718a837b59254adc5017064a2874a548ebfc21e2a7aef62193bf17a5e14740c1

Analysis

max time kernel
148s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 22:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe
Size 243KB
Sample260415-12jadadt71
SHA256 718a837b59254adc5017064a2874a548ebfc21e2a7aef62193bf17a5e14740c1
MD5 1bfe36e38c9ac41f0ac9e4e28c3dde1f
SHA1 1da80f7435a59acd0cbbf2d26bf70710ad70a161
SHA512 aabee3bcb14f52f4f52d2a09de9dd88c875603b8e38dad80b535e0ef5f3b27341e312a6325d9dbce149f7b6c3a1cf2e066bd2e246a86cf4b45abe27e410cb107
SSDEEP 3072:r48AqOLcSyJhr7yZa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7c:c8AqOLctGa3lLNngoqRttA7c
TLSH
T109345A1172818071E71A0B7804AAE7A0567E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3320	CP.exe
5820	mkecxupmhc.exe
2356	CP.exe
4476	CP.exe
4168	i_mkecxupmhc.exe
576	hezxrpjhbz.sys
3308	CP.exe
5436	zurpjhezxr.exe
824	CP.exe
4748	CP.exe
1560	i_zurpjhezxr.exe
4692	bztrmjezwr.sys
4700	CP.exe
4788	rmjezwrojh.exe
4508	CP.exe
2868	CP.exe
3652	i_rmjezwrojh.exe
2372	wtomgeywqo.sys
2728	CP.exe
1780	geywqojgbz.exe
1724	CP.exe
2268	CP.exe
5372	i_geywqojgbz.exe
2260	ljgbywqoig.sys
4352	CP.exe
2708	dywqoigayt.exe
3916	CP.exe
4420	CP.exe
1816	i_dywqoigayt.exe
5024	bvtnlfdyvq.sys
5048	CP.exe
4588	qnigaysqki.exe
3216	CP.exe
1656	CP.exe
1696	i_qnigaysqki.exe
400	idavsnifav.sys
3372	CP.exe
4836	sqlfdavsnl.exe
2312	CP.exe
420	CP.exe
2936	i_sqlfdavsnl.exe
3236	cavsnlfdxv.sys
376	CP.exe
1040	cxvpnhfaxs.exe
3856	CP.exe
3880	CP.exe
1996	i_cxvpnhfaxs.exe
3896	hfzxspkhca.sys
5404	CP.exe
4344	hcaxvpkhca.exe
4152	CP.exe
5444	CP.exe
3720	i_hcaxvpkhca.exe
4304	hfzxrpjhcz.sys
1712	CP.exe
5064	xrpjhczusm.exe
2552	CP.exe
5804	CP.exe
3816	i_xrpjhczusm.exe
568	zxrpjhbzur.sys
3836	CP.exe
488	rmjecwuomg.exe
5364	CP.exe
4452	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_93809973\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_2146878273\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_2070650859\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_93809973\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_2146878273\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_2146878273\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4224_85501257\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_2070650859\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_93809973\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_1777219268\_locales\my\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurpjhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcaxvpkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifaysqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfaxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjecwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecxupmhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecxupmhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dywqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqlfdavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcaxvpkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbwtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbwtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurpjhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qljdbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifaysqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfaxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjezwrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxvpnhfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxvpnhfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqojgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqlfdavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qljdbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicausnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjezwrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqojgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dywqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjecwuomhe.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5448	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
6132	ipconfig.exe
2820	ipconfig.exe
2748	ipconfig.exe
3384	ipconfig.exe
3680	ipconfig.exe
1796	ipconfig.exe
4976	ipconfig.exe
4016	ipconfig.exe
5128	ipconfig.exe
4732	ipconfig.exe
2220	ipconfig.exe
5664	ipconfig.exe
5596	ipconfig.exe
2476	ipconfig.exe
3984	ipconfig.exe
5640	ipconfig.exe
4988	ipconfig.exe
2132	ipconfig.exe
2220	ipconfig.exe
4488	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31247706"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "108951404"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207645298234016"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-600123060-2148212387-2211176695-1000\{77E547F6-B43E-43D9-9345-FCFC974462EE}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2488	msedge.exe
2488	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4168	i_mkecxupmhc.exe
Token: SeDebugPrivilege	1560	i_zurpjhezxr.exe
Token: SeDebugPrivilege	3652	i_rmjezwrojh.exe
Token: SeDebugPrivilege	5372	i_geywqojgbz.exe
Token: SeDebugPrivilege	1816	i_dywqoigayt.exe
Token: SeDebugPrivilege	1696	i_qnigaysqki.exe
Token: SeDebugPrivilege	2936	i_sqlfdavsnl.exe
Token: SeDebugPrivilege	1996	i_cxvpnhfaxs.exe
Token: SeDebugPrivilege	3720	i_hcaxvpkhca.exe
Token: SeDebugPrivilege	3816	i_xrpjhczusm.exe
Token: SeDebugPrivilege	4932	i_rmjecwuomg.exe
Token: SeDebugPrivilege	5568	i_ojgbytrljd.exe
Token: SeDebugPrivilege	2332	i_trljdbwtol.exe
Token: SeDebugPrivilege	3544	i_qljdbvtnlg.exe
Token: SeDebugPrivilege	2724	i_nifaysqkic.exe
Token: SeDebugPrivilege	3732	i_kicausnkfd.exe
Token: SeDebugPrivilege	1208	i_pnhfaxsqki.exe
Token: SeDebugPrivilege	876	i_mkecwupmhf.exe
Token: SeDebugPrivilege	3560	i_mjecwuomhe.exe
Token: SeDebugPrivilege	3064	i_mgeywqojgb.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4224	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 4904	5060	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	78
PID 4904 wrote to memory of 4224	4904	iexplore.exe	79
PID 4224 wrote to memory of 5340	4224	msedge.exe	80
PID 4224 wrote to memory of 3276	4224	msedge.exe	81
PID 4224 wrote to memory of 3276	4224	msedge.exe	81
PID 4224 wrote to memory of 3276	4224	msedge.exe	81
PID 4224 wrote to memory of 5448	4224	msedge.exe	82
PID 4224 wrote to memory of 2196	4224	msedge.exe	83
PID 4224 wrote to memory of 2196	4224	msedge.exe	83
PID 4224 wrote to memory of 3740	4224	msedge.exe	85
PID 4224 wrote to memory of 3560	4224	msedge.exe	86
PID 4224 wrote to memory of 3740	4224	msedge.exe	85
PID 4224 wrote to memory of 3740	4224	msedge.exe	85
PID 4224 wrote to memory of 3560	4224	msedge.exe	86
PID 4224 wrote to memory of 3560	4224	msedge.exe	86
PID 4224 wrote to memory of 3140	4224	msedge.exe	88
PID 4224 wrote to memory of 3140	4224	msedge.exe	88
PID 4224 wrote to memory of 3140	4224	msedge.exe	88
PID 4224 wrote to memory of 6112	4224	msedge.exe	89
PID 4224 wrote to memory of 6112	4224	msedge.exe	89
PID 4224 wrote to memory of 6112	4224	msedge.exe	89
PID 5060 wrote to memory of 3320	5060	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	90
PID 5820 wrote to memory of 2356	5820	mkecxupmhc.exe	93
PID 4224 wrote to memory of 2556	4224	msedge.exe	96
PID 4224 wrote to memory of 1792	4224	msedge.exe	97
PID 4224 wrote to memory of 2556	4224	msedge.exe	96
PID 4224 wrote to memory of 1792	4224	msedge.exe	97
PID 4224 wrote to memory of 1628	4224	msedge.exe	98
PID 4224 wrote to memory of 5696	4224	msedge.exe	100
PID 1628 wrote to memory of 5132	1628	msedge.exe	101
PID 5060 wrote to memory of 4476	5060	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	104
PID 5060 wrote to memory of 3308	5060	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	108
PID 5436 wrote to memory of 824	5436	zurpjhezxr.exe	110
PID 5060 wrote to memory of 4748	5060	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	113
PID 5060 wrote to memory of 4700	5060	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	117
PID 4788 wrote to memory of 4508	4788	rmjezwrojh.exe	119
PID 5060 wrote to memory of 2868	5060	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	122
PID 5060 wrote to memory of 2728	5060	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	126
PID 1780 wrote to memory of 1724	1780	geywqojgbz.exe	128
PID 5060 wrote to memory of 2268	5060	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	131
PID 4224 wrote to memory of 420	4224	msedge.exe	133
PID 4224 wrote to memory of 1440	4224	msedge.exe	134
PID 4224 wrote to memory of 828	4224	msedge.exe	135
PID 4224 wrote to memory of 3864	4224	msedge.exe	136
PID 4224 wrote to memory of 3864	4224	msedge.exe	136
PID 4224 wrote to memory of 4628	4224	msedge.exe	137
PID 4224 wrote to memory of 4628	4224	msedge.exe	137
PID 5060 wrote to memory of 4352	5060	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	140
PID 2708 wrote to memory of 3916	2708	dywqoigayt.exe	142
PID 5060 wrote to memory of 4420	5060	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	145
PID 5060 wrote to memory of 5048	5060	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	149
PID 4588 wrote to memory of 3216	4588	qnigaysqki.exe	151
PID 5060 wrote to memory of 1656	5060	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	154
PID 5060 wrote to memory of 3372	5060	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	158
PID 4836 wrote to memory of 2312	4836	sqlfdavsnl.exe	160
PID 5060 wrote to memory of 420	5060	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	163
PID 5060 wrote to memory of 376	5060	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	167
PID 1040 wrote to memory of 3856	1040	cxvpnhfaxs.exe	169
PID 5060 wrote to memory of 3880	5060	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	172
PID 4224 wrote to memory of 5624	4224	msedge.exe	174
PID 4224 wrote to memory of 5624	4224	msedge.exe	174
PID 5060 wrote to memory of 5404	5060	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	179
PID 4344 wrote to memory of 4152	4344	hcaxvpkhca.exe	181
PID 5060 wrote to memory of 5444	5060	2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe	184

C:\Users\Admin\AppData\Local\Temp\2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_1bfe36e38c9ac41f0ac9e4e28c3dde1f_elex_rhadamanthys_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ffe5293c188,0x7ffe5293c194,0x7ffe5293c1a0
      4⤵
      PID:5340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,6575888224957591883,15668356797772559014,262144 --field-trial-handle=1980,i,13279301609158450494,3553143113149020045,262144 --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:2
      4⤵
      PID:3276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,1695951979392038379,11758202701767903739,524288 --field-trial-handle=1980,i,13279301609158450494,3553143113149020045,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:11
      4⤵
      System Time Discovery
      PID:5448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,14031252071023048056,10553460942876195560,524288 --field-trial-handle=1980,i,13279301609158450494,3553143113149020045,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:13
      4⤵
      PID:2196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,18181276184443052650,4502089432193145723,2097152 --field-trial-handle=1980,i,13279301609158450494,3553143113149020045,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
      4⤵
      PID:3740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,11669741591658521665,5514291822390500995,2097152 --field-trial-handle=1980,i,13279301609158450494,3553143113149020045,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
      4⤵
      PID:3560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,579953482592999398,16668138358867394314,2097152 --field-trial-handle=1980,i,13279301609158450494,3553143113149020045,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:1
      4⤵
      PID:3140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3540,i,867760052142554062,1589907950751852944,2097152 --field-trial-handle=1980,i,13279301609158450494,3553143113149020045,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:1
      4⤵
      PID:6112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,1173299051432452726,11950506326907651777,524288 --field-trial-handle=1980,i,13279301609158450494,3553143113149020045,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:14
      4⤵
      PID:2556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,4287169690812546779,15098109422836497708,524288 --field-trial-handle=1980,i,13279301609158450494,3553143113149020045,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:14
      4⤵
      PID:1792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,7704889745432819359,339442084586120414,524288 --field-trial-handle=1980,i,13279301609158450494,3553143113149020045,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1096
        5⤵
        
        PID:5132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,6262582493303573445,6556373811450839394,524288 --field-trial-handle=1980,i,13279301609158450494,3553143113149020045,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
      4⤵
      PID:6000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,6262582493303573445,6556373811450839394,524288 --field-trial-handle=1980,i,13279301609158450494,3553143113149020045,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
      4⤵
      PID:5696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,16574916110886065646,17165754084198105877,524288 --field-trial-handle=1980,i,13279301609158450494,3553143113149020045,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14
      4⤵
      PID:420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,17643273499986929944,9282964957726967402,524288 --field-trial-handle=1980,i,13279301609158450494,3553143113149020045,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
      4⤵
      PID:1440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,16378375550472106544,5881444108576562381,524288 --field-trial-handle=1980,i,13279301609158450494,3553143113149020045,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
      4⤵
      PID:828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,2666069236226657891,11157365326752541815,524288 --field-trial-handle=1980,i,13279301609158450494,3553143113149020045,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
      4⤵
      PID:3864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,7679724533341534133,17616008964869295209,524288 --field-trial-handle=1980,i,13279301609158450494,3553143113149020045,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
      4⤵
      PID:4628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,16463594389914644456,8339842134627189651,524288 --field-trial-handle=1980,i,13279301609158450494,3553143113149020045,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:14
      4⤵
      PID:5624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,3612161519991609358,11978642515871054082,524288 --field-trial-handle=1980,i,13279301609158450494,3553143113149020045,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
      4⤵
      PID:4916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,9090161631038635215,1220055003631198751,524288 --field-trial-handle=1980,i,13279301609158450494,3553143113149020045,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
      4⤵
      PID:3552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3688,i,14352106529853784376,13207219012605664256,262144 --field-trial-handle=1980,i,13279301609158450494,3553143113149020045,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,7270648723675184962,16606860889911034059,524288 --field-trial-handle=1980,i,13279301609158450494,3553143113149020045,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
      4⤵
      PID:2908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkecxupmhc.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3320
- - C:\Temp\mkecxupmhc.exe
    C:\Temp\mkecxupmhc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5820
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2356
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkecxupmhc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4476
- - C:\Temp\i_mkecxupmhc.exe
    C:\Temp\i_mkecxupmhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zurpjhezxr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3308
- - C:\Temp\zurpjhezxr.exe
    C:\Temp\zurpjhezxr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5436
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:824
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zurpjhezxr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4748
- - C:\Temp\i_zurpjhezxr.exe
    C:\Temp\i_zurpjhezxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmjezwrojh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4700
- - C:\Temp\rmjezwrojh.exe
    C:\Temp\rmjezwrojh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4788
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4508
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4488
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmjezwrojh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2868
- - C:\Temp\i_rmjezwrojh.exe
    C:\Temp\i_rmjezwrojh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywqojgbz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2728
- - C:\Temp\geywqojgbz.exe
    C:\Temp\geywqojgbz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1780
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1724
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywqojgbz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2268
- - C:\Temp\i_geywqojgbz.exe
    C:\Temp\i_geywqojgbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dywqoigayt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4352
- - C:\Temp\dywqoigayt.exe
    C:\Temp\dywqoigayt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3916
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dywqoigayt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4420
- - C:\Temp\i_dywqoigayt.exe
    C:\Temp\i_dywqoigayt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnigaysqki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5048
- - C:\Temp\qnigaysqki.exe
    C:\Temp\qnigaysqki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4588
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3216
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnigaysqki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1656
- - C:\Temp\i_qnigaysqki.exe
    C:\Temp\i_qnigaysqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqlfdavsnl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3372
- - C:\Temp\sqlfdavsnl.exe
    C:\Temp\sqlfdavsnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4836
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2312
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqlfdavsnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:420
- - C:\Temp\i_sqlfdavsnl.exe
    C:\Temp\i_sqlfdavsnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxvpnhfaxs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:376
- - C:\Temp\cxvpnhfaxs.exe
    C:\Temp\cxvpnhfaxs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1040
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3856
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxvpnhfaxs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3880
- - C:\Temp\i_cxvpnhfaxs.exe
    C:\Temp\i_cxvpnhfaxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hcaxvpkhca.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5404
- - C:\Temp\hcaxvpkhca.exe
    C:\Temp\hcaxvpkhca.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4344
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4152
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5664
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hcaxvpkhca.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5444
- - C:\Temp\i_hcaxvpkhca.exe
    C:\Temp\i_hcaxvpkhca.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpjhczusm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1712
- - C:\Temp\xrpjhczusm.exe
    C:\Temp\xrpjhczusm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5064
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2552
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5596
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpjhczusm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5804
- - C:\Temp\i_xrpjhczusm.exe
    C:\Temp\i_xrpjhczusm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmjecwuomg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3836
- - C:\Temp\rmjecwuomg.exe
    C:\Temp\rmjecwuomg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:488
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5364
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmjecwuomg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4452
- - C:\Temp\i_rmjecwuomg.exe
    C:\Temp\i_rmjecwuomg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojgbytrljd.exe ups_run
  2⤵
  PID:3884
- - C:\Temp\ojgbytrljd.exe
    C:\Temp\ojgbytrljd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4848
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4844
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojgbytrljd.exe ups_ins
  2⤵
  PID:4000
- - C:\Temp\i_ojgbytrljd.exe
    C:\Temp\i_ojgbytrljd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljdbwtol.exe ups_run
  2⤵
  PID:480
- - C:\Temp\trljdbwtol.exe
    C:\Temp\trljdbwtol.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2960
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2008
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljdbwtol.exe ups_ins
  2⤵
  PID:812
- - C:\Temp\i_trljdbwtol.exe
    C:\Temp\i_trljdbwtol.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2332
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qljdbvtnlg.exe ups_run
  2⤵
  PID:3000
- - C:\Temp\qljdbvtnlg.exe
    C:\Temp\qljdbvtnlg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1280
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2852
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qljdbvtnlg.exe ups_ins
  2⤵
  PID:236
- - C:\Temp\i_qljdbvtnlg.exe
    C:\Temp\i_qljdbvtnlg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nifaysqkic.exe ups_run
  2⤵
  PID:3648
- - C:\Temp\nifaysqkic.exe
    C:\Temp\nifaysqkic.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5068
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3688
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nifaysqkic.exe ups_ins
  2⤵
  PID:2624
- - C:\Temp\i_nifaysqkic.exe
    C:\Temp\i_nifaysqkic.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicausnkfd.exe ups_run
  2⤵
  PID:5408
- - C:\Temp\kicausnkfd.exe
    C:\Temp\kicausnkfd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5960
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:124
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicausnkfd.exe ups_ins
  2⤵
  PID:2580
- - C:\Temp\i_kicausnkfd.exe
    C:\Temp\i_kicausnkfd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfaxsqki.exe ups_run
  2⤵
  PID:3292
- - C:\Temp\pnhfaxsqki.exe
    C:\Temp\pnhfaxsqki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5700
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4892
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfaxsqki.exe ups_ins
  2⤵
  PID:3652
- - C:\Temp\i_pnhfaxsqki.exe
    C:\Temp\i_pnhfaxsqki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1208
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkecwupmhf.exe ups_run
  2⤵
  PID:1976
- - C:\Temp\mkecwupmhf.exe
    C:\Temp\mkecwupmhf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2480
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1980
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkecwupmhf.exe ups_ins
  2⤵
  PID:5136
- - C:\Temp\i_mkecwupmhf.exe
    C:\Temp\i_mkecwupmhf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjecwuomhe.exe ups_run
  2⤵
  PID:1136
- - C:\Temp\mjecwuomhe.exe
    C:\Temp\mjecwuomhe.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4188
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3296
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjecwuomhe.exe ups_ins
  2⤵
  PID:5132
- - C:\Temp\i_mjecwuomhe.exe
    C:\Temp\i_mjecwuomhe.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgeywqojgb.exe ups_run
  2⤵
  PID:3228
- - C:\Temp\mgeywqojgb.exe
    C:\Temp\mgeywqojgb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2756
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4444
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgeywqojgb.exe ups_ins
  2⤵
  PID:540
- - C:\Temp\i_mgeywqojgb.exe
    C:\Temp\i_mgeywqojgb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3064

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2756

C:\Temp\hezxrpjhbz.sys
C:\Temp\hezxrpjhbz.sys
1⤵
- Executes dropped EXE
PID:576

C:\Temp\bztrmjezwr.sys
C:\Temp\bztrmjezwr.sys
1⤵
- Executes dropped EXE
PID:4692

C:\Temp\wtomgeywqo.sys
C:\Temp\wtomgeywqo.sys
1⤵
- Executes dropped EXE
PID:2372

C:\Temp\ljgbywqoig.sys
C:\Temp\ljgbywqoig.sys
1⤵
- Executes dropped EXE
PID:2260

C:\Temp\bvtnlfdyvq.sys
C:\Temp\bvtnlfdyvq.sys
1⤵
- Executes dropped EXE
PID:5024

C:\Temp\idavsnifav.sys
C:\Temp\idavsnifav.sys
1⤵
- Executes dropped EXE
PID:400

C:\Temp\cavsnlfdxv.sys
C:\Temp\cavsnlfdxv.sys
1⤵
- Executes dropped EXE
PID:3236

C:\Temp\hfzxspkhca.sys
C:\Temp\hfzxspkhca.sys
1⤵
- Executes dropped EXE
PID:3896

C:\Temp\hfzxrpjhcz.sys
C:\Temp\hfzxrpjhcz.sys
1⤵
- Executes dropped EXE
PID:4304

C:\Temp\zxrpjhbzur.sys
C:\Temp\zxrpjhbzur.sys
1⤵
- Executes dropped EXE
PID:568

C:\Temp\hbwuomgeyw.sys
C:\Temp\hbwuomgeyw.sys
1⤵
PID:4828

C:\Temp\eywqojgbzt.sys
C:\Temp\eywqojgbzt.sys
1⤵
PID:2080

C:\Temp\ywqoigbytq.sys
C:\Temp\ywqoigbytq.sys
1⤵
PID:1136

C:\Temp\ytnlfdavtn.sys
C:\Temp\ytnlfdavtn.sys
1⤵
PID:2568

C:\Temp\dxvqnigays.sys
C:\Temp\dxvqnigays.sys
1⤵
PID:2260

C:\Temp\xvpnhfzxsp.sys
C:\Temp\xvpnhfzxsp.sys
1⤵
PID:3364

C:\Temp\xrpkhcausm.sys
C:\Temp\xrpkhcausm.sys
1⤵
PID:1252

C:\Temp\xrpjhbzurm.sys
C:\Temp\xrpjhbzurm.sys
1⤵
PID:1168

C:\Temp\eztrmjecwu.sys
C:\Temp\eztrmjecwu.sys
1⤵
PID:3124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bvtnlfdyvq.sys

Path C:\Temp\bvtnlfdyvq.sys
Size 141KB
SHA256 3482add7b50ba3dccee8b5654e86f8c11dd1f1f19922157d9938327dfebf4b52
MD5 d5865a84bf76c25b82835fdc4a4dc287
SHA1 e7b618f5aeb0b80164da76ddcc213adc1944fead
SHA512 d36b6317d643f8d995e53d3c5d8a135bce20b8f161072457febd60a21afefa6b6f9d65756a1897b77153a7ea2ab1742e0914c56c99e7f156797bea540fc07e63
SSDEEP 1536:Ga3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ga3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DEE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrmjezwr.sys

Path C:\Temp\bztrmjezwr.sys
Size 141KB
SHA256 9dce3c35c61b2e21be513a1a51da8c2d98a0242d4e4e816489a383481e07efdd
MD5 56e975a6d6748a232dfc76248e6d5713
SHA1 9f7723ccb01bb15931b921244400db7cb108212c
SHA512 5ac3c104b1a84ed753d73e65ef5741954734449a61f5fdf43672fbeaa66eb5f1a53a416c7ec87243b123e86138a048918a76b5226e94153ef0b71b695cc53265
SSDEEP 1536:Ga3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ga3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B9E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dywqoigayt.exe

Path C:\Temp\dywqoigayt.exe
Size 243KB
SHA256 01571ffc16d3d7dd556ecbcea459fbc123ab92637b7cb05d798734f41ff0cdf9
MD5 b96c755cfac4a928a297fab2ac6109dd
SHA1 21dd2194d94100c704d8b12373acfc62adbb0a4f
SHA512 2373e1829c276bcba5fd87815cbffde8379cee886ea21c40a51eb4f0c7642460ebe259c3370d3c172941d7b235518b0e114ab61e2be09884a3417c24d9d9533c
SSDEEP 3072:q48AqOLcSyJhr7yZa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7N:X8AqOLctGa3lLNngoqRttA7N
TLSH
T1ED345A1172818071E71A0B7804AAE7A0567E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywqojgbz.exe

Path C:\Temp\geywqojgbz.exe
Size 243KB
SHA256 fdbd43b6bcb35e76ec92e8d2b8870643823130cec366f8f3e3645b282c8f7f96
MD5 d357645cce678990018130e6bf9848bf
SHA1 3cefb0bb8602b5efae5194c1e21aa89a91f50687
SHA512 ab609a95ebe916621cf529cad39f64e56422de4c4b80e6e453ac413361e60d7df83b9485448ab44a2799628d6b2fc1f506b21b9031645b755bafa73597e96de0
SSDEEP 3072:/48AqOLcSyJhr7yZa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7c:Q8AqOLctGa3lLNngoqRttA7c
TLSH
T1A2345A1172818071E71A0B7804AAE7A0567E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hezxrpjhbz.sys

Path C:\Temp\hezxrpjhbz.sys
Size 141KB
SHA256 51aa949f58dbcb36fbf77de01a1d39bef87845bb2c2c86281e90e1bdc61bc5ca
MD5 7311402d4cb4d979e42fc510f53a443f
SHA1 91374620aa06f7363105575ab3656f72aeb66e15
SHA512 cda6e1d399834382185e3b294d8c2683b16387fcbb42ba7f047e446cb5818c8d8e324fd15d994de1d3d7cbd750b5583cd4c30f16bec384ec0a8d86cb57fb6401
SSDEEP 1536:La3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:La3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T18EE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dywqoigayt.exe

Path C:\Temp\i_dywqoigayt.exe
Size 243KB
SHA256 43c1ac978f982482a85e2977e1fa9c30665a319ac15aa8b6c2655448b8580d21
MD5 83724a628e366232b3f673e16ab677ca
SHA1 9dc85f86b65565683e56780796f9ef5c587ca174
SHA512 6003a346c5d9a6a9979a4b8e9511ee92fd20d4de1320ad5a7e2081e45daa7a64eb494b5132761d1d975d432584de50db70254bbf4889fe8e5f78858e420a9641
SSDEEP 3072:W48AqOLcSyJhr7yZa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:j8AqOLctGa3lLNngoqRttA71
TLSH
T1CA345A1172818071E71A0B7804AAE7A0567E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_geywqojgbz.exe

Path C:\Temp\i_geywqojgbz.exe
Size 243KB
SHA256 aac1cf2c39f2e9e9653f852aeb9ed69a2176086343497a6949382b740595df95
MD5 d1f21638173d0fa4b21867b67e3bb249
SHA1 ef5e6027aadc5da47623dda1eb77dee9200d6cbd
SHA512 98ed05d09416d6185663f32bf0fd2ac331432844999ef8bb9483acab1eeeb2413d9028bbec1f2d0a436beacde914be38b49a91915ffa55928606adbaf8694a6d
SSDEEP 3072:u48AqOLcSyJhr7yZa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7F:b8AqOLctGa3lLNngoqRttA7F
TLSH
T1AE345A1172818071E71A0B7804AAE7A0567E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkecxupmhc.exe

Path C:\Temp\i_mkecxupmhc.exe
Size 243KB
SHA256 ce01919aa768205ebdec44013bb045510ddde1fb7b3cfdb3a27f50654f6ac765
MD5 2570986e69b74bf7697d7e19719524fb
SHA1 a011322d84de2042d0e1f06197a554024159f19f
SHA512 d29c261b9f425c93c56a2f2607560d31bc5bd9bc72433ac55ebf5fcb5ec047bf8a584bcb0fbc76d58d92f43202e8375a0541a0149423efe0bae7080de216eda3
SSDEEP 3072:Q48AqOLcSyJhr7yZa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7v:J8AqOLctGa3lLNngoqRttA7v
TLSH
T102345A1172818071E71A0B7804AAE7A0567E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qnigaysqki.exe

Path C:\Temp\i_qnigaysqki.exe
Size 243KB
SHA256 c7e13afb301dad8e882532467db19195f119084d81482e2359fb20f1259d56ef
MD5 6484d813e2d8bbb549c4596850290d77
SHA1 1fd91f0ec4c348aa5860315e9e7d48768f844487
SHA512 32d18883c8ea0ba98de86841fed936d296809e4f5dc825cd5fa1a8db8bae0169ef42357518d68742e92488551f5f9977b3e8a2e3465f428032189ab67a8fce21
SSDEEP 3072:C48AqOLcSyJhr7yZa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7J:P8AqOLctGa3lLNngoqRttA7J
TLSH
T19B345A1172818071E71A0B7804AAE7A0567E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rmjezwrojh.exe

Path C:\Temp\i_rmjezwrojh.exe
Size 243KB
SHA256 5fb28faa34ed930226968ada4f7ce6ac2c108812af4bc1bb79a8ac2bd5759341
MD5 7bca92b606a7bb0b8218777036ca8a54
SHA1 e81815286fe88e7083fe0436d1fcd1ec368e87ff
SHA512 8d6eab234322b541e4dec982bdab293f6867e4397511595205751f0826ff7fb9a9007a2a629005ba1882792a5c2383afa4c9a9df04d178ba0d7cbb7d71ef4f1a
SSDEEP 3072:O48AqOLcSyJhr7yZa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7F:78AqOLctGa3lLNngoqRttA7F
TLSH
T1CD345A1172818071E71A0B7804AAE7A0567E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zurpjhezxr.exe

Path C:\Temp\i_zurpjhezxr.exe
Size 243KB
SHA256 f2d9a17e5bd2d9ff971a8342c7a138ccbeaa2c29c8b52fe94c4bea4cb3a84dcf
MD5 11b38335c58a2329c1b11d8e021eba44
SHA1 975e29ae6c47da4f74619a484e18f09da17d2b3b
SHA512 7d14f2362d62d06b8ce4be6267cb0e6f6a5a933733cd11f9594e15654766289bd627a08f0287b58dbc588c77aa15a49b6d23b8637bb430723578328df190a88d
SSDEEP 3072:f48AqOLcSyJhr7yZa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7E:w8AqOLctGa3lLNngoqRttA7E
TLSH
T102345A1172818071E71A0B7804AAE7A0567E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idavsnifav.sys

Path C:\Temp\idavsnifav.sys
Size 141KB
SHA256 06d5658e9ffb6c766e749e3802ae43ed789f51403f4e89e30c44a02dbd51ec28
MD5 3e6624876186df60c3bd597a6d8753bb
SHA1 8756054369227bde8af11853653c6ac2453d07e3
SHA512 5aac0cac79989e7a86d8c100f6b6484ebe93252f80f81bb3542178e6551803e185240d9e7528f75f0451925e66a75792008c941e7afda6d481dcd8cfdd9aa4ee
SSDEEP 1536:Xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T116E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljgbywqoig.sys

Path C:\Temp\ljgbywqoig.sys
Size 141KB
SHA256 e9e0b9ec1b8d3763fad467411e9d120a88519f4881ea91760d6226e170c36a1e
MD5 9a4da90742475442635252db99294ba7
SHA1 7a39b8f0e73ce635352bb50f7cf8851c50c459c2
SHA512 42664369027fd23721ecdac0ff4b62dc6b77225145a39cb7d3e3ac5c14d07740615633855b0a6d95808e8607deabe1a2cee536c8ecf2eaf729f7daf270493250
SSDEEP 1536:pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C3E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkecxupmhc.exe

Path C:\Temp\mkecxupmhc.exe
Size 243KB
SHA256 30758dc5d446f3b0d6f5f296c051d83ef4f94b2cbc002859498017a9964184e5
MD5 26f65a27f83c82ae19f76600b84f6adc
SHA1 733708212ce51aeac5841a99b4405094563ae7ea
SHA512 76ea361158c74933836af3bb52b16679d693bc13e3e30800fbb9ff0c80025aac8e62d8a26fc12bd37d8ee7fa9f9fb3382158ab3fe5f1b465a926226c3b28235e
SSDEEP 3072:F48AqOLcSyJhr7yZa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7m:q8AqOLctGa3lLNngoqRttA7m
TLSH
T10C345A1172818071E71A0B7804AAE7A0567E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnigaysqki.exe

Path C:\Temp\qnigaysqki.exe
Size 243KB
SHA256 c6c8b65faf150bb801a2d50afbb1d0ee55ddb8276a8a01421792813cc4edcc55
MD5 38be5f102b070b6686f12ba183d32602
SHA1 0903f3c816732a07af6d577db521fdfc6182cce6
SHA512 4e3350a69ee174e2419d13a312c549f001ee9f0d514c76f48cc114500791909632fb87aaeae93e01211d8b9cf048f57f5afa0aead9468be167be51528295ee21
SSDEEP 3072:z48AqOLcSyJhr7yZa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Q:E8AqOLctGa3lLNngoqRttA7Q
TLSH
T116345A1172818071E71A0B7804AAE7A0567E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmjezwrojh.exe

Path C:\Temp\rmjezwrojh.exe
Size 243KB
SHA256 03b87d67a2f65a1aac26a645acf47c40bdf3cdb83943330638054f12927ed685
MD5 755187313e7f8c66ace7650fe7f1a0b8
SHA1 f09210708347e48036caf44a18c5070d53fda72f
SHA512 a339d546b49d075e28332f9bcb7ecc55ad3b2d894a3d3897edc573f105a73553cbc30186ed22e8005e79a206dea7cb105a113c14ad739ba66d288d60093b5af7
SSDEEP 3072:T48AqOLcSyJhr7yZa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7E:k8AqOLctGa3lLNngoqRttA7E
TLSH
T1DF345A1172818071E71A0B7804AAE7A0567E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtomgeywqo.sys

Path C:\Temp\wtomgeywqo.sys
Size 141KB
SHA256 d25303e5ce7491fa9d948474e5e63f09ecd4f378b986dc2632e891f2d1b2b626
MD5 108ad1c7283c84a24df2d1cbdb172e02
SHA1 2540d92ecfcf970372dba1b7b326bd0dcddc8092
SHA512 2d8adbcbb869e24c99fa2f941c1521b87b671994d92481b845fbf537953b6a890deb7efc74548ca2325543b8626c4ec8ce232379fd786fd462ed98974d724930
SSDEEP 1536:da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B4E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zurpjhezxr.exe

Path C:\Temp\zurpjhezxr.exe
Size 243KB
SHA256 4f24a26c8e15ba4ed97ca7354147770ec8c94a42475424ebbacf3201217fb881
MD5 aa48859c3fc192f1c2b6b1678a87ec7f
SHA1 10beac4d93975f0aca46899e22434792ba228c4e
SHA512 2ec49a149f5b1da5a1a47ef7cf2150b0f332d7983d4d488624fb9fbc6a39d6c0010d5e14e4e1c0f97b65425fcd536f7d04413b6d6b656c5f5ac3dae55420e9a8
SSDEEP 3072:548AqOLcSyJhr7yZa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7O:e8AqOLctGa3lLNngoqRttA7O
TLSH
T18E345A1172818071E71A0B7804AAE7A0567E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 71f86f37b013034051fae2e3307728bc40653c617383d6aa85219dd8ea093ca3
MD5 2ee9c9062df63fee32f65bc087b93005
SHA1 2874f6b34fdb5f9ff64aed6e38005f7940050b27
SHA512 99729f971f840d780b0e5404260284b048d532cb0dbd20969536cacd61a2d2c52568d6b9d96f6f0168b93eaa3c7236b49d8aafb6138d1b1fcbe89990c6af5af3
TLSH
T1AFD08C4821F66CBAD09ACA7219057B0A2959EAA79E93AB2A39B36C784C4300115911F7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3bc8d78be1490315bf731897d0a7b85f02d6de7bcc70a15e17ff8159f5fdf4db
MD5 eca6ed85f2dc85ce703a9a90d77aac3f
SHA1 c1b47e069ef699bdbc891c7c22b75cbbbc1abe9b
SHA512 29e15bf3f471d1b49852cf9419a50ae824961e00281e95fee3a6a7429dbfc1ea3df3b569a019d21729dda4841b44e6b7d289971513d2fcd1b8e2db2c0da36b63
TLSH
T1F1E02B6ADC35DC3709FD0B1D2104074AFA6153271641950F3A3C960C8FB063A45D581C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 38cd5777e53f660279ba77de2644ba8cc186ec5a131d4b830c43f11b633e2342
MD5 4b7a3432852b8516fd7dc37650116921
SHA1 cd2216e20b27cf67cc7ca5eb97699a8a9d8b2c33
SHA512 074db71d231452b4668291e524405002d1ac1d9661d5d9aaba2469c56a8e7161cbc6d25389bae927a43306a1967933448d4cf4de594a201b07ce83eb6c153067
TLSH
T153419DF3C3E8856D8A0155F0AA187E2BCE2D0954836C7D5AC5E4AF1BD3E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 e2259885011a76e216a0fa4b5448e2eb00ae18089d004cd3c962c2880b5aea30
MD5 de3db3516a3128da1f7a7e5047c7b767
SHA1 0670e4d2218bc98be92163244cffab13ff1072b5
SHA512 cfa1c124615c2ec102d048df3fac375a2a3d4de7b337767455ed7d786f10c0819465ec9928964472af0e57f5e4e983c9517397c93e9d7b850cc449cbeab829a4
SSDEEP 384:sxZs5EqCw4/fQSssDjqTxlH/bi/5eiv8b:sE5TCw4/fQGDIB/bY5eic
TLSH
T12A72F915AA3899778CD7E219F945BB53D7F8156392800E44AAFCDE0C05D6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 69b77462e0f9e2f3c6888948e0310beee835fecafd4c5917002c11de989b7f02
MD5 77a33adfe22cd89f6f2e7313d8c96909
SHA1 6f2729c79ff01d914448f69c21f6faab868ec0af
SHA512 246e92a88a55ed97e663bd311938a959ea95f2bd1a149fcfe2a45674ef1462c1b8f72c3a695e5cb34f14e52e67bece21e19e28600015501021509bd6f675b565
SSDEEP 384:sxZs5E0w4/fQSsXLjqTxlH/bi/5iivjoq:sE5Rw4/fQNLIB/bY5ii8q
TLSH
T1D7720A156A3899778CD7D209FA45BB53D7F91563D2804E48AAFCDE0C05E6BDD220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 a0cccb8ab3154ebb23cffb94f0d54ed714f1bb9f76228459795c15c83ae0d2e2
MD5 86ecff1f58ad8aec7b289ab5af25ec05
SHA1 99297fd820a8bddf488fbc0e307cb25d9a37d19f
SHA512 71427c373e314587be31bead14a0feea09bcd433c68390df7d80e9d90b147c1ae8cfb19eaa545ee0c8b6e5ab521e9385810508beba73b20d024ab2b103a73969
SSDEEP 768:kA4so86s2+q7pLuL/HzWRmH9QYR8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3bU3SLl1:kA4so86s2+CE/HzWRmH9QYRu1jaKbU3s
TLSH
T102031D3B684CCB7F4F844E9CEC2ABE8A6DE8018F95988D9447FA444C03C67EB55161DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 7622a9155ea5f7d7f5bf38d4276d22a2348db41e9aa5842e2c3c92a3cbee590c
MD5 9cf890a440421e8ca572110debffb900
SHA1 48f35dc76e990718a330b1fc998cf87cd88049f3
SHA512 36685a982e66658337a604b72347d655caa6cf5e87838df6e05e5b01a3d29f3fef590f041e7385fc337528af2c0c206413276adf0a1cdfcec3fe0ba863556951
SSDEEP 96:KkGQKTyeupuKK8DF6KOkKeFGKWoJp+K6wKK6UKXqAugKHqC6S0KzSA+IK/qa2jSn:ubB91NPhfYXHkvl7X3S9r4dFDPl7
TLSH
T1C2B25891797A12907A7E259A8595B83F52C23163701CE86B3BF900B50F6BE20DDFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 dd8584c89e5b06a34087cbaf9ab7230aeb93e11cceddb7eacfe10b2196ae3f3b
MD5 8330c407e75c8a8af4cbbfde1ede97bb
SHA1 8cc85a24fe95fa1714cb4d5f9f607c710c149a79
SHA512 34c59002bb10e33bb1358ce385956346ab8ef1a9ba8790078f47c56780ac3d02cacfc5fdb41df0af55e291632dfafb8cd41bbb25bd68a74968ddf6f96b2f6ed8
SSDEEP 384:nKviFavqMg38Nx8TUNTUlIxBgPSY5oNAOVFfLY1ipc5zg+AmFRYV/Vw1mRNCe02Z:vFayv3uwgGkAEY1ipj+9FRYk1mj/0aV
TLSH
T1CDC25B32EC65CEABEDEA8FC9A7096607EEE00167D59C4AD8D9D41E0D00D719D230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3f97b29553c8cb22864a1d59bb35828d3cf73df104cad96a36f4738aee1cff29
MD5 736f52fb7009583aa73de85377a92b2e
SHA1 a60e20c5cfcc79d2a58847ad6a9cd0a5165ac48b
SHA512 8a0e66ace17730dd57804896a25f479ff1641c8c9f27e3205676161aca08d1eb42ac1336f3a664d10a40b965ac37b0b7e3c7b47d76fb045c4f3f51a804c853e2
SSDEEP 384:nHviFavqMM8NL8TUNTUlIRFgPSY5frXVVFfLY1ipc5zg+A0FOOrfmHSBFPKXrN1T:aFayxwwgKtjtY1ipj+FffmHSYT
TLSH
T112C24A32E865CEABEDEB8E9AA7097653DEF011A3D98C4AC8D6D45D0C00D719D170BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2ffffaed822711e04c11b2175a07ff334c6da1afa57a39b16e324c9b95627f74
MD5 818c5dbc47960ab1ed360246a2d780b2
SHA1 f53aa9be9b12ad4edd41b509befd4b861b9e1d0b
SHA512 2b2cb510d5dfe7d706dacd08f1099b94a268d674a8f33080857ca9eb75cb60c3078de28484d1d6750baa5c72aac85954ef1c56d84913f2537772a63bc9c000ef
SSDEEP 384:nHviF8vqMZ8NL8TUNTUlIRRgPSY5f2XVVFfLY1ipc5zg+A0FOOr8mHSBFPKXrN1T:aF8yAwwgKtgtY1ipj+Ff8mHSYT
TLSH
T17DC24A32E865CEABEDEB8A9AA7097653DEF011A3D98C4AC8D6D45D0C00D719D170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 98a34a817f96bb897740aceee09ca3314b53ba5eb6da90d513a9ad0568a295bb
MD5 f5152f8c427fa2baddb370985167dcf6
SHA1 f874180b68ef4a3d5c939cb0d7a4c8926f598a5c
SHA512 417f0e2266b87e7cbc234b2933f0685a89cfebd006ac5a79b404ec6a003dfa0f35745258c3e77a615128328c72a4903d31bfd929757d19f1c4f79583cc8b129b
SSDEEP 384:niviFejccCs+Bt0S3F8NL8TUNTUlIRdgPSY5f7XVVFfLY1ipc5zg+A0FOOrhmHSX:XFIccQlwwgCtTtY1ipj+FfhmHSYVC
TLSH
T1B1D25B32D8A5CEBBE8EB8E99A3593653EEF01163998C4AD8D5D45E0C00C71DD170BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 cee1c83666bd194e60e66fa3dd428a841046d2a9fe251a60362f387cb1510510
MD5 c0a94bd88b6d4d8c1978a25bb47da86d
SHA1 6dd69b26e7004bad43d82bc31f9d4193f8f38adc
SHA512 35cbc28404b64a3081611c1a3d4245d401a9381e76b3219e50c2742d269e239625792116de7393c73447817ff367b2b8441d7b7afb560c5212d8bebb36c21ad3
SSDEEP 768:4Fayv3AwgGzMY1ipj+FffmHRYk1mj/0aV:zyv3ldiR+F2mkEj/N
TLSH
T13DC26C32E865CEABEDEB8FD9E70A6647EEE01163C98C4AC4D5D45D0D00D719D270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e42752e08b2ac8b1ba01abafcccd9588a0e1db9658fb13ceedeb5569b34d6958
MD5 ed6f3ba7539064c85355012419812c76
SHA1 bb2512406dbb0a342eff8f2e39c1933c9c5d21e4
SHA512 54ba37c3116da54f5eb652f5687cace0771b649699cafa5d196a99e3e17ad8551f10a4d469db887a10bc17abbf26bb83e7dcdc03bd63b3d7c1fb61d2d40b8b53
SSDEEP 384:nisiFejccCs+Bt0S3a8NL8TUNTUlIRdgPSY5fsXVVFfLY1ipc5zg+A0FOOrjmHSX:OFIccQ6wwgCtGtY1ipj+FfjmHSYVC
TLSH
T127D25B32D8A5CDBBECEB8E99A3597653EEF01163998C4AC8D5D46E0C00C719D170BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 1d485657d00c777425dd935afad77620c8bc8b147912c07d91231451603a9113
MD5 e09060efd8d2875da7a8ce7a11c28a01
SHA1 444f3d1fe55ad9189fdc6be3bd6dfda21f2a99bb
SHA512 27338303ea2eecffc2a9ab68871583d0a9c1024394a548bca452de4483be9d129b88e85153c194f3380116271648193de6ac95c0e3982b69614ba9fd48154cfd
TLSH
T1815151E05C3D1AD1E0BD0A7EB49B38FC80DCC626F4A4347D2864E9984A7A60D248043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b1ec49c62d6adbd0f7de55fa7ffd471f508c1d02421c260fd293bc1ac7671f76
MD5 b529ea835df4140e06bca61941c55cb6
SHA1 caaa7b6540da54f1a872f3c5335b86fb75366cf2
SHA512 6918b5270b775b3e14885be433565b996dc296e79b95efbb78beaf306455ebb7b1ef1345ef2a09273b36519b0b9aa501a71926c75f6b592915442ed61519bf98
TLSH
T1335163D18C7D5AD1D4BD0A7EB09B78FC84DCC626F4A4347D2868E9980A7EA1D604143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 9d273a8d21c2431856aae2b272137fe07c1f57c13bc51e02088b2c2af515d387
MD5 2c7ebd73bc896407ed997fe16dc52340
SHA1 538e4fd97741e368738fa09e3bafd5d38001f04a
SHA512 8fb84e7773eba4542622f7d5f020d196747a7362323dc8e8348304b8eea59581eec7099608f9310c2ccfe322abceaa1e072230c4e45d36d61c68a014f7d31bdb
TLSH
T17D5160E04C7D1AD1D0BD0A7EB49B38FD80ECC62AF4A4347D2864ED980A7E60D248083F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_2070650859\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_2070650859\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_2146878273\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4224_93809973\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

CP.exe

Path C:\temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/400-541-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/568-622-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/576-180-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1136-673-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1168-782-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1252-754-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2080-652-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2260-484-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2260-705-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2372-235-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2568-693-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3124-786-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3236-553-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3364-750-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3896-565-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3896-591-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4304-577-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4692-215-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4828-626-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5024-508-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5132-58-0x000001595D600000-0x000001595D9BB000-memory.dmp

Download