3ab60e91e228a47311cab5d8d7f6c99edb03235bfff51d012ad970af01c87f6c

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 16:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe
Size 243KB
Sample260415-t321jsgt3s
SHA256 3ab60e91e228a47311cab5d8d7f6c99edb03235bfff51d012ad970af01c87f6c
MD5 5901bff4fbac5602581ab3ce00e38812
SHA1 c114003551099fa30b7aa6daaa3ebc4710e429cc
SHA512 550b098e516f13252e2fb209281b954b12f33aa7ceacdcd22555ae2fcd2a29a109a9db56c399ea5c481dacd4b7c6b8e598118c9cdcddfba5ebfa0752f371290f
SSDEEP 3072:M+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Z:M+59tBBLkQa3lLNngoqRttA7Z
TLSH
T18834490172818031E7560B78045AE7A1467E7C384BA5D68FF7A83F796E312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2532	CP.exe
6092	hczusmkecx.exe
688	CP.exe
244	CP.exe
2180	i_hczusmkecx.exe
5496	zusmjecwuo.sys
5936	CP.exe
5328	rpjhecwuom.exe
4760	CP.exe
1696	CP.exe
4728	i_rpjhecwuom.exe
4912	urmjecwuom.sys
4496	CP.exe
4476	mgeytrljeb.exe
768	CP.exe
4624	CP.exe
2876	i_mgeytrljeb.exe
3428	uomgeywroj.sys
1992	CP.exe
3732	ytrljdbvtr.exe
3184	CP.exe
2932	CP.exe
1664	i_ytrljdbvtr.exe
2828	gbvtnlgdyw.sys
4840	CP.exe
5024	tnlgeywqoi.exe
1480	CP.exe
4200	CP.exe
5336	i_tnlgeywqoi.exe
2148	dyvqnigays.sys
1832	CP.exe
3104	lfdysqlida.exe
3984	CP.exe
2376	CP.exe
3412	i_lfdysqlida.exe
1560	avsqlidavt.sys
5448	CP.exe
5864	qnifaxsqki.exe
5652	CP.exe
5584	CP.exe
5564	i_qnifaxsqki.exe
5300	xsqkausmkf.sys
6012	CP.exe
4740	hcausmkica.exe
3472	CP.exe
2784	CP.exe
1396	i_hcausmkica.exe
5288	mkicausmkf.sys
5264	CP.exe
4364	camkecxupn.exe
4992	CP.exe
4588	CP.exe
5056	i_camkecxupn.exe
2328	pmhfzxrpjh.sys
3760	CP.exe
5516	ezxrpjhczu.exe
2360	CP.exe
4552	CP.exe
5920	i_ezxrpjhczu.exe
5232	cwuomgeczu.sys
1756	CP.exe
1140	uomgezwroj.exe
1892	CP.exe
4376	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_336395324\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\km\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_754186136\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_224000392\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_754186136\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_2059414979\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_754186136\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_2059414979\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_336395324\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1138085301\_locales\ja\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smhezxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnifaxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdyvqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axsmkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczusmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnifaxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smhezxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdysqlida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdysqlida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgezwroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dywtomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlgdyvtnld.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytrljdbvtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlgeywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dywtomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdyvqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeytrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	camkecxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_camkecxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgezwroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxumkecau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczusmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytrljdbvtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcausmkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcausmkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezxrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezxrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlgdyvtnld.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeytrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axsmkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxumkecau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywrojgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlgeywqoi.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4236	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
6020	ipconfig.exe
1548	ipconfig.exe
4872	ipconfig.exe
4636	ipconfig.exe
744	ipconfig.exe
1776	ipconfig.exe
4328	ipconfig.exe
3944	ipconfig.exe
1792	ipconfig.exe
2588	ipconfig.exe
5444	ipconfig.exe
1780	ipconfig.exe
3920	ipconfig.exe
3680	ipconfig.exe
1996	ipconfig.exe
1976	ipconfig.exe
1280	ipconfig.exe
3848	ipconfig.exe
876	ipconfig.exe
4520	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "472257445"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31247627"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207456085205145"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2397528088-2630719772-1129911217-1000\{E773B34A-B788-43C6-95BB-743841960977}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6004	msedge.exe
6004	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2180	i_hczusmkecx.exe
Token: SeDebugPrivilege	4728	i_rpjhecwuom.exe
Token: SeDebugPrivilege	2876	i_mgeytrljeb.exe
Token: SeDebugPrivilege	1664	i_ytrljdbvtr.exe
Token: SeDebugPrivilege	5336	i_tnlgeywqoi.exe
Token: SeDebugPrivilege	3412	i_lfdysqlida.exe
Token: SeDebugPrivilege	5564	i_qnifaxsqki.exe
Token: SeDebugPrivilege	1396	i_hcausmkica.exe
Token: SeDebugPrivilege	5056	i_camkecxupn.exe
Token: SeDebugPrivilege	5920	i_ezxrpjhczu.exe
Token: SeDebugPrivilege	5324	i_uomgezwroj.exe
Token: SeDebugPrivilege	6112	i_dywtomgeyw.exe
Token: SeDebugPrivilege	2524	i_nlgdyvtnld.exe
Token: SeDebugPrivilege	2240	i_fdyvqoigay.exe
Token: SeDebugPrivilege	5912	i_tnlfdxvqni.exe
Token: SeDebugPrivilege	788	i_axsmkfdxvp.exe
Token: SeDebugPrivilege	3512	i_fcxumkecau.exe
Token: SeDebugPrivilege	4752	i_smhezxrpkh.exe
Token: SeDebugPrivilege	2952	i_wuomgezwrp.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4340	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 3380	2924	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	79
PID 3380 wrote to memory of 4340	3380	iexplore.exe	80
PID 4340 wrote to memory of 5276	4340	msedge.exe	81
PID 4340 wrote to memory of 4236	4340	msedge.exe	82
PID 4340 wrote to memory of 3840	4340	msedge.exe	84
PID 4340 wrote to memory of 3840	4340	msedge.exe	84
PID 4340 wrote to memory of 5396	4340	msedge.exe	83
PID 4340 wrote to memory of 5396	4340	msedge.exe	83
PID 4340 wrote to memory of 5396	4340	msedge.exe	83
PID 4340 wrote to memory of 1608	4340	msedge.exe	86
PID 4340 wrote to memory of 1608	4340	msedge.exe	86
PID 4340 wrote to memory of 1608	4340	msedge.exe	86
PID 4340 wrote to memory of 5648	4340	msedge.exe	87
PID 4340 wrote to memory of 5648	4340	msedge.exe	87
PID 4340 wrote to memory of 5648	4340	msedge.exe	87
PID 4340 wrote to memory of 5896	4340	msedge.exe	89
PID 4340 wrote to memory of 5896	4340	msedge.exe	89
PID 4340 wrote to memory of 5896	4340	msedge.exe	89
PID 4340 wrote to memory of 2196	4340	msedge.exe	90
PID 4340 wrote to memory of 2196	4340	msedge.exe	90
PID 4340 wrote to memory of 2196	4340	msedge.exe	90
PID 2924 wrote to memory of 2532	2924	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	91
PID 6092 wrote to memory of 688	6092	hczusmkecx.exe	94
PID 4340 wrote to memory of 2556	4340	msedge.exe	97
PID 4340 wrote to memory of 2300	4340	msedge.exe	98
PID 4340 wrote to memory of 2556	4340	msedge.exe	97
PID 4340 wrote to memory of 2300	4340	msedge.exe	98
PID 4340 wrote to memory of 1508	4340	msedge.exe	99
PID 1508 wrote to memory of 3328	1508	msedge.exe	100
PID 4340 wrote to memory of 5620	4340	msedge.exe	102
PID 2924 wrote to memory of 244	2924	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	103
PID 2924 wrote to memory of 5936	2924	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	109
PID 5328 wrote to memory of 4760	5328	rpjhecwuom.exe	111
PID 2924 wrote to memory of 1696	2924	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	114
PID 2924 wrote to memory of 4496	2924	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	118
PID 4476 wrote to memory of 768	4476	mgeytrljeb.exe	120
PID 2924 wrote to memory of 4624	2924	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	123
PID 2924 wrote to memory of 1992	2924	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	127
PID 3732 wrote to memory of 3184	3732	ytrljdbvtr.exe	129
PID 2924 wrote to memory of 2932	2924	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	132
PID 4340 wrote to memory of 5008	4340	msedge.exe	134
PID 4340 wrote to memory of 2384	4340	msedge.exe	135
PID 4340 wrote to memory of 3848	4340	msedge.exe	136
PID 4340 wrote to memory of 808	4340	msedge.exe	139
PID 4340 wrote to memory of 808	4340	msedge.exe	139
PID 4340 wrote to memory of 5976	4340	msedge.exe	140
PID 4340 wrote to memory of 5976	4340	msedge.exe	140
PID 2924 wrote to memory of 4840	2924	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	141
PID 5024 wrote to memory of 1480	5024	tnlgeywqoi.exe	143
PID 2924 wrote to memory of 4200	2924	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	146
PID 2924 wrote to memory of 1832	2924	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	150
PID 3104 wrote to memory of 3984	3104	lfdysqlida.exe	152
PID 2924 wrote to memory of 2376	2924	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	155
PID 2924 wrote to memory of 5448	2924	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	159
PID 5864 wrote to memory of 5652	5864	qnifaxsqki.exe	161
PID 2924 wrote to memory of 5584	2924	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	164
PID 4340 wrote to memory of 2288	4340	msedge.exe	169
PID 2924 wrote to memory of 6012	2924	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	170
PID 4740 wrote to memory of 3472	4740	hcausmkica.exe	172
PID 2924 wrote to memory of 2784	2924	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	175
PID 4340 wrote to memory of 3180	4340	msedge.exe	177
PID 4340 wrote to memory of 3180	4340	msedge.exe	177
PID 2924 wrote to memory of 5264	2924	2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe	182
PID 4364 wrote to memory of 4992	4364	camkecxupn.exe	184

C:\Users\Admin\AppData\Local\Temp\2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_5901bff4fbac5602581ab3ce00e38812_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7fff9db2c188,0x7fff9db2c194,0x7fff9db2c1a0
      4⤵
      PID:5276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1720,i,13636863852445722720,8700246546978399428,524288 --field-trial-handle=2156,i,4579636014834287035,9380319874552523817,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:11
      4⤵
      System Time Discovery
      PID:4236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,9884944192669312559,1171299245063366504,262144 --field-trial-handle=2156,i,4579636014834287035,9380319874552523817,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:2
      4⤵
      PID:5396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,8596162838487977571,5532319497767869471,524288 --field-trial-handle=2156,i,4579636014834287035,9380319874552523817,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:13
      4⤵
      PID:3840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3396,i,12015036871469401654,1409405960413788772,2097152 --field-trial-handle=2156,i,4579636014834287035,9380319874552523817,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
      4⤵
      PID:1608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,6471949407285192165,15442056407700663984,2097152 --field-trial-handle=2156,i,4579636014834287035,9380319874552523817,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
      4⤵
      PID:5648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4120,i,5658894416445233742,7239247293179866988,2097152 --field-trial-handle=2156,i,4579636014834287035,9380319874552523817,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:1
      4⤵
      PID:5896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3928,i,13854726115876240687,11431579909711539030,2097152 --field-trial-handle=2156,i,4579636014834287035,9380319874552523817,262144 --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:1
      4⤵
      PID:2196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,7681992682023241762,10560755678821254521,524288 --field-trial-handle=2156,i,4579636014834287035,9380319874552523817,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:14
      4⤵
      PID:2556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,6232364058158529696,7797741843657153272,524288 --field-trial-handle=2156,i,4579636014834287035,9380319874552523817,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:14
      4⤵
      PID:2300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,11302816485193379145,7506628134647109604,524288 --field-trial-handle=2156,i,4579636014834287035,9380319874552523817,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1508
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:3328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,6057032445919910424,6082012058270144603,524288 --field-trial-handle=2156,i,4579636014834287035,9380319874552523817,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
      4⤵
      PID:6012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,6057032445919910424,6082012058270144603,524288 --field-trial-handle=2156,i,4579636014834287035,9380319874552523817,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
      4⤵
      PID:5620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,15619645015695795930,6610341884301308107,524288 --field-trial-handle=2156,i,4579636014834287035,9380319874552523817,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14
      4⤵
      PID:5008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,18132526166963670694,10065334359639758993,524288 --field-trial-handle=2156,i,4579636014834287035,9380319874552523817,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
      4⤵
      PID:2384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,2027293012228101687,10519915272542971912,524288 --field-trial-handle=2156,i,4579636014834287035,9380319874552523817,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
      4⤵
      PID:3848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,4107826497362715174,15770891371918703238,524288 --field-trial-handle=2156,i,4579636014834287035,9380319874552523817,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
      4⤵
      PID:808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,17806378795517429236,7061159420143279948,524288 --field-trial-handle=2156,i,4579636014834287035,9380319874552523817,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
      4⤵
      PID:5976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,10043296629637542935,12520099585072307145,524288 --field-trial-handle=2156,i,4579636014834287035,9380319874552523817,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:4400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,10043296629637542935,12520099585072307145,524288 --field-trial-handle=2156,i,4579636014834287035,9380319874552523817,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:2288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,5497109447875537652,3897783226363036624,524288 --field-trial-handle=2156,i,4579636014834287035,9380319874552523817,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
      4⤵
      PID:3180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,4475776662853157347,6910007547601716559,524288 --field-trial-handle=2156,i,4579636014834287035,9380319874552523817,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
      4⤵
      PID:3588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,5317830514024102590,9819808729502049446,524288 --field-trial-handle=2156,i,4579636014834287035,9380319874552523817,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
      4⤵
      PID:5688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3484,i,10654226482699780988,7102192995877335703,524288 --field-trial-handle=2156,i,4579636014834287035,9380319874552523817,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14
      4⤵
      PID:2484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4836,i,16433526228336464916,17020370731977842166,262144 --field-trial-handle=2156,i,4579636014834287035,9380319874552523817,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,11207436318985378113,6030428119602463360,524288 --field-trial-handle=2156,i,4579636014834287035,9380319874552523817,262144 --variations-seed-version --mojo-platform-channel-handle=1136 /prefetch:14
      4⤵
      PID:4512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hczusmkecx.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2532
- - C:\Temp\hczusmkecx.exe
    C:\Temp\hczusmkecx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6092
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:688
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2588
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hczusmkecx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:244
- - C:\Temp\i_hczusmkecx.exe
    C:\Temp\i_hczusmkecx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2180
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhecwuom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5936
- - C:\Temp\rpjhecwuom.exe
    C:\Temp\rpjhecwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5328
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4760
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhecwuom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1696
- - C:\Temp\i_rpjhecwuom.exe
    C:\Temp\i_rpjhecwuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgeytrljeb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4496
- - C:\Temp\mgeytrljeb.exe
    C:\Temp\mgeytrljeb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4476
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:768
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgeytrljeb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4624
- - C:\Temp\i_mgeytrljeb.exe
    C:\Temp\i_mgeytrljeb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytrljdbvtr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1992
- - C:\Temp\ytrljdbvtr.exe
    C:\Temp\ytrljdbvtr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3732
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3184
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytrljdbvtr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2932
- - C:\Temp\i_ytrljdbvtr.exe
    C:\Temp\i_ytrljdbvtr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1664
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlgeywqoi.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4840
- - C:\Temp\tnlgeywqoi.exe
    C:\Temp\tnlgeywqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5024
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1480
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlgeywqoi.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4200
- - C:\Temp\i_tnlgeywqoi.exe
    C:\Temp\i_tnlgeywqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdysqlida.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1832
- - C:\Temp\lfdysqlida.exe
    C:\Temp\lfdysqlida.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3104
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3984
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6020
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdysqlida.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2376
- - C:\Temp\i_lfdysqlida.exe
    C:\Temp\i_lfdysqlida.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnifaxsqki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5448
- - C:\Temp\qnifaxsqki.exe
    C:\Temp\qnifaxsqki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5864
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5652
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnifaxsqki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5584
- - C:\Temp\i_qnifaxsqki.exe
    C:\Temp\i_qnifaxsqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hcausmkica.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6012
- - C:\Temp\hcausmkica.exe
    C:\Temp\hcausmkica.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4740
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3472
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hcausmkica.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2784
- - C:\Temp\i_hcausmkica.exe
    C:\Temp\i_hcausmkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\camkecxupn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5264
- - C:\Temp\camkecxupn.exe
    C:\Temp\camkecxupn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4364
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4992
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_camkecxupn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4588
- - C:\Temp\i_camkecxupn.exe
    C:\Temp\i_camkecxupn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezxrpjhczu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3760
- - C:\Temp\ezxrpjhczu.exe
    C:\Temp\ezxrpjhczu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5516
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2360
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1780
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezxrpjhczu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4552
- - C:\Temp\i_ezxrpjhczu.exe
    C:\Temp\i_ezxrpjhczu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomgezwroj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1756
- - C:\Temp\uomgezwroj.exe
    C:\Temp\uomgezwroj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1140
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1892
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomgezwroj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4376
- - C:\Temp\i_uomgezwroj.exe
    C:\Temp\i_uomgezwroj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dywtomgeyw.exe ups_run
  2⤵
  PID:4776
- - C:\Temp\dywtomgeyw.exe
    C:\Temp\dywtomgeyw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2144
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1512
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dywtomgeyw.exe ups_ins
  2⤵
  PID:3000
- - C:\Temp\i_dywtomgeyw.exe
    C:\Temp\i_dywtomgeyw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlgdyvtnld.exe ups_run
  2⤵
  PID:2792
- - C:\Temp\nlgdyvtnld.exe
    C:\Temp\nlgdyvtnld.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5460
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3288
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1280
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlgdyvtnld.exe ups_ins
  2⤵
  PID:4316
- - C:\Temp\i_nlgdyvtnld.exe
    C:\Temp\i_nlgdyvtnld.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdyvqoigay.exe ups_run
  2⤵
  PID:5296
- - C:\Temp\fdyvqoigay.exe
    C:\Temp\fdyvqoigay.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5808
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5792
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdyvqoigay.exe ups_ins
  2⤵
  PID:2876
- - C:\Temp\i_fdyvqoigay.exe
    C:\Temp\i_fdyvqoigay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlfdxvqni.exe ups_run
  2⤵
  PID:2368
- - C:\Temp\tnlfdxvqni.exe
    C:\Temp\tnlfdxvqni.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3932
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2148
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4636
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlfdxvqni.exe ups_ins
  2⤵
  PID:4924
- - C:\Temp\i_tnlfdxvqni.exe
    C:\Temp\i_tnlfdxvqni.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axsmkfdxvp.exe ups_run
  2⤵
  PID:4884
- - C:\Temp\axsmkfdxvp.exe
    C:\Temp\axsmkfdxvp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5224
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4380
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axsmkfdxvp.exe ups_ins
  2⤵
  PID:2828
- - C:\Temp\i_axsmkfdxvp.exe
    C:\Temp\i_axsmkfdxvp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fcxumkecau.exe ups_run
  2⤵
  PID:1212
- - C:\Temp\fcxumkecau.exe
    C:\Temp\fcxumkecau.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2736
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5996
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fcxumkecau.exe ups_ins
  2⤵
  PID:5948
- - C:\Temp\i_fcxumkecau.exe
    C:\Temp\i_fcxumkecau.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smhezxrpkh.exe ups_run
  2⤵
  PID:1396
- - C:\Temp\smhezxrpkh.exe
    C:\Temp\smhezxrpkh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5672
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1280
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smhezxrpkh.exe ups_ins
  2⤵
  PID:4976
- - C:\Temp\i_smhezxrpkh.exe
    C:\Temp\i_smhezxrpkh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomgezwrp.exe ups_run
  2⤵
  PID:4164
- - C:\Temp\wuomgezwrp.exe
    C:\Temp\wuomgezwrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3684
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4520
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomgezwrp.exe ups_ins
  2⤵
  PID:5900
- - C:\Temp\i_wuomgezwrp.exe
    C:\Temp\i_wuomgezwrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywrojgbz.exe ups_run
  2⤵
  PID:3940
- - C:\Temp\geywrojgbz.exe
    C:\Temp\geywrojgbz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3588
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4636
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1776

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5200

C:\Temp\zusmjecwuo.sys
C:\Temp\zusmjecwuo.sys
1⤵
- Executes dropped EXE
PID:5496

C:\Temp\urmjecwuom.sys
C:\Temp\urmjecwuom.sys
1⤵
- Executes dropped EXE
PID:4912

C:\Temp\uomgeywroj.sys
C:\Temp\uomgeywroj.sys
1⤵
- Executes dropped EXE
PID:3428

C:\Temp\gbvtnlgdyw.sys
C:\Temp\gbvtnlgdyw.sys
1⤵
- Executes dropped EXE
PID:2828

C:\Temp\dyvqnigays.sys
C:\Temp\dyvqnigays.sys
1⤵
- Executes dropped EXE
PID:2148

C:\Temp\avsqlidavt.sys
C:\Temp\avsqlidavt.sys
1⤵
- Executes dropped EXE
PID:1560

C:\Temp\xsqkausmkf.sys
C:\Temp\xsqkausmkf.sys
1⤵
- Executes dropped EXE
PID:5300

C:\Temp\mkicausmkf.sys
C:\Temp\mkicausmkf.sys
1⤵
- Executes dropped EXE
PID:5288

C:\Temp\pmhfzxrpjh.sys
C:\Temp\pmhfzxrpjh.sys
1⤵
- Executes dropped EXE
PID:2328

C:\Temp\cwuomgeczu.sys
C:\Temp\cwuomgeczu.sys
1⤵
- Executes dropped EXE
PID:5232

C:\Temp\ojgbztrlje.sys
C:\Temp\ojgbztrlje.sys
1⤵
PID:3364

C:\Temp\geywqoigby.sys
C:\Temp\geywqoigby.sys
1⤵
PID:1548

C:\Temp\nljgaytqlj.sys
C:\Temp\nljgaytqlj.sys
1⤵
PID:3716

C:\Temp\aysqlidavt.sys
C:\Temp\aysqlidavt.sys
1⤵
PID:3668

C:\Temp\nkfdavpnic.sys
C:\Temp\nkfdavpnic.sys
1⤵
PID:5884

C:\Temp\zxspkicaup.sys
C:\Temp\zxspkicaup.sys
1⤵
PID:5300

C:\Temp\cwupmhfzxr.sys
C:\Temp\cwupmhfzxr.sys
1⤵
PID:776

C:\Temp\jecwuomhez.sys
C:\Temp\jecwuomhez.sys
1⤵
PID:2096

C:\Temp\trljebwuom.sys
C:\Temp\trljebwuom.sys
1⤵
PID:2796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avsqlidavt.sys

Path C:\Temp\avsqlidavt.sys
Size 141KB
SHA256 82f4130d701aa3ab50f0c9c316f1ed0f4b3e19028b156ed449a6a2ae33b38fc8
MD5 61939020de68ed29c495e287703e8667
SHA1 996b40110c5a2cde143160f98643c3fd0f8defa8
SHA512 8384bc76a89433850fc315428412ba86e6e38c22bad449aaaa1f53b99a59acee4799413c74aab6ae393d6319d49b9bf9030ee790c7b169117ed9ef6e976078de
SSDEEP 1536:xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T135E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvqnigays.sys

Path C:\Temp\dyvqnigays.sys
Size 141KB
SHA256 2c593aa9791b62ffc1cbca166805c2005582608275e037c8ccbec7cf1c90639d
MD5 d3d403c3f2db7003f3c2cb5ad4358711
SHA1 ad9d78e29c100fbe2ef73991cc433e7f32a14048
SHA512 5b7c88b3be45e9b4120824aa5596b812cf651a6f489724e9961e1e070d41e7a6a7eb7415fdf0a5c08a99b917eccef156795b7f2bc24e01a071f701988a00c5cc
SSDEEP 1536:Va3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Va3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T144E37C12B292D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbvtnlgdyw.sys

Path C:\Temp\gbvtnlgdyw.sys
Size 141KB
SHA256 e240dc19e16f90a38428df1880e4cf88e63cf7beb4fc38514acef784239b36a5
MD5 65f5d57590768a61ca16560948f6b739
SHA1 6fcc7defb032215d941f690f9931ae3405d2c52b
SHA512 972b6d7da0af90e967d6e6ab67e3709655c6f5df2fc02cc015840889e6e11bfe43350eba75ad4d98b720640cdfe47246d0b26126a1ddcfb9aeed566273dd21c9
SSDEEP 1536:7a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:7a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T113E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hczusmkecx.exe

Path C:\Temp\hczusmkecx.exe
Size 243KB
SHA256 f3d40c4d0114f09c3145327c2a38b2baa30d8cbb4949993d95503b5c87dad4c9
MD5 21fb3b89f7318b8fb9a1bb235e5172a2
SHA1 37d14b320157bd8f10bbcafd0b48c389ba4bda39
SHA512 413412028c30d73e782c72999877ed5e22f5dbec1ebc4a30645f8e4338e5b044146f58a14304d7a120987f56111e2c16c66b90b9260f982937c01b41cd674a61
SSDEEP 3072:9+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7i:9+59tBBLkQa3lLNngoqRttA7i
TLSH
T17A34490172818031E7560B78045AE7A1467E7C384BA5D68FF7A83F796E312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hczusmkecx.exe

Path C:\Temp\i_hczusmkecx.exe
Size 243KB
SHA256 8f452fa040529a3d0b4fb0448cd2f5279fbca78d3606c2e63ddaaadd89455c24
MD5 eafa728048ac4d64fcf80db886717642
SHA1 b2cac500fe07558a1d681b3edc07a55a35d9f939
SHA512 876e1d85d24b06702cc1fccd397dc181f0bb980c49bda4edc232d5bb92a4dd0ce51203ca0d074420347ec692bfb4170e56587c52a29c6120cca06527fb1e885e
SSDEEP 3072:M+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7V:M+59tBBLkQa3lLNngoqRttA7V
TLSH
T15734490172818031E7560B78045AE7A1467E7C384BA5D68FF7A83F796E312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lfdysqlida.exe

Path C:\Temp\i_lfdysqlida.exe
Size 243KB
SHA256 f058f25f5bfdaf19314d9a7714edc252ca6e964c19f783d20883bbf7e5fb4115
MD5 420dc66af8e0137b57cc1011509b6411
SHA1 3304b5660c9b7581189ee6f158ee62227a357ab4
SHA512 f8712f27265b3237e6a1470d94c51d93fd1974f9879005ef7aff06fa77d75c9d22372435037c590c66841e50db2fecc22fd98f4ac043e1cc83721a369ebbbdba
SSDEEP 3072:i+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7X:i+59tBBLkQa3lLNngoqRttA7X
TLSH
T11634490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mgeytrljeb.exe

Path C:\Temp\i_mgeytrljeb.exe
Size 243KB
SHA256 0f113208c4797010e79d8fe2db138c6fcf93bc2577b90a18893074be60cedb19
MD5 b751f4b9cfd3d7ddddf1f44574cc96f9
SHA1 6450d3b61673b723eaab489e35302701123639a4
SHA512 247614ebc71c3231abab7da45703414442b08c438212e0fc4039bbf760efba10fe10ebe4fdc385e23db227a37e37ee12fff18383eec6853429d2613424c0b537
SSDEEP 3072:e+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7H:e+59tBBLkQa3lLNngoqRttA7H
TLSH
T16134490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpjhecwuom.exe

Path C:\Temp\i_rpjhecwuom.exe
Size 243KB
SHA256 35e42c55bde3c49419dec40bd48e7a2f07b3d2117e7291d864e5ee9263b715a3
MD5 f98b54516f88722f9887bb913cacdc55
SHA1 b40085646176588ca2eda4a71dd65db270af33b1
SHA512 6cf6e4e8db1ede5289c1649a51594ea48004b83be86f913b5d6b78bf530c3352fce5233c8e8a995600ad7f7ff834f35de962d54e4f8ba65af66a13167ea52a83
SSDEEP 3072:Q+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7x:Q+59tBBLkQa3lLNngoqRttA7x
TLSH
T1AE34490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnlgeywqoi.exe

Path C:\Temp\i_tnlgeywqoi.exe
Size 243KB
SHA256 9d54d027ec64258fbc0aac3d8810031529ac145988f97b2bb94d77e4dc704ba5
MD5 b1a034c7ddc2ca0bfd53a1dc8691d68f
SHA1 fcfbfd61b020c7ab8f4c6e6ddee55acc7634e291
SHA512 ab9462cd6e413c38da8c1d34addddd82b15abd2819208607b5a487a8236f0bb0ea8c393373c7f6d15ed8317b9666bf95a4119ddaf4329ea4e2c34d5d5b50dac2
SSDEEP 3072:z+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7E:z+59tBBLkQa3lLNngoqRttA7E
TLSH
T11434490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ytrljdbvtr.exe

Path C:\Temp\i_ytrljdbvtr.exe
Size 243KB
SHA256 efbd1a61705e0ce26c884b76bf9fc11253420b8a17ae66e8b61be5d3ca0edb00
MD5 50d39f100beb8f5a7f7157dead16a75b
SHA1 d18ed1f9f547cbb7ebc8372748e9c98fe9c7419d
SHA512 547fbdd6b27be3ed0a2118a568da8099d5a78779e833eb708bdd49f228a687d991b7ef8b8219475ee5d0eea09c3b6491e079c456006995da49010d2392aa11b0
SSDEEP 3072:E+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA79:E+59tBBLkQa3lLNngoqRttA79
TLSH
T1C934490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdysqlida.exe

Path C:\Temp\lfdysqlida.exe
Size 243KB
SHA256 76b5ea5a727a6a6a87e5440661523dda1364b8c4df7d12916fe0eedb1e9ce106
MD5 cd3daddac40a054e24da0279fff4f5ff
SHA1 6a9486d00759722a7fcbc27103a5d1af9782c043
SHA512 69a674c62c56990f22b783fadf04f4f879ba18ecc40f44d740aa91c17cf76dd95acf8b59543b37d9539f30dfcd0618d4d979a24fec47560ca8f72c3674098b5e
SSDEEP 3072:9+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7S:9+59tBBLkQa3lLNngoqRttA7S
TLSH
T10E34490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgeytrljeb.exe

Path C:\Temp\mgeytrljeb.exe
Size 243KB
SHA256 d5420251e54f531f94d6c52f4641254971e9a9745f647653ef12e800851883f3
MD5 cc267eebcc77651f867022e3a6e94cac
SHA1 d4191ca794bc52b541ab933eb81be4f2a77a8a46
SHA512 274d565b0d82e533eb6c8489052790fb508570a3092d915cba002c70187d38219fd2d603b3cf4f125dee232d55ab9e89f39c95ccf3bb26f31e434dfd3af3a291
SSDEEP 3072:p+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7O:p+59tBBLkQa3lLNngoqRttA7O
TLSH
T18D34490172818031E7560B78045AE7A1467E7C384BA5D68FF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhecwuom.exe

Path C:\Temp\rpjhecwuom.exe
Size 243KB
SHA256 5fb31e92762936341cafee0787dc4f6927fedee7c7067cdcdcaa777755be6659
MD5 b5b8d8b9b716450d75f2b9ae1baef297
SHA1 65aaace7c3f8af0d09c13cb8cc0065f84394a9af
SHA512 314b52b46346bba4e9482b40fe9205b5eb72f16e3a9152eacf17e6eeb10c1b3d40acee455d90eb35f04194f06ffc879122e7da0741bf56ce3bc23c76be768a87
SSDEEP 3072:C+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7L:C+59tBBLkQa3lLNngoqRttA7L
TLSH
T1D434490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlgeywqoi.exe

Path C:\Temp\tnlgeywqoi.exe
Size 243KB
SHA256 2b6a2d38af6ceb649c8d1aa310697d6ea23cf905b4ae79759e119a30b73de6bb
MD5 e0e53394f36ff667841e757b47e43ae4
SHA1 fa3b49db31e99a7176fa66fac687754610c832b4
SHA512 e191feeb11da662661cb4b984a12ca6980d19924507feb3266e3e4ffff6bd056c9892c8eb60b8205674d2c66a7aa4f37bba466044ec04ddb25def516d2e9ff9d
SSDEEP 3072:T+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA70:T+59tBBLkQa3lLNngoqRttA70
TLSH
T1CF34490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomgeywroj.sys

Path C:\Temp\uomgeywroj.sys
Size 141KB
SHA256 fa59ae2a4850d6017c0129ffed0f55d12f20455d3da4857158a51a8786eeccab
MD5 4671d5c9907bc05c62e55a1726990955
SHA1 d74cf8f0186147cbf7bcfeef43be815acb7e943c
SHA512 ba8e93852a5ed86428858f6649a101a21c6413e08e3336dfe4b560e4e26c0945f485cbaee39f03d7f301cc07e2834bdb4fd336525a12ba333725090451a1126a
SSDEEP 1536:7a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:7a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D3E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmjecwuom.sys

Path C:\Temp\urmjecwuom.sys
Size 141KB
SHA256 559720858624d70445edf0d97254582d31c8116b0e8b6e41d20e5970f3498db6
MD5 e04be4d456078aecbbe3e94514052197
SHA1 54eb04df0320af198c638f50b228a8ad6553fa5f
SHA512 e743a9448de8bbc30aec5a86afd6de0938795349b6b9a76f2dad5f79d31ff8c804b987961967152df4c79e05f94bcc64e3e53b9f21d92a4331ec9343ca9c4d74
SSDEEP 1536:pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A6E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytrljdbvtr.exe

Path C:\Temp\ytrljdbvtr.exe
Size 243KB
SHA256 e90cb60733a3413c9dc66a91b588645ce8ae84cc5d313c043b880898fef660f4
MD5 762107db9def9107fec98925b14da5fa
SHA1 db292bdc56d3a9dbe201769517ae67f9e4051934
SHA512 b8afc5e720c1bad8b8fd6bbc80314c029c7981d2dfa2ed694a038abfc3f511d3a5739ed4a8aa073045d6cf80a57a84d171a0a71485555cc5484cd7b41b995724
SSDEEP 3072:7+h3lvbtBBLRj2Jhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k:7+59tBBLkQa3lLNngoqRttA7k
TLSH
T11334490172818031E7560B78045AE7A1467E7C384BA5D6CFF7A83F796A312D3A93B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zusmjecwuo.sys

Path C:\Temp\zusmjecwuo.sys
Size 141KB
SHA256 172e0fc073a36a6a3c4a592a0a4753b385db9670f4f34c6e7f13bfa1d3427779
MD5 8837d8ada6945f7237a487cc41d29d57
SHA1 479342b22d06a1294d5ca78679c095775ba74b37
SHA512 d0eafbe1e28ba878c1c4ac2ecc277c0e14752a86661361f2c0d57b1eb772466b3465705abb401c926f8bae90c8390afca5a9dd1ba7c5d7fe2dc9e51ed45dbba2
SSDEEP 1536:4a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:4a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T11AE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2172811336537a33607e0aadb9c5ba8cadf28b2a4fcb84d32213c685b1c34544
MD5 c6c88b3fb919f1f75228e4aff327fe5c
SHA1 70428f4ae69437730ef237674398113e1a3f3017
SHA512 1cda50c8b022751e3d3a7c73ffc9350fe02786e3000fa887544b774366bd092e165982f8e834c7eb67dc7a078a4dd76c0d5370912b7c3c7b95fc731b504ce5e8
TLSH
T19FD0803D1572BCB4C499DA714456372B6E1DCCE24DC65F116462356D4D9700186D72D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1eac715bceeccb15cc45a13a9b914a80ac00eeb9f178f8c94511c17b32720b1a
MD5 b42dc01f081a5fcaa564011a4fcbf9f9
SHA1 8bcee7db87d1cadc63412a4981a1a46bc8ac9a01
SHA512 70a6ffe00e23a197554908a478c6e06671c1c239e2134c7e2eb172c03b4237bd91a7d62847a63e20268dbfb9c9b77ec1b8df3b9c0e528df0aaa3f9289c5d6452
TLSH
T101D0803D1572ACB4C485DA714456372B7F1DC8E24DC65F116462357D4DD700186D72D3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 599708927230e17145f02099cc52970469074ba3cc0d2ed2bd7c955cf7237c39
MD5 1f041bcf1c0e3dac49b2af4b02ee0d52
SHA1 c510b31851fc6921538f56d8a48f2bbc5127f4ac
SHA512 eaf0943c7ae74bcabbae5dd2c3536737917783e999d75ce5636d7b1d7ffb95cdaccbeae151e603ca158975b0d39cbb4f83f60cf353064e94d1a5b8b3ccefcda6
TLSH
T191E022FAC8359C7718FD572861604B06EB20135B2B91964F7B3C820C8FF1B3B468589C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 db1b7be9255c5188707397af263cb3134bc7fa97b56972bb17b99800a74d460a
MD5 162a273f9cf25baff26a0fd8a1655eaf
SHA1 ed4c78ebf5a2c81f10fc813301265bffcb614ec9
SHA512 8631c95f69784e5b8d4a822aed757b14f9e9080ed5ce0ce3c4ccecbcfa1666747d001574fa3d49f91f078ebc39ce8939c4690d93bd80827f8f2dbd72d248f8ef
TLSH
T1AC41D0F3C3E8856E890195F0A728BE2FCE2D0950432C7D5AC9E4AF1B93E2471E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 86e8a9b21651d2b2ddccf1e82d2755cae2e280538c1a607bf6f5da5815cbd433
MD5 35f26aea2c7bdb8d3c4ef31908491a08
SHA1 e6394d98f3623037e92f1b2ef2ea0492188ffb88
SHA512 3c57703ac7894ab592e195fa0f39b644cbbb413b685391bce8675ce7ef7d2494e544a15e0049f8f7441207dc53511077eec06719ffd490279b6ad390f1c0e7d9
SSDEEP 192:sxZ+6RsyMqZ/K1Ml8UQ6cD/fXsJNQdrskIIDPGKzodpZk/W6+WNsLB/Y0ETUNnCr:sxZLdqJD/fXsJKhJtLQ+/bG/5wjGXh6
TLSH
T13A72F81A6A3889778CDBD619FA45BB53D7F9152792841E44AAFCCB0C01D6BDD220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 499fce19164b1ac6785818410c0c57d821ca33e94e4dd6ba5e05ffa37a1b56c9
MD5 d3df86eed5cade99bb5ff8e94838df3c
SHA1 135edbd897578523c97a5107b711056c9b2c0998
SHA512 47136823d0013d3feb414e491c6132cdde4ed3943468caca2fe2f7a304c90c7a8de0210b465e4e9a30c956a0e6d470a0d634af444b822a3676ed74b9d8191da7
SSDEEP 192:sxZ+6RsyMqZ/K1Ml8McD/fXsJNwGi2IIDPGKzodpZk/W6+WNsLB/Y0ETSjkzC3u3:sxZLd0D/fXsJuX2tLQ+/bG/5wGGjL
TLSH
T14372E8166A3899778CDBD209FA45BF53D7F91563D2801E44AAFCCB0C01E6ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 a7c78e9f80576802a7d43342ebcf13bc91b8ccd3898503241497a58831e54449
MD5 4cfd8e2617b1a0143f16aa7a3be1135c
SHA1 20683ec26015064931ddf6a4e0b68288e860b176
SHA512 cc9fbac94c746f49dba7f7cd522f805255a81f52faf66f56fc2631fc2e975734dfcb2e7432f2d331a3a01993f13db4d6c270296af50140339e08a9b6281562b0
SSDEEP 768:UnjXV8Zp2gv7pLuLnbAWRmAoQ7k8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3xDwvLly:UnjXV8Zp2gpEnbAWRmAoQ7ku1jaKxDwY
TLSH
T1F1030B3B680CCB7E4F844E9CEC27BE9E6DE8018B9698895447FA444C03C66EF551B1DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 78cdf95f215fbe4d5a071703714305ce17ac24a81adf4871620a50bb3db248b9
MD5 f531605e8a1ce905eb537696b731b2a1
SHA1 ba2ac590c856915cad2e2b9b83c0011d1eed7f16
SHA512 694e6bcc74fe35244aa6f5fa6de1c91637faec0b1009ce25235d23b6bc03d0e8cafd5c3e43b825bfd9e47273d50bd4c452e9f2fd232d3c198997f651a087ecc8
SSDEEP 768:UgjXV8Zp2+m7pLuL/AAWRmAoQ7k8F1+UoAYDCx9Tuqh0VfUC9xbog/OV32DwvLlK:UgjXV8Zp2+GE/AAWRmAoQ7ku1jaK2DwQ
TLSH
T1B203FB3B280CCB7E4F844E9CEC27BE9E6DE8018B9698895447EA444C03C76EF551B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 2c6f445b1321af216d13346e2ab6b2ace25868bf2bbcd5a56addc54b0fd95f76
MD5 4fef3ccc48255981758d94cc086db94b
SHA1 eaecf2466b75c1aaf5fd15c9d4967ba6c97cac0d
SHA512 c5a60a5f6c6d7d5aecc5527ea99e3361e6f45b3a456cb0a1d5b14263b63162ddd89b1d568a9c5d0448e82558a04b5f7973202cd25abdd46f2e218b3832e83928
SSDEEP 768:axVJBTwmM9gpJjvp7bn0JlPVZQJmFdXiKTCn/uhb3:axVJBTwmM9gpJjvp7FO3
TLSH
T137B22B11357B03813ABE259A81A1B56F46C230B33158F42B7BF841EA4F66E24DDFE4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.4\data.txt
Size 145KB
SHA256 7dd75cb36b4cc7c5f2df67bac823b9d9d2c3653172ff73ce6cccd39683970a08
MD5 79f8327a9cd094a4edb1fd159e289e95
SHA1 4d3615906d16d8a807e1bd394bef139507ce12ff
SHA512 9ab212871ccbe15c062da9898a782d75d208a2591b4c804df3e32581751801889f8cad8fae53dc0307cb89172c4536d35e44c06d63df6928ec4c4446a55a1343
SSDEEP 3072:tPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEEY6lCuZY:9X1aI5aZoKzMJ07NtxoY
TLSH
T1C7E3F110CDC51FA8CEAC362C60FE0F1A63D1C69D4867A5C9DB63FD0A6F97A0492275C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e5260e609a1ae6248478f65c0a3d9730c37cf9c9fe05bbd4e4b3f87e8d8f9fe5
MD5 b675ec5ec5bf6bce2621870717a450b6
SHA1 477b581c54680fc861a5b04647c15cef8d3bfb16
SHA512 5dc1e7e513997c3bd206171f6bf58a4163aaf85f83b52f9973ee4a0a9b417cf35ff06208771a9696ab236f5136319632be19ec2fc5985559ec5f391023e270d0
SSDEEP 384:ngiFejccCs+Bt0S3UD8NW8TUNTUlIRSvH2d7BrfPKVoLM8JmTXd+U3/hubeJKmY/:7FIccQM9wghNKmAwm7dr3/U3brH
TLSH
T1B8D24B36E8A8CDB7ECE78ED8B34A3643EEE00167958C5AD4D9D95E1D009B1CD230BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 3d2a348d04bfda5dabbecaef3cdd84ba5e618efeaad6b92dd8fedce8f0d53eaa
MD5 4e397ebf1b224e7514436ee14a941f4b
SHA1 46468011ccbb3f44be4ee5f290c53180928b3e06
SHA512 e2ea30566c94f5fa6f2754461b050d3c1603899cbb8af0ba863764f01c93625d1ebf1782da771cb18dc1c94a9a6552fd6eb8a23bb6335bc5507a2d4ccbb65bcf
SSDEEP 384:npiFavqMg38Na8TUNTUlIxBvHT4fGBrfPKVoLM8JY/vdnS4mtmJ+frNlk+5vI+u:AFayv31wgsfiKmAwY/vdS4smETC
TLSH
T1E7C23B35ECA8DAABECE78FD5A7497A17EFE00157D58C4AD4CAD81D1E009B1DE130B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 dd3150c3a614226db66bd2e7115d0946b7c811196a76d4279d20dabd50c9ba4c
MD5 5277b27aeeee9e1e5da0b04f891ff714
SHA1 7d31d257218dbaa45e627e32245dad541a51b46f
SHA512 d567e5fee76fcde2f5bdd706cb1a887595df46e9727871de50b0393c41f26c31c5db1165242b91e58f57767b2a81c379f9bf06df6c495fbddcf889bc98ce27ea
SSDEEP 384:ngiFJjccCs+Bt0S3I8NW8TUNTUlIRGvHJ/d7BrfPKVoLM8JmTXd+Us/hubeJKmY/:7FJccQo9wgW1NKmAwm7drs/U3brH
TLSH
T113C25B36E8A8CDB7ECE68ED8B34A3643EEE00167958C5AD4D9C95E1D009B1DD230BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 11f9e6c6bbd33d35d5d76238a8e60994276bb79f13ff9ecf4c8ba7f7731eda26
MD5 2feb4ef5afa8823b22d4faaf73fa2da5
SHA1 bb957eceda0f145b6853dec714eef637b7fe10a7
SHA512 33065309f02674f1a149443bdbd94c514fa0dd55f253fa6c22b1d5d90ac56fc8e2bcacd6ce22bc402827993973299c62cda8da1563ab5d87b68377ea595d1184
SSDEEP 384:n5iFejccCs+Bt0S3cD8NW8TUNTUlIRSvHjd7BrfPKVoLM8JmTXd+U3/hubeJKmY/:QFIccQE9wg0NKmAwm7dr3/U3brH
TLSH
T1C7D24B36E8A8CDB7ECE78ED8B34A3643EEE00167958C5AD4D9D95E1D009B1CD230BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 93b807379814fb3193b89f98ae111270f634b74d97b3357ff66a0940d829f8fb
MD5 082e396ffd1b74a60828ada736321d75
SHA1 717f7b5729825c977ee054e436862112757ca426
SHA512 0da300a1180c39604491f8c71abc8d16dc653428478afb4370d0112d33ee0ec1aab7876e9aa84143de1f352ac86afb1a0538ac3d883031501581927884b99816
SSDEEP 384:nWiFavqMg38N68TUNTUlIxBvH9k4BrfPKVoLM8JmTXd+UH/hudnS4mtmJ+frNlk7:9Fayv3NwgWAKmAwm7drH/UdS4smETC
TLSH
T144C24B35E8A8CDA7ECE69FD5A7497653EEE00167D88C4AD4DAC81D0D009B1DE170F812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b8f731570cfcf7b569f286c2978cf7dc228bece95ff6e37e62812c052ae56e10
MD5 3e69ab37f9418d12c20ef672892b3af6
SHA1 a188fca48057461fb872640a9cda2ff3f39c86a5
SHA512 579cc71d259666ce203b46b2f492b3ffcb91b978aefaff1e33a0c9943bed00ca66ae1cdd37010ef43c17f4237a2b32abe7616ed079c1def45f4486a330a419c3
SSDEEP 384:nfiFejccCs+Bt0S3s8NW8TUNTUlIRSvH1d7BrfPKVoLM8JmTXd+UO6/hubeJKmY/:qFIccQM9wgqNKmAwm7drO6/U3brH
TLSH
T12DD24B36E8A8CDB7ECE78ED8B34A3643EEE00167958C5AD4D9D95E1D009B1CD230BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a883f1b507fb9428aee7f5aed1952578fba8d4558fb74de52126e0ebb5e9deef
MD5 e222bc00812d34ead83c4d629d7ddd3b
SHA1 08a4c587e2203da8d0aa7b78c0f67ed9570c445a
SHA512 9054320e00b8454efc8fc4543a1c3b204f525720d356db049f673817446063e725abcac4e86f34c04bec99354dd5348eeff8660807ab36da70c3149377abbcd1
TLSH
T1745151E04C3D2AD1E1BD1A7FB48B38FCD5ECC62AF4A4347D6824E998467A21D608447F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 db393ff82aef84ce474c2a50a0af0cdd1a5387a01ac2a809516d8a0304d3ba5f
MD5 1824848c3e414bdb96f4a054280e453d
SHA1 18cec4add89233a03c2e7c7841588655ca28eade
SHA512 427e71174a916b99f31cd4fa8a3182eac098a97d8b6fbb400405a998d44a778ba6ae4fcb898cdb32ef905aede5260e6c778b50cc2d5bb012018b661ccadb10e3
TLSH
T16F5151E05C3D2AC1E0BD1A7EB48B38FC95ECC72AF4A4347D2814E998467A60C648447F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 9ab984842f0baa832b53bd8d3a1d42dfdf7ad335609e65722cecc3b0b729b8c3
MD5 68f0102840dd2af75c4920c248cf24e0
SHA1 4cd4135cc4367d2153affc5057f9e9513f0f4d3f
SHA512 55e03402b24f0c78e1836893ae365b98d3ece05b011eab45bd1478f59e7ae18e279bb066a1de6e5e96b54cbc5ead89758334b677eb0f824c7aed9c9a75c22b46
TLSH
T1865140D18C3D2AD1D4BD0A2EA48B38FC95ECC62AF4A4347D6828E998063A61D608043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 bee95520a6b5f3e628f3d00d879ca3571b3971c35abb580be2f448b52470707b
MD5 24b5f513078f65870d0ac29a479d81fd
SHA1 4081d0b8f59987d0130379fee05324b6d8c395dd
SHA512 1a20170f0ea89deaa7dc83216fef110a5a12d1b3a0dcf37a37e36af2c6e7f65bf2d238c1190db8847515b0973cbe7e0eb645a529915a9b9cf32608c0588069c2
TLSH
T1B25150D15C3D1AD1D4BD1A3EA48B38FC95ECC72AF4A4347D6824EA980A7E61C608443F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_2059414979\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

v1FieldTypes.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_2059414979\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_224000392\manifest.json
Size 52B
SHA256 36565d2ebd6c48537cb3e6fe24ac74ca68dda18b3f0f8be13f47d01aec181d62
MD5 152537f005b8875f68b1af4ac41c46f1
SHA1 70f529940adc1404721cbc1542c65eee289216ff
SHA512 bfcf5e9523b9268e1b0a546b5786498b1decc624ab1ba4fdd89e2e92edacd20800d731fef37c98aef45c64268d267b97d09f78124167685dd152bacd620dc9d0
TLSH
T1D0900260053491171AC10E546570F8859391661955850D1D0545154806A546CE051298
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_336395324\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_336395324\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_754186136\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

CP.exe

Path C:\temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/244-163-0x0000000000990000-0x0000000000A0C000-memory.dmp

Download

memory/688-61-0x0000000000730000-0x00000000007AC000-memory.dmp

Download

memory/768-201-0x0000000000970000-0x00000000009EC000-memory.dmp

Download

memory/776-858-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1212-838-0x0000000000830000-0x00000000008AC000-memory.dmp

Download

memory/1280-860-0x0000000000620000-0x000000000069C000-memory.dmp

Download

memory/1396-861-0x0000000000860000-0x00000000008DC000-memory.dmp

Download

memory/1480-482-0x0000000000960000-0x00000000009DC000-memory.dmp

Download

memory/1512-692-0x0000000000960000-0x00000000009DC000-memory.dmp

Download

memory/1548-732-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1548-756-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1560-537-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1560-596-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1696-193-0x0000000000960000-0x00000000009DC000-memory.dmp

Download

memory/1756-681-0x0000000000830000-0x00000000008AC000-memory.dmp

Download

memory/1832-529-0x0000000000830000-0x00000000008AC000-memory.dmp

Download

memory/1892-680-0x0000000000820000-0x000000000089C000-memory.dmp

Download

memory/1992-233-0x00000000009E0000-0x0000000000A5C000-memory.dmp

Download

memory/2096-875-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2148-773-0x0000000000870000-0x00000000008EC000-memory.dmp

Download

memory/2148-509-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2328-631-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2360-638-0x00000000009A0000-0x0000000000A1C000-memory.dmp

Download

memory/2368-774-0x0000000000880000-0x00000000008FC000-memory.dmp

Download

memory/2376-535-0x0000000000660000-0x00000000006DC000-memory.dmp

Download

memory/2532-62-0x0000000000650000-0x00000000006CC000-memory.dmp

Download

memory/2784-599-0x0000000000980000-0x00000000009FC000-memory.dmp

Download

memory/2792-735-0x0000000000970000-0x00000000009EC000-memory.dmp

Download

memory/2796-906-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2828-833-0x0000000000980000-0x00000000009FC000-memory.dmp

Download

memory/2828-242-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2876-770-0x0000000000960000-0x00000000009DC000-memory.dmp

Download

memory/2932-240-0x0000000000630000-0x00000000006AC000-memory.dmp

Download

memory/3000-731-0x0000000000990000-0x0000000000A0C000-memory.dmp

Download

memory/3184-232-0x0000000000560000-0x00000000005DC000-memory.dmp

Download

memory/3288-734-0x0000000000890000-0x000000000090C000-memory.dmp

Download

memory/3328-66-0x00000240B8DE0000-0x00000240B8E4F000-memory.dmp

Download

memory/3364-690-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3428-226-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3472-594-0x0000000000820000-0x000000000089C000-memory.dmp

Download

memory/3668-771-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3684-877-0x0000000000850000-0x00000000008CC000-memory.dmp

Download

memory/3716-755-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3760-639-0x00000000009B0000-0x0000000000A2C000-memory.dmp

Download

memory/3940-909-0x0000000000840000-0x00000000008BC000-memory.dmp

Download

memory/3984-528-0x0000000000960000-0x00000000009DC000-memory.dmp

Download

memory/4164-878-0x0000000000730000-0x00000000007AC000-memory.dmp

Download

memory/4200-507-0x0000000000590000-0x000000000060C000-memory.dmp

Download

memory/4316-738-0x0000000000990000-0x0000000000A0C000-memory.dmp

Download

memory/4376-689-0x00000000009B0000-0x0000000000A2C000-memory.dmp

Download

memory/4380-820-0x0000000000980000-0x00000000009FC000-memory.dmp

Download

memory/4496-202-0x0000000000590000-0x000000000060C000-memory.dmp

Download

memory/4552-677-0x0000000000830000-0x00000000008AC000-memory.dmp

Download

memory/4588-630-0x0000000000670000-0x00000000006EC000-memory.dmp

Download

memory/4624-224-0x0000000000960000-0x00000000009DC000-memory.dmp

Download

memory/4636-908-0x0000000000980000-0x00000000009FC000-memory.dmp

Download

memory/4760-186-0x0000000000630000-0x00000000006AC000-memory.dmp

Download

memory/4776-693-0x00000000008A0000-0x000000000091C000-memory.dmp

Download

memory/4840-483-0x0000000000960000-0x00000000009DC000-memory.dmp

Download

memory/4884-821-0x0000000000990000-0x0000000000A0C000-memory.dmp

Download

memory/4912-195-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4924-809-0x0000000000730000-0x00000000007AC000-memory.dmp

Download

memory/4976-874-0x0000000000980000-0x00000000009FC000-memory.dmp

Download

memory/4992-618-0x0000000000960000-0x00000000009DC000-memory.dmp

Download

memory/5232-678-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5232-710-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5264-619-0x00000000009B0000-0x0000000000A2C000-memory.dmp

Download

memory/5288-600-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5296-759-0x0000000000980000-0x00000000009FC000-memory.dmp

Download

memory/5300-560-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5300-834-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5448-556-0x0000000000960000-0x00000000009DC000-memory.dmp

Download

memory/5496-165-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5584-559-0x00000000009A0000-0x0000000000A1C000-memory.dmp

Download

memory/5652-555-0x0000000000670000-0x00000000006EC000-memory.dmp

Download

memory/5792-758-0x00000000009C0000-0x0000000000A3C000-memory.dmp

Download

memory/5884-810-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5884-835-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5900-905-0x0000000000960000-0x00000000009DC000-memory.dmp

Download

memory/5936-187-0x0000000000960000-0x00000000009DC000-memory.dmp

Download

memory/5948-849-0x0000000000660000-0x00000000006DC000-memory.dmp

Download

memory/5996-837-0x00000000009B0000-0x0000000000A2C000-memory.dmp

Download

memory/6012-595-0x00000000009A0000-0x0000000000A1C000-memory.dmp

Download