1f57455fd42a1d53ca7ffe58bb70eaf2b25c2e982ca0b15438ca81fb41c4080b

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 15:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_3f2a1ea21dfb661f5f7de68aabb74114_elex_rhadamanthys_stop.exe
Size 243KB
Sample260706-sqffcacy7q
SHA256 1f57455fd42a1d53ca7ffe58bb70eaf2b25c2e982ca0b15438ca81fb41c4080b
MD5 3f2a1ea21dfb661f5f7de68aabb74114
SHA1 bf7f88ee41cb79d9b1ed3584e09a7d0f189b4bef
SHA512 e251586820fe8b86f167eb9128178d3ffbc1ed4d43108f9f08675aa3eab9b37bb9298a10c2008df859a104334ba90ac0ee67ec3136bb26fe1a531d624f52a4cf
SSDEEP 3072:MMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA72:eGii9IL8Xa3lLNngoqRttA72
TLSH
T10834490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
564	CP.exe
3956	khczusmhfz.exe
6096	CP.exe
4972	CP.exe
2708	i_khczusmhfz.exe
236	bztrpjhezx.sys
3028	CP.exe
3160	wromgebwuo.exe
1568	CP.exe
3392	CP.exe
900	i_wromgebwuo.exe
4196	hezwromgez.sys
3888	CP.exe
5752	wqomjdbwto.exe
3520	CP.exe
1500	CP.exe
1844	i_wqomjdbwto.exe
3396	ljgbztrljd.sys
4760	CP.exe
2796	gbytqlgdbw.exe
5344	CP.exe
3896	CP.exe
2220	i_gbytqlgdbw.exe
5604	tqoigdbvtn.sys
5992	CP.exe
476	ljdbvtnlgd.exe
1780	CP.exe
2608	CP.exe
4980	i_ljdbvtnlgd.exe
4196	nlfdavpnif.sys
804	CP.exe
4488	idaysqkida.exe
3960	CP.exe
5876	CP.exe
2740	i_idaysqkida.exe
2116	dankfcausn.sys
5744	CP.exe
5900	qkicausnkf.exe
2852	CP.exe
236	CP.exe
2860	i_qkicausnkf.exe
5292	nkfcaxspnk.sys
4212	CP.exe
2620	pfzxspkhcz.exe
3252	CP.exe
6088	CP.exe
2964	i_pfzxspkhcz.exe
3568	usmkecwusm.sys
5348	CP.exe
4888	pnhezxrpjh.exe
8	CP.exe
3696	CP.exe
3688	i_pnhezxrpjh.exe
944	mjecwuomke.sys
6044	CP.exe
5296	jhbzurmkec.exe
984	CP.exe
5844	CP.exe
5288	i_jhbzurmkec.exe
4652	tromhezwjg.sys
4992	CP.exe
3128	omgeywqojg.exe
4796	CP.exe
2964	CP.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping632_162560008\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping632_162560008\protocols.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping632_824776352\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_3f2a1ea21dfb661f5f7de68aabb74114_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khczusmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jeywromgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khczusmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqomjdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytqlgdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaytqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oifaysqkig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pfzxspkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pfzxspkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywtoiyvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oifaysqkig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxvpmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpkhcwusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wromgebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytqlgdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywtoiyvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpkhcwusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idaysqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wromgebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezxrpjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqomjdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idaysqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaytqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezxrpjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jeywromgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbzurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbzurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxvpmkfcx.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2076	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2720	ipconfig.exe
2364	ipconfig.exe
3292	ipconfig.exe
3536	ipconfig.exe
4496	ipconfig.exe
4944	ipconfig.exe
4196	ipconfig.exe
5912	ipconfig.exe
5356	ipconfig.exe
4784	ipconfig.exe
5276	ipconfig.exe
5152	ipconfig.exe
3300	ipconfig.exe
1048	ipconfig.exe
5460	ipconfig.exe
4884	ipconfig.exe
3736	ipconfig.exe
3816	ipconfig.exe
3744	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278247818808214"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{7B495546-AA10-4719-AC49-AA9A02A22F62}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5868	msedge.exe
5868	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2708	i_khczusmhfz.exe
Token: SeDebugPrivilege	900	i_wromgebwuo.exe
Token: SeDebugPrivilege	1844	i_wqomjdbwto.exe
Token: SeDebugPrivilege	2220	i_gbytqlgdbw.exe
Token: SeDebugPrivilege	4980	i_ljdbvtnlgd.exe
Token: SeDebugPrivilege	2740	i_idaysqkida.exe
Token: SeDebugPrivilege	2860	i_qkicausnkf.exe
Token: SeDebugPrivilege	2964	i_pfzxspkhcz.exe
Token: SeDebugPrivilege	3688	i_pnhezxrpjh.exe
Token: SeDebugPrivilege	5288	i_jhbzurmkec.exe
Token: SeDebugPrivilege	5696	i_omgeywqojg.exe
Token: SeDebugPrivilege	944	i_geywtoiyvt.exe
Token: SeDebugPrivilege	1580	i_qoigaytqli.exe
Token: SeDebugPrivilege	5540	i_oifaysqkig.exe
Token: SeDebugPrivilege	1552	i_aysqkicavs.exe
Token: SeDebugPrivilege	2472	i_fcxvpmkfcx.exe
Token: SeDebugPrivilege	3844	i_rpkhcwusmk.exe
Token: SeDebugPrivilege	2768	i_ezxrpjhbzu.exe
Token: SeDebugPrivilege	5252	i_jeywromgey.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
632	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 6100	4160	2026-07-06_3f2a1ea21dfb661f5f7de68aabb74114_elex_rhadamanthys_stop.exe	88
PID 6100 wrote to memory of 632	6100	iexplore.exe	89
PID 632 wrote to memory of 4284	632	msedge.exe	90
PID 632 wrote to memory of 5156	632	msedge.exe	91
PID 632 wrote to memory of 2076	632	msedge.exe	92
PID 632 wrote to memory of 5156	632	msedge.exe	91
PID 632 wrote to memory of 5156	632	msedge.exe	91
PID 632 wrote to memory of 4988	632	msedge.exe	94
PID 632 wrote to memory of 4988	632	msedge.exe	94
PID 632 wrote to memory of 2940	632	msedge.exe	95
PID 632 wrote to memory of 5392	632	msedge.exe	96
PID 632 wrote to memory of 2940	632	msedge.exe	95
PID 632 wrote to memory of 2940	632	msedge.exe	95
PID 632 wrote to memory of 5392	632	msedge.exe	96
PID 632 wrote to memory of 5392	632	msedge.exe	96
PID 632 wrote to memory of 2056	632	msedge.exe	97
PID 632 wrote to memory of 4780	632	msedge.exe	98
PID 632 wrote to memory of 2056	632	msedge.exe	97
PID 632 wrote to memory of 2056	632	msedge.exe	97
PID 632 wrote to memory of 4780	632	msedge.exe	98
PID 632 wrote to memory of 4780	632	msedge.exe	98
PID 632 wrote to memory of 2472	632	msedge.exe	99
PID 632 wrote to memory of 2472	632	msedge.exe	99
PID 4160 wrote to memory of 564	4160	2026-07-06_3f2a1ea21dfb661f5f7de68aabb74114_elex_rhadamanthys_stop.exe	101
PID 3956 wrote to memory of 6096	3956	khczusmhfz.exe	104
PID 632 wrote to memory of 1788	632	msedge.exe	107
PID 632 wrote to memory of 5864	632	msedge.exe	108
PID 632 wrote to memory of 1788	632	msedge.exe	107
PID 632 wrote to memory of 5864	632	msedge.exe	108
PID 632 wrote to memory of 4464	632	msedge.exe	110
PID 632 wrote to memory of 2116	632	msedge.exe	111
PID 632 wrote to memory of 2116	632	msedge.exe	111
PID 632 wrote to memory of 4760	632	msedge.exe	112
PID 632 wrote to memory of 4760	632	msedge.exe	112
PID 4160 wrote to memory of 4972	4160	2026-07-06_3f2a1ea21dfb661f5f7de68aabb74114_elex_rhadamanthys_stop.exe	115
PID 4160 wrote to memory of 3028	4160	2026-07-06_3f2a1ea21dfb661f5f7de68aabb74114_elex_rhadamanthys_stop.exe	119
PID 3160 wrote to memory of 1568	3160	wromgebwuo.exe	121
PID 4160 wrote to memory of 3392	4160	2026-07-06_3f2a1ea21dfb661f5f7de68aabb74114_elex_rhadamanthys_stop.exe	124
PID 4160 wrote to memory of 3888	4160	2026-07-06_3f2a1ea21dfb661f5f7de68aabb74114_elex_rhadamanthys_stop.exe	128
PID 5752 wrote to memory of 3520	5752	wqomjdbwto.exe	130
PID 4160 wrote to memory of 1500	4160	2026-07-06_3f2a1ea21dfb661f5f7de68aabb74114_elex_rhadamanthys_stop.exe	133
PID 632 wrote to memory of 1148	632	msedge.exe	137
PID 632 wrote to memory of 1148	632	msedge.exe	137
PID 632 wrote to memory of 1148	632	msedge.exe	137
PID 632 wrote to memory of 4164	632	msedge.exe	138
PID 632 wrote to memory of 4164	632	msedge.exe	138
PID 632 wrote to memory of 4164	632	msedge.exe	138
PID 4160 wrote to memory of 4760	4160	2026-07-06_3f2a1ea21dfb661f5f7de68aabb74114_elex_rhadamanthys_stop.exe	139
PID 2796 wrote to memory of 5344	2796	gbytqlgdbw.exe	141
PID 4160 wrote to memory of 3896	4160	2026-07-06_3f2a1ea21dfb661f5f7de68aabb74114_elex_rhadamanthys_stop.exe	145
PID 632 wrote to memory of 2708	632	msedge.exe	147
PID 632 wrote to memory of 4716	632	msedge.exe	148
PID 632 wrote to memory of 5112	632	msedge.exe	149
PID 4160 wrote to memory of 5992	4160	2026-07-06_3f2a1ea21dfb661f5f7de68aabb74114_elex_rhadamanthys_stop.exe	152
PID 476 wrote to memory of 1780	476	ljdbvtnlgd.exe	154
PID 4160 wrote to memory of 2608	4160	2026-07-06_3f2a1ea21dfb661f5f7de68aabb74114_elex_rhadamanthys_stop.exe	157
PID 632 wrote to memory of 2360	632	msedge.exe	161
PID 632 wrote to memory of 2360	632	msedge.exe	161
PID 632 wrote to memory of 2360	632	msedge.exe	161
PID 4160 wrote to memory of 804	4160	2026-07-06_3f2a1ea21dfb661f5f7de68aabb74114_elex_rhadamanthys_stop.exe	162
PID 4488 wrote to memory of 3960	4488	idaysqkida.exe	164
PID 4160 wrote to memory of 5876	4160	2026-07-06_3f2a1ea21dfb661f5f7de68aabb74114_elex_rhadamanthys_stop.exe	167
PID 4160 wrote to memory of 5744	4160	2026-07-06_3f2a1ea21dfb661f5f7de68aabb74114_elex_rhadamanthys_stop.exe	171
PID 5900 wrote to memory of 2852	5900	qkicausnkf.exe	173

C:\Users\Admin\AppData\Local\Temp\2026-07-06_3f2a1ea21dfb661f5f7de68aabb74114_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_3f2a1ea21dfb661f5f7de68aabb74114_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:6100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2cc,0x2f8,0x2d4,0x354,0x7fff8f71c188,0x7fff8f71c194,0x7fff8f71c1a0
      4⤵
      PID:4284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,6957332084601815623,6228014636077097425,262144 --field-trial-handle=2676,i,7159368695210437561,16374582768754439342,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:2
      4⤵
      PID:5156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,1125756722348941612,11636851016744115767,524288 --field-trial-handle=2676,i,7159368695210437561,16374582768754439342,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:11
      4⤵
      System Time Discovery
      PID:2076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2132,i,10422115609351572559,8915161733927412732,524288 --field-trial-handle=2676,i,7159368695210437561,16374582768754439342,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:13
      4⤵
      PID:4988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,14734558264321746082,6366491776367046775,2097152 --field-trial-handle=2676,i,7159368695210437561,16374582768754439342,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:2940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,6708631163668675305,15286481004779030318,2097152 --field-trial-handle=2676,i,7159368695210437561,16374582768754439342,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      PID:5392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,12475764375988978465,11572755998821996728,2097152 --field-trial-handle=2676,i,7159368695210437561,16374582768754439342,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:1
      4⤵
      PID:2056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,5709208792965734465,7435356313763097594,2097152 --field-trial-handle=2676,i,7159368695210437561,16374582768754439342,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:9
      4⤵
      PID:4780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,8950625875219394584,14662636211408146524,524288 --field-trial-handle=2676,i,7159368695210437561,16374582768754439342,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
      4⤵
      PID:2472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,12834484362239729769,12237540540558732725,524288 --field-trial-handle=2676,i,7159368695210437561,16374582768754439342,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
      4⤵
      PID:1788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,12315315492409378458,17433822747126248855,524288 --field-trial-handle=2676,i,7159368695210437561,16374582768754439342,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
      4⤵
      PID:5864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,1927736453083425099,5166847367215932240,524288 --field-trial-handle=2676,i,7159368695210437561,16374582768754439342,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
      4⤵
      PID:3512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,1927736453083425099,5166847367215932240,524288 --field-trial-handle=2676,i,7159368695210437561,16374582768754439342,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
      4⤵
      PID:4464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,14517437443933033402,13046388683341879058,524288 --field-trial-handle=2676,i,7159368695210437561,16374582768754439342,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:2116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,77433603495417658,14418694446644267554,524288 --field-trial-handle=2676,i,7159368695210437561,16374582768754439342,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
      4⤵
      PID:4760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4612,i,3464154935758273575,17157471761043952169,2097152 --field-trial-handle=2676,i,7159368695210437561,16374582768754439342,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:1
      4⤵
      PID:1148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3868,i,5496153784779991409,6070098650643995352,2097152 --field-trial-handle=2676,i,7159368695210437561,16374582768754439342,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:1
      4⤵
      PID:4164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,12764134532068105638,587166538117073792,524288 --field-trial-handle=2676,i,7159368695210437561,16374582768754439342,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:14
      4⤵
      PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,6438278867729413652,1918891455662468034,524288 --field-trial-handle=2676,i,7159368695210437561,16374582768754439342,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
      4⤵
      PID:4716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4788,i,2000069565317360799,308127739931485412,524288 --field-trial-handle=2676,i,7159368695210437561,16374582768754439342,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:14
      4⤵
      PID:5112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4656,i,11297748343106376328,4175086653504207906,2097152 --field-trial-handle=2676,i,7159368695210437561,16374582768754439342,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:1
      4⤵
      PID:2360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3876,i,12693216337503023954,17197979851441739171,2097152 --field-trial-handle=2676,i,7159368695210437561,16374582768754439342,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:1
      4⤵
      PID:5024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,16500348267819150995,2484751790483826458,524288 --field-trial-handle=2676,i,7159368695210437561,16374582768754439342,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:14
      4⤵
      PID:2892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=2940,i,17543851902568051347,14099124065397141233,2097152 --field-trial-handle=2676,i,7159368695210437561,16374582768754439342,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
      4⤵
      PID:2700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,13552788049392879800,1487302739393092006,524288 --field-trial-handle=2676,i,7159368695210437561,16374582768754439342,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
      4⤵
      PID:1748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5172,i,11302930542851852278,11316829585274467250,2097152 --field-trial-handle=2676,i,7159368695210437561,16374582768754439342,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:1
      4⤵
      PID:4116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6212,i,13924362186199753437,505896675517419926,262144 --field-trial-handle=2676,i,7159368695210437561,16374582768754439342,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,15557335599325255211,11029455179848808353,524288 --field-trial-handle=2676,i,7159368695210437561,16374582768754439342,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:14
      4⤵
      PID:4220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\khczusmhfz.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:564
- - C:\Temp\khczusmhfz.exe
    C:\Temp\khczusmhfz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6096
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_khczusmhfz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4972
- - C:\Temp\i_khczusmhfz.exe
    C:\Temp\i_khczusmhfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wromgebwuo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3028
- - C:\Temp\wromgebwuo.exe
    C:\Temp\wromgebwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3160
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1568
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wromgebwuo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3392
- - C:\Temp\i_wromgebwuo.exe
    C:\Temp\i_wromgebwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqomjdbwto.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3888
- - C:\Temp\wqomjdbwto.exe
    C:\Temp\wqomjdbwto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5752
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3520
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqomjdbwto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1500
- - C:\Temp\i_wqomjdbwto.exe
    C:\Temp\i_wqomjdbwto.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbytqlgdbw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4760
- - C:\Temp\gbytqlgdbw.exe
    C:\Temp\gbytqlgdbw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5344
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbytqlgdbw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3896
- - C:\Temp\i_gbytqlgdbw.exe
    C:\Temp\i_gbytqlgdbw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbvtnlgd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5992
- - C:\Temp\ljdbvtnlgd.exe
    C:\Temp\ljdbvtnlgd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:476
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1780
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5356
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbvtnlgd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2608
- - C:\Temp\i_ljdbvtnlgd.exe
    C:\Temp\i_ljdbvtnlgd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\idaysqkida.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:804
- - C:\Temp\idaysqkida.exe
    C:\Temp\idaysqkida.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4488
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3960
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3292
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_idaysqkida.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5876
- - C:\Temp\i_idaysqkida.exe
    C:\Temp\i_idaysqkida.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkicausnkf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5744
- - C:\Temp\qkicausnkf.exe
    C:\Temp\qkicausnkf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5900
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2852
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkicausnkf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:236
- - C:\Temp\i_qkicausnkf.exe
    C:\Temp\i_qkicausnkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pfzxspkhcz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4212
- - C:\Temp\pfzxspkhcz.exe
    C:\Temp\pfzxspkhcz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2620
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3252
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pfzxspkhcz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6088
- - C:\Temp\i_pfzxspkhcz.exe
    C:\Temp\i_pfzxspkhcz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhezxrpjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5348
- - C:\Temp\pnhezxrpjh.exe
    C:\Temp\pnhezxrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4888
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:8
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhezxrpjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3696
- - C:\Temp\i_pnhezxrpjh.exe
    C:\Temp\i_pnhezxrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbzurmkec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6044
- - C:\Temp\jhbzurmkec.exe
    C:\Temp\jhbzurmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5296
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:984
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbzurmkec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5844
- - C:\Temp\i_jhbzurmkec.exe
    C:\Temp\i_jhbzurmkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgeywqojg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4992
- - C:\Temp\omgeywqojg.exe
    C:\Temp\omgeywqojg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3128
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4796
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgeywqojg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2964
- - C:\Temp\i_omgeywqojg.exe
    C:\Temp\i_omgeywqojg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywtoiyvt.exe ups_run
  2⤵
  PID:1524
- - C:\Temp\geywtoiyvt.exe
    C:\Temp\geywtoiyvt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2732
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4496
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywtoiyvt.exe ups_ins
  2⤵
  PID:3972
- - C:\Temp\i_geywtoiyvt.exe
    C:\Temp\i_geywtoiyvt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigaytqli.exe ups_run
  2⤵
  PID:5680
- - C:\Temp\qoigaytqli.exe
    C:\Temp\qoigaytqli.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5544
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4436
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigaytqli.exe ups_ins
  2⤵
  PID:2724
- - C:\Temp\i_qoigaytqli.exe
    C:\Temp\i_qoigaytqli.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oifaysqkig.exe ups_run
  2⤵
  PID:5664
- - C:\Temp\oifaysqkig.exe
    C:\Temp\oifaysqkig.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4552
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5696
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oifaysqkig.exe ups_ins
  2⤵
  PID:2764
- - C:\Temp\i_oifaysqkig.exe
    C:\Temp\i_oifaysqkig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqkicavs.exe ups_run
  2⤵
  PID:2164
- - C:\Temp\aysqkicavs.exe
    C:\Temp\aysqkicavs.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4704
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4216
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqkicavs.exe ups_ins
  2⤵
  PID:5244
- - C:\Temp\i_aysqkicavs.exe
    C:\Temp\i_aysqkicavs.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fcxvpmkfcx.exe ups_run
  2⤵
  PID:1972
- - C:\Temp\fcxvpmkfcx.exe
    C:\Temp\fcxvpmkfcx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1580
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3812
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fcxvpmkfcx.exe ups_ins
  2⤵
  PID:1036
- - C:\Temp\i_fcxvpmkfcx.exe
    C:\Temp\i_fcxvpmkfcx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpkhcwusmk.exe ups_run
  2⤵
  PID:3568
- - C:\Temp\rpkhcwusmk.exe
    C:\Temp\rpkhcwusmk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4640
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2800
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpkhcwusmk.exe ups_ins
  2⤵
  PID:3492
- - C:\Temp\i_rpkhcwusmk.exe
    C:\Temp\i_rpkhcwusmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezxrpjhbzu.exe ups_run
  2⤵
  PID:6072
- - C:\Temp\ezxrpjhbzu.exe
    C:\Temp\ezxrpjhbzu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5508
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3836
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3300
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezxrpjhbzu.exe ups_ins
  2⤵
  PID:1988
- - C:\Temp\i_ezxrpjhbzu.exe
    C:\Temp\i_ezxrpjhbzu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jeywromgey.exe ups_run
  2⤵
  PID:5732
- - C:\Temp\jeywromgey.exe
    C:\Temp\jeywromgey.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1284
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4944
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jeywromgey.exe ups_ins
  2⤵
  PID:4612
- - C:\Temp\i_jeywromgey.exe
    C:\Temp\i_jeywromgey.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5252

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1504

C:\Temp\bztrpjhezx.sys
C:\Temp\bztrpjhezx.sys
1⤵
- Executes dropped EXE
PID:236

C:\Temp\hezwromgez.sys
C:\Temp\hezwromgez.sys
1⤵
- Executes dropped EXE
PID:4196

C:\Temp\ljgbztrljd.sys
C:\Temp\ljgbztrljd.sys
1⤵
- Executes dropped EXE
PID:3396

C:\Temp\tqoigdbvtn.sys
C:\Temp\tqoigdbvtn.sys
1⤵
- Executes dropped EXE
PID:5604

C:\Temp\nlfdavpnif.sys
C:\Temp\nlfdavpnif.sys
1⤵
- Executes dropped EXE
PID:4196

C:\Temp\dankfcausn.sys
C:\Temp\dankfcausn.sys
1⤵
- Executes dropped EXE
PID:2116

C:\Temp\nkfcaxspnk.sys
C:\Temp\nkfcaxspnk.sys
1⤵
- Executes dropped EXE
PID:5292

C:\Temp\usmkecwusm.sys
C:\Temp\usmkecwusm.sys
1⤵
- Executes dropped EXE
PID:3568

C:\Temp\mjecwuomke.sys
C:\Temp\mjecwuomke.sys
1⤵
- Executes dropped EXE
PID:944

C:\Temp\tromhezwjg.sys
C:\Temp\tromhezwjg.sys
1⤵
- Executes dropped EXE
PID:4652

C:\Temp\romgeywroj.sys
C:\Temp\romgeywroj.sys
1⤵
PID:4736

C:\Temp\bytqljdbyt.sys
C:\Temp\bytqljdbyt.sys
1⤵
PID:5064

C:\Temp\gaysqnlfdy.sys
C:\Temp\gaysqnlfdy.sys
1⤵
PID:4264

C:\Temp\ifaysqkidx.sys
C:\Temp\ifaysqkidx.sys
1⤵
PID:4900

C:\Temp\sqkicausmk.sys
C:\Temp\sqkicausmk.sys
1⤵
PID:5732

C:\Temp\ausmkecxus.sys
C:\Temp\ausmkecxus.sys
1⤵
PID:4876

C:\Temp\jhezxupmhe.sys
C:\Temp\jhezxupmhe.sys
1⤵
PID:5412

C:\Temp\rpjhbztrmj.sys
C:\Temp\rpjhbztrmj.sys
1⤵
PID:1288

C:\Temp\mgeywqojgb.sys
C:\Temp\mgeywqojgb.sys
1⤵
PID:4512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrpjhezx.sys

Path C:\Temp\bztrpjhezx.sys
Size 141KB
SHA256 8e239af300dcad7546c0dbaadfc5cb24a143783b3d484f64bdaed9afe5f6a5e3
MD5 75f4b2a14b9714ff3f1de861685187e6
SHA1 8276535b4034a9fe3c3664b63718b32313cc4d11
SHA512 5d0c7afbd3d2e5b7374b0a4215abd787284183acd0d96f0ad4f4210e284bb7ca400d390857df8efca188ae035f9b7bffc90233103d973c4fc3244608c4bb612c
SSDEEP 1536:/a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:/a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T197E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytqlgdbw.exe

Path C:\Temp\gbytqlgdbw.exe
Size 243KB
SHA256 019ec362163c9b393e2d19129823b2eeb06a7086238a1cfeba7ce0fa4f93186b
MD5 38fbf9867cf6f621682c7c8b04d0a45e
SHA1 1014455e617f0f7db3d670d303ff3aa47372e1ae
SHA512 d735330e3d4d07749578fd92591ecdedf54a80d9659449c1d9d13f5f6b772d44eb163443e3e84ff75da92162bbad31cacdaeac2a3a768a9c3ed2ad8219312a24
SSDEEP 3072:AMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7e:qGii9IL8Xa3lLNngoqRttA7e
TLSH
T14F34490272818031E71A0B74046AE7A046BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hezwromgez.sys

Path C:\Temp\hezwromgez.sys
Size 141KB
SHA256 defb93a989bbd2ee90fd292a169e08b2827bb8bc905898ac3b6b4fd4b217e9c5
MD5 738a2f535a3accf8cd021be112a2fe30
SHA1 6fad9508e9595ebc91726995a483f515dd3fc1e0
SHA512 9d003933871e48058ad12878eaeebbc953cc6b5cb8b92614967c41a03f7db8017ac820d6e58204eb5f7ced21402d3bbcea335699cd2b4bc0da7cbf770d995be9
SSDEEP 1536:fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T12CE37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gbytqlgdbw.exe

Path C:\Temp\i_gbytqlgdbw.exe
Size 243KB
SHA256 20938e2322e4a39c74e8814ea4f08d9248f925281f53cad723c07ad858646a92
MD5 2355ba499970eace34639306461b9adc
SHA1 85b94ac19adbef0216ba2027366ea31a79ddb961
SHA512 6003fe1cb6779f0b5d1cf54b76dc3d61729722a1afb99eb56def022104b1d47c7c7bd3e14900b146536bf93d523e0816ae44c7230ef844f5285dde3e99d282fb
SSDEEP 3072:XMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7t:DGii9IL8Xa3lLNngoqRttA7t
TLSH
T1A534490272818031E71A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_khczusmhfz.exe

Path C:\Temp\i_khczusmhfz.exe
Size 243KB
SHA256 48eabec7a35125a7e190cf160cd564b86f5dcd76ff41e86614640ae2664a1856
MD5 1dafcbffd782d1c4af7f7d963309dd06
SHA1 2874838dd0097deb390855dcaacb3f7bbfbfe545
SHA512 b46ee9c3254418124ed64d725c433629a13c03dcd090e4739272155f53c02d503584057baff5aef8f14b6e050aaab3adf8efec2a5361eab7cd3518bceb4eca01
SSDEEP 3072:qMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Q:MGii9IL8Xa3lLNngoqRttA7Q
TLSH
T1E234490272818031E75A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljdbvtnlgd.exe

Path C:\Temp\i_ljdbvtnlgd.exe
Size 243KB
SHA256 bdba4339fd7521ebe3ac2a7a8c5e67f4d5f6c29c4156cbe6953648a29df77457
MD5 dc188aa64636cb97ad6cd0e6b79f998a
SHA1 f57e4a9ce2fb910b448a22ecfd395a4d12b72354
SHA512 f1128a3a7c1c34327738c34fb0116b53aeaa29fdcaf73c9f3be06f328d2057afe8e953deaa0de2583c1dee98ed6eaa659ead05a12ed499fb9b6b73a9e5d96fcf
SSDEEP 3072:rMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7t:PGii9IL8Xa3lLNngoqRttA7t
TLSH
T10634490272818031E71A0B78046AE7A046BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wqomjdbwto.exe

Path C:\Temp\i_wqomjdbwto.exe
Size 243KB
SHA256 30c0805fabe8b5bbab75c5b01a172b4aca5161de7528b8211587035b433572dd
MD5 62ab96c4ac93fda5846bada324293ba7
SHA1 d789ed49f1b386e06142898daff0fec03814aef2
SHA512 b6216b66b9a15e9a85410eb25559230d97bd8bd15884cbaa99323c88364cbfd9290810cf8401133bf611e2141a5cf0edaad939f4be30b720ae55b028ee2d7926
SSDEEP 3072:+MaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7E:YGii9IL8Xa3lLNngoqRttA7E
TLSH
T10934490272818031E71A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wromgebwuo.exe

Path C:\Temp\i_wromgebwuo.exe
Size 243KB
SHA256 74b4c7966dc28d8eb2f79cf5a6fc77b8f9b0a67538b2754ad5ed9ae0dd71c758
MD5 af84348a60b240998a8da2e3b68dd8d1
SHA1 d7d1d2d2a05e5387dae59effd9ed35c5c6ed24d4
SHA512 df90523d6c7dbf766a2ec4017bbbcffeea89861dce4ebddca0f61dc866fa05163e509c34b715bdf5fd7ea8b1e2721538d26976d3a6032a176f77ba2768c70ce9
SSDEEP 3072:MMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:eGii9IL8Xa3lLNngoqRttA7W
TLSH
T18334490272818031E75A0B78046AE7A046BE7D344FB5E58FF7683B795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idaysqkida.exe

Path C:\Temp\idaysqkida.exe
Size 243KB
SHA256 981237dcfa80fc8427bbffd27382861882b1dbaaeb7f2087b843d2ccc7b3a744
MD5 e1f9175eca424feb6f00d8dc0c9f49c7
SHA1 e2a582be4ec1888287234373189ab2204a8974c7
SHA512 7b59ec4af4b357c531748ab6bc457fba3141a64c90bdfc97d287fae7dbb9452dad49694814da11470182096ea87afddfdb830d9a08b5e268caf96dcf4941edbe
SSDEEP 3072:vMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA79:rGii9IL8Xa3lLNngoqRttA79
TLSH
T1CB34490272818031E75A0B74046AE7A046BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khczusmhfz.exe

Path C:\Temp\khczusmhfz.exe
Size 243KB
SHA256 43f6300e4f3c466798f8539175d92dcbf587f5c39d538b42bc9c30cffa1d4bca
MD5 5912dca60229397ef1ba60e7fb44c794
SHA1 831ce7fadebf271c0de4b7c5d9ab124132471a73
SHA512 3fba0dd0566f7f52195c8a56033ce9b58aa479c21de79f19d1402cdb4700eba0ff00dcd8eea750891e74a2f6cebf4dd8632758fd999587b604d8522576401605
SSDEEP 3072:zMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7d:HGii9IL8Xa3lLNngoqRttA7d
TLSH
T1FB34490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbvtnlgd.exe

Path C:\Temp\ljdbvtnlgd.exe
Size 243KB
SHA256 572cc2c303d6fc07078cdd16e4e0532c4d787ba3ca62507e35b4c3f5e394f5ff
MD5 ec93234849a0b02c342ac142adb45eba
SHA1 528b7b23e75718b2524c0dcb9f2e558d1afa496c
SHA512 05ada4133fbd9619f993a292508b15c45bfa4da26b3bd00e1f4c4a561e87e335721a969e1f9d909419ebaf4df92ccd554aec74b4e2eb1a46075b25a63279d7c0
SSDEEP 3072:CMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7I:0Gii9IL8Xa3lLNngoqRttA7I
TLSH
T1E834490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljgbztrljd.sys

Path C:\Temp\ljgbztrljd.sys
Size 141KB
SHA256 be79a67569b894c91b156054ef5a9649c0ef3b71dee817e09e005ca2ed5bf17f
MD5 b9926409cbe0984080326e036d1f4d40
SHA1 9df1a3f427caccb08fa4a3839eb3e22fe8c7d0d3
SHA512 38193c852cc490fe24a0e3de273874b5bde37fc216b195a84b7ace86018714987ea2eca262a1e6e09895d4a018b4d7e34405f467a34733f8ac894a355fea8a91
SSDEEP 1536:Ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T16DE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdavpnif.sys

Path C:\Temp\nlfdavpnif.sys
Size 141KB
SHA256 628ca374635b71b8806b9d3547bfdefec6e4771cfee0f792080e89b7ed196912
MD5 db233784838153317dbbc5bd8b446857
SHA1 37a409f8e7021b50a62cb3262cf2ccd0a90b558e
SHA512 625b9a1e90dac0e3b0d4c0a1a6c2b3445d96734970a5221bccc1115c5a91cd775f16d918ff8e83e9fb92674bfd78a38ec8811022eb698f0ceea41aebaf10b428
SSDEEP 1536:ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CEE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqoigdbvtn.sys

Path C:\Temp\tqoigdbvtn.sys
Size 141KB
SHA256 fd7f2a7f47e583ab682b9ec1974c75a7f898b3266c653003354b28aa8c5ca1f8
MD5 1db0554049b6ebdb927085ce1f01a4eb
SHA1 dfd7f1612cc00a1de39e0c2e35ebd35a9112eb55
SHA512 5491ff0c043a798c6f027d9f9bd4c934e3897ce33d412ba941240b2e56ba0af6a0249e612b14d611c7cf86f3066ac850d0c0e7f57251c0d5d000c7737c8c85bf
SSDEEP 1536:na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T159E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqomjdbwto.exe

Path C:\Temp\wqomjdbwto.exe
Size 243KB
SHA256 a153bd95ca48b68a42bf24a9d602b05168fe75e926bdfa49d699eabe2cb01910
MD5 e1290e036ef2aae5f23a769acf972b55
SHA1 876ff5a6f55e77e4bad4447373b35afcf4030641
SHA512 f2462e1492cc9654ab20e9fdb8c1d6d3ba007966b42c88205e5d30c5724382d44058f695af7d4cd14c7b8c52ce85d11cf143410f86cae9329fa592339c3e62b3
SSDEEP 3072:EMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7G:GGii9IL8Xa3lLNngoqRttA7G
TLSH
T1AB34490272818031E71A0B74046AE7A046BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wromgebwuo.exe

Path C:\Temp\wromgebwuo.exe
Size 243KB
SHA256 e8e3cd4e21bc68ed0db84066a0fabaa53142fed492f8148e94831c99dcaf9d73
MD5 706c8d9fa62bed6b1004d81f80a21dc6
SHA1 c618f3bceb5fda6906568b62c6607164d1435731
SHA512 c664bbbcc71464d87e3c182291d284d504793eabf3a15eb88f35fb5c0b5802457ab462d0f8841f8c798c7857b70201d76f02380f616e8d6ebe89257c934ab7a1
SSDEEP 3072:yMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7M:EGii9IL8Xa3lLNngoqRttA7M
TLSH
T18534490272818031E75A0B78046AE7A046BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2fd9384e79508a77111bb6310e9414898358885ca508610502ff6f1a15ad704f
MD5 714e68787bb5a6d2fd82139f833a5d0d
SHA1 f7a22adc92641d05515b3ae096da910924f11c1a
SHA512 b133f27abfa4ed5bdbd3eaf997e0664f0627537d4882fdaa63c0b1b301219d07f8ba46857db9a196b1210c29ed9f79e6cfd8c688d502b118a21640805665f762
TLSH
T16DD080F43795F605C786617357D0574173750872241647095051D01CCC645DD63DB1EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 233c07bfff48b5fbad30cd7d90579abd0886400017cd6e7fb037e5626abb1a4d
MD5 71fa6328268340b183c55defa643c474
SHA1 7c004defb21dc2981b3091495c900e02b34e3a86
SHA512 e5b634d358633981cd343c3da26ee18738fb6c54b2334814637e0a9a45343d14770fed7a09c63d55dd190bf7ef111664ba5872f5d5ce925e6bee783e166c75b7
TLSH
T1D4D080F437A5F505C786617357D0574173650872101647095151D02CCC645DD63DB1DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 223ccdbab442dc2b4c2b8c115e2c5c6b6a552141cf5e530075f16d4b4013f97a
MD5 5602a34eddff812361274f716028a744
SHA1 9db4312a4e5764b1c0f07bcb7560731b2076354e
SHA512 8a7bc1ee5992590c692e173b010bc57eb5781a59879b1d6a401e8a948974a5f3511aaea053a05bd3e948a8779aa1adc98f51d2a006db2bf3f01f468e35511110
TLSH
T1606131E8E8D13B2EEBE70CB74AD724D97732C4B207076D07685A8F78945A71660610B2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5968f1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5968f1.TMP
Size 3KB
SHA256 a71412914f1c902cc85f7f15a15482785324b35a6b78275d65429049d26d44a8
MD5 0faa0e3145d220cd12f142c97d976550
SHA1 31fdb203cfc7f3371ae5df352e93efe5a03063e7
SHA512 6776e40bad2bca75a0b84b6f0c0966368cebb9741957ca82a3113d18f3d4621046d304582221c33082ef3fb95034fddcd9b894affce860a8cd178a7f6f992b48
TLSH
T1806140D9E8D13B2EEBE70CF74AD724D97732C4B207076D076C5A8F78945A71660610B2
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d297dc0878afd08add83d606631df01210ffa9fbb90d96b16fd8af5ab1225735
MD5 fd1ac95cc476e1a92c7f18ceb5933195
SHA1 b38921079e1094fddb1af8b96bf62d2b14f71d0b
SHA512 dc7cb33d8fb0892b7422fdf5282472d7cdfc743d000578040f40618c0c91db04f69eb4e332924f0febba99ac3efff38494747efa188ce2f38dce68cdc9f5d5d5
TLSH
T16251CCF7C3E8853E8A1146F0BB186E2BCE2D0914832C3D5AC9E4AF1B93E2471E14195E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 05c9188aabe5f8a67c248cdd193640546f276a8b7e36ca94b52d9d01ee4ee641
MD5 d14f7936f17e0daa158eab5e3a91738f
SHA1 f426a08b7b001afa115ad590190bf957775ec6c2
SHA512 824ec17308a01dcf81ca1dd12391be55420ed98a968a97843c91229bfcfd30281bc92f57f966e9b80f2ccc777aa7e38551a9f9c870d88ae2c3bbba13697cd0fa
SSDEEP 192:sxRFRsyM/jK1Ml8wcT/f3ssGMEqZwozoA8pi/g6+WNIYyBJrG8IgtJ:sxRFCCT/f3svf8Si/5IFV3
TLSH
T18352EB156A34993B8CDBD209FA557F53D6F81573A2901E48AAFCCA0C01E76DD621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 db00741298576694e6889dad8140bb1ff65ee404a63407d18e7b156c9f3fd683
MD5 aee500eda45009bcccb06656bf91e056
SHA1 5e7d3fe6592334888ea72c787ba7f238b61f8d91
SHA512 5b6275441d55bf47f59ff516267201501cc1d30b45ae0a97af539811d349be456260411d825a7a10448f7f34120949a902b539a4b7e61b256e5afe802efa4ce1
SSDEEP 192:sxRWRsyM/jK1Ml8wcT/f3slGMEqZwozoA8pi/g6+WNIYyBJrG8IgDBJ:sxRWCCT/f3s4f8Si/5IFVX
TLSH
T1B852EB15AA349D3B8CDBD209FA557F53D6F81573A2901E48A9FCCA0C01E76DD621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f8c1c5aeae26a9e641d722aa7e17890c8ae37aae5161878ecbbb516713988b61
MD5 434cf27e81ffe32581e86d2f321cc200
SHA1 217f30b7333c922b73023127a5f8632b3da41803
SHA512 250e7dcc915dcedbbdfd2c04e4793c629038f0bc73e85743dc48c57176a18842b53c4d91cdbc1354055dc87f6d9d6fd815eec33ac08b3d7d27b4fbc71dec2778
SSDEEP 192:sxRWRsyM/jK1Ml8UQQcT/f3slGMPqZwszoA8pr5/g6+WNIYy2JrG8IgDzJ:sxRWCqvT/f3s4s8Kt/5IOVx
TLSH
T10462DB16AA349D3B8CDBD20DFA517F53D6F8157292901E48AAFCCA0C01E76DD621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 aff5de53a1c9f6ff61fd07aeb2c559384880dd272e38d76d8ac4cbbb2983c284
MD5 3425cc4f7f46d2512d567ef2bebe1116
SHA1 6d6840478ef9bfc716e96b8c53aa69a8cf7434d2
SHA512 440000ae0e3e34849455207cfaade3a2c1e0ac63e75f2142cfe3f6b35ae7f2220236b66ba02b32bbbd5972ae77cfc99276881aa1e822f9013011f364dacfae3a
SSDEEP 768:AIox/O7pLuL7p0WguMfnA8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4lfcci8ro5WlDF:AIox/OE7p0WguMfnAu1javlfXin5Wj
TLSH
T15EE2EB3B680CCB7E4F80499CEC29BE8A6DE801CF96D8CD5447FA851C03C66EB551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 b98413add64435760760dfbfa5cefa0aebd73e843e9b31b0f0131d36a1fe851b
MD5 a0c8b27e12f7c161f933d3c8cf790b68
SHA1 df11422cff6c9c56b97bfa5c22f5de668603c92e
SHA512 f32cc1b785cd959b2993554a4e20f151fb02aab8594d8a687b6f588ffb1d1ea34bdd89f67e2a6a823861c767a485c5da958939dbbaa342b443b2fac1fe70a1f7
SSDEEP 96:K0AgKluqi4AKV+WaYKHq2OxWKisf/oNJo:qbL6z5O/oNJo
TLSH
T13BB10584797F1B803D3D650982B9E42B528130A230DEA4AB7FA950E65F67F405FFC6C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7056463f-1ee5-4511-a86a-2f7b590f7f7d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7056463f-1ee5-4511-a86a-2f7b590f7f7d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 26387d6c2a3ad8e2487ae3b5e913c9ede6ac16b711e8c6c004c142dd0b42be79
MD5 d11bf42cf3ddb5b860286583457539ff
SHA1 4616eedbe0b68845992f15cdaa4abd90e81fcae2
SHA512 97c0d76c6d09589a6821e0f3c12a19eb08e028e1d59a6914aa62f3a785d053712f9b9b1f66eb9896d716bc304bdf39592390953ec3b143f27cb09bd8159f0679
SSDEEP 768:oj+9N3ESFU6QOJI9QPSy/hUAFjQIMyOV3N5E9E8b9Mi:39N3TLhNFUIpONNm1b+i
TLSH
T1E1F2AD31A8A6DEA24CA7E3C5771A3293BFF411BB45850D44DAEEAF0D028729D0757826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ca66c5f3b9b60ace0f2151023880ed903019a4ea776e3da51cbb250e2442f7cc
MD5 5f22f3172dff1af3e30c3b14e3043fc1
SHA1 51dcd2317fae409e82e9d96f22184355adcb864b
SHA512 06e567d4ed7d9c79eed1fa436e4ef5907e55653950514728984f198e165088792a52a9774405ac38d0b4e0c5dab667ec0144b1c8c494e0c345a249a83187dd46
SSDEEP 768:9rv+4UNbdF35cbQOJI9QF/hUAFjQIMyOV3N5E9MK5+8r0mL:9bsbf3KRhNFUIpONNmNDrv
TLSH
T14903BF31E8A4DAB39CE7A7C5760A72437FF4416355C50784C9EE6B0D824B1DE231BC62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7acf86fa6330276478407c0aba0cc97cddbf97671e6c52c0a27457a18b3e9118
MD5 f521214b2194bfc2e66a3cde412cd9d2
SHA1 26c2f01d4eaa3b5c737bc5f900718ae26b2cca8a
SHA512 032e136d1b3f3af5a69771aa29c55aeceb93c4922bdcbfc5c3e4fd5abfb6eaf75be10fba4ec7f36eb0fb3fbb47f89bc4d446cfe380fd51f71b25daee2e253bb9
SSDEEP 768:tj+9N3BSa6QOJI9QPSy/hUAFjQIMyOV3N5E9E8b9Mi:I9N3oLhNFUIpONNm1b+i
TLSH
T176F2AD31B8A6DEA24CA7A3C5771A3293BFF411BB45850D44DAEEAF0D028729D0757C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 06e75cb9a668d77ec7a2b4e27dac09a3be3414e31cf52d3c7d6c3997cd8e6187
MD5 5c63acccf6759fc51b86b2f7ab8742b4
SHA1 2af8efead77c531dac654e143dd9201bdd07aced
SHA512 b2d7eeb22454343603066dc0ffe0212a673dd4e23b26b325faedffc2069a0c86689613851831b77389af9dab4179d6b816c2aebcac60b2da1396e28e06567a99
SSDEEP 768:OF1j+9s3pwgmSFUTrOJI9QPSB/hUAFjQIMyOV3N5E9E8b9Mi:r9s3DehNFUIpONNm1b+i
TLSH
T1AE038D36E895CFAB9CE797C5B7197287AEE001B785C95CC4DADE9E0801872DE0347C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir632_750272923\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-191-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/944-342-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1288-454-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2116-319-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3396-266-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3568-338-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4196-310-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4196-238-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4264-401-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4512-474-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4652-381-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4652-367-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4736-379-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4876-431-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4900-421-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4900-427-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5064-393-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5292-323-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5412-442-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5604-316-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5604-278-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5732-425-0x0000000000010000-0x0000000000083000-memory.dmp

Download