_stop.exe	143
PID 4100 wrote to memory of 2520	4100	msedge.exe	146
PID 4100 wrote to memory of 5584	4100	msedge.exe	147
PID 4100 wrote to memory of 2348	4100	msedge.exe	148
PID 4884 wrote to memory of 3764	4884	2026-08-16_e42d6a7c7ced777a29c99c6659f41a82_elex_rhadamanthys_stop.exe	151
PID 2508 wrote to memory of 4528	2508	ojgbvtolge.exe	153
PID 4884 wrote to memory of 5660	4884	2026-08-16_e42d6a7c7ced777a29c99c6659f41a82_elex_rhadamanthys_stop.exe	156
PID 4884 wrote to memory of 5280	4884	2026-08-16_e42d6a7c7ced777a29c99c6659f41a82_elex_rhadamanthys_stop.exe	160
PID 5784 wrote to memory of 1740	5784	yvqoigayvq.exe	162
PID 4884 wrote to memory of 4724	4884	2026-08-16_e42d6a7c7ced777a29c99c6659f41a82_elex_rhadamanthys_stop.exe	165
PID 4884 wrote to memory of 1480	4884	2026-08-16_e42d6a7c7ced777a29c99c6659f41a82_elex_rhadamanthys_stop.exe	169
PID 5944 wrote to memory of 3452	5944	davtnlicay.exe	171
PID 4884 wrote to memory of 1452	4884	2026-08-16_e42d6a7c7ced777a29c99c6659f41a82_elex_rhadamanthys_stop.exe	174
PID 4884 wrote to memory of 5228	4884	2026-08-16_e42d6a7c7ced777a29c99c6659f41a82_elex_rhadamanthys_stop.exe	178
PID 2148 wrote to memory of 5080	2148	daupnkfaxs.exe	180
PID 4884 wrote to memory of 796	4884	2026-08-16_e42d6a7c7ced777a29c99c6659f41a82_elex_rhadamanthys_stop.exe	183
PID 4100 wrote to memory of 3176	4100	msedge.exe	185
PID 4100 wrote to memory of 3176	4100	msedge.exe	185
PID 4884 wrote to memory of 4492	4884	2026-08-16_e42d6a7c7ced777a29c99c6659f41a82_elex_rhadamanthys_stop.exe	191
PID 1988 wrote to memory of 5104	1988	avpnhfzxsp.exe	193
PID 4884 wrote to memory of 4660	4884	2026-08-16_e42d6a7c7ced777a29c99c6659f41a82_elex_rhadamanthys_stop.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-16_e42d6a7c7ced777a29c99c6659f41a82_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_e42d6a7c7ced777a29c99c6659f41a82_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x31c,0x7ff8c661c188,0x7ff8c661c194,0x7ff8c661c1a0
      4⤵
      PID:1568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,15459330797407845409,1858509548983727849,262144 --field-trial-handle=2376,i,16628558049485685612,13699308840304545317,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:2
      4⤵
      PID:680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,15827631428870884659,14051326888104928450,524288 --field-trial-handle=2376,i,16628558049485685612,13699308840304545317,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:11
      4⤵
      System Time Discovery
      PID:5540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,12424985151299798910,17693462428840760204,524288 --field-trial-handle=2376,i,16628558049485685612,13699308840304545317,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:13
      4⤵
      PID:2228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3640,i,17228648106106716568,18078662455549764071,2097152 --field-trial-handle=2376,i,16628558049485685612,13699308840304545317,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
      4⤵
      PID:5356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3324,i,9390869646623076682,18353386177248053379,2097152 --field-trial-handle=2376,i,16628558049485685612,13699308840304545317,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
      4⤵
      PID:5860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,4197661748965902701,11889936614277541745,2097152 --field-trial-handle=2376,i,16628558049485685612,13699308840304545317,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
      4⤵
      PID:348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,16766502634811780945,9476037759694206388,2097152 --field-trial-handle=2376,i,16628558049485685612,13699308840304545317,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:9
      4⤵
      PID:120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3836,i,17895122214486165940,18071886399939125211,524288 --field-trial-handle=2376,i,16628558049485685612,13699308840304545317,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:14
      4⤵
      PID:1580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,17569510311975414643,7794519886745706302,524288 --field-trial-handle=2376,i,16628558049485685612,13699308840304545317,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
      4⤵
      PID:3904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,7498365380790097246,12536857367910435741,524288 --field-trial-handle=2376,i,16628558049485685612,13699308840304545317,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
      4⤵
      PID:1204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,8776934423623811091,8832113832826611921,524288 --field-trial-handle=2376,i,16628558049485685612,13699308840304545317,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
      4⤵
      PID:2940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,8776934423623811091,8832113832826611921,524288 --field-trial-handle=2376,i,16628558049485685612,13699308840304545317,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
      4⤵
      PID:944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,1477841846741618882,9851233053281994330,524288 --field-trial-handle=2376,i,16628558049485685612,13699308840304545317,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
      4⤵
      PID:4968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,6616948215474478949,13789109954311728305,524288 --field-trial-handle=2376,i,16628558049485685612,13699308840304545317,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
      4⤵
      PID:1740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,16827582496881233301,6586751182950972241,524288 --field-trial-handle=2376,i,16628558049485685612,13699308840304545317,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:14
      4⤵
      PID:2520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,14250556154952402648,6984142969341941851,524288 --field-trial-handle=2376,i,16628558049485685612,13699308840304545317,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
      4⤵
      PID:5584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,9113793793240118209,2222350176460729727,524288 --field-trial-handle=2376,i,16628558049485685612,13699308840304545317,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14
      4⤵
      PID:2348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,1693507010969287594,10871395195554715163,524288 --field-trial-handle=2376,i,16628558049485685612,13699308840304545317,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
      4⤵
      PID:3176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,5739305019883568956,14449734932782913496,524288 --field-trial-handle=2376,i,16628558049485685612,13699308840304545317,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
      4⤵
      PID:2348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2868,i,3611794227686087344,7743250231277945160,524288 --field-trial-handle=2376,i,16628558049485685612,13699308840304545317,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
      4⤵
      PID:6028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,9581391905418261889,9979239140304397711,524288 --field-trial-handle=2376,i,16628558049485685612,13699308840304545317,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
      4⤵
      PID:1200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5056,i,1604536068139474253,2439311856927963235,262144 --field-trial-handle=2376,i,16628558049485685612,13699308840304545317,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,12140806324854544033,15097010677477556972,524288 --field-trial-handle=2376,i,16628558049485685612,13699308840304545317,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
      4⤵
      PID:5924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausnhezxrp.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:636
- - C:\Temp\ausnhezxrp.exe
    C:\Temp\ausnhezxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3220
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5812
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausnhezxrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2536
- - C:\Temp\i_ausnhezxrp.exe
    C:\Temp\i_ausnhezxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eczxrpjhcw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3608
- - C:\Temp\eczxrpjhcw.exe
    C:\Temp\eczxrpjhcw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4224
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4768
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eczxrpjhcw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4252
- - C:\Temp\i_eczxrpjhcw.exe
    C:\Temp\i_eczxrpjhcw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmjhebwtrm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4448
- - C:\Temp\rmjhebwtrm.exe
    C:\Temp\rmjhebwtrm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2980
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5292
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmjhebwtrm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1996
- - C:\Temp\i_rmjhebwtrm.exe
    C:\Temp\i_rmjhebwtrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgeywqojgb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3780
- - C:\Temp\mgeywqojgb.exe
    C:\Temp\mgeywqojgb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2972
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3356
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgeywqojgb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3480
- - C:\Temp\i_mgeywqojgb.exe
    C:\Temp\i_mgeywqojgb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojgbvtolge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3764
- - C:\Temp\ojgbvtolge.exe
    C:\Temp\ojgbvtolge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2508
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4528
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojgbvtolge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5660
- - C:\Temp\i_ojgbvtolge.exe
    C:\Temp\i_ojgbvtolge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5896
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\yvqoigayvq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5280
- - C:\Temp\yvqoigayvq.exe
    C:\Temp\yvqoigayvq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5784
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1740
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_yvqoigayvq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4724
- - C:\Temp\i_yvqoigayvq.exe
    C:\Temp\i_yvqoigayvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\davtnlicay.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1480
- - C:\Temp\davtnlicay.exe
    C:\Temp\davtnlicay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5944
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3452
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_davtnlicay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1452
- - C:\Temp\i_davtnlicay.exe
    C:\Temp\i_davtnlicay.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1280
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\daupnkfaxs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5228
- - C:\Temp\daupnkfaxs.exe
    C:\Temp\daupnkfaxs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2148
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5080
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_daupnkfaxs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:796
- - C:\Temp\i_daupnkfaxs.exe
    C:\Temp\i_daupnkfaxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avpnhfzxsp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4492
- - C:\Temp\avpnhfzxsp.exe
    C:\Temp\avpnhfzxsp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1988
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5104
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avpnhfzxsp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4660
- - C:\Temp\i_avpnhfzxsp.exe
    C:\Temp\i_avpnhfzxsp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmkfcxupmh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5848
- - C:\Temp\pmkfcxupmh.exe
    C:\Temp\pmkfcxupmh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2008
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:784
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmkfcxupmh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1152
- - C:\Temp\i_pmkfcxupmh.exe
    C:\Temp\i_pmkfcxupmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhezwrpjeb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3692
- - C:\Temp\jhezwrpjeb.exe
    C:\Temp\jhezwrpjeb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1488
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1448
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhezwrpjeb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6008
- - C:\Temp\i_jhezwrpjeb.exe
    C:\Temp\i_jhezwrpjeb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljebzwuom.exe ups_run
  2⤵
  PID:5124
- - C:\Temp\rljebzwuom.exe
    C:\Temp\rljebzwuom.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5676
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4888
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljebzwuom.exe ups_ins
  2⤵
  PID:1952
- - C:\Temp\i_rljebzwuom.exe
    C:\Temp\i_rljebzwuom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztomjeywto.exe ups_run
  2⤵
  PID:2096
- - C:\Temp\ztomjeywto.exe
    C:\Temp\ztomjeywto.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3104
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4284
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3144
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztomjeywto.exe ups_ins
  2⤵
  PID:5976
- - C:\Temp\i_ztomjeywto.exe
    C:\Temp\i_ztomjeywto.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eyvtnlgdyw.exe ups_run
  2⤵
  PID:4148
- - C:\Temp\eyvtnlgdyw.exe
    C:\Temp\eyvtnlgdyw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3292
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6108
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eyvtnlgdyw.exe ups_ins
  2⤵
  PID:5356
- - C:\Temp\i_eyvtnlgdyw.exe
    C:\Temp\i_eyvtnlgdyw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gaysqnifda.exe ups_run
  2⤵
  PID:6132
- - C:\Temp\gaysqnifda.exe
    C:\Temp\gaysqnifda.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4640
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3532
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gaysqnifda.exe ups_ins
  2⤵
  PID:1552
- - C:\Temp\i_gaysqnifda.exe
    C:\Temp\i_gaysqnifda.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnkfdxsqk.exe ups_run
  2⤵
  PID:2456
- - C:\Temp\vpnkfdxsqk.exe
    C:\Temp\vpnkfdxsqk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2576
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2808
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnkfdxsqk.exe ups_ins
  2⤵
  PID:4960
- - C:\Temp\i_vpnkfdxsqk.exe
    C:\Temp\i_vpnkfdxsqk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnifzxvsqk.exe ups_run
  2⤵
  PID:1336
- - C:\Temp\pnifzxvsqk.exe
    C:\Temp\pnifzxvsqk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5276
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4356
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnifzxvsqk.exe ups_ins
  2⤵
  PID:884
- - C:\Temp\i_pnifzxvsqk.exe
    C:\Temp\i_pnifzxvsqk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spnhfzxupn.exe ups_run
  2⤵
  PID:1732
- - C:\Temp\spnhfzxupn.exe
    C:\Temp\spnhfzxupn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2552
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3068
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spnhfzxupn.exe ups_ins
  2⤵
  PID:3144
- - C:\Temp\i_spnhfzxupn.exe
    C:\Temp\i_spnhfzxupn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omhezxromh.exe ups_run
  2⤵
  PID:5704
- - C:\Temp\omhezxromh.exe
    C:\Temp\omhezxromh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2692
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4404
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omhezxromh.exe ups_ins
  2⤵
  PID:4628
- - C:\Temp\i_omhezxromh.exe
    C:\Temp\i_omhezxromh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpmgeywtrp.exe ups_run
  2⤵
  PID:1316
- - C:\Temp\rpmgeywtrp.exe
    C:\Temp\rpmgeywtrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5372
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5464
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpmgeywtrp.exe ups_ins
  2⤵
  PID:3140
- - C:\Temp\i_rpmgeywtrp.exe
    C:\Temp\i_rpmgeywtrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1968

C:\Temp\keczurpjec.sys
C:\Temp\keczurpjec.sys
1⤵
- Executes dropped EXE
PID:2416

C:\Temp\zwuomhbztr.sys
C:\Temp\zwuomhbztr.sys
1⤵
- Executes dropped EXE
PID:3116

C:\Temp\zwrojebwuo.sys
C:\Temp\zwrojebwuo.sys
1⤵
- Executes dropped EXE
PID:1968

C:\Temp\rljdbywqoj.sys
C:\Temp\rljdbywqoj.sys
1⤵
- Executes dropped EXE
PID:2148

C:\Temp\dyvtolgdys.sys
C:\Temp\dyvtolgdys.sys
1⤵
- Executes dropped EXE
PID:2456

C:\Temp\kigavtnlfd.sys
C:\Temp\kigavtnlfd.sys
1⤵
- Executes dropped EXE
PID:2416

C:\Temp\kidaysnlid.sys
C:\Temp\kidaysnlid.sys
1⤵
- Executes dropped EXE
PID:2520

C:\Temp\icausqkica.sys
C:\Temp\icausqkica.sys
1⤵
- Executes dropped EXE
PID:3008

C:\Temp\upmkecxusm.sys
C:\Temp\upmkecxusm.sys
1⤵
- Executes dropped EXE
PID:6108

C:\Temp\omhezwuojh.sys
C:\Temp\omhezwuojh.sys
1⤵
- Executes dropped EXE
PID:3296

C:\Temp\xromjebztr.sys
C:\Temp\xromjebztr.sys
1⤵
PID:3292

C:\Temp\ywtojgbztr.sys
C:\Temp\ywtojgbztr.sys
1⤵
PID:6132

C:\Temp\ligaywqolj.sys
C:\Temp\ligaywqolj.sys
1⤵
PID:1968

C:\Temp\davtqlidbv.sys
C:\Temp\davtqlidbv.sys
1⤵
PID:5652

C:\Temp\ifdyvqnifa.sys
C:\Temp\ifdyvqnifa.sys
1⤵
PID:2852

C:\Temp\xvpnicaysq.sys
C:\Temp\xvpnicaysq.sys
1⤵
PID:1188

C:\Temp\smkhfzxrpm.sys
C:\Temp\smkhfzxrpm.sys
1⤵
PID:5096

C:\Temp\urpkhcwupm.sys
C:\Temp\urpkhcwupm.sys
1⤵
PID:3868

C:\Temp\zwupmgebzu.sys
C:\Temp\zwupmgebzu.sys
1⤵
PID:4652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ausnhezxrp.exe

Path C:\Temp\ausnhezxrp.exe
Size 243KB
SHA256 e100089f58df19e3ced59ef4db4b6819458e88bfd518f08612441c79ee581be1
MD5 32110ac8af9b6f27c6f0229ce9c1bc48
SHA1 d2f1a8985020e1aafe32520bf3088ab48b1b4fc8
SHA512 b605fd3e7a0a5651bd2b02dfe404c372dd64a31dd744602f0428a04290643f062bf5a4fa70cca0e515cfd9858baf0a8c1869c0fe53a011117149e54070206b21
SSDEEP 3072:BCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7r:cvMsLaOa3lLNngoqRttA7r
TLSH
T164345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvtolgdys.sys

Path C:\Temp\dyvtolgdys.sys
Size 141KB
SHA256 64490c4016fbc2cb7fde585dbcfd8073843c5ac9cd5445c17723aabba5905cbb
MD5 6024a1a90144ab7ab13520046c02a5bf
SHA1 424af290075e179e403c9f0e956034e332592178
SHA512 ba55f2bbda8e72f86f8e8a58a78bcdf9490b40a4baf435f225c1bd8284275206a765efabddc2be6d6c23d336caf0082293dafae52540d6f1f178426cd292f96f
SSDEEP 1536:fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T111E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eczxrpjhcw.exe

Path C:\Temp\eczxrpjhcw.exe
Size 243KB
SHA256 d59ef0234c45e433b3e3e276d8565b9a05caf9f3c07ff0aa7f9755c6decc73eb
MD5 dd4cf70e85504d9e274b79d96810f334
SHA1 802fd8b23170ed49471e2f15c774142241ab65f6
SHA512 03c9b5409055991efd3b5dc5de5b64093d201ee936f674ad49014fb56653702f9d22686d947388f43b575b9853e4c39f75781d7f8ee6d35f79a8b81d86c8dcc3
SSDEEP 3072:gCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7q:bvMsLaOa3lLNngoqRttA7q
TLSH
T10C345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ausnhezxrp.exe

Path C:\Temp\i_ausnhezxrp.exe
Size 243KB
SHA256 2f6a658431ce37361ba82797a118482c42d385811f56aec8fb81717371af136f
MD5 3745799b73c53a1d0a264915fd6d2575
SHA1 a0c920795ca5e1f5d4128e021bd4101dcb0f022a
SHA512 f7583257da278a5d60356efbfe054c74af8c45c591d42ead2101e943f75623158b2cea3c277375d8476d7f8bf0952c556e9717a9b05f8f061593045a6a31aa85
SSDEEP 3072:0CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA72:HvMsLaOa3lLNngoqRttA72
TLSH
T19D345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eczxrpjhcw.exe

Path C:\Temp\i_eczxrpjhcw.exe
Size 243KB
SHA256 3513cc3fdd8d05f57921ef5f208d2171af374477a6dfc9d24c0483bf9b7f74b8
MD5 033604e831f715c1ef68097698f1eda2
SHA1 ee30ff3aa424216239f26faa49c331a44facbf27
SHA512 194370d9faffc7a01fe28609c1438ce39af6c6b17d8e599e8f10a34f7f0817a9327bbffddafee1295ede51b0b504d868cd00d9223fba72de42c5cb1a72bd18ee
SSDEEP 3072:sCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA72:PvMsLaOa3lLNngoqRttA72
TLSH
T125345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mgeywqojgb.exe

Path C:\Temp\i_mgeywqojgb.exe
Size 243KB
SHA256 b24e5ff69833f4ff438f195372fb11d92a4f325c36769d873bcabd9b5fbc4c0a
MD5 0a03ef345d42494eacbeb08bdde26431
SHA1 04e688a1dca306805bc8e0763679f184b5bb6314
SHA512 047fc928f88cc93a4a6e550fb94ea9100678ea89e46eccb165c7f2309682258ced1e8b81e51f0dc40c72002fbc40bbd21178823bba086fd7551d1b0b83913a4b
SSDEEP 3072:HCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7V:ivMsLaOa3lLNngoqRttA7V
TLSH
T184345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ojgbvtolge.exe

Path C:\Temp\i_ojgbvtolge.exe
Size 243KB
SHA256 f4afed61bb888b93ed4a438dfa442583ed805ffe1d7bc1b7c1bfc7abf19d46ad
MD5 fbee2e42cd5e20caa99dce86100f0eab
SHA1 5c807c23f86f127a162e7f97f918abd34ae21405
SHA512 65e43679a3f4daac42eb541b5b79b011b70e80a8ae652aa7dc8304a031577dcabc549583bc9ce8db9ff6b91a096edf299cc52f4255e62e0396e6f3e54c60ce28
SSDEEP 3072:CCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7w:9vMsLaOa3lLNngoqRttA7w
TLSH
T121345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rmjhebwtrm.exe

Path C:\Temp\i_rmjhebwtrm.exe
Size 243KB
SHA256 14a796e6a6a63929ca93e5f4430e48d9dec5d888eceb168294de7acbb39a8038
MD5 87ddb03f6e2c935e83744485d0183a12
SHA1 62eeba0f9c746b22c4359b732804654b15b8820e
SHA512 e6d109939c2e071cd974b98186e81bf4a9dde188256d0741becd09567fb8eeef5a20e4a4ac77ff77fe1847d3a1706fe9e0d5df5d0d7589a16b4f51fdf88456ce
SSDEEP 3072:+CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7U:xvMsLaOa3lLNngoqRttA7U
TLSH
T1AA345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_yvqoigayvq.exe

Path C:\Temp\i_yvqoigayvq.exe
Size 243KB
SHA256 5e5c2d28ecba10a3b09e5094dbdbae4be5e6e4b99bef6eaf6aee79b01cd58fca
MD5 6420c2e7a2b6943966eb02052f395a0c
SHA1 db71f4994eea9fd88482ab6d5b30abba3474e752
SHA512 81d74dbd36a5df5bc1344cdda21dda3d42573e3bd4a987378aaa81c66d41c33da78a9fdd8a4f7d0b9d8bea0acdeef4fc4d930adc1e04be26d9f7a731510b11a0
SSDEEP 3072:ICvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7u:zvMsLaOa3lLNngoqRttA7u
TLSH
T1EA345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keczurpjec.sys

Path C:\Temp\keczurpjec.sys
Size 141KB
SHA256 baec793cfadeb100e3335b0be01792e3561fceca7c311cfc2f5a524b7f3dbd12
MD5 a974f52d7b742c7e3e9d87b991b4ef57
SHA1 8104ccb37628f67e24d2d17f66a7d6db050bd418
SHA512 d754a1f5cadf530de7f45181ba42bb0521a5f75508c53b673c36b91f1fa574328fb1308ad6d4e7c930f90506b4f83d2b4f3ca6826ce17ff153c628dac81a9f26
SSDEEP 1536:3a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:3a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T110E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgeywqojgb.exe

Path C:\Temp\mgeywqojgb.exe
Size 243KB
SHA256 1c1402be382f768598533a68733e0dcdf29332243a7c5d9bcc980b5be8d6cc20
MD5 8eb992bed9571f681f4f5d8c02364bfc
SHA1 ee2a2f1029d515edfdb67cb04c8af3080a192946
SHA512 2dbc39d29061addc5acdd92b5ed33bce0483488d9debf3200da50c97024e7850080cdcae56f9ae542489b74f7a8f60f623763b1eca69c5122682807c70029589
SSDEEP 3072:rCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA79:evMsLaOa3lLNngoqRttA79
TLSH
T151345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojgbvtolge.exe

Path C:\Temp\ojgbvtolge.exe
Size 243KB
SHA256 ec0db225a6aa26578d356c6307e0e04f12f5283b7b259b958e0ecf5339615fb6
MD5 898d5371ace53b6a68032e947f80497b
SHA1 31265d476776cd54bd8b09251dca117dccc4456a
SHA512 b87bd366fe3b139ec21643ee1b0b396732196a07422324e5405dfec762344d136fa84f5d3fc0c70eac2a6eeee8715e05f9f774e76d232458ea7dedbc98a49f4e
SSDEEP 3072:rCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7x:evMsLaOa3lLNngoqRttA7x
TLSH
T109345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljdbywqoj.sys

Path C:\Temp\rljdbywqoj.sys
Size 141KB
SHA256 4d1de1f101c6839197bb741e559c5681512e432e5ee8f266f222f52e4ca3bb78
MD5 916aedd3f686a98e14cce6200cf53d3c
SHA1 2574afdbc3d96c6a2b7a722d255f8d57d4df9f4c
SHA512 1ae58784993d18656f85c1e521e6a7acdd538b0e6a237c367dd523de847a765539deac766279492c5a7f5dd05c47cce1494aebcac7c73740454fd88d0a3a1736
SSDEEP 1536:ha3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ha3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T15DE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmjhebwtrm.exe

Path C:\Temp\rmjhebwtrm.exe
Size 243KB
SHA256 d2906970769d46acfc51e01a0d0612e17f1299dd1a2a92546196f80ce9cbf0b1
MD5 1b531654d44599a48a787c05b54ccf23
SHA1 024db5d003f14f2d16d1c186c05ccfd14b302230
SHA512 701033d0f04ebb937ce3cd4f3d11c09d7fadf3dbd30a2c669a09853c9081792e4d0cba2b692de0f967eccae95c54a7831c736b5f9eb301ca31e0f9412ec75c39
SSDEEP 3072:cCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7m:/vMsLaOa3lLNngoqRttA7m
TLSH
T166345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqoigayvq.exe

Path C:\Temp\yvqoigayvq.exe
Size 243KB
SHA256 32e3b68890845fdbfbaa75756622c8bdc088493ae13b54e019cb10976970dd4c
MD5 c8a0baab1b6048b103917bb7e5c3b00a
SHA1 6b57be226a296400f976a6f5e1b0bd522106ff67
SHA512 c8a0695e3bca94fb23299d184ad19cf613a1493af57da02c85bf13044bb96d466c9fa828d655aeba88122451e671e56147a17f3b2471b82e31075c75ef0d2ea9
SSDEEP 3072:mCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:JvMsLaOa3lLNngoqRttA7o
TLSH
T153345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwrojebwuo.sys

Path C:\Temp\zwrojebwuo.sys
Size 141KB
SHA256 3b46216563fa2d53aa2fdc3016dc1c3e0460ba579a55fa0e5c943440ba9fb192
MD5 73be67a564994ae5b1dec8bbe897eb43
SHA1 326d8f8f26a7cfc623c684263ae6534bc570b013
SHA512 f155e57867b354019964da69c5211a56862505c10022941c0c470eeab53e4c561c2b730333f467f729d90ad085b420e0a00c049d6bf3a72c8cbea9907ab38f8f
SSDEEP 1536:Wa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Wa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T13BE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwuomhbztr.sys

Path C:\Temp\zwuomhbztr.sys
Size 141KB
SHA256 8eae4d3bc6b9962f038a2e58d327406cd4a1df1b62edf2d084fcd6476547f294
MD5 8a1a236238c8e307e7055599a6d0b049
SHA1 e81f4e22f2cfa7c6ca2c1d1c44e7ff9370793127
SHA512 8c66d9b73cd2baf4cfbd1c16da3f0707d120bf7efb6a2bb57ed6f477c6d68bbd0786a4b9c74b63ccfc3ee191a36fdec23ba45c9711e48235c0e11d8f9a96594b
SSDEEP 1536:ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T168E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 9f2424cd409afdae76845eff7aa3c185dcb12f20f3cf67944c6dc2b883fc231c
MD5 3bad1b8e3e35d6eee77f28c2b350f577
SHA1 e34a15c978b718046ab4abaef5c68d665af7542f
SHA512 e7a573a31b7438b106ec3ba8e1f6025f048c41890f0d906d90bc190d32df97b89ffbe81ed20faadf76c12026fad3160d0db9d7df3c9432cde3ad7f259ad7c030
TLSH
T118512ECE5325ADE9DB6295B1D0E5501936F6B5AB0283AFC048B33EF05E22F4C00EE463
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594e84.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594e84.TMP
Size 2KB
SHA256 d12662aed9a3dbb6d958587ce062b0de3bcd9b14847416c6248d28a5e85b369c
MD5 ad2625147654d4216ff8c226826cd98c
SHA1 e454794c9c975fb02dd64a85c3e1d7039ffe5c73
SHA512 1b4e03665642f8c22dc9490ee245215cd5d5d877aef0ba8e8ce2d26f982c61fc3880f426022c27cee86dad9ea50015fbde6b04ec6329685dc2b164a0a3ebe93e
TLSH
T1B7513DCE5325ADE8DB6295B1D0E4511936F6B5AB0283AFC048B33EF05E22F0C00EE463
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1691c1ba37f611baa53bc80087108702697526856c41b917f83a654ef3d700bb
MD5 0bc69afbbed2306ae74841a6d36135f6
SHA1 7c9372cd30c4b68517d4dedfa1d96c32e3a2e8e7
SHA512 ffa4ee13930c0f2c0265438fe2ee0a4a9bce66aff766f21c8d3f03993b6bdc7ca3539715efe0c65516e1337d19081c02b350fd3a7e9e347a52839aa868b6db6c
TLSH
T1BF41B0F387F4857E8A0196F0AA146E1FCE2D0515432C7D5A89E4AE2B93E3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4e97ec0f1941689e932ad8967a6059eac64f10f1e07bd27080eca9d91337f97e
MD5 1d31e787fc5cf3b763364e06f388e2ac
SHA1 47e6f37d82b6fb78eb3ab0acc7715fad4f777cc7
SHA512 199ffe8d5136af4abf9f2935154ebd677345055f478d12b386286769d67f58d6f8501204f1ef09121749e931f325d91eacd70929638078f5ab4895dcf3e97cf2
SSDEEP 192:sxRMRdCS/fysKz5JZUOdNzoD8p9C/g6+WNCON/YCPPuOi+GiIgVoJ:sxRMiS/fysKz5H1pg/5R/ni8W
TLSH
T11142D8156E28A97B5CC7E20DBB15BF53D2F9603294D42E48EBFC961C14EA6DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4d09a3e48ae9afaa3390ec9e0fc9afa611d246afd1f6b61eacf4b9b10df796ba
MD5 489e6b2a9087ad7497057854bf3397d4
SHA1 19502fc5ba6f2be26504d18c437f7a014d036015
SHA512 1f8c0b2ebb27a24cd31ae34ecba47936540a08567b08839a028726c3c7188b377fec561d8c48331cbf595ff35e7a8011908b1a9520efa08dc9c2c74801c0b59b
SSDEEP 192:sxRDRdCS/fyszz5JZUOdNzoD8p9C/g6+WNCON/YCPPuOi+GiIgDOoJ:sxRDiS/fyszz5H1pg/5R/ni8P
TLSH
T19D42D9156E28A97B5CC7E20DBB15BF53D3F9603294D42E48EBFC961C14EA6DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c0d2e6044d3eaaa6d880c7f47501696549e0b8396a451e6854d2af8f248400ba
MD5 5624cefa0dff43f34a1ba5d0f8780a1a
SHA1 a85e557acdb7fe11eb48c5370e76fb0264098d45
SHA512 bd04a96de9f51ce9db7f0f4aa02fafd5b18169a291aa3a6c84f347b6c36bec4647779df6e38d8477d3b53c97d831343319f13a8fbb51d4ae681005d9d810e517
SSDEEP 192:sxRDRdCS/fyszzMJZUOdNzoD8p9C/g6+WNCON/YCpluOi+GiIgD0oJ:sxRDiS/fyszzMH1pg/5R//i8Z
TLSH
T16E42D915AE28AD7B5CC7E20CBB15BF53D3F9603294952E48ABFC961C10EB6DD510380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 bc1c7ce712641c3bb17d931f8fc055d241a219880b85cfff6d339f1da6a46237
MD5 7124da1e6a6e4468556ea19ef95c3aab
SHA1 fa530b64f2a1f60f169b46ee85a5f7d71058f0a2
SHA512 00c469ffb72dd67e83fde2b085b2b2ebfbe05ccf6de3a65e7049446cb5eb5febd4a1892b65afa51851ffd37b43752390202b899ec30aa9dfe5249cbdc076a1be
SSDEEP 768:jC+vIN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OViV0QqcWroZJ:jC+vI7E7JQWgQ+f4+u1jaNV0Vctf
TLSH
T1B5D2EA7B640DCB7F4F804ADDEC197E9B6DA802CB9698CD4047FA941C02C67EB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59eb12.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59eb12.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 551393233a991cc53fe4ad1e10437a8cc2aefd97610d930efad01a0030851779
MD5 d871c8889815a104c775f6c6e1a877f7
SHA1 56e042084aeb4504de46cf7b8858febc06277e12
SHA512 7bb9425fd9762bba28790828530eb16ae5e5b3a2a5114565bc372397459fd6e7ec43e401b91148f25f687e6b26a55bb0146e32664d821d0549d859f77b9ca439
SSDEEP 768:Wy3ltVEp8+p3bd66j+4BRv86aLIWrPi9POd:Wy39S8+p3Z6n4ypPr
TLSH
T18CF2AEB1E8A9DD635CEAD784769627436FF42173E5C01DD8D8D8AB0D048726E1B0B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 0a61a0bda87d4badb7adf30429217711f337c409acbf4f3520cede2701430ec5
MD5 785e73e0e2496ed4108297564e8cce65
SHA1 9c9cc9c64c7b28a419087930abbf439c56419535
SHA512 7130c14c1c7afe0a500dc1392a102120ccdbc489a552274513c71e6bfcf2e5ba31dbb609496f8df3c2c55fabba1a64d8f118eed0f1eed7d8d7f92b34776a5573
SSDEEP 768:uFQJ3wwgpiep8+p3bd66j+4BRv86aLIWrPi9POd:FJ3u8+p3Z6n4ypPr
TLSH
T1EE1317F198D79977D8AE8783677D2E429EBCD163B5845884BBC85E0CCC8217FC70A825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 38ebc29707c3dd287ff943a33842f46d7c2f1c98a21079ade55dfcec95943f44
MD5 1e01613ae27c5a6018db6e1e3af770bb
SHA1 ebfc8b967c163b9585edd731bfd18a525d766ec9
SHA512 2097bdd4992eb35ab0b3c936b3ce1ca41f05dee74bb49ccd88ae5e327173fd78d03e23b001d32ee73e84ab4be63bc1f9788d24b029c36551fc4bc8ef18696f10
SSDEEP 768:Irv+4UNbdD3lcuNp8+p3bd66j+4BRv86aLIiD2bwCl1:Ibsbp3lL8+p3Z6n4yp0ww
TLSH
T16E03CE73F8A899739CE6C64472467A433FF851A396C10AC4D4DD2B4E419A1AE230BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 4a3941affc8517c9dc413685796b87ebe39fedec8882a68fde467c87a167ae59
MD5 3602219686c17ee70a48a850e32ebe1a
SHA1 b29c96fabd41df5a57c0975cbd17f663ff345371
SHA512 1e38af3988fd126051afdd4d2468ccdcf1cde03e0504b1ca6975f415ef27a3ee88d1bbe4be89c6ed8cfa8305e111999077c45809e5a76e85bc7e1e065e67d879
SSDEEP 768:1rv+4UNbdD3u3VNp8+p3bd66j+4BRv86aLITr2bwCl1:1bsbp3mL8+p3Z6n4y+0ww
TLSH
T18A03BE72E46899339CE6C64471867A837FF821A399C10EC4D9D96B8E405A29F270B937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5daaaee0332b7a487dc9e4d93ac8aa463b6c5260e4a312137e1d72a4ffc994a1
MD5 b94e1f414987ab8deb360edc02748025
SHA1 070e0a6ee368ea65bb737b74c4f0d83e937ba4d7
SHA512 ce7cdb9810bdba7c9ebf4f95e4585d90974686c0a18ee23cceca29efb44c0ca8f237cd6dbcaa1971188a0d33106a5b494ac486a8461481ecceafa72970b8a463
SSDEEP 768:Ky3VtVzp8+p3bd66j+4BRv86aLIWrPi9POd:Ky3NF8+p3Z6n4ypPr
TLSH
T1A0F2AEB1E8A9DD635CEAD684769627436FF42163E5C01DD8D8D8AB0D048726E1B0B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

ead67062-0378-4607-923c-31ec3e8abee8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ead67062-0378-4607-923c-31ec3e8abee8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4100_1216421960\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1188-442-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1968-406-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1968-269-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1968-255-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2148-268-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2416-179-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2416-309-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2416-232-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2456-282-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2520-313-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2520-329-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2852-437-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3008-317-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3116-261-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3116-226-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3292-382-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3296-362-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3868-483-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5096-462-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5652-426-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6108-333-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6132-395-0x0000000000010000-0x0000000000083000-memory.dmp

Download