0b75cb31d0cd4df552c80342f636e28f07446d2c3438b23ca19c8cec09d379cb

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_ad19b3754a04c7e042847f12d070a2f1_elex_rhadamanthys_stop.exe
Size 243KB
Sample260629-ejzzhsdy5j
SHA256 0b75cb31d0cd4df552c80342f636e28f07446d2c3438b23ca19c8cec09d379cb
MD5 ad19b3754a04c7e042847f12d070a2f1
SHA1 cfc040fb431c136f357088ba01a034b560d0c318
SHA512 f776dd736a80d33f8fdc29d8323bd45bdddd268a51b2f4fe9f2a7e446905509c3a2ca85f53d1e101e8ebdee9c1448e29197c80aa9de8fb227abf3f7a2c44756c
SSDEEP 3072:e2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7e:ewD99LB68zowa3lLNngoqRttA7e
TLSH
T17F345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2912	CP.exe
4856	kfavpnhfzx.exe
3840	CP.exe
1300	CP.exe
5484	i_kfavpnhfzx.exe
1712	xsmkicxmhe.sys
5616	CP.exe
3036	fcwupmhczx.exe
1876	CP.exe
1992	CP.exe
5648	i_fcwupmhczx.exe
5720	kebzuomhec.sys
4900	CP.exe
5404	uomhezxrpj.exe
4588	CP.exe
2552	CP.exe
4764	i_uomhezxrpj.exe
5316	ebztrmjecw.sys
2592	CP.exe
2420	wrojhbztrm.exe
4652	CP.exe
4072	CP.exe
2028	i_wrojhbztrm.exe
5960	ojgbytrljd.sys
3692	CP.exe
3668	gbytrljdbv.exe
3244	CP.exe
5052	CP.exe
1800	i_gbytrljdbv.exe
3444	tqligdbvtq.sys
4512	CP.exe
6060	ysqoljdbvt.exe
4448	CP.exe
4880	CP.exe
2220	i_ysqoljdbvt.exe
1956	gdyvqoiday.sys
5820	CP.exe
1136	xvtnlfdxvq.exe
1056	CP.exe
5156	CP.exe
5300	i_xvtnlfdxvq.exe
1712	kidavsqkid.sys
1268	CP.exe
5964	idaysqkida.exe
1260	CP.exe
3188	CP.exe
5572	i_idaysqkida.exe
6052	fcausnkfca.sys
6136	CP.exe
2092	xspnkfdxvp.exe
3508	CP.exe
5976	CP.exe
3008	i_xspnkfdxvp.exe
3272	pmkecxupnh.sys
476	CP.exe
6088	jhczxupnhf.exe
5860	CP.exe
5232	CP.exe
2000	i_jhczxupnhf.exe
1004	wupmkeczxr.sys
3156	CP.exe
2512	urmjhczurm.exe
1332	CP.exe
2052	CP.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2492_1551300654\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2492_2062725197\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2492_702723020\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2492_2062725197\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2492_702723020\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2492_214704252\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2492_214704252\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2492_214704252\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2492_214704252\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqoljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtoigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_ad19b3754a04c7e042847f12d070a2f1_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytrljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqoljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmjhczurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywtrljhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtoigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwupjhecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomhezxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomhezxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytrljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgecwromhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkfcxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxupnhfzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcwupmhczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idaysqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idaysqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgecwromhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkfcxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvtnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywtrljhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkicaxsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcwupmhczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhczxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvsnlfdays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfavpnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvtnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmjhczurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igbytqlgdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igbytqlgdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvsnlfdays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwupjhecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfavpnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhczxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkicaxsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxupnhfzur.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3404	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1796	ipconfig.exe
1048	ipconfig.exe
5216	ipconfig.exe
3708	ipconfig.exe
1004	ipconfig.exe
3092	ipconfig.exe
1168	ipconfig.exe
5772	ipconfig.exe
5952	ipconfig.exe
4512	ipconfig.exe
1456	ipconfig.exe
2316	ipconfig.exe
2080	ipconfig.exe
876	ipconfig.exe
6092	ipconfig.exe
5972	ipconfig.exe
1360	ipconfig.exe
5060	ipconfig.exe
4404	ipconfig.exe
2844	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271791451350544"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-487906980-2895880840-1957110281-1000\{03941CA2-C793-450C-8ADA-694A192E5847}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5628	msedge.exe
5628	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5484	i_kfavpnhfzx.exe
Token: SeDebugPrivilege	5648	i_fcwupmhczx.exe
Token: SeDebugPrivilege	4764	i_uomhezxrpj.exe
Token: SeDebugPrivilege	2028	i_wrojhbztrm.exe
Token: SeDebugPrivilege	1800	i_gbytrljdbv.exe
Token: SeDebugPrivilege	2220	i_ysqoljdbvt.exe
Token: SeDebugPrivilege	5300	i_xvtnlfdxvq.exe
Token: SeDebugPrivilege	5572	i_idaysqkida.exe
Token: SeDebugPrivilege	3008	i_xspnkfdxvp.exe
Token: SeDebugPrivilege	2000	i_jhczxupnhf.exe
Token: SeDebugPrivilege	5720	i_urmjhczurm.exe
Token: SeDebugPrivilege	4912	i_mgecwromhb.exe
Token: SeDebugPrivilege	5644	i_eywtrljhbz.exe
Token: SeDebugPrivilege	3112	i_igbytqlgdb.exe
Token: SeDebugPrivilege	5060	i_bvtoigaytq.exe
Token: SeDebugPrivilege	4188	i_bvsnlfdays.exe
Token: SeDebugPrivilege	1960	i_snkicaxsnk.exe
Token: SeDebugPrivilege	5716	i_smkfcxvpnh.exe
Token: SeDebugPrivilege	596	i_zxupnhfzur.exe
Token: SeDebugPrivilege	4524	i_ecwupjhecw.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2492	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5336 wrote to memory of 4952	5336	2026-06-27_ad19b3754a04c7e042847f12d070a2f1_elex_rhadamanthys_stop.exe	89
PID 4952 wrote to memory of 2492	4952	iexplore.exe	90
PID 2492 wrote to memory of 472	2492	msedge.exe	91
PID 2492 wrote to memory of 3404	2492	msedge.exe	93
PID 2492 wrote to memory of 5064	2492	msedge.exe	94
PID 2492 wrote to memory of 5064	2492	msedge.exe	94
PID 2492 wrote to memory of 5064	2492	msedge.exe	94
PID 2492 wrote to memory of 1240	2492	msedge.exe	95
PID 2492 wrote to memory of 1240	2492	msedge.exe	95
PID 2492 wrote to memory of 5772	2492	msedge.exe	96
PID 2492 wrote to memory of 5772	2492	msedge.exe	96
PID 2492 wrote to memory of 5772	2492	msedge.exe	96
PID 2492 wrote to memory of 4280	2492	msedge.exe	97
PID 2492 wrote to memory of 4280	2492	msedge.exe	97
PID 2492 wrote to memory of 4280	2492	msedge.exe	97
PID 2492 wrote to memory of 6092	2492	msedge.exe	98
PID 2492 wrote to memory of 6092	2492	msedge.exe	98
PID 2492 wrote to memory of 6092	2492	msedge.exe	98
PID 2492 wrote to memory of 4628	2492	msedge.exe	99
PID 2492 wrote to memory of 4628	2492	msedge.exe	99
PID 2492 wrote to memory of 4628	2492	msedge.exe	99
PID 2492 wrote to memory of 1980	2492	msedge.exe	101
PID 2492 wrote to memory of 1980	2492	msedge.exe	101
PID 5336 wrote to memory of 2912	5336	2026-06-27_ad19b3754a04c7e042847f12d070a2f1_elex_rhadamanthys_stop.exe	102
PID 4856 wrote to memory of 3840	4856	kfavpnhfzx.exe	105
PID 2492 wrote to memory of 1168	2492	msedge.exe	109
PID 2492 wrote to memory of 1164	2492	msedge.exe	108
PID 2492 wrote to memory of 1168	2492	msedge.exe	109
PID 2492 wrote to memory of 1164	2492	msedge.exe	108
PID 2492 wrote to memory of 2044	2492	msedge.exe	111
PID 2492 wrote to memory of 3736	2492	msedge.exe	112
PID 2492 wrote to memory of 3736	2492	msedge.exe	112
PID 2492 wrote to memory of 4580	2492	msedge.exe	115
PID 2492 wrote to memory of 4580	2492	msedge.exe	115
PID 5336 wrote to memory of 1300	5336	2026-06-27_ad19b3754a04c7e042847f12d070a2f1_elex_rhadamanthys_stop.exe	116
PID 5336 wrote to memory of 5616	5336	2026-06-27_ad19b3754a04c7e042847f12d070a2f1_elex_rhadamanthys_stop.exe	120
PID 3036 wrote to memory of 1876	3036	fcwupmhczx.exe	122
PID 5336 wrote to memory of 1992	5336	2026-06-27_ad19b3754a04c7e042847f12d070a2f1_elex_rhadamanthys_stop.exe	125
PID 5336 wrote to memory of 4900	5336	2026-06-27_ad19b3754a04c7e042847f12d070a2f1_elex_rhadamanthys_stop.exe	129
PID 5404 wrote to memory of 4588	5404	uomhezxrpj.exe	131
PID 5336 wrote to memory of 2552	5336	2026-06-27_ad19b3754a04c7e042847f12d070a2f1_elex_rhadamanthys_stop.exe	134
PID 2492 wrote to memory of 4268	2492	msedge.exe	136
PID 2492 wrote to memory of 4268	2492	msedge.exe	136
PID 2492 wrote to memory of 4268	2492	msedge.exe	136
PID 2492 wrote to memory of 2568	2492	msedge.exe	137
PID 2492 wrote to memory of 2568	2492	msedge.exe	137
PID 2492 wrote to memory of 2568	2492	msedge.exe	137
PID 5336 wrote to memory of 2592	5336	2026-06-27_ad19b3754a04c7e042847f12d070a2f1_elex_rhadamanthys_stop.exe	140
PID 2420 wrote to memory of 4652	2420	wrojhbztrm.exe	142
PID 5336 wrote to memory of 4072	5336	2026-06-27_ad19b3754a04c7e042847f12d070a2f1_elex_rhadamanthys_stop.exe	146
PID 2492 wrote to memory of 1260	2492	msedge.exe	148
PID 2492 wrote to memory of 5244	2492	msedge.exe	149
PID 2492 wrote to memory of 5196	2492	msedge.exe	150
PID 5336 wrote to memory of 3692	5336	2026-06-27_ad19b3754a04c7e042847f12d070a2f1_elex_rhadamanthys_stop.exe	153
PID 3668 wrote to memory of 3244	3668	gbytrljdbv.exe	155
PID 5336 wrote to memory of 5052	5336	2026-06-27_ad19b3754a04c7e042847f12d070a2f1_elex_rhadamanthys_stop.exe	158
PID 5336 wrote to memory of 4512	5336	2026-06-27_ad19b3754a04c7e042847f12d070a2f1_elex_rhadamanthys_stop.exe	162
PID 6060 wrote to memory of 4448	6060	ysqoljdbvt.exe	164
PID 5336 wrote to memory of 4880	5336	2026-06-27_ad19b3754a04c7e042847f12d070a2f1_elex_rhadamanthys_stop.exe	167
PID 5336 wrote to memory of 5820	5336	2026-06-27_ad19b3754a04c7e042847f12d070a2f1_elex_rhadamanthys_stop.exe	171
PID 1136 wrote to memory of 1056	1136	xvtnlfdxvq.exe	173
PID 5336 wrote to memory of 5156	5336	2026-06-27_ad19b3754a04c7e042847f12d070a2f1_elex_rhadamanthys_stop.exe	176
PID 5336 wrote to memory of 1268	5336	2026-06-27_ad19b3754a04c7e042847f12d070a2f1_elex_rhadamanthys_stop.exe	180
PID 5964 wrote to memory of 1260	5964	idaysqkida.exe	182

C:\Users\Admin\AppData\Local\Temp\2026-06-27_ad19b3754a04c7e042847f12d070a2f1_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_ad19b3754a04c7e042847f12d070a2f1_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5336
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x364,0x7ffbf57bc188,0x7ffbf57bc194,0x7ffbf57bc1a0
      4⤵
      PID:472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,11803563170398290369,10710234819467218075,524288 --field-trial-handle=2424,i,136553328672059987,16027564036135443127,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:11
      4⤵
      System Time Discovery
      PID:3404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,216654354749848964,2106053771070131937,262144 --field-trial-handle=2424,i,136553328672059987,16027564036135443127,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:2
      4⤵
      PID:5064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,10285421479566810236,1692662432436686976,524288 --field-trial-handle=2424,i,136553328672059987,16027564036135443127,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:13
      4⤵
      PID:1240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,11899982766238682644,14069367792498901885,2097152 --field-trial-handle=2424,i,136553328672059987,16027564036135443127,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:5772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,18004965240072114412,13327106731326450841,2097152 --field-trial-handle=2424,i,136553328672059987,16027564036135443127,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:4280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,3099793576096918770,11275536553548149930,2097152 --field-trial-handle=2424,i,136553328672059987,16027564036135443127,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:1
      4⤵
      PID:6092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,5466273765182571985,12173897188837570700,2097152 --field-trial-handle=2424,i,136553328672059987,16027564036135443127,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:9
      4⤵
      PID:4628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,16377027961581363088,10981232850218067696,524288 --field-trial-handle=2424,i,136553328672059987,16027564036135443127,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:14
      4⤵
      PID:1980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,8965904118783987714,9610217429287138849,524288 --field-trial-handle=2424,i,136553328672059987,16027564036135443127,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
      4⤵
      PID:1164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,7260944960820098906,6115287638895554762,524288 --field-trial-handle=2424,i,136553328672059987,16027564036135443127,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
      4⤵
      PID:1168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,618524965053000186,14833936946965357401,524288 --field-trial-handle=2424,i,136553328672059987,16027564036135443127,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
      4⤵
      PID:2476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,618524965053000186,14833936946965357401,524288 --field-trial-handle=2424,i,136553328672059987,16027564036135443127,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
      4⤵
      PID:2044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,9560900322384996254,9931899081696720684,524288 --field-trial-handle=2424,i,136553328672059987,16027564036135443127,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
      4⤵
      PID:3736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,13189735087987074896,5847131362689108792,524288 --field-trial-handle=2424,i,136553328672059987,16027564036135443127,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
      4⤵
      PID:4580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3784,i,1114578016666306378,15583370310907171897,2097152 --field-trial-handle=2424,i,136553328672059987,16027564036135443127,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
      4⤵
      PID:4268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5128,i,17295035369284022056,12332563390684016106,2097152 --field-trial-handle=2424,i,136553328672059987,16027564036135443127,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:1
      4⤵
      PID:2568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,11630033385808260807,12026265815444211581,524288 --field-trial-handle=2424,i,136553328672059987,16027564036135443127,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
      4⤵
      PID:1260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,5240327203755835707,13531667094283318884,524288 --field-trial-handle=2424,i,136553328672059987,16027564036135443127,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:14
      4⤵
      PID:5244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,1621359290759953952,1542563942446625963,524288 --field-trial-handle=2424,i,136553328672059987,16027564036135443127,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:14
      4⤵
      PID:5196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,11421998703437145899,15127799441989840157,524288 --field-trial-handle=2424,i,136553328672059987,16027564036135443127,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
      4⤵
      PID:1612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,12435103091990154112,18423169033640419382,524288 --field-trial-handle=2424,i,136553328672059987,16027564036135443127,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:14
      4⤵
      PID:2616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3368,i,11754882117750602727,8211693666082254577,524288 --field-trial-handle=2424,i,136553328672059987,16027564036135443127,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:14
      4⤵
      PID:1440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,13737150643095640856,1020603530878464816,524288 --field-trial-handle=2424,i,136553328672059987,16027564036135443127,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:1168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6840,i,6129128272343521970,14897211448761254812,262144 --field-trial-handle=2424,i,136553328672059987,16027564036135443127,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,18097642656868900370,7683016936860888751,524288 --field-trial-handle=2424,i,136553328672059987,16027564036135443127,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:14
      4⤵
      PID:2548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfavpnhfzx.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2912
- - C:\Temp\kfavpnhfzx.exe
    C:\Temp\kfavpnhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4856
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3840
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfavpnhfzx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1300
- - C:\Temp\i_kfavpnhfzx.exe
    C:\Temp\i_kfavpnhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fcwupmhczx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5616
- - C:\Temp\fcwupmhczx.exe
    C:\Temp\fcwupmhczx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3036
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1876
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fcwupmhczx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1992
- - C:\Temp\i_fcwupmhczx.exe
    C:\Temp\i_fcwupmhczx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5648
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomhezxrpj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4900
- - C:\Temp\uomhezxrpj.exe
    C:\Temp\uomhezxrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5404
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4588
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomhezxrpj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2552
- - C:\Temp\i_uomhezxrpj.exe
    C:\Temp\i_uomhezxrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrojhbztrm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2592
- - C:\Temp\wrojhbztrm.exe
    C:\Temp\wrojhbztrm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2420
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4652
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrojhbztrm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4072
- - C:\Temp\i_wrojhbztrm.exe
    C:\Temp\i_wrojhbztrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2028
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbytrljdbv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3692
- - C:\Temp\gbytrljdbv.exe
    C:\Temp\gbytrljdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3668
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3244
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbytrljdbv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5052
- - C:\Temp\i_gbytrljdbv.exe
    C:\Temp\i_gbytrljdbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqoljdbvt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4512
- - C:\Temp\ysqoljdbvt.exe
    C:\Temp\ysqoljdbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6060
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4448
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqoljdbvt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4880
- - C:\Temp\i_ysqoljdbvt.exe
    C:\Temp\i_ysqoljdbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvtnlfdxvq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5820
- - C:\Temp\xvtnlfdxvq.exe
    C:\Temp\xvtnlfdxvq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1136
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1056
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvtnlfdxvq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5156
- - C:\Temp\i_xvtnlfdxvq.exe
    C:\Temp\i_xvtnlfdxvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5300
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\idaysqkida.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1268
- - C:\Temp\idaysqkida.exe
    C:\Temp\idaysqkida.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5964
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1260
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_idaysqkida.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3188
- - C:\Temp\i_idaysqkida.exe
    C:\Temp\i_idaysqkida.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xspnkfdxvp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6136
- - C:\Temp\xspnkfdxvp.exe
    C:\Temp\xspnkfdxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2092
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3508
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xspnkfdxvp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5976
- - C:\Temp\i_xspnkfdxvp.exe
    C:\Temp\i_xspnkfdxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhczxupnhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:476
- - C:\Temp\jhczxupnhf.exe
    C:\Temp\jhczxupnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6088
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5860
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhczxupnhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5232
- - C:\Temp\i_jhczxupnhf.exe
    C:\Temp\i_jhczxupnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urmjhczurm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3156
- - C:\Temp\urmjhczurm.exe
    C:\Temp\urmjhczurm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2512
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1332
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urmjhczurm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2052
- - C:\Temp\i_urmjhczurm.exe
    C:\Temp\i_urmjhczurm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgecwromhb.exe ups_run
  2⤵
  PID:5400
- - C:\Temp\mgecwromhb.exe
    C:\Temp\mgecwromhb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3008
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3924
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgecwromhb.exe ups_ins
  2⤵
  PID:6092
- - C:\Temp\i_mgecwromhb.exe
    C:\Temp\i_mgecwromhb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywtrljhbz.exe ups_run
  2⤵
  PID:5332
- - C:\Temp\eywtrljhbz.exe
    C:\Temp\eywtrljhbz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5652
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1480
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywtrljhbz.exe ups_ins
  2⤵
  PID:1736
- - C:\Temp\i_eywtrljhbz.exe
    C:\Temp\i_eywtrljhbz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igbytqlgdb.exe ups_run
  2⤵
  PID:1356
- - C:\Temp\igbytqlgdb.exe
    C:\Temp\igbytqlgdb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3444
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3488
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igbytqlgdb.exe ups_ins
  2⤵
  PID:4876
- - C:\Temp\i_igbytqlgdb.exe
    C:\Temp\i_igbytqlgdb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvtoigaytq.exe ups_run
  2⤵
  PID:5732
- - C:\Temp\bvtoigaytq.exe
    C:\Temp\bvtoigaytq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3272
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6056
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bvtoigaytq.exe ups_ins
  2⤵
  PID:3476
- - C:\Temp\i_bvtoigaytq.exe
    C:\Temp\i_bvtoigaytq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvsnlfdays.exe ups_run
  2⤵
  PID:4312
- - C:\Temp\bvsnlfdays.exe
    C:\Temp\bvsnlfdays.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6072
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2908
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bvsnlfdays.exe ups_ins
  2⤵
  PID:1264
- - C:\Temp\i_bvsnlfdays.exe
    C:\Temp\i_bvsnlfdays.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snkicaxsnk.exe ups_run
  2⤵
  PID:4536
- - C:\Temp\snkicaxsnk.exe
    C:\Temp\snkicaxsnk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3732
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3448
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snkicaxsnk.exe ups_ins
  2⤵
  PID:3724
- - C:\Temp\i_snkicaxsnk.exe
    C:\Temp\i_snkicaxsnk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkfcxvpnh.exe ups_run
  2⤵
  PID:4912
- - C:\Temp\smkfcxvpnh.exe
    C:\Temp\smkfcxvpnh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3416
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5476
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkfcxvpnh.exe ups_ins
  2⤵
  PID:2248
- - C:\Temp\i_smkfcxvpnh.exe
    C:\Temp\i_smkfcxvpnh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxupnhfzur.exe ups_run
  2⤵
  PID:3440
- - C:\Temp\zxupnhfzur.exe
    C:\Temp\zxupnhfzur.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1800
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1412
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxupnhfzur.exe ups_ins
  2⤵
  PID:4284
- - C:\Temp\i_zxupnhfzur.exe
    C:\Temp\i_zxupnhfzur.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:596
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwupjhecw.exe ups_run
  2⤵
  PID:3900
- - C:\Temp\ecwupjhecw.exe
    C:\Temp\ecwupjhecw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:716
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:708
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwupjhecw.exe ups_ins
  2⤵
  PID:2348
- - C:\Temp\i_ecwupjhecw.exe
    C:\Temp\i_ecwupjhecw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4524

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2464

C:\Temp\xsmkicxmhe.sys
C:\Temp\xsmkicxmhe.sys
1⤵
- Executes dropped EXE
PID:1712

C:\Temp\kebzuomhec.sys
C:\Temp\kebzuomhec.sys
1⤵
- Executes dropped EXE
PID:5720

C:\Temp\ebztrmjecw.sys
C:\Temp\ebztrmjecw.sys
1⤵
- Executes dropped EXE
PID:5316

C:\Temp\ojgbytrljd.sys
C:\Temp\ojgbytrljd.sys
1⤵
- Executes dropped EXE
PID:5960

C:\Temp\tqligdbvtq.sys
C:\Temp\tqligdbvtq.sys
1⤵
- Executes dropped EXE
PID:3444

C:\Temp\gdyvqoiday.sys
C:\Temp\gdyvqoiday.sys
1⤵
- Executes dropped EXE
PID:1956

C:\Temp\kidavsqkid.sys
C:\Temp\kidavsqkid.sys
1⤵
- Executes dropped EXE
PID:1712

C:\Temp\fcausnkfca.sys
C:\Temp\fcausnkfca.sys
1⤵
- Executes dropped EXE
PID:6052

C:\Temp\pmkecxupnh.sys
C:\Temp\pmkecxupnh.sys
1⤵
- Executes dropped EXE
PID:3272

C:\Temp\wupmkeczxr.sys
C:\Temp\wupmkeczxr.sys
1⤵
- Executes dropped EXE
PID:1004

C:\Temp\mjhbzurmke.sys
C:\Temp\mjhbzurmke.sys
1⤵
PID:2988

C:\Temp\geywtrljhb.sys
C:\Temp\geywtrljhb.sys
1⤵
PID:5476

C:\Temp\rljgbytrlb.sys
C:\Temp\rljgbytrlb.sys
1⤵
PID:4980

C:\Temp\aytnljdbvt.sys
C:\Temp\aytnljdbvt.sys
1⤵
PID:4444

C:\Temp\ysqnlfdays.sys
C:\Temp\ysqnlfdays.sys
1⤵
PID:4240

C:\Temp\axvpnifays.sys
C:\Temp\axvpnifays.sys
1⤵
PID:2780

C:\Temp\cxvpnhfaxs.sys
C:\Temp\cxvpnhfaxs.sys
1⤵
PID:2068

C:\Temp\zurpkhcaur.sys
C:\Temp\zurpkhcaur.sys
1⤵
PID:1004

C:\Temp\ezxrpmhezx.sys
C:\Temp\ezxrpmhezx.sys
1⤵
PID:2660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebztrmjecw.sys

Path C:\Temp\ebztrmjecw.sys
Size 141KB
SHA256 a3863c5730656fb2cfd725f2734e4fb8f78af960f95c350428ae11c007a3d02c
MD5 b841080d5d1ff8a443af3ef063916d79
SHA1 133afee9c7aa218916b3889b7979b3255c286512
SHA512 293e816b73bc9154ccf6bc929a75d30b21d0dfdf497645443da91b61fb8b576d7c8027cd027b99bca9a6020247bd37ab682e7d89b8b81461bbe2d09fb7233bb0
SSDEEP 1536:ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T115E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcwupmhczx.exe

Path C:\Temp\fcwupmhczx.exe
Size 243KB
SHA256 4d0053c0b54423e72dac6eb0c555753a5406f06679e1a44e23b91b69a2ea51e3
MD5 3033fae6e5bea554b4fe2b21f81007ca
SHA1 cdef7cdcd6aa44e6889ce477a50d497faefec282
SHA512 1856b01c9e2b1084991d3c0a39c57c2127c143cd0e873cd9415c9c95d98febe3584cee0ec7c1defc714228d6fe7b9612d3b23963217ec358ba259479a103b309
SSDEEP 3072:12z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7N:1wD99LB68zowa3lLNngoqRttA7N
TLSH
T184345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytrljdbv.exe

Path C:\Temp\gbytrljdbv.exe
Size 243KB
SHA256 80ed02477894dfa2e7c73890c8c097d75ee9f67fc81839e11133218b36ea7322
MD5 bf83731b158744e09d87c72446605a73
SHA1 c16a6928060f0d3a99696dac743fa94a980514bd
SHA512 cc8e5b0f340b4ed608e39cff6a144363ef00edb69919f12c5107216580c89f007201c64582bcaabdbb4298b1cda591427e18fe76b7c9e825555129c9f983ddd2
SSDEEP 3072:b2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7H:bwD99LB68zowa3lLNngoqRttA7H
TLSH
T15B345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fcwupmhczx.exe

Path C:\Temp\i_fcwupmhczx.exe
Size 243KB
SHA256 ae1eca9f468bb83621b2f79ef5dc9d0bd00ff70ed02d98f5d3fa94792bb75e0a
MD5 16639db9da7ec6fc4a44ef522f28cc98
SHA1 d57d3c36e85c859ab0c1361ac2e512811e8bb5dc
SHA512 635961fc2430e00153baa1e09157ceae8f4ddc5259c844d737d70a311d34bce6179e1b4ab8bef2c991d2dad04e54eb9d87645f058d28d86879adb4e510727182
SSDEEP 3072:h2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7p:hwD99LB68zowa3lLNngoqRttA7p
TLSH
T124345A1172818071E75A0B78046AE7A1467E7C384BA5E5CFF7683F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gbytrljdbv.exe

Path C:\Temp\i_gbytrljdbv.exe
Size 243KB
SHA256 205e9d2608a217c6a2904c3c10f5970c33dcba3e7f696323e61cf0b1b6290060
MD5 f09a2bb3eafc354513352fd035869b7e
SHA1 3a8c3f272eca8f05597df0274090bee2799480e1
SHA512 765329ec45bdf25d3d7e4562d215d369d386242b4487da3b5efc86133720714fa91bfd35475a557f0ddeaa81545ccfda16cc23c06e1630259f054c123e5982c7
SSDEEP 3072:82z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7w:8wD99LB68zowa3lLNngoqRttA7w
TLSH
T1DC345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kfavpnhfzx.exe

Path C:\Temp\i_kfavpnhfzx.exe
Size 243KB
SHA256 3a9716dc7e79265290f8fdfbd31a60355c2cb62baabf4e8e0f0f4f51630a67a6
MD5 a21cc42fd0fe332f26bf661ebc5e6682
SHA1 1e46f54033bddaaf574578db35c0a95d28cf071a
SHA512 baa28ed45aefa19f7471387d5a23222199984899b648553fae8731c0e26d72108058db2b4c4ff4dcec8f7ec5d9c776f419d6ed41eaf15cffcb749d01d5469ffb
SSDEEP 3072:b2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7X:bwD99LB68zowa3lLNngoqRttA7X
TLSH
T139345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uomhezxrpj.exe

Path C:\Temp\i_uomhezxrpj.exe
Size 243KB
SHA256 011e00f11145a186aacbee403aec17bcad6aeabb99dced8635b269583ba92860
MD5 43fa873db7a1b436675aefd01c9b6e75
SHA1 3d4923264b61ec7d290b146c2887ee4496bb3d78
SHA512 84f231d3704f1a5782dd74a106b2fa3a98dea222672d2a2e1c02aec426a6db064201c4a6a9a0c3509dc1dba934f800af4b351312ffa31aba0fe7872fd8e42da2
SSDEEP 3072:62z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7G:6wD99LB68zowa3lLNngoqRttA7G
TLSH
T189345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrojhbztrm.exe

Path C:\Temp\i_wrojhbztrm.exe
Size 243KB
SHA256 1d211ec601950b2bf2f44635a7e54e4f85e142d0bcb0eaf9c50e465f0e87de07
MD5 e41a08924d97bfa2b8972f026b546d33
SHA1 b4f5f15fbda9b3f490de1e3d53a07a06bc809422
SHA512 508f835ae8b98481e2da689ef5f2002aae9faf642ee9c8825f6bf5f38440abafee222ec2687546501e5c9cc8a33f208088c4f01f75ba58d4f58dea54e1020dce
SSDEEP 3072:b2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7H:bwD99LB68zowa3lLNngoqRttA7H
TLSH
T1C5345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ysqoljdbvt.exe

Path C:\Temp\i_ysqoljdbvt.exe
Size 243KB
SHA256 c511e506c86e5ec3b5e254a30f10755ec65f4cd0faf414436d94f5c6fb7ecb0f
MD5 fd9c026f1caf9b3d3222fbb486ba5cdd
SHA1 62b92cf9627aa2b0523eee8cb92d9079e45ab59c
SHA512 6c3c2923840e53bdbcc0ee05a2b69c77ac26e108ec10c3cdacba325abd334a584b9eeee97d6280afe4dce910e22a409ff5e42f2a70237e911e751bf1b7fb827b
SSDEEP 3072:E2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7M:EwD99LB68zowa3lLNngoqRttA7M
TLSH
T1C5345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kebzuomhec.sys

Path C:\Temp\kebzuomhec.sys
Size 141KB
SHA256 8769a958304ccb84e8a2b81e9c5506ec67ecf91cbeb2ee844d594aa1545a51f6
MD5 105b02d6ae162ebb9ab1adbbe6184409
SHA1 40559b83803830974f272851d785fe8c6c79923e
SHA512 f17457e13b1f2c12f367cb0c1454424186695c7e6b8bcbd399fde56dacc66e92128b5de96b28a915b0ace906ce72178d96ea210017f0808bec4b69716a850ca6
SSDEEP 1536:Fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C7E37C12B2D2D172E4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfavpnhfzx.exe

Path C:\Temp\kfavpnhfzx.exe
Size 243KB
SHA256 758fb8053d62302c73146da10b4217770a176dc59e1d58abd5f12babcd92a71b
MD5 417d2f3bb8c9e39d0f7aca38d02931de
SHA1 4e4e743d7b1c05dd1f013ae3c68a1f29933099d5
SHA512 140483004d497fa91cd9ed331cec9037d32adacc287c415088015645c0e958391b1d8268427a18dd93c2394630656eac0c7fb837febea402fc0c923bdcd189ec
SSDEEP 3072:O2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7O:OwD99LB68zowa3lLNngoqRttA7O
TLSH
T1DA345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7683F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojgbytrljd.sys

Path C:\Temp\ojgbytrljd.sys
Size 141KB
SHA256 40a7070cf07f5839f33e26c794544b6068424192fcc54cff0222cbb846c56e9f
MD5 4d0b194641671b3a90dccef6a0a086c3
SHA1 ef7e3d31b8400eb7a7dcacc3377697342cfb3d95
SHA512 5cdae15431dc3c1f53d5e48237153a42950690b3f5c7dd43861c8ae6543f69e205cb8d70ecc63d1614bf70f3b0ee795a6b87330b8fcd793c41764a432f75e049
SSDEEP 1536:0a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:0a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B4E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqligdbvtq.sys

Path C:\Temp\tqligdbvtq.sys
Size 141KB
SHA256 87896fc272b020a9595d8d5a95c820dfff4594b84528e444ee17219f66e4b7b9
MD5 e8da4fc6882c3e7897630ba37cbff7a8
SHA1 4e86d7067e53af55e847c3a7de58d5a9ce1078b7
SHA512 64fd77b36cd73c71c725f7a46e552d1e916af967aa0143427d6d0bd4146d09c4c34d71f6b57c58da17529a6657acdd482e02c1a080adfe750433d39e71bd9e28
SSDEEP 1536:Va3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Va3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1FEE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomhezxrpj.exe

Path C:\Temp\uomhezxrpj.exe
Size 243KB
SHA256 dda02b3ebd21ff09268e1ecdccef174fff70a551208135d0f1e493b52b820e5d
MD5 21c6a0a0271687f93c5e807bba23dbaa
SHA1 30a91320779ad0c8a6494e69de122283156ae80c
SHA512 832fd6403b5f294e1c3a7903e591fe565bd2a53d605479a53a411d94e24debf4b001b66fceca316c2bf7887f72c12eb118bb7a1ca36feb6084c44b05198ca530
SSDEEP 3072:n2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7j:nwD99LB68zowa3lLNngoqRttA7j
TLSH
T100345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrojhbztrm.exe

Path C:\Temp\wrojhbztrm.exe
Size 243KB
SHA256 5c664c93d9664be6e45e7ca0269101b87cc85432e1c3afdfbfe7937c9404a518
MD5 1c664daf9cccf9b2bb6bd5d6963bda0f
SHA1 27bc1f88b19ea577c1b21c0854111a259e21e2b2
SHA512 0d1cc242fb7c2b43c71429196b182332683b9bf4524c8759efdb659953940e921e7e4fd3de44b6f9a5133827d457e885ccef0b191c59073be929e41e90ace8d8
SSDEEP 3072:Y2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA70:YwD99LB68zowa3lLNngoqRttA70
TLSH
T1C2345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xsmkicxmhe.sys

Path C:\Temp\xsmkicxmhe.sys
Size 141KB
SHA256 7bfb7ddd93a7c8d95945f801ce7f63fb6942a2559fa6ff05b7f7f50a353e6020
MD5 f9c23b6eb5997bd85cbf9aef9213192c
SHA1 b6dc032ce00fea7e9ab69f9eecae7e5c7e5a7777
SHA512 8303e7f3ab83e84b4c8e1464cc7eaa9594cbfa70311727d372309002ac979dd760cce1ac851b99acf536e75af7337cb67c5794ba4743a7c7731dfb754b36f3c5
SSDEEP 1536:6a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:6a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T18AE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqoljdbvt.exe

Path C:\Temp\ysqoljdbvt.exe
Size 243KB
SHA256 a95625ac0fede0f595f2ecc1414298f4716ecc994f305b5c32c8ccc11e48654f
MD5 2fb3b306c2ca0b646f220cc7c319f2e9
SHA1 50cd6bf5b46bbb9c9d9b00293ddce6f7066c81ef
SHA512 baac4a14a5b83b7cc2a7c06a8fb3f2e215614ab76311bfd3bd384e2a732ae0872d023b655f53232e9475f5feb0b5af1d05f289e5f468cf7dc51d5dce751d593f
SSDEEP 3072:pv2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7P5:pwD99LB68zowa3lLNngoqRttA7h
TLSH
T1FF345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 86bd3a0f7328ff17cf8f5c348bd8ac04b7d41c52ef238ad0b048b09e5a964859
MD5 c6e3af776b1f4463a76e29cca079d5e5
SHA1 19b7f1bc72393d7717302ee15e0e4afa431cea45
SHA512 b15ef012a17356e47acc81e1922c433a19e6e554795a46fdf0ae05df1e9abbc87a47b05bc831bac2c6c32faad3f39c7a7cb21ae65ceb4f96f3deb3ea0d83e9c6
TLSH
T1D7D080613B05A616D54B19729C18E7117237844234E3D9097171D10EDABD3C4F3C51F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 be05b8d7f0bed3c8d0e89a1a49e4bae1f45619d94149f9abd8291f558897f2f2
MD5 e02c579c3ab95f9c3a77f9c2199a30f0
SHA1 f96c7c58830f56a993117d75a3b0f9e30bfc93a7
SHA512 264a83561849b0e2a1c42c3e478b7d5a3b3fa31f901f29440fc853108e9046e73ba21a692d0dbdef7d9fd76e9b6aac64489fb603c47ab551280df09d26d7e2a4
TLSH
T140D080613B05A516D54B19729C19E7117237844224E3D9097171D11EDABD3C4F3C51E3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e42ee113cf8cf22cddd01ce4a402cc629c9bcab89fbf2f4e8228207dca099b18
MD5 8d37866ebfba1ff820a2b020594dccfe
SHA1 e68eff18f810616f8dbcbaf62a2881c9a4ebf770
SHA512 578a8237e689d7c1599c8ee8d95c1a0f363e511a79457c0cb92835ada4db36024b05166ee8956fb94703c4f511d438f1456ce50b3168ea926e88b6734e6d7fd2
TLSH
T1D661A369C226CA61EF6743F1D1FAD4993F748836060BAD1D789E3034BA06F8F54A3032
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 33466562cb0e288f16735d26cbbd8528959a4b9bd517aa1342dff0e5d5bc5aa2
MD5 423c894c798b060ce017f4c5635ebe96
SHA1 521eaff578f466acd0f82917e602edf91122c6d1
SHA512 5018a3fabea14efa6172473ee37372766dcf16a26ac367cc248066addc61bb330ee133fe81c7879140aed867573fd2e9b61d4c1892650b928eb3424b265e1dd7
TLSH
T13B61A369C226CA61EF6743F5D1FAE4A93F704836060BAD1C798E3034BA06F8F5463036
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1d79f1de76ede1478d9f3e2f2010d78305d93b70089e2275b2ccd45dc0d687af
MD5 687ac0d5a44aa21e0310187c529a7bb0
SHA1 9594d0139ed19cabb96212816ddb9455f2c27cbc
SHA512 03edffa50ddce1122bbce8b3d6c6445484a53c1418fea3bb108fe8ac9aea464230a2827552db4eabba62ec300eb0ed5914813c38b867d7e3c42405a7202e7baf
TLSH
T18C51CCF3C3E8866D891196F0BA147E2BCE2E0914432C3D5AC9E4EF1B93E2471E24194E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5bf19bdbdd646e9ca9e1acafe0bda058f415ea6c160e900a9887a9821b132f66
MD5 e3dadb7735a37622e52cd1b04979f54f
SHA1 ede0291a9a7c976473643c6b65f4803f4352cb5b
SHA512 8814cf23be1924d54d43c3f1d384327ff0b206f5581ddbec4889eadf3b1527ac846fef6936916412e2b00b4c73bc4bb91bcb9864a7ec4146f5706f987c8e2e86
SSDEEP 192:sxRFRFyM/jK1Ml8wcQ/fKsHh5ZRTuKzoA8pi/g6+WNIYAQzwWgYVGLHIgtJ:sxRFxCQ/fKsHhXZuHi/5IQwWgYA3
TLSH
T15352C9166A24993BCCDBD30DFA557F53D6F85563A2901E44AAFC8A0C04E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 974c3df1c4612a3f0e8d85ca9a17668fee65935190d9422c30d0c00e4f67315c
MD5 2e0877611fe7f7d811f274d40cda5a3e
SHA1 b5852a3978b29d1f467f1a9bf1b18ea26a1cc0a5
SHA512 d0f2ecca49112f3e1ec9af27f0ba657d5487840435a290b0a4d1ab7548a7466290679e20b6a1615bbbef38f1cb8a352be6fed2cc25c1af782b9eb35e10b555d2
SSDEEP 192:sxRuRFyM/jK1Ml8UQ6cQ/fKsZd5ZRbuKzoA8prv/g6+WNCpW/YAtzwWgYVGLHIgJ:sxRuDqJQ/fKsZdXtuHT/5N/9wWgYAJ
TLSH
T18662D916A524997BCCDBD309FA517B53D2F85573A2901E48AAFC8B0C05E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b3f1cd826acfdeec0dc417243f61a833560ec6fd3bf57cb30d1742048bd1a629
MD5 950290c415b64da0f819593ae5f5c991
SHA1 2b138321ff76620615b0e842af48b7719b7eada4
SHA512 a859158c0662ce14caa242a592c2f365e4950626d9549a27a614379fe521bec2b60a95ff9df38b313eea61d9c156b1a4e820032dccd33420326c07bb7129bed5
SSDEEP 192:sxRuRFyM/jK1Ml8wcQ/fKsZd5ZRbuKzoA8p9v/g6+WNCpW/YAtzwWgYVGLHIgDTJ:sxRuDCQ/fKsZdXtuH5/5N/9wWgYAJ
TLSH
T1C062D916A624597BCCDBD309FA517B53D2F85573A2901E48AAFC8B0C05E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 eb7ba297748e8e92b7fc71c6c44661203e0f4d2219267412b584c670e36291ef
MD5 0486280993399d8fefca03fe6deaee25
SHA1 a8ded032e981c0e51463e1b3fb6a4a1172c0b116
SHA512 a6b36fa14e266a67a9349630458dacc068856edfd2ce7bf7b6669fc8337db027a9e16c9d12323e13fe9ff20d43eeba47ce36ef931d396184bdd5f2f9ca9a8c2f
SSDEEP 192:sxRuRFyM/jK1Ml8wcQ/fKsZh5ZRTuKzoA8pi/g6+WNIYAQzwWgYVGLHIgDhJ:sxRuxCQ/fKsZhXZuHi/5IQwWgYA/
TLSH
T1AE52D9166A24593BCCDBD30DFA557F53D6F85563A2901E48AAFC8A0C04E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 20463ebe5a4468a2a61e1f404a20b84d6ec4700bad8a0f3e407c3b4b3a0be88f
MD5 4751de1fe95e504b7b97dc77e80ce641
SHA1 e7c25bffc23d9dd2c4b9667b86da9ef9a0658598
SHA512 3fc90938d2927bd48c8220273b1091c2a79778479f29513faacd8b03699f8e9cf29ccb60cc2bd650f91d631ef38ca3461df078dd0adf3ca00a636bd25dd8f193
SSDEEP 768:l1AvbY7pLuL7j+WgI+f2z8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpqD7zV6ro9s71:l1AvbEE7j+WgI+f2zu1jaeqD/VxS71
TLSH
T1B0E2FC3B680CCB7E4F844A9CEC29BE9F6DA801CF96988D5447EA440C03C67EF551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a195a9222de01ae4ed9e650f2673f70f33c1f1b1fd09dc73a284a641b2b237da
MD5 233e9ce523c3843cdae99f40354fe712
SHA1 835a2edda04ca84c77771c2e62495c4290ebad7d
SHA512 cbefa65dc88a7d35bb03b0bb2b82b1591a65592cce3a60dbb8dbdcebab40f8b8f88b0b4dabb78e69334d0be6b9ea2a7ca21f128545b78a94d6c2fc00a731f2cf
SSDEEP 48:KUoIrKlicbydrIZKwIMzy2sfAcu62kG6pPIpkkKYBgWkU80vJu/:KUoAKli6GrKKwIK2F+KGod
TLSH
T1B991F5057ABE265028BE6508D2D5995E33423473B226E63B7FBC24D75E27E001EFC8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59d7a9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59d7a9.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 531ead28fec70f7ebd4fe342e702f4afd14a964be43764dfa644da5c1ecc0699
MD5 f03b3c5169c810dc062d7f694f411ccc
SHA1 6d802e3b19feef7ca725063f00a7333bd12718a2
SHA512 8d3fd1d96e9a9f4f5146835453083e556c0185d5aa98483753f852a4d5383dd0379d14e1850ff09e164e158ac5071282a7146c801657517eca86d653da6760ba
SSDEEP 768:ojaeqD4MlshiLdMmp38/Dj95BwT7VWs+DoLSpG0/TIoF4+ApXGFTX:oqcjhIdMC3LVmoTiTC+KXi
TLSH
T11103C07AA8A89D739CA6C7C1760BA5432F744353C6C83FD8D9DD6A0D01972DE634342A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 a8ebf7995e6376aa67c23cc813fae4f4512687c98da022a2081e25f0b4ad640b
MD5 40e8aee91d5885ad80ed1d2122140f40
SHA1 1e10ee766df30a512cd62aacce3af9c3b7c99547
SHA512 70a7d7da332f78fd6e56fca47038c7ad98c96792b4264cb905fc58d0bf2e2c2e796957b7f9a7f271273d54ff179361ea5d545610d5606aa8b1fbcbfa7478f3b6
SSDEEP 768:bF1j+9+3swgRMs7XE5BwT7VWs+DoLSpG0/TIo5jVzn12bfJ38:69+38VmoTiTzByJ38
TLSH
T14F1327F698D78936E89E8783673E6E465ABCC163B5881994F7884D0DCC832BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 feff55b9509a8492b6c041e132e261d5e856e4f742f6109fc10e28561c10ddfb
MD5 7d5f1a7314612c9318b3693d44cf0a3c
SHA1 106e18d62376e37e13c7c6e2be7cfd6522c77322
SHA512 2f34d8d753726bf99937bffe763dfa35c3cde75550abca3d04134eb71024c9b36b690402fc42fefad78359d12c4697543a3df35a7bd082518058cc1e96f12df5
SSDEEP 768:njaeqD4MlshiLdMm83d0MEGjK5BwT7VWs+DoLSpG0/TIo5jV+ApXGGTo:nqcjhIdMb3d/VmoTiTz+KXC
TLSH
T17D13C075A8A89D739CA7C381764BBA832F7402A3C5C43F9CD9D95A0D05836DE274782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9a6ea76d202918b80b90e54a91465efa2e54a7f9bf2726ae588828c27e090f5a
MD5 52cb18daf5ce8915a63b8946de43c198
SHA1 9f800527ddc5bec511ee220b40e34ec02f87a781
SHA512 9d50fed9eb842ee371653df2ac3f99c60a0168633ff73f4af4facfa75099200fb9df0340536d4cecad701f28624d0c3a8a041d69c0ca794d5f9aa37944bdb87b
SSDEEP 768:Gj+923GM7GjQ5BwT7VWs+DoLSpG0/TIo5jVzn12bfJ38:V923uVmoTiTzByJ38
TLSH
T1A2F2BE71E8A89D636CD6C7C5760B67836FB442A3C5C92E98C9DD5F0E098339D270782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

d769077b-8e1a-4294-9ad8-5b832b830ea7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d769077b-8e1a-4294-9ad8-5b832b830ea7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2492_1314749651\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1004-373-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1004-485-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1712-339-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1712-186-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1712-323-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1956-318-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2068-473-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2660-502-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2780-453-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2988-385-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3272-343-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3444-308-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4240-448-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4444-437-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4980-416-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5316-299-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5316-265-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5476-434-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5720-233-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5960-285-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6052-366-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6052-338-0x0000000000010000-0x0000000000083000-memory.dmp

Download