470d37fa0a5d68c098fee4bf093567353aeb9a977e6b2e30aa6ce1f29d6f3a6a

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 13:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_91cce945d80d2992949190388c50845d_elex_rhadamanthys_stop.exe
Size 243KB
Sample260702-qa111aey31
SHA256 470d37fa0a5d68c098fee4bf093567353aeb9a977e6b2e30aa6ce1f29d6f3a6a
MD5 91cce945d80d2992949190388c50845d
SHA1 a8a619aff572b3ca18ece41916db2666c44ab95a
SHA512 2ff5a7a84b481b94697463b4ad002e7a60d38f6c9fe1e97209fefdcab3d69c327690504709bb68178777e3d0ffaf4f84047fe142e77890cd9d0ee34ae249f9a6
SSDEEP 3072:2mCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k+:+vMsLaOa3lLNngoqRttA7d
TLSH
T154345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1580	CP.exe
5888	khbzusmkfz.exe
3580	CP.exe
4212	CP.exe
1708	i_khbzusmkfz.exe
2944	mjebwurmje.sys
1476	CP.exe
2912	hbztrmjhbz.exe
3384	CP.exe
548	CP.exe
5348	i_hbztrmjhbz.exe
5420	ebwtrljebw.sys
1424	CP.exe
1268	uomgeywroj.exe
2412	CP.exe
4128	CP.exe
2120	i_uomgeywroj.exe
1552	tqojgeywqo.sys
3396	CP.exe
5064	wtoljdbytq.exe
5996	CP.exe
3304	CP.exe
2236	i_wtoljdbytq.exe
2756	aywqolfdbv.sys
4880	CP.exe
2176	wtnlfdbvtn.exe
2744	CP.exe
2892	CP.exe
4232	i_wtnlfdbvtn.exe
5864	ysqnigaysq.sys
4444	CP.exe
1668	vtnlfdyvqn.exe
2072	CP.exe
4640	CP.exe
1952	i_vtnlfdyvqn.exe
2556	davtnlfdav.sys
4980	CP.exe
5412	snkfcausnk.exe
4704	CP.exe
2848	CP.exe
1320	i_snkfcausnk.exe
4736	xspkicausm.sys
1108	CP.exe
1572	usmkfcxupn.exe
2364	CP.exe
5376	CP.exe
5884	i_usmkfcxupn.exe
1112	zusmkecwup.sys
3112	CP.exe
5592	xusmkezusm.exe
4768	CP.exe
476	CP.exe
5848	i_xusmkezusm.exe
5388	rmjecwurpj.sys
4808	CP.exe
2560	mjhecwurmj.exe
4744	CP.exe
2392	CP.exe
3376	i_mjhecwurmj.exe
4304	zwrpjhbztr.sys
4564	CP.exe
3212	ljhbztrlge.exe
5504	CP.exe
5744	CP.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_1199863006\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_1605715131\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_254356388\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_254356388\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_254356388\office_endpoints_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_822321672\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_1199863006\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_1605715131\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_254356388\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdyvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkfcxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtomgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khcausmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrmjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkfcausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljhbztrlge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmjwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtoljdbytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdyvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtomgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khcausmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywuomgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkfcxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhecwurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aywqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmjwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrmjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkfcausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xusmkezusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aywqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywuomgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khbzusmkfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtnlfdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_91cce945d80d2992949190388c50845d_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khbzusmkfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtoljdbytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtnlfdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xusmkezusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljhbztrlge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhecwurmj.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5264	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3208	ipconfig.exe
576	ipconfig.exe
1396	ipconfig.exe
2804	ipconfig.exe
2556	ipconfig.exe
2360	ipconfig.exe
4564	ipconfig.exe
1984	ipconfig.exe
5688	ipconfig.exe
2376	ipconfig.exe
1040	ipconfig.exe
5492	ipconfig.exe
4232	ipconfig.exe
5360	ipconfig.exe
2616	ipconfig.exe
2376	ipconfig.exe
1844	ipconfig.exe
5984	ipconfig.exe
2616	ipconfig.exe
4796	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274710629343632"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{D2EAF1AB-7DB1-406A-AD86-1F57AA80980A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6104	msedge.exe
6104	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1708	i_khbzusmkfz.exe
Token: SeDebugPrivilege	5348	i_hbztrmjhbz.exe
Token: SeDebugPrivilege	2120	i_uomgeywroj.exe
Token: SeDebugPrivilege	2236	i_wtoljdbytq.exe
Token: SeDebugPrivilege	4232	i_wtnlfdbvtn.exe
Token: SeDebugPrivilege	1952	i_vtnlfdyvqn.exe
Token: SeDebugPrivilege	1320	i_snkfcausnk.exe
Token: SeDebugPrivilege	5884	i_usmkfcxupn.exe
Token: SeDebugPrivilege	5848	i_xusmkezusm.exe
Token: SeDebugPrivilege	3376	i_mjhecwurmj.exe
Token: SeDebugPrivilege	5584	i_ljhbztrlge.exe
Token: SeDebugPrivilege	5308	i_wtomgeywqo.exe
Token: SeDebugPrivilege	6052	i_aywqoigayt.exe
Token: SeDebugPrivilege	2712	i_gaysqlidbv.exe
Token: SeDebugPrivilege	1788	i_xvpnkfdxvp.exe
Token: SeDebugPrivilege	5176	i_qkicausnkf.exe
Token: SeDebugPrivilege	5072	i_khcausmkec.exe
Token: SeDebugPrivilege	4200	i_pmhfzxrpjh.exe
Token: SeDebugPrivilege	5984	i_urmjwuomge.exe
Token: SeDebugPrivilege	3412	i_ywuomgeywr.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2464	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 6100	4160	2026-07-02_91cce945d80d2992949190388c50845d_elex_rhadamanthys_stop.exe	88
PID 6100 wrote to memory of 2464	6100	iexplore.exe	89
PID 2464 wrote to memory of 2020	2464	msedge.exe	90
PID 2464 wrote to memory of 5212	2464	msedge.exe	92
PID 2464 wrote to memory of 5264	2464	msedge.exe	93
PID 2464 wrote to memory of 5212	2464	msedge.exe	92
PID 2464 wrote to memory of 5212	2464	msedge.exe	92
PID 2464 wrote to memory of 1032	2464	msedge.exe	94
PID 2464 wrote to memory of 1032	2464	msedge.exe	94
PID 2464 wrote to memory of 2812	2464	msedge.exe	95
PID 2464 wrote to memory of 2812	2464	msedge.exe	95
PID 2464 wrote to memory of 2812	2464	msedge.exe	95
PID 2464 wrote to memory of 1248	2464	msedge.exe	96
PID 2464 wrote to memory of 1248	2464	msedge.exe	96
PID 2464 wrote to memory of 1248	2464	msedge.exe	96
PID 2464 wrote to memory of 2468	2464	msedge.exe	97
PID 2464 wrote to memory of 5296	2464	msedge.exe	98
PID 2464 wrote to memory of 2468	2464	msedge.exe	97
PID 2464 wrote to memory of 2468	2464	msedge.exe	97
PID 2464 wrote to memory of 5296	2464	msedge.exe	98
PID 2464 wrote to memory of 5296	2464	msedge.exe	98
PID 2464 wrote to memory of 2620	2464	msedge.exe	99
PID 2464 wrote to memory of 2620	2464	msedge.exe	99
PID 2464 wrote to memory of 3968	2464	msedge.exe	101
PID 2464 wrote to memory of 2900	2464	msedge.exe	102
PID 2464 wrote to memory of 3968	2464	msedge.exe	101
PID 2464 wrote to memory of 2900	2464	msedge.exe	102
PID 2464 wrote to memory of 6140	2464	msedge.exe	104
PID 4160 wrote to memory of 1580	4160	2026-07-02_91cce945d80d2992949190388c50845d_elex_rhadamanthys_stop.exe	105
PID 2464 wrote to memory of 5540	2464	msedge.exe	107
PID 2464 wrote to memory of 5540	2464	msedge.exe	107
PID 5888 wrote to memory of 3580	5888	khbzusmkfz.exe	110
PID 2464 wrote to memory of 4448	2464	msedge.exe	114
PID 2464 wrote to memory of 4448	2464	msedge.exe	114
PID 4160 wrote to memory of 4212	4160	2026-07-02_91cce945d80d2992949190388c50845d_elex_rhadamanthys_stop.exe	115
PID 4160 wrote to memory of 1476	4160	2026-07-02_91cce945d80d2992949190388c50845d_elex_rhadamanthys_stop.exe	119
PID 2912 wrote to memory of 3384	2912	hbztrmjhbz.exe	121
PID 4160 wrote to memory of 548	4160	2026-07-02_91cce945d80d2992949190388c50845d_elex_rhadamanthys_stop.exe	124
PID 4160 wrote to memory of 1424	4160	2026-07-02_91cce945d80d2992949190388c50845d_elex_rhadamanthys_stop.exe	128
PID 1268 wrote to memory of 2412	1268	uomgeywroj.exe	130
PID 4160 wrote to memory of 4128	4160	2026-07-02_91cce945d80d2992949190388c50845d_elex_rhadamanthys_stop.exe	133
PID 4160 wrote to memory of 3396	4160	2026-07-02_91cce945d80d2992949190388c50845d_elex_rhadamanthys_stop.exe	137
PID 5064 wrote to memory of 5996	5064	wtoljdbytq.exe	139
PID 4160 wrote to memory of 3304	4160	2026-07-02_91cce945d80d2992949190388c50845d_elex_rhadamanthys_stop.exe	142
PID 2464 wrote to memory of 5540	2464	msedge.exe	145
PID 2464 wrote to memory of 5288	2464	msedge.exe	146
PID 2464 wrote to memory of 5284	2464	msedge.exe	147
PID 4160 wrote to memory of 4880	4160	2026-07-02_91cce945d80d2992949190388c50845d_elex_rhadamanthys_stop.exe	150
PID 2176 wrote to memory of 2744	2176	wtnlfdbvtn.exe	152
PID 4160 wrote to memory of 2892	4160	2026-07-02_91cce945d80d2992949190388c50845d_elex_rhadamanthys_stop.exe	155
PID 4160 wrote to memory of 4444	4160	2026-07-02_91cce945d80d2992949190388c50845d_elex_rhadamanthys_stop.exe	159
PID 1668 wrote to memory of 2072	1668	vtnlfdyvqn.exe	161
PID 4160 wrote to memory of 4640	4160	2026-07-02_91cce945d80d2992949190388c50845d_elex_rhadamanthys_stop.exe	164
PID 4160 wrote to memory of 4980	4160	2026-07-02_91cce945d80d2992949190388c50845d_elex_rhadamanthys_stop.exe	168
PID 5412 wrote to memory of 4704	5412	snkfcausnk.exe	170
PID 4160 wrote to memory of 2848	4160	2026-07-02_91cce945d80d2992949190388c50845d_elex_rhadamanthys_stop.exe	173
PID 4160 wrote to memory of 1108	4160	2026-07-02_91cce945d80d2992949190388c50845d_elex_rhadamanthys_stop.exe	177
PID 1572 wrote to memory of 2364	1572	usmkfcxupn.exe	179
PID 4160 wrote to memory of 5376	4160	2026-07-02_91cce945d80d2992949190388c50845d_elex_rhadamanthys_stop.exe	182
PID 2464 wrote to memory of 5540	2464	msedge.exe	184
PID 2464 wrote to memory of 5540	2464	msedge.exe	184
PID 4160 wrote to memory of 3112	4160	2026-07-02_91cce945d80d2992949190388c50845d_elex_rhadamanthys_stop.exe	190
PID 5592 wrote to memory of 4768	5592	xusmkezusm.exe	192
PID 4160 wrote to memory of 476	4160	2026-07-02_91cce945d80d2992949190388c50845d_elex_rhadamanthys_stop.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-02_91cce945d80d2992949190388c50845d_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_91cce945d80d2992949190388c50845d_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:6100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7fff8f71c188,0x7fff8f71c194,0x7fff8f71c1a0
      4⤵
      PID:2020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1904,i,8421839730368222291,17292091128266705923,262144 --field-trial-handle=2696,i,6606637181854687334,7535573468708896820,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:2
      4⤵
      PID:5212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2040,i,5343622307608025508,7074437572345017706,524288 --field-trial-handle=2696,i,6606637181854687334,7535573468708896820,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:11
      4⤵
      System Time Discovery
      PID:5264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,15437889721396635071,14730750762945826220,524288 --field-trial-handle=2696,i,6606637181854687334,7535573468708896820,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:13
      4⤵
      PID:1032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,8223999659241782390,14703388698113221690,2097152 --field-trial-handle=2696,i,6606637181854687334,7535573468708896820,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      PID:2812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,13490302484061841512,14496850146352028432,2097152 --field-trial-handle=2696,i,6606637181854687334,7535573468708896820,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
      4⤵
      PID:1248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,15252426255656045767,17314530553374494845,2097152 --field-trial-handle=2696,i,6606637181854687334,7535573468708896820,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:1
      4⤵
      PID:2468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,1232521048380652906,7749110191140701253,2097152 --field-trial-handle=2696,i,6606637181854687334,7535573468708896820,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:9
      4⤵
      PID:5296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,6157212443375125606,6516301608989159737,524288 --field-trial-handle=2696,i,6606637181854687334,7535573468708896820,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
      4⤵
      PID:2620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,424938204153457038,6484052215758953199,524288 --field-trial-handle=2696,i,6606637181854687334,7535573468708896820,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
      4⤵
      PID:3968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,15978013100778694269,7872978131603065122,524288 --field-trial-handle=2696,i,6606637181854687334,7535573468708896820,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
      4⤵
      PID:2900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,16051253315636303940,8257409845345968611,524288 --field-trial-handle=2696,i,6606637181854687334,7535573468708896820,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
      4⤵
      PID:4244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,16051253315636303940,8257409845345968611,524288 --field-trial-handle=2696,i,6606637181854687334,7535573468708896820,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
      4⤵
      PID:6140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,10069256695484058556,13396944189526280856,524288 --field-trial-handle=2696,i,6606637181854687334,7535573468708896820,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:5540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,17142490497728866897,15211341922898389022,524288 --field-trial-handle=2696,i,6606637181854687334,7535573468708896820,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
      4⤵
      PID:4448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,3166991289510523782,13382582296971652175,524288 --field-trial-handle=2696,i,6606637181854687334,7535573468708896820,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
      4⤵
      PID:5540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,5092508392153049820,2537675468581629749,524288 --field-trial-handle=2696,i,6606637181854687334,7535573468708896820,262144 --variations-seed-version --mojo-platform-channel-handle=1428 /prefetch:14
      4⤵
      PID:5288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,412811567567625059,9071455291971887223,524288 --field-trial-handle=2696,i,6606637181854687334,7535573468708896820,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:14
      4⤵
      PID:5284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,14875707406221916853,17198670058858909845,524288 --field-trial-handle=2696,i,6606637181854687334,7535573468708896820,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
      4⤵
      PID:5540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,9079855897152465151,1385312935705858403,524288 --field-trial-handle=2696,i,6606637181854687334,7535573468708896820,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
      4⤵
      PID:5176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,3320651927998006421,11566596671163970107,524288 --field-trial-handle=2696,i,6606637181854687334,7535573468708896820,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
      4⤵
      PID:5832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,15703572306467691113,12605840193307891289,524288 --field-trial-handle=2696,i,6606637181854687334,7535573468708896820,262144 --variations-seed-version --mojo-platform-channel-handle=1428 /prefetch:14
      4⤵
      PID:1300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5976,i,722906963905441689,7628538154014419077,262144 --field-trial-handle=2696,i,6606637181854687334,7535573468708896820,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,10116642081624120068,14900900692266582045,524288 --field-trial-handle=2696,i,6606637181854687334,7535573468708896820,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
      4⤵
      PID:3172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\khbzusmkfz.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1580
- - C:\Temp\khbzusmkfz.exe
    C:\Temp\khbzusmkfz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5888
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3580
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_khbzusmkfz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4212
- - C:\Temp\i_khbzusmkfz.exe
    C:\Temp\i_khbzusmkfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbztrmjhbz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1476
- - C:\Temp\hbztrmjhbz.exe
    C:\Temp\hbztrmjhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3384
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4232
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbztrmjhbz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:548
- - C:\Temp\i_hbztrmjhbz.exe
    C:\Temp\i_hbztrmjhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomgeywroj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1424
- - C:\Temp\uomgeywroj.exe
    C:\Temp\uomgeywroj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1268
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2412
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3208
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomgeywroj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4128
- - C:\Temp\i_uomgeywroj.exe
    C:\Temp\i_uomgeywroj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtoljdbytq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3396
- - C:\Temp\wtoljdbytq.exe
    C:\Temp\wtoljdbytq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5064
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5996
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtoljdbytq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3304
- - C:\Temp\i_wtoljdbytq.exe
    C:\Temp\i_wtoljdbytq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtnlfdbvtn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4880
- - C:\Temp\wtnlfdbvtn.exe
    C:\Temp\wtnlfdbvtn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2176
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2744
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtnlfdbvtn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2892
- - C:\Temp\i_wtnlfdbvtn.exe
    C:\Temp\i_wtnlfdbvtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4232
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnlfdyvqn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4444
- - C:\Temp\vtnlfdyvqn.exe
    C:\Temp\vtnlfdyvqn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1668
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2072
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnlfdyvqn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4640
- - C:\Temp\i_vtnlfdyvqn.exe
    C:\Temp\i_vtnlfdyvqn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snkfcausnk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4980
- - C:\Temp\snkfcausnk.exe
    C:\Temp\snkfcausnk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5412
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4704
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snkfcausnk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2848
- - C:\Temp\i_snkfcausnk.exe
    C:\Temp\i_snkfcausnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkfcxupn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1108
- - C:\Temp\usmkfcxupn.exe
    C:\Temp\usmkfcxupn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1572
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2364
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkfcxupn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5376
- - C:\Temp\i_usmkfcxupn.exe
    C:\Temp\i_usmkfcxupn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xusmkezusm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3112
- - C:\Temp\xusmkezusm.exe
    C:\Temp\xusmkezusm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5592
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4768
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xusmkezusm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:476
- - C:\Temp\i_xusmkezusm.exe
    C:\Temp\i_xusmkezusm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjhecwurmj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4808
- - C:\Temp\mjhecwurmj.exe
    C:\Temp\mjhecwurmj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2560
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4744
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjhecwurmj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2392
- - C:\Temp\i_mjhecwurmj.exe
    C:\Temp\i_mjhecwurmj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljhbztrlge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4564
- - C:\Temp\ljhbztrlge.exe
    C:\Temp\ljhbztrlge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3212
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5504
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljhbztrlge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5744
- - C:\Temp\i_ljhbztrlge.exe
    C:\Temp\i_ljhbztrlge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5584
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtomgeywqo.exe ups_run
  2⤵
  PID:2720
- - C:\Temp\wtomgeywqo.exe
    C:\Temp\wtomgeywqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3252
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3028
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtomgeywqo.exe ups_ins
  2⤵
  PID:6088
- - C:\Temp\i_wtomgeywqo.exe
    C:\Temp\i_wtomgeywqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aywqoigayt.exe ups_run
  2⤵
  PID:5508
- - C:\Temp\aywqoigayt.exe
    C:\Temp\aywqoigayt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2964
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2960
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aywqoigayt.exe ups_ins
  2⤵
  PID:3516
- - C:\Temp\i_aywqoigayt.exe
    C:\Temp\i_aywqoigayt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gaysqlidbv.exe ups_run
  2⤵
  PID:2968
- - C:\Temp\gaysqlidbv.exe
    C:\Temp\gaysqlidbv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4448
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4760
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gaysqlidbv.exe ups_ins
  2⤵
  PID:5484
- - C:\Temp\i_gaysqlidbv.exe
    C:\Temp\i_gaysqlidbv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnkfdxvp.exe ups_run
  2⤵
  PID:5772
- - C:\Temp\xvpnkfdxvp.exe
    C:\Temp\xvpnkfdxvp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5788
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2076
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnkfdxvp.exe ups_ins
  2⤵
  PID:5308
- - C:\Temp\i_xvpnkfdxvp.exe
    C:\Temp\i_xvpnkfdxvp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkicausnkf.exe ups_run
  2⤵
  PID:1552
- - C:\Temp\qkicausnkf.exe
    C:\Temp\qkicausnkf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6040
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4488
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkicausnkf.exe ups_ins
  2⤵
  PID:3004
- - C:\Temp\i_qkicausnkf.exe
    C:\Temp\i_qkicausnkf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\khcausmkec.exe ups_run
  2⤵
  PID:4688
- - C:\Temp\khcausmkec.exe
    C:\Temp\khcausmkec.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4388
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5632
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_khcausmkec.exe ups_ins
  2⤵
  PID:2944
- - C:\Temp\i_khcausmkec.exe
    C:\Temp\i_khcausmkec.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5072
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmhfzxrpjh.exe ups_run
  2⤵
  PID:2788
- - C:\Temp\pmhfzxrpjh.exe
    C:\Temp\pmhfzxrpjh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1356
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5676
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmhfzxrpjh.exe ups_ins
  2⤵
  PID:1300
- - C:\Temp\i_pmhfzxrpjh.exe
    C:\Temp\i_pmhfzxrpjh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urmjwuomge.exe ups_run
  2⤵
  PID:5228
- - C:\Temp\urmjwuomge.exe
    C:\Temp\urmjwuomge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3316
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2764
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urmjwuomge.exe ups_ins
  2⤵
  PID:2740
- - C:\Temp\i_urmjwuomge.exe
    C:\Temp\i_urmjwuomge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywuomgeywr.exe ups_run
  2⤵
  PID:3880
- - C:\Temp\ywuomgeywr.exe
    C:\Temp\ywuomgeywr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5664
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3052
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywuomgeywr.exe ups_ins
  2⤵
  PID:1352
- - C:\Temp\i_ywuomgeywr.exe
    C:\Temp\i_ywuomgeywr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5360

C:\Temp\mjebwurmje.sys
C:\Temp\mjebwurmje.sys
1⤵
- Executes dropped EXE
PID:2944

C:\Temp\ebwtrljebw.sys
C:\Temp\ebwtrljebw.sys
1⤵
- Executes dropped EXE
PID:5420

C:\Temp\tqojgeywqo.sys
C:\Temp\tqojgeywqo.sys
1⤵
- Executes dropped EXE
PID:1552

C:\Temp\aywqolfdbv.sys
C:\Temp\aywqolfdbv.sys
1⤵
- Executes dropped EXE
PID:2756

C:\Temp\ysqnigaysq.sys
C:\Temp\ysqnigaysq.sys
1⤵
- Executes dropped EXE
PID:5864

C:\Temp\davtnlfdav.sys
C:\Temp\davtnlfdav.sys
1⤵
- Executes dropped EXE
PID:2556

C:\Temp\xspkicausm.sys
C:\Temp\xspkicausm.sys
1⤵
- Executes dropped EXE
PID:4736

C:\Temp\zusmkecwup.sys
C:\Temp\zusmkecwup.sys
1⤵
- Executes dropped EXE
PID:1112

C:\Temp\rmjecwurpj.sys
C:\Temp\rmjecwurpj.sys
1⤵
- Executes dropped EXE
PID:5388

C:\Temp\zwrpjhbztr.sys
C:\Temp\zwrpjhbztr.sys
1⤵
- Executes dropped EXE
PID:4304

C:\Temp\trljgbywuo.sys
C:\Temp\trljgbywuo.sys
1⤵
PID:4924

C:\Temp\bytqolgeyw.sys
C:\Temp\bytqolgeyw.sys
1⤵
PID:1772

C:\Temp\lgdyoigays.sys
C:\Temp\lgdyoigays.sys
1⤵
PID:3332

C:\Temp\lfdavtnlfd.sys
C:\Temp\lfdavtnlfd.sys
1⤵
PID:2044

C:\Temp\pnifaxsqki.sys
C:\Temp\pnifaxsqki.sys
1⤵
PID:4772

C:\Temp\mkhfzxvpmk.sys
C:\Temp\mkhfzxvpmk.sys
1⤵
PID:4116

C:\Temp\xuhfzxrpjh.sys
C:\Temp\xuhfzxrpjh.sys
1⤵
PID:2936

C:\Temp\cwuomhezxr.sys
C:\Temp\cwuomhezxr.sys
1⤵
PID:5300

C:\Temp\tromjebztr.sys
C:\Temp\tromjebztr.sys
1⤵
PID:5456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aywqolfdbv.sys

Path C:\Temp\aywqolfdbv.sys
Size 141KB
SHA256 ea3a78bfa9a7adea149cc11c98a0431046956138d9691c59b872a2324afd8340
MD5 abe7073ab609aafc4c8af0d65e967d4d
SHA1 cfa8dc8df01eab8b0ae4b8bfc0e3a3b2a53e9205
SHA512 62629b41d8704b4f8612e0444736f7e5d273f3451d8a196dde47d2e0e882c7a282e9bc995e6cf68859460c670c4cc02b3d1f3a5ec39909489e7cf98382a3d589
SSDEEP 1536:ha3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ha3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1EDE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

davtnlfdav.sys

Path C:\Temp\davtnlfdav.sys
Size 141KB
SHA256 628553b83fbb51e19c64881b479b77dc84dbc3422291ed727f6fef09a62ffc1c
MD5 b7418b6a2a3b1db1cee765fdcc70219a
SHA1 52298aaab8095f9dcabc9423be77b94b11e29a4c
SHA512 323c7c6bb9c209f61d6550578dbef20e54d10d42f2a72e692a0e1b0e9329d68a286d6c904afab84626d91e431a9dafa015ada25c630cf8da5ef1997852a4f096
SSDEEP 1536:za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T159E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebwtrljebw.sys

Path C:\Temp\ebwtrljebw.sys
Size 141KB
SHA256 585e913255db10e8a55de61be58b632be86be6f46240272a72638d1bc029eb8f
MD5 c508f809751a628bce9ef63c055f2f61
SHA1 87ca09f09d92a069f79781c9664998fb38dff30e
SHA512 c75dd6e8a91075e74ab573ef24fc31027da4b493d83a73c7cc5319b6130932764670b7c7288d1f0bb9da02250dd694c9776d069a3b39ef5ea1c9e029f6c03542
SSDEEP 1536:na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T142E37C12B2D2D172D8A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbztrmjhbz.exe

Path C:\Temp\hbztrmjhbz.exe
Size 243KB
SHA256 2c9f6bc82434658d6b5d7895ad22ab3ae71258951752721cde809366f8db2550
MD5 5efe9cdd4670cbbd10c0527e950b69a6
SHA1 8684d7ccc82ceeb8fec275a7544de3d069ad8658
SHA512 23e6ed88ade59f21c93e22265ff481160d4128dc5e8f085da6a4653a850893ec845587bdba4a0745d171ec92da8b165fc5d1de1ee0f2e76a302eb51d262be28b
SSDEEP 3072:2CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA74:ZvMsLaOa3lLNngoqRttA74
TLSH
T145345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hbztrmjhbz.exe

Path C:\Temp\i_hbztrmjhbz.exe
Size 243KB
SHA256 9a836819d4fda84d4713c4988377d71de21811a58128b5cee29d5594e7c140a0
MD5 bf998c805bc931b8e024726541618922
SHA1 052142d8354e2b420954bcd747a0c300d8eb7db6
SHA512 e0f43bd9ec984d91010cc799b41b6ae966bf05f0b395a194226d9f48922ba05a085f56a539403073a37aa7310e0aab942343da9af704eeef85c49554b77af8dd
SSDEEP 3072:1CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7L:4vMsLaOa3lLNngoqRttA7L
TLSH
T1F7345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_khbzusmkfz.exe

Path C:\Temp\i_khbzusmkfz.exe
Size 243KB
SHA256 281b55d33139acf7ab6b5352079b800281ea915d4aae239b72433cb5a23d77cd
MD5 9af5e7af8b287a1a639928519e8d85f6
SHA1 fdb8c3b74c5b14c1e1b958d0e0a0e384c6149eab
SHA512 d2ea982c9a35fade54f775bda64c1e1dd464ff6847c4b170b8ad41833acf9e8798797b216a165db8c597c3080438662362b0bd33f575ef76ee5a73fc097f8dbc
SSDEEP 3072:lCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7z:ovMsLaOa3lLNngoqRttA7z
TLSH
T1BF345A017281C031E7160B78045AE7A1467EBC384BA9E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uomgeywroj.exe

Path C:\Temp\i_uomgeywroj.exe
Size 243KB
SHA256 91c337767c0bbabbdf9de05976db7bb501ff329197b68cade6f9f319ad40605c
MD5 c0298e1fbad7abb18ba26b7ee30bdb33
SHA1 6e4458aeb4df64a2510b0628ff6fdc81855ba786
SHA512 7c0a4e52411610eb70851e87ef20f90dda73744e35ca8f33a1d9f0f330839183e6e1c5c9e61754e496be4b81784d51ef0142a96dea6b7f72163e0c0481f2ef2f
SSDEEP 3072:fCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA75:qvMsLaOa3lLNngoqRttA75
TLSH
T19A345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtnlfdyvqn.exe

Path C:\Temp\i_vtnlfdyvqn.exe
Size 243KB
SHA256 42c4392b33893f186defd18cb4a28b6c7f13419c92d8f965236330ee2936939d
MD5 8262c992eaa50277fe31a7290f4800f5
SHA1 4fdd540d62a45f77c8f146d0b668aa08f99907ad
SHA512 136227c194b97aa323f2b2d3db1afb35d59331ecb1d72648e38f83d188b2ed0cd946d6154facaed8058ca79f77a47825205370067184f6a1fad2bd4aa9e2a3a2
SSDEEP 3072:3CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7R:SvMsLaOa3lLNngoqRttA7R
TLSH
T13B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wtnlfdbvtn.exe

Path C:\Temp\i_wtnlfdbvtn.exe
Size 243KB
SHA256 6db1dd529f3803be9fd33b28b9fe001dda025d3b0f0410b62e2a8bd3df2208ba
MD5 91efcaaac0ed9bfa2522e744bada65a7
SHA1 4d26299129c3180be8756c39aadf196bb6fd57bf
SHA512 fc516dfe3cffa3b2e204e356c9532379f0e1904ed6a156fdfe72d8c49e74c72d6568214219a68289d4724941dda6f9c2915221b8133cf9efb97b049aae7884cf
SSDEEP 3072:/CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7V:KvMsLaOa3lLNngoqRttA7V
TLSH
T1D0345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wtoljdbytq.exe

Path C:\Temp\i_wtoljdbytq.exe
Size 243KB
SHA256 32cebb5d6c96f75d88f4216fc28ed16d96fac2d5dc2012a658c70231a7f47c15
MD5 370c373a348e76bac56e2a57f22163d1
SHA1 2744372f06fa21fcf0aafbdfa8262bd8cfe5d2d8
SHA512 25c1da761a0a4971f2454ca14239dc2744aa5cc4570803076c6d8044e3d13b877ded1545acdb8346f0cb36d0767bef74780811be4a9f6bc3a5663c0ff6ad31a7
SSDEEP 3072:wCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7K:rvMsLaOa3lLNngoqRttA7K
TLSH
T12D345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khbzusmkfz.exe

Path C:\Temp\khbzusmkfz.exe
Size 243KB
SHA256 ed305c1f9c521102782f5095a2ebd064f53128200685a7933cd846133b56d581
MD5 331a941c10f856f8f2c009b3cbd33b55
SHA1 6e897c65b99cac1cb29ed6110016b5971c76f74d
SHA512 3c2e1de89305506de5c60e8e83e7f6f7a05672e43eb0913ba80cf1e627e8561b3d5486199b01ea4ac8f7bb833f5e412002cee4bbcfb36e87df7db20dc04a6c98
SSDEEP 3072:XCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA75:yvMsLaOa3lLNngoqRttA75
TLSH
T1B3345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjebwurmje.sys

Path C:\Temp\mjebwurmje.sys
Size 141KB
SHA256 50b38ae342dc12a8159da9edbdf8aec18b289d349e621c2df255312226dd7ebb
MD5 84043c7655d304f5cdd84e7d3a302aeb
SHA1 274f0ef72495dd8a36665aa2ba17a3d94a855718
SHA512 6ba32d1d8b583de40d99238e172b687dd6bfd45bba87ca2b02f991812d0aacb904c33257ae1c8a7ff248f55a7f1dc4a3a5ad0b9d87e53c7deebea6736b7e5bce
SSDEEP 3072:La3rV3dZPFvOAngoRUAFa1nxayHdXkbv:La3lLNngoqRt
TLSH
T1D3E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqojgeywqo.sys

Path C:\Temp\tqojgeywqo.sys
Size 141KB
SHA256 f355f7f204986477d7da7ac187d4aabaa356056a15967ece81cb89928c91d271
MD5 103884e69b093a70248af42f328ece0e
SHA1 3f0936c1d69b88a033092a3520c7cbd28295ec72
SHA512 09709f5fc82cf0e9e5953624123e1e9bdbdf1b65295696c85e91cd1d391c2075cea69109ce3ee331b2cfd518d8eb591822b18f9fa5845c3407d16fdc31fdb621
SSDEEP 1536:ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1BAE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomgeywroj.exe

Path C:\Temp\uomgeywroj.exe
Size 243KB
SHA256 6529180faf85bebfa05daca3041441036737d45438dd846b6ca5418c08f1c237
MD5 43e7e31fbd25fbb9a9d4dfc76c50b925
SHA1 e037588fc44e87b287bb6c65f5ae270c7e6e2ca9
SHA512 47eadfc7cfc52cce6e8e93986799186f8c48216a84710d06dfa70433549e0a64633f0e52c763db87bb5a12da41b4d39cb3fc0276db2519faf7204ffd4d8c34d5
SSDEEP 3072:RCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7X:svMsLaOa3lLNngoqRttA7X
TLSH
T182345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdyvqn.exe

Path C:\Temp\vtnlfdyvqn.exe
Size 243KB
SHA256 b1ff195dbd0563557705330427695e6e2c38820891ad93f2d08d22cf97af514b
MD5 4fbe92876c2d8ce5e91793f09b29ef13
SHA1 bb60d5cb8143534c2a97d61481a0b4482a160337
SHA512 f51b110d5f7c495915613c647a8792e8e58b9bfa2d7a2e2a5bf764bfa5bdbe371673b00b0beaae03dc9842f46c7be75dc354704e618a9522f8000ba9ba34802f
SSDEEP 3072:iCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:dvMsLaOa3lLNngoqRttA7o
TLSH
T1D1345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtnlfdbvtn.exe

Path C:\Temp\wtnlfdbvtn.exe
Size 243KB
SHA256 ffe8b820c29232cd4b23a1d73a840919f79f9b30d1f719f22d90e26691bf51d1
MD5 372baf2d07aeb9a8e42be9010598c506
SHA1 17cc80a6fe69bb400d1d6e849ab54cb7ba60e8f4
SHA512 2cbc07a448d5ff53cf79c2bfa42050ddd13c3c3bc38294527cbcbc4dd3c990a18a49e1c3f8446202fcee9fa1d77eb1a47e1ed6d73a238a2396160a97596e0eb1
SSDEEP 3072:7CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7F:uvMsLaOa3lLNngoqRttA7F
TLSH
T101345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtoljdbytq.exe

Path C:\Temp\wtoljdbytq.exe
Size 243KB
SHA256 97b12975184f9788dfd8dbc09b5aef957b7ede81af67adf0d57aad5cf65625d0
MD5 e9a80db34becde13ad2dd4e1673ff268
SHA1 f42d6f54eaf9c5ad83bc9b7be5c5cafbdfa1ae8a
SHA512 ee048d10a9a692d5de2cb3e6ce092395621afe54b0c86a705d76cdc66b98e11b8af107893c723e2febe9c76efaeda5016cdb8b3806883e177daaf30ec745f380
SSDEEP 3072:BCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7P:cvMsLaOa3lLNngoqRttA7P
TLSH
T19E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqnigaysq.sys

Path C:\Temp\ysqnigaysq.sys
Size 141KB
SHA256 350e2a1477c56f424136b7794b31bdc1c374492ce87f067dc43e53cab470d9ad
MD5 1b010f50f8cf0e9e2c75269d09df5092
SHA1 c07cf5084d951d47b3fa6a07d4103b3a2af5e7c9
SHA512 50b95cbb1fdef6da3ff80381e86d456f379c2fa7748ebaab4d92442635c0bd7e1b06991b291a1342c770d54a091f3839d458212842157bb74f7ca362433caf62
SSDEEP 1536:fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1BFE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2fd9384e79508a77111bb6310e9414898358885ca508610502ff6f1a15ad704f
MD5 714e68787bb5a6d2fd82139f833a5d0d
SHA1 f7a22adc92641d05515b3ae096da910924f11c1a
SHA512 b133f27abfa4ed5bdbd3eaf997e0664f0627537d4882fdaa63c0b1b301219d07f8ba46857db9a196b1210c29ed9f79e6cfd8c688d502b118a21640805665f762
TLSH
T16DD080F43795F605C786617357D0574173750872241647095051D01CCC645DD63DB1EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 233c07bfff48b5fbad30cd7d90579abd0886400017cd6e7fb037e5626abb1a4d
MD5 71fa6328268340b183c55defa643c474
SHA1 7c004defb21dc2981b3091495c900e02b34e3a86
SHA512 e5b634d358633981cd343c3da26ee18738fb6c54b2334814637e0a9a45343d14770fed7a09c63d55dd190bf7ef111664ba5872f5d5ce925e6bee783e166c75b7
TLSH
T1D4D080F437A5F505C786617357D0574173650872101647095151D02CCC645DD63DB1DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 dd01c4847261c88bfbb5f02b9cf7f7111b41c2ea9c94129168c0683fafc4f8b6
MD5 5aac55fad398326e3c806743cd11837e
SHA1 6ecd9f53d98cb346997e37ad84e0cd94d4a43f2a
SHA512 e391a10642ab7be254a936cbdca38626c108be993549fc1137e25b1eb41e28b2e873658ff05649978d409da9f7620afb689bc770841adefe1e974c774e63571c
TLSH
T1CF613FD8E8D13B2EEBA70CB74AD724D97732C4B207076907685A9F78945A71660610B2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5968d2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5968d2.TMP
Size 3KB
SHA256 6442481520abaef4f338ed1641fa20e0616c3d5ddedafd24f6c8a37ec6a057b8
MD5 2d464d0f5182d2bcc143ad284caac18b
SHA1 d4460d90aacf778e8ddc49fc8867341f6d76edab
SHA512 dc3229bc744be89bf3e61f78ab5b91b706201ef7ac50e2a8d133a19020ba5019fb1ee7d3ba9fb5f0efe83495288ae0509ef987a1e03a84f5d50af2e16d215e9f
TLSH
T1E66140E8E8D13B2EEBE70CF74AD724D97732C4B207076D076C5A9F78945A71660610B2
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 48c2d2f8c10fe8822e759bb162a846c6d31b65d3413df04bcbc719eee06102b9
MD5 c96906070cdb55f41c76f926e5651d79
SHA1 a9f1c382d687cb5f4eb7ed47d952d28287dbd45c
SHA512 e364761edcfe60727f8a03ec9f822eeb7a0fa37da03f6c13937d95389a32057e4393d506cf1395f0c39b45f26f2c8774886acd3f6bd712dcea09f51ba747c618
TLSH
T1BA51ADF7C3E8867DCA1156F0BA147E2BCE1D0915832C3D5A89E4AF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 18aeb7ce2696c7bbc561873732ea04f3dde68f11170ee0c1f4164b78ebe5cfca
MD5 8c9e4ea25d43ed1041ecc0ddb5f502dc
SHA1 48b756d7cc80dcb6d324791df929a89d6bcef5c7
SHA512 c416f013f872fc47ab20df74aa77907d702119765336b25c4c1264233fab1d0be7f9aec9e383339ddad3b7cab6066e209fa1dedec98e99ef90a1a13bc3b30ecd
SSDEEP 192:sxRjFR9yM/jK1Ml8wcSc/fh9sRIMdfCrDcUzoA8p9c/g6+WNCN7/Yy4JWjGDMIg3:sxR5xCd/frsRX4+O/5M/8A3
TLSH
T14D62D8166A249D778CDBD209FA517F53D6F91473E2900E48AEFC8A0C05E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1e02ebd8b98b6dd4eb0796bc8d6210947f26c7104e64c90ac0f66e7b670405d4
MD5 867a01b8b482628488c38c018447d41c
SHA1 0851889b9acc48f713f70dc1a810786d65feb386
SHA512 6613c7d6142d244c61c86951485bf4ddf3450307fd2c4f3d3cadbcde85f24d42b7bc22ee1fc5d06e18d558fa1b0407e14bc5f15ec3a9c5ae82338d903820572d
SSDEEP 192:sxRmFR9yM/jK1Ml8wcSc/fh9syIMdfCrDcUzoA8p9c/g6+WNCN7/Yy4JWjGDMIgR:sxRyxCd/frsyX4+O/5M/8AR
TLSH
T1F662D8166A249D778CDBD209FA517F53D6F91472E2910E48AEFC8B0C05E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7ec6a3e67e27a6674d30303042fd4cdceb0ca20636f336e184dee2d247ea3e98
MD5 b164faa9c894b2fce6d89decb4eb6143
SHA1 b9a536523e5f2be914bc4a4603e08a2b8056fcd7
SHA512 ab259b20d2621f35edb2b5caebf9c19e0a900e5024e0fb20cc559be48efa839c35698b0f9f8389317308da481cac900f96ca6cd2b0a19dbf07cd5020b5cb47db
SSDEEP 192:sxRmFR9yM/jK1Ml8UQMcSc/fh9syI5eZqa+ncUzoA8prc/g6+WNCN7/Yy5JWjGDM:sxRyxqLd/frsyGYqa+So/5M/JAf
TLSH
T17262D9169A249D778CDBD209FA517F53D6F91472A2910E48AEFCCB0C05E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 e9c5eabf6b9280c1800dda074b7b8e1349b4a6a32f94a79cbdd87c115cfa42b7
MD5 81673afad774ff2045e55e50db1ba169
SHA1 1f50dbd69f3e97cb697585f455500789f41ceab3
SHA512 f0fde25b44cbe71fc21fbc1cd63bc2cb1ca2895d711cc4ef75b0446f7128115781d1334f4d8b91d623aa618851fc5ca4f0fddce734197f2ee54ab30a6fb1765c
SSDEEP 768:AIox/O7pLuL7p0WguMfnA8F1+UoAYDCx9Tuqh0VfUC9xbog/OVVmfccizro5MlWU:AIox/OE7p0WguMfnAu1jaymfXiA5Mf
TLSH
T1F3E2EB3B680CCB7F4F804A9CEC29BE8A6DA801CF96D8CD5447FA841C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 2cf40e60baa7b18e5fa3c86f6a8991a86732dd20ecb815553de046e80d5ecd35
MD5 e179cc803eb8a77aea8e9a65daa0ca0b
SHA1 d394f0c2e4e1030a1991f4577b79d7a9672815f4
SHA512 86dbe199198c57d07f5ffeba506f7fcaab8c9d7fa1799f20cfa9d685020b0595b66a1f1917abe78be3d207c33bc8c1bf214d3619e02be873c5820cd1100e590c
SSDEEP 96:K0AgKluqi4AKV+WaYKHq2OxWKisfAxEwn:qbL6z5OAxEwn
TLSH
T1FEB1F68079BF1B803D3D650982B9E42B5182306630DEA4AB7FA950E65F67F405FFC6C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 410e7e8c90fd111b94c06ecd27ffcff65c665164ab6c0c9b67a796018d97b89a
MD5 87294edd545a8ad87863240f49baebd8
SHA1 f4d5a7904ddab222f530b5a2d190672d407fce22
SHA512 ea0b7475300a33a81d5e635a11cf35423e0bb8878971a862f89b325d005c01a88bf060eac199ea52a73a89f4bdcf40d16f2e43b1d6ef2dde7b848da80ac8d5fc
SSDEEP 768:Dj+9v3wDA5QOJI9QPS2/hUAFjQIMyOV3N5E9ESDl8BvTPaSwr:G9v3pvhNFUIpONNmDDl0WSwr
TLSH
T170F2AE71B892CEA74DABE7C5731662876FF400B795C11E84CADDAB0D028728D175BC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 9ff38924ddc3d3db95347897ca31457a4cfb356f78078478161a6fe2ec961564
MD5 34c840cd1450aed335776c9e644bcc2e
SHA1 babc57c9c305a56cd36715d9310072b47f2ca67c
SHA512 18dc0a27ba263c8080505bec5567706752c4ece3560cfe490a1745dbbb6ee66dcd7bc193429d7d7ec1c334e9dd092f4bda546affc2404635e1467e6886fc8dca
SSDEEP 768:mF1j+9n3Twg8DxMrOJI9QPSc/hUAFjQIMyOV3N5E9ESDl8BvTPaSwr:T9n3S7hNFUIpONNmDDl0WSwr
TLSH
T1EB1339F198D3CA76D9AE9787633D6E469AFCC06374841884BBD95E0CCC821BFC346825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 064836e64c8cc1df67522abc1aaf63b7ba5f649b15d2b2f5501414307ba639da
MD5 17d41e1edadb467fe75599a6b060fff8
SHA1 493663784c45977505c68cae6199cb821c6e6a0c
SHA512 1af20e5f01b737e9b0b5fd038a893e757446f316cbc660e79f2f0e3c9c8320df89ff22584cc466583ff3246418e3f6f0f1553c6ba2420e6220f06816e6e6f1ea
SSDEEP 768:brv+4UNbd53iDo5QOJI9QPS7/hUAFjQIMyOV3N5E9ESDl8BvTPaSwO:bbsbD3NUhNFUIpONNmDDl0WSwO
TLSH
T1A613BF71B8A4DAB74DBBE784B20672837FF410B785C10A84DADEAB0C42471C9274BD36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 254c7bb5c367ba2156b48546ff3fd4615efed06a45a529c550badfa12f6596d7
MD5 490330e26fee80fcf3cc7594230cb484
SHA1 1c6e2e1c93e36a1a187f74f3c43e90a251162a68
SHA512 391fb660e7412880178c1b91d102e054b194f32786644580baf91f9246ac98b26f65ef645955c0689c2f4c50535590a4bde87d4683f3f67ebc442784e9023bb5
SSDEEP 768:wj+9v31DA5QOJI9QPS2/hUAFjQIMyOV3N5E9ESDl8BvTPaSwr:P9v30vhNFUIpONNmDDl0WSwr
TLSH
T17FF2AE71B892CEA74DABD7C5731662876FF400B795C11E84CADEAB0D028728D175BC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 88bfe0322f49fc28347d3456eea650ba26e4f41573c279236a67c70ebe27d479
MD5 4aa47d18acdcffe14a9c9d3b683ae050
SHA1 728364d1d52ac28b9bf3fdb627750456a7022ab6
SHA512 f63cbf2cefb38ffb1135a3abb80a8fa07e93831cfea05e110d125ed70d392b23deb30d2dc355630703336e555e125d5e0917abed9994a9a5682cc527cbba8508
SSDEEP 768:9rv+4UNbdF35BbQOJI9QF/hUAFjQIMyOV3N5E9Mm5+8r0mL:9bsbf3bRhNFUIpONNmxDrv
TLSH
T16203BF32E8A4D6B39CE7A7C5760A72437FF441A795C20784C9DE2B0D824B5DE231BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

60b0eca7-1132-4751-98ed-cfa5320f97f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\60b0eca7-1132-4751-98ed-cfa5320f97f2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2464_2004768431\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1112-332-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1552-268-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1772-408-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2044-433-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2556-329-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2556-323-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2756-280-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2936-470-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2936-497-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2944-193-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3332-413-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3332-434-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4116-450-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4304-368-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4736-327-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4736-335-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4772-445-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4924-409-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4924-380-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5300-482-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5388-339-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5420-240-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5456-500-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5864-303-0x0000000000010000-0x0000000000083000-memory.dmp

Download