68cf1d8ba1d65ea1bc7737979a4d66c50ee3f1904d002517d248aea1190c92d2

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 21:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-04_d384844aa95b2249f3201c824e892b98_elex_rhadamanthys_stop.exe
Size 243KB
Sample260704-1lp3zset3x
SHA256 68cf1d8ba1d65ea1bc7737979a4d66c50ee3f1904d002517d248aea1190c92d2
MD5 d384844aa95b2249f3201c824e892b98
SHA1 545e0b871ae936032d8bde7bae092fe969f4b83c
SHA512 b1fd215c12423abfa0cd1ad8df312618af62c8cbf2bb024cfbe5c6072c81a6f103d48ea8b006ab5d413f2686e9f32621af4b9517c24376a92b5c2cf666dd55e4
SSDEEP 3072:LVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA72:ZXP7LQMa3lLNngoqRttA72
TLSH
T10B345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2132	CP.exe
2776	rmjecwuojh.exe
5572	CP.exe
5924	CP.exe
5324	i_rmjecwuojh.exe
3300	dbwtomjdbw.sys
3720	CP.exe
5844	trljdbwtom.exe
1236	CP.exe
3976	CP.exe
4376	i_trljdbwtom.exe
4248	qlgdbvtolg.sys
5144	CP.exe
5760	gdbvtolgay.exe
5896	CP.exe
5780	CP.exe
5976	i_gdbvtolgay.exe
4388	aysqligayw.sys
5596	CP.exe
5408	tnlfdxvqnl.exe
1148	CP.exe
5584	CP.exe
1184	i_tnlfdxvqnl.exe
1292	nlfdxvsnif.sys
688	CP.exe
2312	kfdxvpnifa.exe
2768	CP.exe
5020	CP.exe
6024	i_kfdxvpnifa.exe
920	faxvpnkfcx.sys
4248	CP.exe
5244	icausmkfcx.exe
1580	CP.exe
628	CP.exe
700	i_icausmkfcx.exe
5024	ecwusmkhca.sys
3616	CP.exe
1624	cwupmkecxu.exe
4020	CP.exe
1632	CP.exe
4060	i_cwupmkecxu.exe
3256	cwuspnhecz.sys
980	CP.exe
1680	wurpmgecwu.exe
3964	CP.exe
5660	CP.exe
4672	i_wurpmgecwu.exe
2376	jecwuomgec.sys
2472	CP.exe
5812	ebwuomjecw.exe
1084	CP.exe
4476	CP.exe
4980	i_ebwuomjecw.exe
4392	tomgeywqom.sys
4704	CP.exe
480	omgeywrojh.exe
4084	CP.exe
3100	CP.exe
1404	i_omgeywrojh.exe
4088	ljdbvtrljd.sys
5852	CP.exe
2492	lgeywqoigb.exe
3516	CP.exe
236	CP.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1604_1104194839\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1604_1714074365\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1604_1714074365\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1604_513355107\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1604_513355107\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1604_513355107\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1604_1104194839\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1604_513355107\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1604_1923220138\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfdxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wurpmgecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwuomjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigayvqnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigayvqnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxupnhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfdxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icausmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjecwuojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpnhfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywtoljgbyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwupmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfaysqnid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_keczurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwurpmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwupmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlfdxvqnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icausmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjecwuojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdbvtolgay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljhbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljhbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwuomjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgeywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfaysqnid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxupnhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keczurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywtoljgbyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-04_d384844aa95b2249f3201c824e892b98_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdbvtolgay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wurpmgecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgeywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvpnhfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwurpmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdxvqnl.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2292	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5812	ipconfig.exe
5580	ipconfig.exe
2596	ipconfig.exe
3124	ipconfig.exe
4140	ipconfig.exe
4052	ipconfig.exe
4368	ipconfig.exe
4932	ipconfig.exe
6116	ipconfig.exe
5016	ipconfig.exe
2924	ipconfig.exe
2376	ipconfig.exe
4712	ipconfig.exe
4392	ipconfig.exe
700	ipconfig.exe
3324	ipconfig.exe
2900	ipconfig.exe
1084	ipconfig.exe
2640	ipconfig.exe
4532	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134276750796657170"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{DB7A6287-492A-487F-BD5B-E95E0D928AAE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3748	msedge.exe
3748	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5324	i_rmjecwuojh.exe
Token: SeDebugPrivilege	4376	i_trljdbwtom.exe
Token: SeDebugPrivilege	5976	i_gdbvtolgay.exe
Token: SeDebugPrivilege	1184	i_tnlfdxvqnl.exe
Token: SeDebugPrivilege	6024	i_kfdxvpnifa.exe
Token: SeDebugPrivilege	700	i_icausmkfcx.exe
Token: SeDebugPrivilege	4060	i_cwupmkecxu.exe
Token: SeDebugPrivilege	4672	i_wurpmgecwu.exe
Token: SeDebugPrivilege	4980	i_ebwuomjecw.exe
Token: SeDebugPrivilege	1404	i_omgeywrojh.exe
Token: SeDebugPrivilege	252	i_lgeywqoigb.exe
Token: SeDebugPrivilege	764	i_oigayvqnlf.exe
Token: SeDebugPrivilege	4848	i_nlfaysqnid.exe
Token: SeDebugPrivilege	5428	i_fdxvpnhfdx.exe
Token: SeDebugPrivilege	2320	i_cxupnhfzxr.exe
Token: SeDebugPrivilege	2940	i_keczurmkec.exe
Token: SeDebugPrivilege	5820	i_mkecwurpmg.exe
Token: SeDebugPrivilege	4016	i_ljhbztrlje.exe
Token: SeDebugPrivilege	1836	i_wtolgeywqo.exe
Token: SeDebugPrivilege	2248	i_ywtoljgbyw.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1604	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 6060	2588	2026-07-04_d384844aa95b2249f3201c824e892b98_elex_rhadamanthys_stop.exe	88
PID 6060 wrote to memory of 1604	6060	iexplore.exe	89
PID 1604 wrote to memory of 2804	1604	msedge.exe	90
PID 1604 wrote to memory of 4504	1604	msedge.exe	91
PID 1604 wrote to memory of 2292	1604	msedge.exe	93
PID 1604 wrote to memory of 4504	1604	msedge.exe	91
PID 1604 wrote to memory of 4504	1604	msedge.exe	91
PID 1604 wrote to memory of 3756	1604	msedge.exe	94
PID 1604 wrote to memory of 3756	1604	msedge.exe	94
PID 1604 wrote to memory of 2120	1604	msedge.exe	95
PID 1604 wrote to memory of 2120	1604	msedge.exe	95
PID 1604 wrote to memory of 2120	1604	msedge.exe	95
PID 1604 wrote to memory of 4740	1604	msedge.exe	96
PID 1604 wrote to memory of 4740	1604	msedge.exe	96
PID 1604 wrote to memory of 4740	1604	msedge.exe	96
PID 1604 wrote to memory of 2644	1604	msedge.exe	97
PID 1604 wrote to memory of 2644	1604	msedge.exe	97
PID 1604 wrote to memory of 2644	1604	msedge.exe	97
PID 1604 wrote to memory of 5944	1604	msedge.exe	98
PID 1604 wrote to memory of 5944	1604	msedge.exe	98
PID 1604 wrote to memory of 5944	1604	msedge.exe	98
PID 1604 wrote to memory of 5856	1604	msedge.exe	99
PID 1604 wrote to memory of 5856	1604	msedge.exe	99
PID 2588 wrote to memory of 2132	2588	2026-07-04_d384844aa95b2249f3201c824e892b98_elex_rhadamanthys_stop.exe	101
PID 2776 wrote to memory of 5572	2776	rmjecwuojh.exe	104
PID 1604 wrote to memory of 5140	1604	msedge.exe	107
PID 1604 wrote to memory of 5140	1604	msedge.exe	107
PID 1604 wrote to memory of 5284	1604	msedge.exe	108
PID 1604 wrote to memory of 5284	1604	msedge.exe	108
PID 1604 wrote to memory of 3532	1604	msedge.exe	110
PID 1604 wrote to memory of 1624	1604	msedge.exe	111
PID 1604 wrote to memory of 1624	1604	msedge.exe	111
PID 1604 wrote to memory of 3996	1604	msedge.exe	114
PID 1604 wrote to memory of 3996	1604	msedge.exe	114
PID 2588 wrote to memory of 5924	2588	2026-07-04_d384844aa95b2249f3201c824e892b98_elex_rhadamanthys_stop.exe	115
PID 1604 wrote to memory of 2196	1604	msedge.exe	119
PID 1604 wrote to memory of 2196	1604	msedge.exe	119
PID 1604 wrote to memory of 2196	1604	msedge.exe	119
PID 1604 wrote to memory of 5692	1604	msedge.exe	120
PID 1604 wrote to memory of 5692	1604	msedge.exe	120
PID 1604 wrote to memory of 5692	1604	msedge.exe	120
PID 2588 wrote to memory of 3720	2588	2026-07-04_d384844aa95b2249f3201c824e892b98_elex_rhadamanthys_stop.exe	121
PID 5844 wrote to memory of 1236	5844	trljdbwtom.exe	123
PID 2588 wrote to memory of 3976	2588	2026-07-04_d384844aa95b2249f3201c824e892b98_elex_rhadamanthys_stop.exe	126
PID 2588 wrote to memory of 5144	2588	2026-07-04_d384844aa95b2249f3201c824e892b98_elex_rhadamanthys_stop.exe	130
PID 5760 wrote to memory of 5896	5760	gdbvtolgay.exe	132
PID 2588 wrote to memory of 5780	2588	2026-07-04_d384844aa95b2249f3201c824e892b98_elex_rhadamanthys_stop.exe	135
PID 2588 wrote to memory of 5596	2588	2026-07-04_d384844aa95b2249f3201c824e892b98_elex_rhadamanthys_stop.exe	139
PID 5408 wrote to memory of 1148	5408	tnlfdxvqnl.exe	141
PID 2588 wrote to memory of 5584	2588	2026-07-04_d384844aa95b2249f3201c824e892b98_elex_rhadamanthys_stop.exe	145
PID 1604 wrote to memory of 5988	1604	msedge.exe	147
PID 1604 wrote to memory of 3436	1604	msedge.exe	148
PID 1604 wrote to memory of 3592	1604	msedge.exe	149
PID 2588 wrote to memory of 688	2588	2026-07-04_d384844aa95b2249f3201c824e892b98_elex_rhadamanthys_stop.exe	152
PID 2312 wrote to memory of 2768	2312	kfdxvpnifa.exe	154
PID 2588 wrote to memory of 5020	2588	2026-07-04_d384844aa95b2249f3201c824e892b98_elex_rhadamanthys_stop.exe	157
PID 2588 wrote to memory of 4248	2588	2026-07-04_d384844aa95b2249f3201c824e892b98_elex_rhadamanthys_stop.exe	161
PID 5244 wrote to memory of 1580	5244	icausmkfcx.exe	163
PID 2588 wrote to memory of 628	2588	2026-07-04_d384844aa95b2249f3201c824e892b98_elex_rhadamanthys_stop.exe	166
PID 2588 wrote to memory of 3616	2588	2026-07-04_d384844aa95b2249f3201c824e892b98_elex_rhadamanthys_stop.exe	170
PID 1624 wrote to memory of 4020	1624	cwupmkecxu.exe	172
PID 2588 wrote to memory of 1632	2588	2026-07-04_d384844aa95b2249f3201c824e892b98_elex_rhadamanthys_stop.exe	175
PID 2588 wrote to memory of 980	2588	2026-07-04_d384844aa95b2249f3201c824e892b98_elex_rhadamanthys_stop.exe	179
PID 1680 wrote to memory of 3964	1680	wurpmgecwu.exe	181

C:\Users\Admin\AppData\Local\Temp\2026-07-04_d384844aa95b2249f3201c824e892b98_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_d384844aa95b2249f3201c824e892b98_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:6060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x384,0x7ffc92eac188,0x7ffc92eac194,0x7ffc92eac1a0
      4⤵
      PID:2804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1584,i,13422313429951631116,10721890845246134756,262144 --field-trial-handle=2244,i,1900339708705124344,5251766358177351054,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
      4⤵
      PID:4504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,91880297572015164,14729191926425458227,524288 --field-trial-handle=2244,i,1900339708705124344,5251766358177351054,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:11
      4⤵
      System Time Discovery
      PID:2292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,17102527331000510974,12798316209020276552,524288 --field-trial-handle=2244,i,1900339708705124344,5251766358177351054,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:13
      4⤵
      PID:3756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,13099808037818178321,11949624963868885969,2097152 --field-trial-handle=2244,i,1900339708705124344,5251766358177351054,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:2120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,12046651186862276884,12034999593298745612,2097152 --field-trial-handle=2244,i,1900339708705124344,5251766358177351054,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
      4⤵
      PID:4740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,5884147783184250850,10532301420904496036,2097152 --field-trial-handle=2244,i,1900339708705124344,5251766358177351054,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:1
      4⤵
      PID:2644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,5640232181844949574,9848263561051111008,2097152 --field-trial-handle=2244,i,1900339708705124344,5251766358177351054,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:9
      4⤵
      PID:5944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,678279200733141843,18025389520383021895,524288 --field-trial-handle=2244,i,1900339708705124344,5251766358177351054,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:14
      4⤵
      PID:5856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,7840032210093342266,16413152687390386350,524288 --field-trial-handle=2244,i,1900339708705124344,5251766358177351054,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
      4⤵
      PID:5140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,2515941521923711423,2420882396680722945,524288 --field-trial-handle=2244,i,1900339708705124344,5251766358177351054,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
      4⤵
      PID:5284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,7120111830373686661,10693070526370728553,524288 --field-trial-handle=2244,i,1900339708705124344,5251766358177351054,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
      4⤵
      PID:4792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,7120111830373686661,10693070526370728553,524288 --field-trial-handle=2244,i,1900339708705124344,5251766358177351054,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
      4⤵
      PID:3532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,2296025733045523376,15702421948320504265,524288 --field-trial-handle=2244,i,1900339708705124344,5251766358177351054,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
      4⤵
      PID:1624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,2645606903597095363,697373907673563540,524288 --field-trial-handle=2244,i,1900339708705124344,5251766358177351054,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
      4⤵
      PID:3996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6544,i,3080809249332988893,2569739614104730955,2097152 --field-trial-handle=2244,i,1900339708705124344,5251766358177351054,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:1
      4⤵
      PID:2196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3620,i,7937014976779964525,8925052272637298021,2097152 --field-trial-handle=2244,i,1900339708705124344,5251766358177351054,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:5692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,3909733013216644882,17889720777850218111,524288 --field-trial-handle=2244,i,1900339708705124344,5251766358177351054,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:14
      4⤵
      PID:5988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,10316587471777772499,16621740317914066421,524288 --field-trial-handle=2244,i,1900339708705124344,5251766358177351054,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:14
      4⤵
      PID:3436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,14146981318084033621,16385448197569316143,524288 --field-trial-handle=2244,i,1900339708705124344,5251766358177351054,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
      4⤵
      PID:3592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,4479033920649353304,1051304220740499931,524288 --field-trial-handle=2244,i,1900339708705124344,5251766358177351054,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
      4⤵
      PID:2972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,12491732236921339318,5084070782229146256,524288 --field-trial-handle=2244,i,1900339708705124344,5251766358177351054,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
      4⤵
      PID:3972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,3109662534332406230,10085229544837796565,524288 --field-trial-handle=2244,i,1900339708705124344,5251766358177351054,262144 --variations-seed-version --mojo-platform-channel-handle=920 /prefetch:14
      4⤵
      PID:5944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,7853966100120680629,4037474145890372124,524288 --field-trial-handle=2244,i,1900339708705124344,5251766358177351054,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
      4⤵
      PID:3312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5464,i,7677483631203155627,4972719629098315997,262144 --field-trial-handle=2244,i,1900339708705124344,5251766358177351054,262144 --variations-seed-version --mojo-platform-channel-handle=912 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,4501280966049654115,15801695707335207132,524288 --field-trial-handle=2244,i,1900339708705124344,5251766358177351054,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
      4⤵
      PID:3808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmjecwuojh.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2132
- - C:\Temp\rmjecwuojh.exe
    C:\Temp\rmjecwuojh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5572
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4392
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmjecwuojh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5924
- - C:\Temp\i_rmjecwuojh.exe
    C:\Temp\i_rmjecwuojh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljdbwtom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3720
- - C:\Temp\trljdbwtom.exe
    C:\Temp\trljdbwtom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5844
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1236
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljdbwtom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3976
- - C:\Temp\i_trljdbwtom.exe
    C:\Temp\i_trljdbwtom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdbvtolgay.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5144
- - C:\Temp\gdbvtolgay.exe
    C:\Temp\gdbvtolgay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5760
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5896
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdbvtolgay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5780
- - C:\Temp\i_gdbvtolgay.exe
    C:\Temp\i_gdbvtolgay.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlfdxvqnl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5596
- - C:\Temp\tnlfdxvqnl.exe
    C:\Temp\tnlfdxvqnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5408
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1148
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlfdxvqnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5584
- - C:\Temp\i_tnlfdxvqnl.exe
    C:\Temp\i_tnlfdxvqnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfdxvpnifa.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:688
- - C:\Temp\kfdxvpnifa.exe
    C:\Temp\kfdxvpnifa.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2312
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2768
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfdxvpnifa.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5020
- - C:\Temp\i_kfdxvpnifa.exe
    C:\Temp\i_kfdxvpnifa.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icausmkfcx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4248
- - C:\Temp\icausmkfcx.exe
    C:\Temp\icausmkfcx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5244
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1580
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icausmkfcx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:628
- - C:\Temp\i_icausmkfcx.exe
    C:\Temp\i_icausmkfcx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwupmkecxu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3616
- - C:\Temp\cwupmkecxu.exe
    C:\Temp\cwupmkecxu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1624
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4020
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwupmkecxu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1632
- - C:\Temp\i_cwupmkecxu.exe
    C:\Temp\i_cwupmkecxu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wurpmgecwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:980
- - C:\Temp\wurpmgecwu.exe
    C:\Temp\wurpmgecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1680
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3964
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2596
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wurpmgecwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5660
- - C:\Temp\i_wurpmgecwu.exe
    C:\Temp\i_wurpmgecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebwuomjecw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2472
- - C:\Temp\ebwuomjecw.exe
    C:\Temp\ebwuomjecw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5812
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1084
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebwuomjecw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4476
- - C:\Temp\i_ebwuomjecw.exe
    C:\Temp\i_ebwuomjecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgeywrojh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4704
- - C:\Temp\omgeywrojh.exe
    C:\Temp\omgeywrojh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:480
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4084
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgeywrojh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3100
- - C:\Temp\i_omgeywrojh.exe
    C:\Temp\i_omgeywrojh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgeywqoigb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5852
- - C:\Temp\lgeywqoigb.exe
    C:\Temp\lgeywqoigb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2492
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3516
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgeywqoigb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:236
- - C:\Temp\i_lgeywqoigb.exe
    C:\Temp\i_lgeywqoigb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigayvqnlf.exe ups_run
  2⤵
  PID:4888
- - C:\Temp\oigayvqnlf.exe
    C:\Temp\oigayvqnlf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4672
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2528
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigayvqnlf.exe ups_ins
  2⤵
  PID:2796
- - C:\Temp\i_oigayvqnlf.exe
    C:\Temp\i_oigayvqnlf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlfaysqnid.exe ups_run
  2⤵
  PID:3984
- - C:\Temp\nlfaysqnid.exe
    C:\Temp\nlfaysqnid.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3648
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5388
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlfaysqnid.exe ups_ins
  2⤵
  PID:3280
- - C:\Temp\i_nlfaysqnid.exe
    C:\Temp\i_nlfaysqnid.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvpnhfdx.exe ups_run
  2⤵
  PID:2440
- - C:\Temp\fdxvpnhfdx.exe
    C:\Temp\fdxvpnhfdx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1516
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2644
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6116
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvpnhfdx.exe ups_ins
  2⤵
  PID:2904
- - C:\Temp\i_fdxvpnhfdx.exe
    C:\Temp\i_fdxvpnhfdx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxupnhfzxr.exe ups_run
  2⤵
  PID:1152
- - C:\Temp\cxupnhfzxr.exe
    C:\Temp\cxupnhfzxr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:256
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3988
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxupnhfzxr.exe ups_ins
  2⤵
  PID:4184
- - C:\Temp\i_cxupnhfzxr.exe
    C:\Temp\i_cxupnhfzxr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\keczurmkec.exe ups_run
  2⤵
  PID:2340
- - C:\Temp\keczurmkec.exe
    C:\Temp\keczurmkec.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4208
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4180
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_keczurmkec.exe ups_ins
  2⤵
  PID:2480
- - C:\Temp\i_keczurmkec.exe
    C:\Temp\i_keczurmkec.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkecwurpmg.exe ups_run
  2⤵
  PID:4628
- - C:\Temp\mkecwurpmg.exe
    C:\Temp\mkecwurpmg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1612
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1784
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkecwurpmg.exe ups_ins
  2⤵
  PID:5532
- - C:\Temp\i_mkecwurpmg.exe
    C:\Temp\i_mkecwurpmg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljhbztrlje.exe ups_run
  2⤵
  PID:4876
- - C:\Temp\ljhbztrlje.exe
    C:\Temp\ljhbztrlje.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4848
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5936
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljhbztrlje.exe ups_ins
  2⤵
  PID:2756
- - C:\Temp\i_ljhbztrlje.exe
    C:\Temp\i_ljhbztrlje.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtolgeywqo.exe ups_run
  2⤵
  PID:4140
- - C:\Temp\wtolgeywqo.exe
    C:\Temp\wtolgeywqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2156
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1452
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtolgeywqo.exe ups_ins
  2⤵
  PID:5288
- - C:\Temp\i_wtolgeywqo.exe
    C:\Temp\i_wtolgeywqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywtoljgbyw.exe ups_run
  2⤵
  PID:5872
- - C:\Temp\ywtoljgbyw.exe
    C:\Temp\ywtoljgbyw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2468
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2928
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywtoljgbyw.exe ups_ins
  2⤵
  PID:1876
- - C:\Temp\i_ywtoljgbyw.exe
    C:\Temp\i_ywtoljgbyw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2248

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2760

C:\Temp\dbwtomjdbw.sys
C:\Temp\dbwtomjdbw.sys
1⤵
- Executes dropped EXE
PID:3300

C:\Temp\qlgdbvtolg.sys
C:\Temp\qlgdbvtolg.sys
1⤵
- Executes dropped EXE
PID:4248

C:\Temp\aysqligayw.sys
C:\Temp\aysqligayw.sys
1⤵
- Executes dropped EXE
PID:4388

C:\Temp\nlfdxvsnif.sys
C:\Temp\nlfdxvsnif.sys
1⤵
- Executes dropped EXE
PID:1292

C:\Temp\faxvpnkfcx.sys
C:\Temp\faxvpnkfcx.sys
1⤵
- Executes dropped EXE
PID:920

C:\Temp\ecwusmkhca.sys
C:\Temp\ecwusmkhca.sys
1⤵
- Executes dropped EXE
PID:5024

C:\Temp\cwuspnhecz.sys
C:\Temp\cwuspnhecz.sys
1⤵
- Executes dropped EXE
PID:3256

C:\Temp\jecwuomgec.sys
C:\Temp\jecwuomgec.sys
1⤵
- Executes dropped EXE
PID:2376

C:\Temp\tomgeywqom.sys
C:\Temp\tomgeywqom.sys
1⤵
- Executes dropped EXE
PID:4392

C:\Temp\ljdbvtrljd.sys
C:\Temp\ljdbvtrljd.sys
1⤵
- Executes dropped EXE
PID:4088

C:\Temp\tolgeyvtql.sys
C:\Temp\tolgeyvtql.sys
1⤵
PID:3300

C:\Temp\qkidaysqli.sys
C:\Temp\qkidaysqli.sys
1⤵
PID:5716

C:\Temp\kfcausnkfd.sys
C:\Temp\kfcausnkfd.sys
1⤵
PID:2900

C:\Temp\zxvpnkifax.sys
C:\Temp\zxvpnkifax.sys
1⤵
PID:3868

C:\Temp\rpnhcausmk.sys
C:\Temp\rpnhcausmk.sys
1⤵
PID:3392

C:\Temp\mjecwurmjh.sys
C:\Temp\mjecwurmjh.sys
1⤵
PID:5560

C:\Temp\mjhbztrlje.sys
C:\Temp\mjhbztrlje.sys
1⤵
PID:3588

C:\Temp\bwuomgeyoj.sys
C:\Temp\bwuomgeyoj.sys
1⤵
PID:5348

C:\Temp\wqolgdbytq.sys
C:\Temp\wqolgdbytq.sys
1⤵
PID:2484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aysqligayw.sys

Path C:\Temp\aysqligayw.sys
Size 141KB
SHA256 66b6256c16745cfea8d59a12fde8f1328573f675f12ceb64ef21050d6a2bd1ff
MD5 2bfc6d9fad9ba243de14f391afe0a573
SHA1 fa1caf8403b7d0e569c86028499e863b7a3622ed
SHA512 1a91cce61fb0c8486aaa65f19563cf52d1fc488830c95de54f88bf09a8ec5b6bf5b46f0905ef3560a5344ea55282eaa764598581848694f73764cf000ccbb0f0
SSDEEP 1536:Xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B8E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbwtomjdbw.sys

Path C:\Temp\dbwtomjdbw.sys
Size 141KB
SHA256 a0176edf37a133dd3c0ae401b8bb991f5b80e590a196e6d8a3b19259d571e2da
MD5 ec1c1a06af0933a1e81d760a4ee11ef0
SHA1 c7f0ad56721eefeba2bf9689ec39a539ffdca9fa
SHA512 f46207db0eb3ae8d4cbece8c4b1ac76ba03ff4d1c484677deaf16d06036d9c502add9a93bec2b074b3ce0ba21b2ef52021ef9d92eeb7de35c5754bf617af502b
SSDEEP 1536:Wa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Wa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T100E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxvpnkfcx.sys

Path C:\Temp\faxvpnkfcx.sys
Size 141KB
SHA256 642d5227be3d702117a3faa8c9b6e40b83880152559a35e2eefb444b4412def5
MD5 582cd416a0972d0b0616efb261321461
SHA1 91e318f7e704c25446ff1a2fcbdaf7c228d8760f
SHA512 fbc1a6dc49043123533d66dd1a3d43a00f7c424e165e615adcb56cbafefd6917e2bb7cc841e1eb71528b48bde296f4af30807b1f45c5ebb93cbd8fb17ae6ce08
SSDEEP 1536:6a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:6a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T135E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdbvtolgay.exe

Path C:\Temp\gdbvtolgay.exe
Size 243KB
SHA256 495e3b111c20d245a8be2dfc2ffe995b844e305cfb314f6ccf575e48ccfb1ca8
MD5 e5b79d3a18a38e4dbcd05d4f77183f9a
SHA1 38aa7be1f0803292e21701b1fa1c334cc6c99168
SHA512 88da95c73a9e69391ff016c85de7208fb1ef11308aa926fe0173995d9428c60ba274dc1b54dd2255aefad7b2acc2c6ba676d399dfb39d6c5f96c839474283ded
SSDEEP 3072:VYVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7/r:6XP7LQMa3lLNngoqRttA7T
TLSH
T13C345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gdbvtolgay.exe

Path C:\Temp\i_gdbvtolgay.exe
Size 243KB
SHA256 cfca1eb6cd3e409e8afd31df157b7a8fbc55c5e5884c0b5e862836c8600ea853
MD5 06e5d05506a4df2d5822cef5c9641a5a
SHA1 5018987dcdbc3890ab2f4ce0a9759b4d555d1719
SHA512 3f7706f95209ad9a7a62a681e749bba6f6acd47eefe69adf4e42c1971eea817ba54d0e5993d03ec16f73da96a7ac59f2d9765b288ca09165713bf943c924796f
SSDEEP 3072:OVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7v:+XP7LQMa3lLNngoqRttA7v
TLSH
T183345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kfdxvpnifa.exe

Path C:\Temp\i_kfdxvpnifa.exe
Size 243KB
SHA256 8fdaf62b4d344c907c79bb3b1c93fb55309d2dfc95038c1fbba758ba2b883d16
MD5 e4da28774154a072f1329796b84c75bd
SHA1 fb48679a478396124ce8ecf6377da983ec07b506
SHA512 77a819570c4b33ccb84b9d7a65d788090fd778c6d040e1931c8eceb3488c64259721e31d5cc7ff541aee2745f119074198d579c87b9cb7fbe9c56e57897c4f58
SSDEEP 3072:qVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7P:qXP7LQMa3lLNngoqRttA7P
TLSH
T18A345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rmjecwuojh.exe

Path C:\Temp\i_rmjecwuojh.exe
Size 243KB
SHA256 14d18e1257ea09d6e5745dcd697b172f3096e0e0896d6b7bd956ca6fc35cc97b
MD5 d683e9028e81af4326f4ff45d1f7e3e0
SHA1 c28d25402f555f6fad5808f1727f907342748f30
SHA512 bfe4fb4c4fe6e6b6489419234a72e9ab7826f9934f1c14343465e570a6116d7e8eeeb2ff0358a2dc7ad4cfa71d6b6e515dadca779d14bb4774f7d4acbbeaf58b
SSDEEP 3072:rVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7K:5XP7LQMa3lLNngoqRttA7K
TLSH
T11A345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnlfdxvqnl.exe

Path C:\Temp\i_tnlfdxvqnl.exe
Size 243KB
SHA256 0b21badadf7e707f53783217b4498272dfcbba18375d72db1f5adea627af4501
MD5 277347c729634b98da018402ef7fadec
SHA1 85f0f0666e106ba8474037e5531f9e0169667fc5
SHA512 c12a7e12765a21b8059fd216aa340895f2e073c19e1b40b94b72b921e69a16694b67cc684433068c3067220eb615ee672db64612d278467e9f479da8089b0b54
SSDEEP 3072:ZVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7w:rXP7LQMa3lLNngoqRttA7w
TLSH
T18A345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trljdbwtom.exe

Path C:\Temp\i_trljdbwtom.exe
Size 243KB
SHA256 855b9b1b1fa3ee37095267fade37b93bc07e4da708a2777a34c39f757564623a
MD5 dfaa25e5dcd811883fd908e431e1be70
SHA1 d6b88e678ee678b3f0f68ffe646f56f18103acc0
SHA512 c9d8a0fa75653e169eb4fa093ff6d23d9738944db8d82845714a0ec277716427cdc6c97190261bbd2d5f4ba12f792cbc018bfb744d8f59981b94898349c732e6
SSDEEP 3072:ZVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:rXP7LQMa3lLNngoqRttA7A
TLSH
T122345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icausmkfcx.exe

Path C:\Temp\icausmkfcx.exe
Size 243KB
SHA256 1766fba1637712319231d9dfd1ff404d6fceddef7ddb86a71697755fb0eac510
MD5 9a6337407619bf7dac28e9cd2a701f84
SHA1 c53ab1932ffd627951188df27897031c635681db
SHA512 7faa2ebacf3621592780b43108189a64ed9a2903515c4f5b115bff10dda7483ab1919332aeb16ab40d0349421fd3303a849e4f512abedb83f52ec74eb60823fe
SSDEEP 3072:GVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:2XP7LQMa3lLNngoqRttA7D
TLSH
T140345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfdxvpnifa.exe

Path C:\Temp\kfdxvpnifa.exe
Size 243KB
SHA256 cf00995a1f12f70a1393267eb9b590a1392ba599d9d0c95d2b761a948a63d39b
MD5 9a2287e60f47742230fe1f7631f7811b
SHA1 b26d2858398801b1b5ce4001e25beb4dc677345e
SHA512 7525b23c18c71ae01f1870deb81036a234fb123244ac54587859ad7cddf92af6d126827cbd096f5d4aaaac8d37cd7f0c1e4e8a0625b828b72bbd925c264725f6
SSDEEP 3072:iVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7H:iXP7LQMa3lLNngoqRttA7H
TLSH
T128345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdxvsnif.sys

Path C:\Temp\nlfdxvsnif.sys
Size 141KB
SHA256 3fcae9b1c7ab37c7add87b86205bd185ffe512936b5c7f13e4608089e25291a4
MD5 066c3b56b13acd51b6616207fc434369
SHA1 1da2ff7e170b6059b6be45b58aaf22431a375d87
SHA512 c89eb38bf2ba9f4752b89e1c358cc075430794b59ae80adb2c646784c220ff55a6ce78f5bc1ac84a9a206dee463e3f53cc48653311fc1475429edcb0ed9bbf94
SSDEEP 1536:oa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:oa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A4E37C12B292D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qlgdbvtolg.sys

Path C:\Temp\qlgdbvtolg.sys
Size 141KB
SHA256 7f814cfb9e2268bf18ab439b39c9840dc95f94e9a14fb728437e3066e68c6002
MD5 1a5f3205725b18df767ba7b3a6fb32bb
SHA1 66bcf67406895d132d10e6b2aa351785c4e7abd6
SHA512 92290aaa7d08508c445551e425be78e9ba3fd662b6ab1f1953c24d4c5a435aab0dfed96874242abdf2141453e88824c330c61e86a8bda57e5edf9ceee072881f
SSDEEP 1536:za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T100E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmjecwuojh.exe

Path C:\Temp\rmjecwuojh.exe
Size 243KB
SHA256 6c109b9c7ee26f43e1f2ac4032d78c00fa2862e2b5763566366cade6fe6db7bc
MD5 4e47b66d01d6544d6feaa4c25ff2e176
SHA1 6c26bd5648b6367639cba82e543d12f982b6f7d0
SHA512 9a3c494556a23d86350f90d9b6950be91d46f3c6f22c07d633e2a23042249f5f5e88e9351ccd1e717bacc3ea8c0dcc7c01550762349f6c8c1ea43efa660918d8
SSDEEP 3072:KVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7v:KXP7LQMa3lLNngoqRttA7v
TLSH
T114345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlfdxvqnl.exe

Path C:\Temp\tnlfdxvqnl.exe
Size 243KB
SHA256 446c57a95c7860b4fda8f12a73bef055b28411f98d2d9dbdc4a3b587fdb6f40c
MD5 64f56f929742beebb99110871a30bc09
SHA1 d587c5291c1016239303e298e31a751a90bab38e
SHA512 58c5f67e598add436c50887fb9c5c10e56027da0ece623c6f88cc2bcce534631bfe596c4a6c5c143c1501cd3f263a429ceb18233171a7aa36eac34929b9ee87a
SSDEEP 3072:yVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7P:yXP7LQMa3lLNngoqRttA7P
TLSH
T10E345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbwtom.exe

Path C:\Temp\trljdbwtom.exe
Size 243KB
SHA256 4ffc4a05034e4ca260214926b1f9b9c15f0bc725c3393dbc29f49d313f37ee11
MD5 505307eb303f38bd71db5e607617c609
SHA1 476f16620b3b389cb8c49775f851cfad0793fe60
SHA512 9e978d83bbfebfe91949d10c6147f5d28dde71968d6c3bdbe0598368557f51badd4fae23bca621b16f1211c9e364e4b2445ee79f4d5a4d7dbf11e14da07efa6a
SSDEEP 3072:nVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7y:VXP7LQMa3lLNngoqRttA7y
TLSH
T132345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 48b0127c48894e5c8e42b14bcc7f6b1f91ca5d97355f42d22391fb602568bb1d
MD5 df62623cabc43e309a7767f4081f29d9
SHA1 420f1a4b11b86944a73d3cbcd4aec4883dfdfd62
SHA512 02067a08d194a87842f985ff7d0bee13c7b7228146565bf19114ffaebc120cb3d2ba8b19c941bb0d2773043366f064246a55efd57127d4a0de5768f453b2730c
TLSH
T1FDD08035774DFD08C18054717890D3517A204460345AC3186329A01DDDBC68513DF0EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a958178f477b8cf0f18d83e0835916167b3eaf95d859728b647bc0100a82efc
MD5 b2c496fb89251ff9b8ff1c46a5315932
SHA1 19626950ca3b280d084016871229a48eb3fa5ffc
SHA512 bbd974e4a08ca8f629f0b9a8892ba78ac7d4191c1640d1037e4fd018dadb4d8edd0a663e4a673a29497151c4defd9be09b6a4a4788adf24b182cbc36b18ccda7
TLSH
T1C5D08031774DFD08C18054757890D3517A104460245AC3186329E01DDDBC68513DF0DF
MD5 SHA1 SHA512 TLSH

Submit Download

8f34f72a-7e4b-4f55-9aee-63593a880d46.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8f34f72a-7e4b-4f55-9aee-63593a880d46.tmp
Size 32KB
SHA256 902a2bcaed6d3678189da940ecfe642a8336aedaa94c8f39817a905c34ed2112
MD5 e369040971ae3fadef944233fb967b0d
SHA1 6d51e1d5017b8297f292af8e496d87c6750dc98e
SHA512 96ab0e829bab2ad37fe27263a25198e88130a04b5de6738a2590a49b112cbfb71f9515d089352936d587b8a53a5e195922230410542a6f6af0cc375e86b1e5f3
SSDEEP 768:Tqi0NR7pLuL7C3WgNxfez8F1+UoAYDCx9Tuqh0VfUC9xbog/OVzJzXNGAroKTp0j:Tqi0NHE7C3WgNxfezu1jasJz9GL5
TLSH
T1DFE2ED3B680CCB7E4F804E9CEC2A7E9A6DE801CF96D8C95447EA841C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 139f980562ef078824ca408f099f96edf1f9f8a1168a62bcf937cb6a892fa774
MD5 05015e44890e95e93457d7dfaddd257e
SHA1 c163a05bf637879bb378fc55aa59ba32a32f96cb
SHA512 8d691b20ee3019f3ce6e9aa5cbce8db9d58507cc4932092a61b3a11cd9c358898022a19e05fa1676a52358230b0637886dd77ee53d5a40fcf6c579d6ecc51bcb
TLSH
T10251403B1E350B53EB99817F46D1D387BF3AC6E1800B6F006207B077DD0A7A06AA1B52
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599512.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599512.TMP
Size 3KB
SHA256 d1097fc9ec88b296c1598803cb1dc6d0f79b7c398d8007cb4f065621886947e7
MD5 243f8fd96a3bab071658516ffe441886
SHA1 ad90ad80a29f775738c19f7776940c44caec8cc1
SHA512 bcd59fbc9f9fbd59985d95580eba7a26fb41727fac27aea253dc8ac75c7c7422afad451fed11f4f15abeabc2140d1c338e62e05c7f1309db5ae685743a56e12c
TLSH
T15D51203B5E350B53EB99817F46E1D387BF2AC6E1800B6F016207B077DD0A7A06AA1752
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5628dbe3a8a58887675452c31218707f194ba2ee31133719820fd2840311d303
MD5 55b87b1bd3e78aa9134ba55dc9a4f872
SHA1 356735e4bfad203388d766d976432a7646f47eb9
SHA512 01962d2f1fb213297d47f1fa439df0cc902c515fac1f2287e972491d8bfe852b007d62143ae10acf1ea5f2b30f6440a1021f0c05890131de407099273546690d
TLSH
T17E51ACF7C3E8856E890195F4BB147E2BCE1D0914832C3D5AC9E4AE1BA3E2471E14195E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4f56d9d8bff1d957de0bfb7192923cd777e74b2c85e0d0fa9930d61beba253fa
MD5 2b76c633f6dbc3f677dd68d5501329d0
SHA1 0aaab8a276e4d0c405deb690383ddb1ba31ce776
SHA512 184b48ce120c4a4fb74e0aa555d18bfd712ee6691ff59edcd14eead63f653d18e89aa3e9c975f3359261c9ebc6b40c31646bed2de0189852e5f7bc98dd185bd3
SSDEEP 192:sxR3RnyM/jK1Ml8wc7f/fJsxPINo1Z94zzoA8pi/g6+WNIY4MAe0q+GAIgtJ:sxR3nC7f/fJsxgo79Hi/5I7e0q+3
TLSH
T1CF52EA15AA249937CCDBD20DFA557F53D6FD1523A2901E48A9FCCA0C05E7AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 418cbafab72809b71d59b7514237c8f5726c8fdd37b331db9c14c6644ba29dab
MD5 411e6e574557055a477c440642103266
SHA1 49f166eaad63b3d8d028f26be48a421807818e7c
SHA512 44966b9cef731cf6058a87f241c26c571a9d39487d40c11c930afad4fdf7baa1ea5683bf5d9ce40da4787477362fd236a1e3a3a9ec2b8657e171867c4d7d951b
SSDEEP 192:sxR8RnyM/jK1Ml8UQMc7f/fJscPIko1Z94LzoA8pr1/g6+WNC8K/Y4JAe0q+GAIn:sxR8xqL7f/fJscpo79vp/5k/ue0q+I
TLSH
T10B62EA16AA249937CCDBD209FA517F53D2F91563A2940E48A9FCCB0C05F7ADD220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 fc26f5234d966b1c1aa8ab98ba18b01919d7191566d9cce6f5ce66a450ee8663
MD5 8f9aa338f5e4f50b0491790b3828a7b0
SHA1 59e691106f4bb4a62bd3a2bb2d72e43714044b0a
SHA512 5d39b1641303e6782cce1db3cf6fc1ecc5654c04a65349bab31f33baadc5a6226e36d6e7520bad2fd8b8617986a4f5e5aecc9397d206c76aa07d84d5b4ce3ef5
SSDEEP 192:sxR8RnyM/jK1Ml8wc7f/fJscPIko1Z94LzoA8p91/g6+WNC8K/Y4JAe0q+GAIgDk:sxR8xC7f/fJscpo79vP/5k/ue0q+I
TLSH
T1DE62E915AA249977CCDBD309FA517F53D6F91563A2940E48A9FCCB0C05E7ADD220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ef92665560b8f40526cdc71b249b01e4a620bc4fc5a0cd54966b3cf25ec1a8c2
MD5 7c3664004c823e08e5350e79ee38692b
SHA1 0b0cdb16f9c814210159712847672647b837610e
SHA512 8e50161f4f628184ff89ac1159f56830074ad0095448922834787941c413c6d54b9f3fbd1d6fea262f0a80c94d86f0bc008a1aa86030741035dea7fc48e4286f
SSDEEP 192:sxR8RnyM/jK1Ml8wc7f/fJscPINo1Z94LzoA8p9c/g6+WNIY4SAe0q+GAIgDOJ:sxR8nC7f/fJscgo79vS/5IFe0q+u
TLSH
T1C862F915AA349937CCDBD209FA557F53D6FD1563A2900E48A9FCCA0C05E7AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 81e889062b61744cccbb328221e3a372f66b167385cae2b8e8d38b70234877bc
MD5 83126d84e7e3a984c4da136906e255a9
SHA1 ef8a1f62a4c2c0e494c637330da2bf473edd855d
SHA512 a199d78653e6633a21b00a8e5746ea392b1bdd898fd72b7954d079e03ece2c8cb0858b2f1fc1072c68b76b60a5e85c499300a8af7eb318385c5fd128fd203575
SSDEEP 768:Arv+4UNbd23pPthVcq+AW+152MvSCa2aX+8rir9:Absbs3xpx2pjXDriR
TLSH
T18603BE32E869A9738CA686C4B64B36137FB0529385C10F94CDD92B4D429B6CD231FC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 635ecfc2de7d539dd5d85118531c53e2fea683d0ca94891ec82e200aa6a4b0c8
MD5 273d1d4da8d12567323ad241068857b2
SHA1 aaea7f79ab57c18d6f35d1f606e8818474c74874
SHA512 7e2ee2103c17dba0a4b7ebc686b7000bbbc9319f64dddae6814cbf1ece3a0640817d10535adb703e8a26ffea685a7d1ec9385638d9693428aa86074f23dfc858
SSDEEP 768:Ij+9n3IathVc8O1E+AW+152MvSCai1b9MbZ:X9n3YGpx2pab+bZ
TLSH
T126F2AE31A85AED738C9687C4B74B3796AFE0116785C11E88CDD9AB0D06C368D179BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 089aacb090feb679b23a8dfbd7577d3a1ea7c252b69fe6b818ab8e608d1b04e5
MD5 721e9340e69ccc65723089d154193891
SHA1 64938070e8afe5df283df883dd6d2e17898fb057
SHA512 495f6a87d4ef8053cf8dbad90e4618229c09fe79e81514003065c748d0319877d412478ecb6c5e6512b5606af9bf107a08da980655504ceb86dcc326d9538925
SSDEEP 768:Aj+9q3Wv6hVc8O1Q+AW+152MvSCai1b9MbZ:/9q3Iupx2pab+bZ
TLSH
T1A21339F598D79D32C89E8383637E3E469EBCD15375840988BBC45E0DCD822BFD64A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f3146cf06be94d426735d7636eaf75b093f9268ca5c86b8a437e6118b231fe5e
MD5 a80bb3181453ab33e85d2d292fdbf10f
SHA1 060a2ac17367301aaeb43d364168cf16f184b737
SHA512 1e43d5646afd007d2efa549cb9c2ebfd61be6c8453e9ac21bb670a9c240ab865d0257bbb97ad2d8ecc87234378da51ccbe972753dd3734a0da2d4ff386111107
SSDEEP 768:Bj+9n3CathVc8O1P+AW+152MvSCai1b9MbZ:c9n3i9px2pab+bZ
TLSH
T1A9F2AE31A85AED738C9687C4B74B3796AFE0116785C11E88CDD9AB0D06C378D275BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

054f2856-14a7-40db-9f39-87f8a40808de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\054f2856-14a7-40db-9f39-87f8a40808de.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1604_1682890771\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/920-305-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1292-283-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2376-348-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2484-486-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2900-422-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2900-400-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3256-323-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3256-318-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3300-376-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3300-187-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3392-425-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3588-457-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3868-420-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4088-356-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4248-235-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4388-263-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4392-326-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5024-314-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5348-469-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5348-488-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5560-437-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5716-389-0x0000000000010000-0x0000000000083000-memory.dmp

Download