c435f5f9ed02a5912deaaa9f0bcc0083bf2fe8d25736890acddfefab24ce0091

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_c8c82b78ec94e980d307ccd3e31ff2e6_elex_rhadamanthys_stop.exe
Size 243KB
Sample260628-xtt55acz3n
SHA256 c435f5f9ed02a5912deaaa9f0bcc0083bf2fe8d25736890acddfefab24ce0091
MD5 c8c82b78ec94e980d307ccd3e31ff2e6
SHA1 9ce9b09e29da98f2393ea78a3c5d78f45f55b94f
SHA512 22d5954530e257b4829a0340397cc588691e15f2e4d2dad692568ed453a4af4ebcf13f9d1c53d53667582772da186a01d12b0b12a7539a3c01f7ad9407042657
SSDEEP 3072:HqCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7BS:1vMsLaOa3lLNngoqRttA7g
TLSH
T1AB345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3980	CP.exe
5636	faysqlidxs.exe
5648	CP.exe
5932	CP.exe
2788	i_faysqlidxs.exe
4512	qkicavsnkf.sys
3544	CP.exe
4600	kicausmkfc.exe
3500	CP.exe
5184	CP.exe
3820	i_kicausmkfc.exe
1252	nhfzxspnkf.sys
4092	CP.exe
4692	zusmkecwup.exe
5348	CP.exe
4052	CP.exe
5408	i_zusmkecwup.exe
5712	ecxusmkecx.sys
2788	CP.exe
4148	hczusmkecx.exe
5292	CP.exe
1816	CP.exe
2072	i_hczusmkecx.exe
952	hbzurmjecw.sys
5960	CP.exe
6008	ecwuomkezw.exe
3820	CP.exe
4596	CP.exe
4840	i_ecwuomkezw.exe
5328	bzwurmjgey.sys
2848	CP.exe
2932	gbywrojdbw.exe
3152	CP.exe
2936	CP.exe
3324	i_gbywrojdbw.exe
3660	rojgbytrlj.sys
5852	CP.exe
5828	lgdywtolge.exe
2160	CP.exe
828	CP.exe
2924	i_lgdywtolge.exe
404	jdbywqoiga.sys
4612	CP.exe
952	dyvtnlgdyo.exe
3548	CP.exe
1948	CP.exe
4180	i_dyvtnlgdyo.exe
5332	aysqlidayt.sys
1208	CP.exe
4172	vtnlfdxvqn.exe
2724	CP.exe
2568	CP.exe
3464	i_vtnlfdxvqn.exe
2156	snkfdxvpnl.sys
3012	CP.exe
5444	nifaxsqkhc.exe
5428	CP.exe
2044	CP.exe
5240	i_nifaxsqkhc.exe
1852	vpnifaxsqk.sys
3024	CP.exe
5372	nhfzxspkic.exe
4528	CP.exe
6076	CP.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_1048606007\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_1055510680\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_1055510680\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_971168824\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_967745538\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_967745538\office_endpoints_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_971168824\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_967745538\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_967745538\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhezwrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlgdbwqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zusmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomkezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgdyvqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicausmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczusmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifaxsqkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhcxupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgdyvqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uspkhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faysqlidxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomkezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdywtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezwuomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlgdbwqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zusmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhcxupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhezwrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecxupnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbywrojdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uspkhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faysqlidxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvtnlgdyo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvtnlgdyo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifaxsqkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icaysnkidx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icaysnkidx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczusmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezwuomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecxupnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_c8c82b78ec94e980d307ccd3e31ff2e6_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbywrojdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdywtolge.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2216	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2724	ipconfig.exe
4436	ipconfig.exe
3200	ipconfig.exe
5560	ipconfig.exe
4276	ipconfig.exe
5892	ipconfig.exe
1252	ipconfig.exe
2320	ipconfig.exe
5644	ipconfig.exe
6068	ipconfig.exe
5852	ipconfig.exe
6136	ipconfig.exe
3336	ipconfig.exe
4080	ipconfig.exe
252	ipconfig.exe
3036	ipconfig.exe
1316	ipconfig.exe
2452	ipconfig.exe
2864	ipconfig.exe
5328	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271473578307474"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-537605601-1362463912-856654178-1000\{3F156B82-5D70-41E6-9DB3-E712573204BF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1464	msedge.exe
1464	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2788	i_faysqlidxs.exe
Token: SeDebugPrivilege	3820	i_kicausmkfc.exe
Token: SeDebugPrivilege	5408	i_zusmkecwup.exe
Token: SeDebugPrivilege	2072	i_hczusmkecx.exe
Token: SeDebugPrivilege	4840	i_ecwuomkezw.exe
Token: SeDebugPrivilege	3324	i_gbywrojdbw.exe
Token: SeDebugPrivilege	2924	i_lgdywtolge.exe
Token: SeDebugPrivilege	4180	i_dyvtnlgdyo.exe
Token: SeDebugPrivilege	3464	i_vtnlfdxvqn.exe
Token: SeDebugPrivilege	5240	i_nifaxsqkhc.exe
Token: SeDebugPrivilege	1488	i_nhfzxspkic.exe
Token: SeDebugPrivilege	2968	i_pkhcxupmhf.exe
Token: SeDebugPrivilege	1456	i_mhezwrpjhc.exe
Token: SeDebugPrivilege	1628	i_hezwuomgey.exe
Token: SeDebugPrivilege	5304	i_mgeywqojgb.exe
Token: SeDebugPrivilege	4304	i_vtnlgdbwqo.exe
Token: SeDebugPrivilege	5136	i_olgdyvqnig.exe
Token: SeDebugPrivilege	668	i_icaysnkidx.exe
Token: SeDebugPrivilege	6060	i_uspkhfzxsp.exe
Token: SeDebugPrivilege	296	i_ecxupnhfzx.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
800	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 1936	3652	2026-06-28_c8c82b78ec94e980d307ccd3e31ff2e6_elex_rhadamanthys_stop.exe	87
PID 1936 wrote to memory of 800	1936	iexplore.exe	89
PID 800 wrote to memory of 5848	800	msedge.exe	90
PID 800 wrote to memory of 2216	800	msedge.exe	92
PID 800 wrote to memory of 5216	800	msedge.exe	94
PID 800 wrote to memory of 5216	800	msedge.exe	94
PID 800 wrote to memory of 2564	800	msedge.exe	93
PID 800 wrote to memory of 2564	800	msedge.exe	93
PID 800 wrote to memory of 2564	800	msedge.exe	93
PID 800 wrote to memory of 3788	800	msedge.exe	95
PID 800 wrote to memory of 3788	800	msedge.exe	95
PID 800 wrote to memory of 3788	800	msedge.exe	95
PID 800 wrote to memory of 3324	800	msedge.exe	96
PID 800 wrote to memory of 3324	800	msedge.exe	96
PID 800 wrote to memory of 3324	800	msedge.exe	96
PID 800 wrote to memory of 2092	800	msedge.exe	97
PID 800 wrote to memory of 2092	800	msedge.exe	97
PID 800 wrote to memory of 2092	800	msedge.exe	97
PID 800 wrote to memory of 4856	800	msedge.exe	98
PID 800 wrote to memory of 4856	800	msedge.exe	98
PID 800 wrote to memory of 4856	800	msedge.exe	98
PID 800 wrote to memory of 5132	800	msedge.exe	99
PID 800 wrote to memory of 5132	800	msedge.exe	99
PID 3652 wrote to memory of 3980	3652	2026-06-28_c8c82b78ec94e980d307ccd3e31ff2e6_elex_rhadamanthys_stop.exe	101
PID 5636 wrote to memory of 5648	5636	faysqlidxs.exe	104
PID 800 wrote to memory of 2436	800	msedge.exe	107
PID 800 wrote to memory of 1660	800	msedge.exe	108
PID 800 wrote to memory of 2436	800	msedge.exe	107
PID 800 wrote to memory of 1660	800	msedge.exe	108
PID 800 wrote to memory of 2088	800	msedge.exe	110
PID 800 wrote to memory of 2676	800	msedge.exe	113
PID 800 wrote to memory of 2676	800	msedge.exe	113
PID 800 wrote to memory of 5364	800	msedge.exe	114
PID 800 wrote to memory of 5364	800	msedge.exe	114
PID 3652 wrote to memory of 5932	3652	2026-06-28_c8c82b78ec94e980d307ccd3e31ff2e6_elex_rhadamanthys_stop.exe	116
PID 3652 wrote to memory of 3544	3652	2026-06-28_c8c82b78ec94e980d307ccd3e31ff2e6_elex_rhadamanthys_stop.exe	120
PID 4600 wrote to memory of 3500	4600	kicausmkfc.exe	122
PID 3652 wrote to memory of 5184	3652	2026-06-28_c8c82b78ec94e980d307ccd3e31ff2e6_elex_rhadamanthys_stop.exe	125
PID 3652 wrote to memory of 4092	3652	2026-06-28_c8c82b78ec94e980d307ccd3e31ff2e6_elex_rhadamanthys_stop.exe	129
PID 4692 wrote to memory of 5348	4692	zusmkecwup.exe	131
PID 3652 wrote to memory of 4052	3652	2026-06-28_c8c82b78ec94e980d307ccd3e31ff2e6_elex_rhadamanthys_stop.exe	134
PID 3652 wrote to memory of 2788	3652	2026-06-28_c8c82b78ec94e980d307ccd3e31ff2e6_elex_rhadamanthys_stop.exe	138
PID 4148 wrote to memory of 5292	4148	hczusmkecx.exe	140
PID 3652 wrote to memory of 1816	3652	2026-06-28_c8c82b78ec94e980d307ccd3e31ff2e6_elex_rhadamanthys_stop.exe	143
PID 800 wrote to memory of 4612	800	msedge.exe	146
PID 800 wrote to memory of 4488	800	msedge.exe	147
PID 800 wrote to memory of 2336	800	msedge.exe	148
PID 3652 wrote to memory of 5960	3652	2026-06-28_c8c82b78ec94e980d307ccd3e31ff2e6_elex_rhadamanthys_stop.exe	151
PID 6008 wrote to memory of 3820	6008	ecwuomkezw.exe	153
PID 3652 wrote to memory of 4596	3652	2026-06-28_c8c82b78ec94e980d307ccd3e31ff2e6_elex_rhadamanthys_stop.exe	156
PID 3652 wrote to memory of 2848	3652	2026-06-28_c8c82b78ec94e980d307ccd3e31ff2e6_elex_rhadamanthys_stop.exe	160
PID 2932 wrote to memory of 3152	2932	gbywrojdbw.exe	162
PID 3652 wrote to memory of 2936	3652	2026-06-28_c8c82b78ec94e980d307ccd3e31ff2e6_elex_rhadamanthys_stop.exe	165
PID 3652 wrote to memory of 5852	3652	2026-06-28_c8c82b78ec94e980d307ccd3e31ff2e6_elex_rhadamanthys_stop.exe	169
PID 5828 wrote to memory of 2160	5828	lgdywtolge.exe	171
PID 3652 wrote to memory of 828	3652	2026-06-28_c8c82b78ec94e980d307ccd3e31ff2e6_elex_rhadamanthys_stop.exe	174
PID 3652 wrote to memory of 4612	3652	2026-06-28_c8c82b78ec94e980d307ccd3e31ff2e6_elex_rhadamanthys_stop.exe	178
PID 952 wrote to memory of 3548	952	dyvtnlgdyo.exe	180
PID 3652 wrote to memory of 1948	3652	2026-06-28_c8c82b78ec94e980d307ccd3e31ff2e6_elex_rhadamanthys_stop.exe	183
PID 800 wrote to memory of 2780	800	msedge.exe	185
PID 800 wrote to memory of 2780	800	msedge.exe	185
PID 3652 wrote to memory of 1208	3652	2026-06-28_c8c82b78ec94e980d307ccd3e31ff2e6_elex_rhadamanthys_stop.exe	191
PID 4172 wrote to memory of 2724	4172	vtnlfdxvqn.exe	193
PID 3652 wrote to memory of 2568	3652	2026-06-28_c8c82b78ec94e980d307ccd3e31ff2e6_elex_rhadamanthys_stop.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-06-28_c8c82b78ec94e980d307ccd3e31ff2e6_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_c8c82b78ec94e980d307ccd3e31ff2e6_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x25c,0x304,0x7fff74e1c188,0x7fff74e1c194,0x7fff74e1c1a0
      4⤵
      PID:5848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,1247534585244077087,18295065043111332170,524288 --field-trial-handle=2156,i,3895131735707515219,16777384614638927673,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:11
      4⤵
      System Time Discovery
      PID:2216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,17230841585852753008,3184671897882486390,262144 --field-trial-handle=2156,i,3895131735707515219,16777384614638927673,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:2
      4⤵
      PID:2564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,5518660699365491984,17657146752882455398,524288 --field-trial-handle=2156,i,3895131735707515219,16777384614638927673,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:13
      4⤵
      PID:5216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,18363346810789879298,16421539609672239831,2097152 --field-trial-handle=2156,i,3895131735707515219,16777384614638927673,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:3788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,8670914814858349091,15050475571469701502,2097152 --field-trial-handle=2156,i,3895131735707515219,16777384614638927673,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
      4⤵
      PID:3324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,10412137983449245952,14431629221287906524,2097152 --field-trial-handle=2156,i,3895131735707515219,16777384614638927673,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:1
      4⤵
      PID:2092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,420386214750812016,8867851788773688610,2097152 --field-trial-handle=2156,i,3895131735707515219,16777384614638927673,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:9
      4⤵
      PID:4856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3824,i,10409139848098750154,12552787077612202818,524288 --field-trial-handle=2156,i,3895131735707515219,16777384614638927673,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
      4⤵
      PID:5132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,14892906217548375525,1403678115724211711,524288 --field-trial-handle=2156,i,3895131735707515219,16777384614638927673,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
      4⤵
      PID:2436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,13501875840924499492,6296935603661656953,524288 --field-trial-handle=2156,i,3895131735707515219,16777384614638927673,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
      4⤵
      PID:1660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,8178870287396133604,11570708898129423011,524288 --field-trial-handle=2156,i,3895131735707515219,16777384614638927673,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
      4⤵
      PID:2336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,8178870287396133604,11570708898129423011,524288 --field-trial-handle=2156,i,3895131735707515219,16777384614638927673,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
      4⤵
      PID:2088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,7075426016126515215,14529146228309373427,524288 --field-trial-handle=2156,i,3895131735707515219,16777384614638927673,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
      4⤵
      PID:2676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,1633511987549767393,12682766484907310094,524288 --field-trial-handle=2156,i,3895131735707515219,16777384614638927673,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
      4⤵
      PID:5364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,16473621321732527396,17417616179660569630,524288 --field-trial-handle=2156,i,3895131735707515219,16777384614638927673,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:14
      4⤵
      PID:4612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,8448115949788775822,2361488916256347944,524288 --field-trial-handle=2156,i,3895131735707515219,16777384614638927673,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
      4⤵
      PID:4488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,4975740329059919039,13457994913391521206,524288 --field-trial-handle=2156,i,3895131735707515219,16777384614638927673,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
      4⤵
      PID:2336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2100,i,3073500832808672742,4141582518046942345,524288 --field-trial-handle=2156,i,3895131735707515219,16777384614638927673,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
      4⤵
      PID:2780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3840,i,2891794448013229224,1220427422109117863,524288 --field-trial-handle=2156,i,3895131735707515219,16777384614638927673,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:14
      4⤵
      PID:3000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,14159989330604467529,12476741635609712657,524288 --field-trial-handle=2156,i,3895131735707515219,16777384614638927673,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
      4⤵
      PID:3272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,6442388885233080768,16723763851829399178,524288 --field-trial-handle=2156,i,3895131735707515219,16777384614638927673,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
      4⤵
      PID:2824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6368,i,11381556664095304646,8734505404858205957,262144 --field-trial-handle=2156,i,3895131735707515219,16777384614638927673,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,17201893590261557049,14358689032901386172,524288 --field-trial-handle=2156,i,3895131735707515219,16777384614638927673,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
      4⤵
      PID:2320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faysqlidxs.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3980
- - C:\Temp\faysqlidxs.exe
    C:\Temp\faysqlidxs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5636
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5648
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3036
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faysqlidxs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5932
- - C:\Temp\i_faysqlidxs.exe
    C:\Temp\i_faysqlidxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicausmkfc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3544
- - C:\Temp\kicausmkfc.exe
    C:\Temp\kicausmkfc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4600
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3500
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicausmkfc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5184
- - C:\Temp\i_kicausmkfc.exe
    C:\Temp\i_kicausmkfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zusmkecwup.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4092
- - C:\Temp\zusmkecwup.exe
    C:\Temp\zusmkecwup.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4692
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5348
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zusmkecwup.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4052
- - C:\Temp\i_zusmkecwup.exe
    C:\Temp\i_zusmkecwup.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hczusmkecx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2788
- - C:\Temp\hczusmkecx.exe
    C:\Temp\hczusmkecx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4148
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5292
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hczusmkecx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1816
- - C:\Temp\i_hczusmkecx.exe
    C:\Temp\i_hczusmkecx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2072
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwuomkezw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5960
- - C:\Temp\ecwuomkezw.exe
    C:\Temp\ecwuomkezw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6008
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3820
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwuomkezw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4596
- - C:\Temp\i_ecwuomkezw.exe
    C:\Temp\i_ecwuomkezw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4840
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbywrojdbw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2848
- - C:\Temp\gbywrojdbw.exe
    C:\Temp\gbywrojdbw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2932
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3152
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbywrojdbw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2936
- - C:\Temp\i_gbywrojdbw.exe
    C:\Temp\i_gbywrojdbw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgdywtolge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5852
- - C:\Temp\lgdywtolge.exe
    C:\Temp\lgdywtolge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5828
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2160
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4436
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgdywtolge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:828
- - C:\Temp\i_lgdywtolge.exe
    C:\Temp\i_lgdywtolge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dyvtnlgdyo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4612
- - C:\Temp\dyvtnlgdyo.exe
    C:\Temp\dyvtnlgdyo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:952
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3548
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dyvtnlgdyo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1948
- - C:\Temp\i_dyvtnlgdyo.exe
    C:\Temp\i_dyvtnlgdyo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4180
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnlfdxvqn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1208
- - C:\Temp\vtnlfdxvqn.exe
    C:\Temp\vtnlfdxvqn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4172
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2724
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnlfdxvqn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2568
- - C:\Temp\i_vtnlfdxvqn.exe
    C:\Temp\i_vtnlfdxvqn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nifaxsqkhc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3012
- - C:\Temp\nifaxsqkhc.exe
    C:\Temp\nifaxsqkhc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5444
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5428
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nifaxsqkhc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2044
- - C:\Temp\i_nifaxsqkhc.exe
    C:\Temp\i_nifaxsqkhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfzxspkic.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3024
- - C:\Temp\nhfzxspkic.exe
    C:\Temp\nhfzxspkic.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5372
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4528
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfzxspkic.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6076
- - C:\Temp\i_nhfzxspkic.exe
    C:\Temp\i_nhfzxspkic.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1488
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkhcxupmhf.exe ups_run
  2⤵
  PID:5312
- - C:\Temp\pkhcxupmhf.exe
    C:\Temp\pkhcxupmhf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4136
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2148
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkhcxupmhf.exe ups_ins
  2⤵
  PID:5768
- - C:\Temp\i_pkhcxupmhf.exe
    C:\Temp\i_pkhcxupmhf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhezwrpjhc.exe ups_run
  2⤵
  PID:200
- - C:\Temp\mhezwrpjhc.exe
    C:\Temp\mhezwrpjhc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2860
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2944
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhezwrpjhc.exe ups_ins
  2⤵
  PID:5400
- - C:\Temp\i_mhezwrpjhc.exe
    C:\Temp\i_mhezwrpjhc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hezwuomgey.exe ups_run
  2⤵
  PID:2872
- - C:\Temp\hezwuomgey.exe
    C:\Temp\hezwuomgey.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2736
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3752
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hezwuomgey.exe ups_ins
  2⤵
  PID:3164
- - C:\Temp\i_hezwuomgey.exe
    C:\Temp\i_hezwuomgey.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgeywqojgb.exe ups_run
  2⤵
  PID:4896
- - C:\Temp\mgeywqojgb.exe
    C:\Temp\mgeywqojgb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3060
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1488
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgeywqojgb.exe ups_ins
  2⤵
  PID:1040
- - C:\Temp\i_mgeywqojgb.exe
    C:\Temp\i_mgeywqojgb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnlgdbwqo.exe ups_run
  2⤵
  PID:3688
- - C:\Temp\vtnlgdbwqo.exe
    C:\Temp\vtnlgdbwqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2644
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3536
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnlgdbwqo.exe ups_ins
  2⤵
  PID:4284
- - C:\Temp\i_vtnlgdbwqo.exe
    C:\Temp\i_vtnlgdbwqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\olgdyvqnig.exe ups_run
  2⤵
  PID:4516
- - C:\Temp\olgdyvqnig.exe
    C:\Temp\olgdyvqnig.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1476
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5728
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_olgdyvqnig.exe ups_ins
  2⤵
  PID:4192
- - C:\Temp\i_olgdyvqnig.exe
    C:\Temp\i_olgdyvqnig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icaysnkidx.exe ups_run
  2⤵
  PID:5340
- - C:\Temp\icaysnkidx.exe
    C:\Temp\icaysnkidx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5452
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4256
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icaysnkidx.exe ups_ins
  2⤵
  PID:5764
- - C:\Temp\i_icaysnkidx.exe
    C:\Temp\i_icaysnkidx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uspkhfzxsp.exe ups_run
  2⤵
  PID:4064
- - C:\Temp\uspkhfzxsp.exe
    C:\Temp\uspkhfzxsp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4028
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3660
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uspkhfzxsp.exe ups_ins
  2⤵
  PID:3768
- - C:\Temp\i_uspkhfzxsp.exe
    C:\Temp\i_uspkhfzxsp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecxupnhfzx.exe ups_run
  2⤵
  PID:1604
- - C:\Temp\ecxupnhfzx.exe
    C:\Temp\ecxupnhfzx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1204
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3720
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecxupnhfzx.exe ups_ins
  2⤵
  PID:5644
- - C:\Temp\i_ecxupnhfzx.exe
    C:\Temp\i_ecxupnhfzx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:296

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6020

C:\Temp\qkicavsnkf.sys
C:\Temp\qkicavsnkf.sys
1⤵
- Executes dropped EXE
PID:4512

C:\Temp\nhfzxspnkf.sys
C:\Temp\nhfzxspnkf.sys
1⤵
- Executes dropped EXE
PID:1252

C:\Temp\ecxusmkecx.sys
C:\Temp\ecxusmkecx.sys
1⤵
- Executes dropped EXE
PID:5712

C:\Temp\hbzurmjecw.sys
C:\Temp\hbzurmjecw.sys
1⤵
- Executes dropped EXE
PID:952

C:\Temp\bzwurmjgey.sys
C:\Temp\bzwurmjgey.sys
1⤵
- Executes dropped EXE
PID:5328

C:\Temp\rojgbytrlj.sys
C:\Temp\rojgbytrlj.sys
1⤵
- Executes dropped EXE
PID:3660

C:\Temp\jdbywqoiga.sys
C:\Temp\jdbywqoiga.sys
1⤵
- Executes dropped EXE
PID:404

C:\Temp\aysqlidayt.sys
C:\Temp\aysqlidayt.sys
1⤵
- Executes dropped EXE
PID:5332

C:\Temp\snkfdxvpnl.sys
C:\Temp\snkfdxvpnl.sys
1⤵
- Executes dropped EXE
PID:2156

C:\Temp\vpnifaxsqk.sys
C:\Temp\vpnifaxsqk.sys
1⤵
- Executes dropped EXE
PID:1852

C:\Temp\rpkhcauspn.sys
C:\Temp\rpkhcauspn.sys
1⤵
PID:892

C:\Temp\mkhczurmke.sys
C:\Temp\mkhczurmke.sys
1⤵
PID:2156

C:\Temp\geywuomgey.sys
C:\Temp\geywuomgey.sys
1⤵
PID:1084

C:\Temp\omjebztroj.sys
C:\Temp\omjebztroj.sys
1⤵
PID:4464

C:\Temp\ytrljdbytr.sys
C:\Temp\ytrljdbytr.sys
1⤵
PID:1848

C:\Temp\qoigaywqoi.sys
C:\Temp\qoigaywqoi.sys
1⤵
PID:2940

C:\Temp\nigaysqnid.sys
C:\Temp\nigaysqnid.sys
1⤵
PID:716

C:\Temp\kfdxvpnkic.sys
C:\Temp\kfdxvpnkic.sys
1⤵
PID:5364

C:\Temp\fcxusmkica.sys
C:\Temp\fcxusmkica.sys
1⤵
PID:5740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bzwurmjgey.sys

Path C:\Temp\bzwurmjgey.sys
Size 141KB
SHA256 985d5e10e662f0c6171a55f40b4e1aac854ded59992364e245dc73a88a774b82
MD5 5bf7008880ea1235b22bbc288fa81d55
SHA1 80078b450621918caebf7d88acb8b7768c334b61
SHA512 332b96d9fe15dce62dfe8bce1ab43afc9e9b8882c7c47f8bdc9c525375f81956ba1998e64e293b6561a9e66e7c6e862012ddc4f5097ded9990adc7fb8941843f
SSDEEP 1536:Qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T153E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwuomkezw.exe

Path C:\Temp\ecwuomkezw.exe
Size 243KB
SHA256 53624df660b45d4725e5493d4f60bacbc06c9c0a0b9b9c7344ab6a5f95edaf44
MD5 9ce21dba8dd26af516b6afac1b7b9a81
SHA1 f7f9d48191dfb4d57cf9e1916a0c4cc6be282986
SHA512 cc0ce855331da462bac7719885d651421e6063fbb0aa1d76cf994983d903a846eb81f855829912934f5ce2d36a71aac0b23fc8dfca475c41db620e9e7bda6889
SSDEEP 3072:0CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7i:HvMsLaOa3lLNngoqRttA7i
TLSH
T107345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecxusmkecx.sys

Path C:\Temp\ecxusmkecx.sys
Size 141KB
SHA256 4b55ad515e00d41667dabb526f1e79f47c24611427097dfb54047770c58df17f
MD5 b156d7553c92b8d2cae4c9ee6a846a01
SHA1 356ab800e4f091ed22ce585c62e0cb2030c5968d
SHA512 b796e4d557245d80851987dfdfb773dc53f1d7b4d7b16725b474e25d5636d85c2a618bc35d1bb07557c9b21f7c1a8c52c32cc74379d3bf083cf40ea1da84bfd3
SSDEEP 1536:ha3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ha3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DAE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faysqlidxs.exe

Path C:\Temp\faysqlidxs.exe
Size 243KB
SHA256 420bdbd465782e861cb203ab5b0fe6c63f62df9ffa6bcee1a93f650e4fab65f6
MD5 00aa8c3e29ca3d9db4e6b760830a732c
SHA1 244f4ce4892fd14fb970a83b29b55dd08515f183
SHA512 1e7a42f509b2a93d3ae2e5bfd2fbeb7605e5cea597d85e129cd253d225de5ce718c6022f351ea9068970a955b3ea7f4caf2c868323bebcbb50a990249cc49c45
SSDEEP 3072:1CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7H:4vMsLaOa3lLNngoqRttA7H
TLSH
T189345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbywrojdbw.exe

Path C:\Temp\gbywrojdbw.exe
Size 243KB
SHA256 499aed426306f053572a2294ac7384bdb1a9bb1dc8152b01ad3a4fd21f8cbdda
MD5 018911e89b0b19fe7cc59e5c6af279fc
SHA1 01d3f36d3b8faaf38506b102e972e942778db17a
SHA512 2e006a00a0b6602a95846a1adb11b00d18f8a473bbf2edda6e119b5d60e23411775209e2655bdf1c584124b6ce40d9c2703e510e8c018881e5a610e67c02d049
SSDEEP 3072:zCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA79:2vMsLaOa3lLNngoqRttA79
TLSH
T1FC345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbzurmjecw.sys

Path C:\Temp\hbzurmjecw.sys
Size 141KB
SHA256 2f46f972cbf7f04f8e8c6e5e5c93351dffabff3206d2a3027e6fef138860fe3c
MD5 4e5e6dc414064985b57e6f5967331fc0
SHA1 aba1c0ed663ad841682b744e26cab5e7aa33f4a3
SHA512 d0e2cb463164632c7400efeb976fbee9210180c6ff04d3af0678f0ccb0e9afffad89e7475a02f3ae6702d562afe8a110ef0e5ee9df1da95a93653bbc0bc0304f
SSDEEP 1536:ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T189E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hczusmkecx.exe

Path C:\Temp\hczusmkecx.exe
Size 243KB
SHA256 7dff7f0ee7721bd7d44d06e33c8401a1aa4d4a4909e1739cc6f2b4f0901138a6
MD5 4cb53c73599c2965f862e1f20566e466
SHA1 ad68198259c275a9810a5415f00dd77cd8c262d2
SHA512 d1972e665eb114ecd6a0e1cfb94ba6e8431607ff1dd61a8f932248f75411ba553d9be5b1ef1d71dffe514d6258ee90d2e2daf6e480526add02f17073f730dd73
SSDEEP 3072:HCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7J:ivMsLaOa3lLNngoqRttA7J
TLSH
T18A345A017281C031E7160B78045AE7A1467EBC384BA9E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ecwuomkezw.exe

Path C:\Temp\i_ecwuomkezw.exe
Size 243KB
SHA256 a1d27a56455fa4d42c7991820e477b4387327db694523c5ae6b138df17a1f77d
MD5 5966c9a6f97729d4b179013a13446664
SHA1 693bae426f5e5c5cedb0e7fc6b5bfef195c36f09
SHA512 ede417306a8d30ade2848bf68c25c3725d99c65443004f0438366c191cbbdbd8f7ac9d56a8cf3d387c739f0a9e6d4a27ed19c22fd6d5efb4d5bf4565c5bc7560
SSDEEP 3072:UCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7m:nvMsLaOa3lLNngoqRttA7m
TLSH
T111345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_faysqlidxs.exe

Path C:\Temp\i_faysqlidxs.exe
Size 243KB
SHA256 b6193dd34fba17f488edf9a3c53505653c42f98cf35598baa1b3d31b1f283fac
MD5 df5df67e4ca2fddfa27d926dc01f656d
SHA1 a7f358d1880a2507ea2a80285f005da846890145
SHA512 dc971571ddaddc81bebe1d548b3d90d36b370dc15b0be3716db18942bfe761f20ce82b51d4d3814b15834bba9406cab23eeaa91bb1772f19ace26ff022a4c3fa
SSDEEP 3072:DCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7t:GvMsLaOa3lLNngoqRttA7t
TLSH
T126345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gbywrojdbw.exe

Path C:\Temp\i_gbywrojdbw.exe
Size 243KB
SHA256 589d7399529eeda3dfc8762784440f14661c62f79f594423c446799628491fc6
MD5 943194c6491fac309b01c622ce3de24f
SHA1 775b5bc5652a08bfba72394f3a2715a89e780233
SHA512 2b49f69a857036323a9565803151fa3a11b2fe76fe44aa98d14a9f4c0eab21a558dff0a138f84b936941e32cd98fed0b0d2c1553f6c2f6d01ed23a119c42dbf9
SSDEEP 3072:FCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:IvMsLaOa3lLNngoqRttA7D
TLSH
T1E9345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hczusmkecx.exe

Path C:\Temp\i_hczusmkecx.exe
Size 243KB
SHA256 789a33005140f98899681fbdbea8ca5418a7fbda9bb45af77dfecfa57b09069a
MD5 4be34adedd8103a6ba5a76b32d61f073
SHA1 e8f3a5f6bafeba1fe493664976e37bb3f2b16cec
SHA512 38e71d1f067ba3048b844f2eb86c130199278f61e7d93dede9a02975a73847516415495ec33a7db0daa7e69584f9940e17f5663e081fbee0d55b1ff7d7c4111d
SSDEEP 3072:LCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7F:+vMsLaOa3lLNngoqRttA7F
TLSH
T19A345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kicausmkfc.exe

Path C:\Temp\i_kicausmkfc.exe
Size 243KB
SHA256 c411b29536833064c824819908e41ce4ed31a944785615b1f3f90e56ea7b1c5f
MD5 b440a12291b39df35c833494405c4d91
SHA1 2a3f1bbf2faf1d95c9c3793066cda8d51089bf12
SHA512 71ee66c98f59c5faea6fd6070b751fd7355e47f3ce1dbffdd1f11f234073d09eaa51d61a9ed77fc4eab87ae358e270fc410a52b926b3a914a855b1c8ca3f9f49
SSDEEP 3072:NCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:AvMsLaOa3lLNngoqRttA7b
TLSH
T144345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zusmkecwup.exe

Path C:\Temp\i_zusmkecwup.exe
Size 243KB
SHA256 5edd7ddb110f81bdc237c1f8fb1802bd355b96ab99121126c0a3fb4e82700524
MD5 560c135efdaf3e1ff872abf40a907730
SHA1 f081598d3403d85263b59ec120007976ea1d3154
SHA512 e12a6180323bec44ca3d199880160b9b1f842cfbbf16b5291b35c3a6826ae4f6315ce0cfaf1df0ab953995a46caf89e9378cccb00ecf5baf74b00de7b33a1723
SSDEEP 3072:ICvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7+:zvMsLaOa3lLNngoqRttA7+
TLSH
T165345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicausmkfc.exe

Path C:\Temp\kicausmkfc.exe
Size 243KB
SHA256 ca520fb756777e19b6beff44f0cd75cad9f07127e25d8d927aa01f3b13d180c3
MD5 3e2c4d1c98a20685eb85dd148ecf9e6e
SHA1 0df7989a8d04806413cd17a3b17bc96a84ddec7d
SHA512 303a5a7168d7ff2eb5a678b45f6f3b190f7e67e5873a30d34efff2afac453ae0c285d0bfa47dc36f402b79efc26b92ad55690c2c6ba67da6492d307f002979c5
SSDEEP 3072:+CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Q:xvMsLaOa3lLNngoqRttA7Q
TLSH
T146345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfzxspnkf.sys

Path C:\Temp\nhfzxspnkf.sys
Size 141KB
SHA256 539818bf29f2080f361b3293c74c878c25cd31c34796f5332bde05adb3531716
MD5 b6fdc2b22173041fd53a508fe038c6a0
SHA1 c439adc36d9caae40a50b2e587876e76032dca1c
SHA512 7ff783a426d95f54817dc7eb7fd3cf4fa5fc594b3163d3aa2c83e059a9f917b7cb9a5f8ee4ddb9f47d2417dfd8954996c22ff28c2196f9b1ceba28f883324f1e
SSDEEP 1536:pNa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXl+:Ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T189E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkicavsnkf.sys

Path C:\Temp\qkicavsnkf.sys
Size 141KB
SHA256 74d5fd1e399d3ba9b440ff4ffc22f84814a4f23434236a011816b34007815c64
MD5 d1ca904df3c206da29b949681e389c88
SHA1 c24117559d155551a67c213b01c43f734385f068
SHA512 8fe93eab5b508f274be77b9d26eaed82a0d4caacaf17bcfe21ec596455af5b2b23ed3dedf700d1e903a6af54e714c4a3d5d655b5bbc3aa70906a4e5989caff2a
SSDEEP 1536:0a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:0a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T174E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rojgbytrlj.sys

Path C:\Temp\rojgbytrlj.sys
Size 141KB
SHA256 0af2d37a193d9c4515bc632b80aaacef2653d923c88adda88fb81b2175a7a5df
MD5 edcfb32945bdf78d1d3b4778d77adc3e
SHA1 3a3cf5e29d124768781bdca973e8e7c43422ffa3
SHA512 8b8a61b41d7c1171fed87dac551dd65d24fa384317f137ba39aa37e81286ca21b26b14f6655b140a79d27161301438ee4f644c6517f65d4ebeddd85e68b3c654
SSDEEP 1536:pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T10BE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zusmkecwup.exe

Path C:\Temp\zusmkecwup.exe
Size 243KB
SHA256 1abb695641e72ef9448f3c5c7799c688bb7e64f6d7ec8da02ac54ce95974cb4d
MD5 2068f442546d7e9ab79b924d11ee18ff
SHA1 5be0cb127287c6d3097c92518579ae6916ce667e
SHA512 69e9a8d3b8d50e2832eb301c4d296d20f410765681d1545c8096440933ccd0f0d80eb38d722cc008c4ef064afd18d2888c3aad0f2216e17dd31346df327d6796
SSDEEP 3072:/CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7h:KvMsLaOa3lLNngoqRttA7h
TLSH
T15E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ff19e848916f9346514f95113e3d80cd569935b36d785719b19d90f9f740fbd6
MD5 5ab41182d14eb22e7143c63d2e18b77b
SHA1 ca8c747e1a5e38b0f0a08b492fcea6d3a75865c2
SHA512 bbecb67f89826ee2bd219f14bbc8ca87fb260f8a22bd2d52b6ccdb72d47a4b58eeb897a42a6e591bd4e75fe870419162172353d5d3ec7f1fb0fbc7b5dc6adcf1
TLSH
T1AED080757B467B11D58F0472D424E271A737455135D296057170C10E55602D1FFCA0B7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5f46172781024fe58b7a7d87a406b81679d17de445e9e90110d33f5747ecc226
MD5 08a5ef0e8eb4590a7f0e6f821698071e
SHA1 1b756aceae48cf2649d310d7ab4883595c2e5bde
SHA512 95c72989df00c3caf1230ca41b6dcbc24f8a592c45202f7b16044b8d574fe569d4db8614652b0d1695d3fe1d795b07ea334de5b4fa9dcbb9d27de40a55592586
TLSH
T155D080757B467A11D58F0476D424E271A737455125D296057170C10E55602D1FFC90A7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 065ba0ab6da3b22c35cde08975cdfb5f8d3da964c5ee41cfc9cdc1366f6cf82b
MD5 7f0332b62b692881e4f89718ea54050d
SHA1 3ad56916bc297df7c5f7c8587ee3ac4a149a387d
SHA512 56960c15d36635b7e4214e5cbad7d1c22045333763d5e21cec74fa11e48b0401bf0e59fd4f2ed12904195ebd8edd4ea2cacbb50dd02cfd33e8132edaaa4e717b
TLSH
T1E8613C7421B20C6BEBE94675F3E110E623B0995FFF3BDE9131A7F8789B853085085028
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a0b8a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a0b8a.TMP
Size 3KB
SHA256 15aff3cbbaff586833bc4ef6f437093ae8818fbe18fef5dcef63e4db1d7f2d74
MD5 b2a5a39e72dbc22ab69e3a51f43f41e9
SHA1 3df8bda70fc9631e8178c4864056b4dd77c079ca
SHA512 ad856739afce9aa5cdd0be3945b072097d6f35f84fbf57dcd8a995abc361362eaf52d9ddd469cb4f08ef5b03e60bef0157a739f5cdea8714903e2b602ad2e711
TLSH
T16E612C7421B21C6BEBE95675F3E110E623B0995FFF3BDE9131A7F8789B863085185028
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8a92fe353396751ef7417430e3a9e55397714dd2defbe8512d327b427558e233
MD5 c630022833e7641cb8221002271f662c
SHA1 2d9c9db19d6cf598bae01483c0dd19213dd93f85
SHA512 743ef65d7f6b1b7739babd54f69cb5de8ecefebf22d31252b7a3fb5ea944edc1bf82d664a5f870521005f7c5fb80e0cb1504ee6437ef51dd23f8f474d8d1fd8b
TLSH
T15B41A0F3C6E8856D890156F0BB186E2FDE2D0964832C3D5AC8E4AF1B93E3471E24195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c9aa408f452df23ff00a8a466acabfc6b06d0b12e30ddb68a850baf8cda9fbd8
MD5 3ce81077d0041afe5cb1d168c36701a1
SHA1 468e8af604f0ea60865e42ad30d97ac0dd2af41f
SHA512 c69e3c05e6f9431dc8baac02a94988ee2250a9ac34cd48216cfaa5a0f5a9f97690e2f61743e570f3b553896928d583cb0c7acf2a2821025450848e42e77da24d
SSDEEP 192:sxRdRWyM/jK1Ml8UQlc9/fbsL//IZFzoA8prA/g6+WNCgt/Y4pkTGMIgDblqJ:sxRdIqK9/fbsLH2o0/5j/i0
TLSH
T16562D815AA349A77CCDBD609FA517F53D7F85572A2901E44AAFCCA0C00E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 22844e3f6f047a4768c8928122af8103bfd31f07110e323b60f84cfbbc418772
MD5 3d033abefaeb2640022890545fa2f782
SHA1 87b50f79467f98e369a22eb5887d946b5760244e
SHA512 f06db4b751380f3065b1684e6deba0451e6df89814541d83b3a66ef0361db3313c7a6531e9b311b3af7cfe435a986f2017e4bd9f2f8e6a9b9afbb15bb95bfcea
SSDEEP 192:sxRdRWyM/jK1Ml8wc9/fbsL/MIZFzoA8p9A/g6+WNCgt/Y4pRTGMIgDxlqJ:sxRdIC9/fbsL02ou/5j/9G
TLSH
T1E062DA156A349A77CCDBD209FA557F53D7F85572A2901E44AAFCCA0C00E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 78864f404a3ea6a79fa636597f4f29133261d71d66680dfe8fedeaa38d0a935a
MD5 d416c5dc5855daff13e345c82556d5a6
SHA1 79ca75125f19da29f934a54f3926e6335f91581c
SHA512 a2cd5382c9cfda9a1ede6a71f9584c141eac29fdd7846c68ce9b5ca53c69071ef778a37ae506fcaf2be416941c664624106ec0be9d087e991a1702485cf8d8bb
SSDEEP 192:sxRmRWyM/jK1Ml8wc9/fbsQ/MIZFzoA8p9A/g6+WNCgt/Y4pRTGMIgVlqJ:sxRmIC9/fbsQ02ou/5j/9W
TLSH
T12A62E9156A349A7BCCDBD209FA557F53D7F85572A2901E44AAFCCA0C00E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 3e0134c7122822acde77dc51b3c6ca9b82656db0cc267aabae2ac3d00fcc5a62
MD5 518120c986369f76e1bf97d8d276fff5
SHA1 b8cdcde058139ea5de6bf1959cf33bc3dae87195
SHA512 b5a57bf20485169b6f46726b93051a3353a06ad9ae7284dea02c624074e82c8dc84741fb99e62c00b8ba42f9fcb25ece0dd6e9774b8ad50ea35e189756dedf8d
SSDEEP 768:Nmym5/7pLuL7YpWgvHfSv8F1+UoAYDCx9Tuqh0VfUC9xbog/OVwxwLxg6roRL4Tx:Nmym55E7YpWgvHfSvu1javxwNgxRL4Tx
TLSH
T1A7E2ED3B680CCB7E4F844AADEC29BD9A6DD801CF5A98CD5447EA840C03C67EB511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 0d4a539803b132dbae3778079f2f35d48304c0ec4e9601dfdbbf7f88a0c9f959
MD5 f9d86803b17a162a000361614cb16045
SHA1 73a29633a5bf374e6aca021588867f3126da40ca
SHA512 d7c75d7849bac7194f1074c86ca92ca76e70f91bd443a9f61303068f41dc1b76d95f1b3d06a0291c81cfd3033f8b1056f51fef7b0fed1fcd09953ff01fd71c93
SSDEEP 96:K0KYKvKW6OoKHK4xSKyACSTqHzd9daXFUppjaKBvp5atzrcRN:OjHGpSTqHzd9dAFUzjbvp5EzrcRN
TLSH
T168B1FF60797A220538FD3509E1A1A61F2A4930F3755AA82F7BB960F24A67F404FFC5CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5aa6b1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5aa6b1.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 1de4bcdc3b76d095bbb67d905ab4037ae9429da00cc03e496616c83b16ed3d92
MD5 e9350c13bf38aa29fb0de9907b428d65
SHA1 f3a31d4b1165fb8d140af2d54c4f6895d5bf441f
SHA512 aebe19153b32ebe85cdd6348c90e31f9ad3150c011bcb5026dd457a98f740f9a076a69e9964e9ac7040ae57d4f34fe7f13cf2547a0ea2f958cb0c2e471165422
SSDEEP 768:FjaeqD4MlshiLdMmO3+RfyhfR5EfXP/A7NpespIRM0UmkTziwjgzSYBJT8:FqcjhIdM53UfefkffCQsZ0UmY4Bu
TLSH
T1B103B071D8645E778CBAEA497A433787AFF002A3C5852F989CD95E0D41832DD274B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 9281a0caec87fc90ed7fea4d79a7dd9b85a308b8ebca95a6c29641592237b7a2
MD5 11a33c0062c43fb233da38ee3ecdefde
SHA1 a1fefc7631e1d3cde8c629848e754c3d04293e7d
SHA512 98fa09d380a29e7f8cb0a4a2361458d64556b0acb10bed6b2e57032c6e63de6189756c618988410e2ee845670ea541d4e351e063699f915d8bf5af520033a4c4
SSDEEP 768:Fj+9M37RfyhfR5EfXPUA7NpespIRM0UmkTziwjgzSYwn12bfZZ:w9M3tfefkffpQsZ0UmY4KyZZ
TLSH
T14AF2AE31D8255E634DFAEA897A47378BAFE01263C1C41E5898E99F0D45C379C270B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 8d911c94d0352f896fceb21cf5f7adf9f1f3f2d41d47390a35f416f473f37b0b
MD5 89896a1f3108e710e2446d7a69db2577
SHA1 f16ccc9cbaa4010dab49f6620c755798b862a14d
SHA512 83db10827cd7ba6a921cf578eaf8c40269e44df5b4464b30cbbe6eb18dca31d615dd4a83c7cd6c38fd9989952cd0dc309bb2b115c628b959c53ad0c490922418
SSDEEP 768:8F1j+9yH3/wg81cfyhfR5EfXPpA7NpespIRM0UmkTziwjgzSYwn12bfZZ:x9yH3FfefkffgQsZ0UmY4KyZZ
TLSH
T1D72338F188D38A76D8AE9B87673D2E469EFCC153B1845984BBD84D0CCC821BFD70A915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 0cdc09581097fd3cf03f828ecf94a8111cd51b83f5cbe9a1b049cdef865a4901
MD5 9882a5f3c6323535d2317e604c39cebd
SHA1 4a3bb976d032c5d65c5db88960c7bda0ee715000
SHA512 139e242c5631994c76d70e6c9e955ae4c01c794fb85690939b58c6bdfd2b2369d9228e7c3cb4cb97dd0b1ac66ddb79f68b2a83da8eeef1c0c5bf5e78087612d5
SSDEEP 768:3jaeqD4MlshiLdMmf3CJfyhfR58A7NpespIRM0UmkTziwjgzGJnApXLPQTU:3qcjhIdMo3sfefhQsZ0UmYhnKXD
TLSH
T1CF03CF3698605EB78CB6E68A264776576FB00253C2C43BC8CCED6E0D42935DC670B96B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 3c999f738d0e230e5d60a9afbc1af0dac524851029e1e017ad54cc6ffdf4af09
MD5 10b2b0482adfa7d2998fcfa94746d4ee
SHA1 b7d67e49b78fc25cc56df7b6c73beb0936130aa1
SHA512 d20ca1cab127046a3b3542a1688dd066169ddb4408d2018c70db69b411503c0cd196a2cccbf4955c2a2cb6e22eb4f35d45899c8d7b83d4f86aeaffb993cda14f
SSDEEP 768:Yj+9M3uRfyhfR5EfXPUA7NpespIRM0UmkTziwjgzSYwn12bfZZ:H9M3kfefkffpQsZ0UmY4KyZZ
TLSH
T1DAF2AE31D8255E634DFAEA897A47378BAFE00263C1C41A5898E99F0D45C369C271FD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

57f6f1f5-7f18-413f-b0bd-aef613c1d6e9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\57f6f1f5-7f18-413f-b0bd-aef613c1d6e9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir800_898898330\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/404-333-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/716-487-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/892-396-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/952-283-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1084-428-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1084-451-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1252-243-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1848-461-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1852-384-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2156-424-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2156-446-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2156-354-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2940-466-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3660-329-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4464-449-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4464-463-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4512-195-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5328-301-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5332-372-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5332-348-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5364-499-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5712-271-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5740-516-0x0000000000010000-0x0000000000083000-memory.dmp

Download