152635705f9b7990906a4b0c46a73a758a06e59fcb17c195db2cd6abb9587b2d

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_d017fa53a0583d84bba5d7faac610db3_elex_rhadamanthys_stop.exe
Size 243KB
Sample260708-vbqzmscx4m
SHA256 152635705f9b7990906a4b0c46a73a758a06e59fcb17c195db2cd6abb9587b2d
MD5 d017fa53a0583d84bba5d7faac610db3
SHA1 15ce17f0d56f8ba2d55077dffd23322ecc8ca1db
SHA512 6a51d7798cd20589791f0eb14fc369cd82952841eb56280c1905a2017e40f564949db9556eab4305d5489d1e545cdeea6c3b6b8152e968ca1a350905fdf9268e
SSDEEP 3072:LkruwzLLCJhj7yxa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7p:AruiLSWa3lLNngoqRttA7p
TLSH
T118345A0172818072E71A0B78045AE7A1467E7C394BA5D5CFFB683F7A1A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
6024	CP.exe
4412	ywqoigbywq.exe
2376	CP.exe
4092	CP.exe
4832	i_ywqoigbywq.exe
5020	wogdywqoig.sys
4308	CP.exe
3156	ywqoidbvtn.exe
2408	CP.exe
4688	CP.exe
5408	i_ywqoidbvtn.exe
3372	qljdaytqlj.sys
2200	CP.exe
688	igaytqlida.exe
6060	CP.exe
5060	CP.exe
4680	i_igaytqlida.exe
2556	ifaysqkida.sys
2868	CP.exe
3216	avsnlfdxvp.exe
1084	CP.exe
3008	CP.exe
4408	i_avsnlfdxvp.exe
2396	nkfdxvpnif.sys
956	CP.exe
628	axspnhfaxs.exe
5796	CP.exe
4968	CP.exe
1576	i_axspnhfaxs.exe
3336	dxvpfzxrpk.sys
200	CP.exe
5908	hecxupmhcz.exe
2588	CP.exe
5948	CP.exe
2556	i_hecxupmhcz.exe
256	fzxrpkhczu.sys
5548	CP.exe
784	jhecwuomke.exe
2436	CP.exe
4580	CP.exe
6092	i_jhecwuomke.exe
2536	khbzurmkec.sys
1120	CP.exe
4560	ztrmjebwuo.exe
2304	CP.exe
5884	CP.exe
2976	i_ztrmjebwuo.exe
2368	romgeywroj.sys
4824	CP.exe
4536	mjebwuomge.exe
2372	CP.exe
4156	CP.exe
3048	i_mjebwuomge.exe
4428	vtnlgdywqo.sys
3844	CP.exe
1484	olgeywqoig.exe
2332	CP.exe
1760	CP.exe
6044	i_olgeywqoig.exe
4808	ljdbytqljd.sys
3244	CP.exe
6076	sqlidbvtnl.exe
3200	CP.exe
2172	CP.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3300_1760548781\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3300_689925847\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3300_689925847\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqoidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhecwuomke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjebwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqlidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljeywu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbztrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqoigaysqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsnlfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hecxupmhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrmjebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hecwupmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhecwuomke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrmjebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljeywu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqoigaysqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hecxupmhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgeywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqnigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspkicaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxupnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_d017fa53a0583d84bba5d7faac610db3_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqoidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspkicaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbztrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqoigbywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axspnhfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjebwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqnigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaytqlida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsnlfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axspnhfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgeywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hecwupmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqoigbywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaytqlida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqlidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxupnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjebwuomge.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1172	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3044	ipconfig.exe
3744	ipconfig.exe
4580	ipconfig.exe
5520	ipconfig.exe
2744	ipconfig.exe
3748	ipconfig.exe
4788	ipconfig.exe
940	ipconfig.exe
3784	ipconfig.exe
5856	ipconfig.exe
3364	ipconfig.exe
5380	ipconfig.exe
4208	ipconfig.exe
1884	ipconfig.exe
2848	ipconfig.exe
5052	ipconfig.exe
4908	ipconfig.exe
1168	ipconfig.exe
3944	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280029611031063"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2699128254-3633964024-152949075-1000\{2662CD84-C241-49C3-AF89-38930C3704E6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5340	msedge.exe
5340	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
840	Process not Found
840	Process not Found
840	Process not Found
840	Process not Found
840	Process not Found
840	Process not Found
840	Process not Found
840	Process not Found
840	Process not Found
840	Process not Found
840	Process not Found
840	Process not Found
840	Process not Found
840	Process not Found
840	Process not Found
840	Process not Found
840	Process not Found
840	Process not Found
840	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4832	i_ywqoigbywq.exe
Token: SeDebugPrivilege	5408	i_ywqoidbvtn.exe
Token: SeDebugPrivilege	4680	i_igaytqlida.exe
Token: SeDebugPrivilege	4408	i_avsnlfdxvp.exe
Token: SeDebugPrivilege	1576	i_axspnhfaxs.exe
Token: SeDebugPrivilege	2556	i_hecxupmhcz.exe
Token: SeDebugPrivilege	6092	i_jhecwuomke.exe
Token: SeDebugPrivilege	2976	i_ztrmjebwuo.exe
Token: SeDebugPrivilege	3048	i_mjebwuomge.exe
Token: SeDebugPrivilege	6044	i_olgeywqoig.exe
Token: SeDebugPrivilege	3540	i_sqlidbvtnl.exe
Token: SeDebugPrivilege	2672	i_yvqnigaysq.exe
Token: SeDebugPrivilege	2392	i_xspkicaxsq.exe
Token: SeDebugPrivilege	2460	i_fzxupnhfzx.exe
Token: SeDebugPrivilege	4224	i_hecwupmhfz.exe
Token: SeDebugPrivilege	5860	i_mjebwuomge.exe
Token: SeDebugPrivilege	1296	i_bztrljeywu.exe
Token: SeDebugPrivilege	3940	i_jgbztrljdb.exe
Token: SeDebugPrivilege	2612	i_sqoigaysqo.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3300	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 3204	3192	2026-07-08_d017fa53a0583d84bba5d7faac610db3_elex_rhadamanthys_stop.exe	88
PID 3204 wrote to memory of 3300	3204	iexplore.exe	89
PID 3300 wrote to memory of 3052	3300	msedge.exe	90
PID 3300 wrote to memory of 3056	3300	msedge.exe	91
PID 3300 wrote to memory of 1172	3300	msedge.exe	92
PID 3300 wrote to memory of 3056	3300	msedge.exe	91
PID 3300 wrote to memory of 3056	3300	msedge.exe	91
PID 3300 wrote to memory of 3196	3300	msedge.exe	93
PID 3300 wrote to memory of 3196	3300	msedge.exe	93
PID 3300 wrote to memory of 5828	3300	msedge.exe	96
PID 3300 wrote to memory of 6044	3300	msedge.exe	95
PID 3300 wrote to memory of 5828	3300	msedge.exe	96
PID 3300 wrote to memory of 5828	3300	msedge.exe	96
PID 3300 wrote to memory of 6044	3300	msedge.exe	95
PID 3300 wrote to memory of 6044	3300	msedge.exe	95
PID 3300 wrote to memory of 5200	3300	msedge.exe	97
PID 3300 wrote to memory of 5200	3300	msedge.exe	97
PID 3300 wrote to memory of 5200	3300	msedge.exe	97
PID 3300 wrote to memory of 4320	3300	msedge.exe	98
PID 3300 wrote to memory of 4320	3300	msedge.exe	98
PID 3300 wrote to memory of 4320	3300	msedge.exe	98
PID 3300 wrote to memory of 4688	3300	msedge.exe	99
PID 3300 wrote to memory of 4688	3300	msedge.exe	99
PID 3192 wrote to memory of 6024	3192	2026-07-08_d017fa53a0583d84bba5d7faac610db3_elex_rhadamanthys_stop.exe	101
PID 4412 wrote to memory of 2376	4412	ywqoigbywq.exe	104
PID 3300 wrote to memory of 5780	3300	msedge.exe	107
PID 3300 wrote to memory of 3944	3300	msedge.exe	108
PID 3300 wrote to memory of 5780	3300	msedge.exe	107
PID 3300 wrote to memory of 3944	3300	msedge.exe	108
PID 3300 wrote to memory of 2648	3300	msedge.exe	110
PID 3300 wrote to memory of 3892	3300	msedge.exe	111
PID 3300 wrote to memory of 3892	3300	msedge.exe	111
PID 3300 wrote to memory of 1084	3300	msedge.exe	112
PID 3300 wrote to memory of 1084	3300	msedge.exe	112
PID 3192 wrote to memory of 4092	3192	2026-07-08_d017fa53a0583d84bba5d7faac610db3_elex_rhadamanthys_stop.exe	113
PID 3192 wrote to memory of 4308	3192	2026-07-08_d017fa53a0583d84bba5d7faac610db3_elex_rhadamanthys_stop.exe	119
PID 3156 wrote to memory of 2408	3156	ywqoidbvtn.exe	121
PID 3192 wrote to memory of 4688	3192	2026-07-08_d017fa53a0583d84bba5d7faac610db3_elex_rhadamanthys_stop.exe	124
PID 3192 wrote to memory of 2200	3192	2026-07-08_d017fa53a0583d84bba5d7faac610db3_elex_rhadamanthys_stop.exe	128
PID 688 wrote to memory of 6060	688	igaytqlida.exe	130
PID 3192 wrote to memory of 5060	3192	2026-07-08_d017fa53a0583d84bba5d7faac610db3_elex_rhadamanthys_stop.exe	133
PID 3300 wrote to memory of 5352	3300	msedge.exe	137
PID 3300 wrote to memory of 5352	3300	msedge.exe	137
PID 3300 wrote to memory of 5352	3300	msedge.exe	137
PID 3300 wrote to memory of 2716	3300	msedge.exe	138
PID 3300 wrote to memory of 2716	3300	msedge.exe	138
PID 3300 wrote to memory of 2716	3300	msedge.exe	138
PID 3192 wrote to memory of 2868	3192	2026-07-08_d017fa53a0583d84bba5d7faac610db3_elex_rhadamanthys_stop.exe	139
PID 3216 wrote to memory of 1084	3216	avsnlfdxvp.exe	141
PID 3192 wrote to memory of 3008	3192	2026-07-08_d017fa53a0583d84bba5d7faac610db3_elex_rhadamanthys_stop.exe	144
PID 3300 wrote to memory of 2856	3300	msedge.exe	147
PID 3300 wrote to memory of 2340	3300	msedge.exe	148
PID 3300 wrote to memory of 3544	3300	msedge.exe	149
PID 3192 wrote to memory of 956	3192	2026-07-08_d017fa53a0583d84bba5d7faac610db3_elex_rhadamanthys_stop.exe	152
PID 628 wrote to memory of 5796	628	axspnhfaxs.exe	154
PID 3192 wrote to memory of 4968	3192	2026-07-08_d017fa53a0583d84bba5d7faac610db3_elex_rhadamanthys_stop.exe	157
PID 3192 wrote to memory of 200	3192	2026-07-08_d017fa53a0583d84bba5d7faac610db3_elex_rhadamanthys_stop.exe	161
PID 5908 wrote to memory of 2588	5908	hecxupmhcz.exe	163
PID 3192 wrote to memory of 5948	3192	2026-07-08_d017fa53a0583d84bba5d7faac610db3_elex_rhadamanthys_stop.exe	166
PID 3192 wrote to memory of 5548	3192	2026-07-08_d017fa53a0583d84bba5d7faac610db3_elex_rhadamanthys_stop.exe	170
PID 784 wrote to memory of 2436	784	jhecwuomke.exe	172
PID 3192 wrote to memory of 4580	3192	2026-07-08_d017fa53a0583d84bba5d7faac610db3_elex_rhadamanthys_stop.exe	175
PID 3192 wrote to memory of 1120	3192	2026-07-08_d017fa53a0583d84bba5d7faac610db3_elex_rhadamanthys_stop.exe	179
PID 4560 wrote to memory of 2304	4560	ztrmjebwuo.exe	181

C:\Users\Admin\AppData\Local\Temp\2026-07-08_d017fa53a0583d84bba5d7faac610db3_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_d017fa53a0583d84bba5d7faac610db3_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffbc964c188,0x7ffbc964c194,0x7ffbc964c1a0
      4⤵
      PID:3052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,3583881631270748936,2829003672350133484,262144 --field-trial-handle=2272,i,11685906118293010629,1027730444555743753,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
      4⤵
      PID:3056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1832,i,14401714749415212460,17351711135999795454,524288 --field-trial-handle=2272,i,11685906118293010629,1027730444555743753,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:11
      4⤵
      System Time Discovery
      PID:1172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2556,i,17420154921410862677,5755502491432255772,524288 --field-trial-handle=2272,i,11685906118293010629,1027730444555743753,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:13
      4⤵
      PID:3196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3616,i,16260948609625506615,4502075362753238570,2097152 --field-trial-handle=2272,i,11685906118293010629,1027730444555743753,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:6044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3632,i,14852479126261802090,12989421716002914288,2097152 --field-trial-handle=2272,i,11685906118293010629,1027730444555743753,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:5828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,3707929529157080866,10070287577328471306,2097152 --field-trial-handle=2272,i,11685906118293010629,1027730444555743753,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:1
      4⤵
      PID:5200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,3618382353244139849,13269473087276072911,2097152 --field-trial-handle=2272,i,11685906118293010629,1027730444555743753,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:9
      4⤵
      PID:4320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5396,i,9221090327012499201,10601179260807804966,524288 --field-trial-handle=2272,i,11685906118293010629,1027730444555743753,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:14
      4⤵
      PID:4688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5552,i,9287927224338313434,13799786887083757719,524288 --field-trial-handle=2272,i,11685906118293010629,1027730444555743753,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
      4⤵
      PID:5780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5544,i,9023577664763661267,5575976810139944775,524288 --field-trial-handle=2272,i,11685906118293010629,1027730444555743753,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:14
      4⤵
      PID:3944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5956,i,8616259305095711004,11331051599729413841,524288 --field-trial-handle=2272,i,11685906118293010629,1027730444555743753,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
      4⤵
      PID:5856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5956,i,8616259305095711004,11331051599729413841,524288 --field-trial-handle=2272,i,11685906118293010629,1027730444555743753,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
      4⤵
      PID:2648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6276,i,1663460694306748911,16995155107579848597,524288 --field-trial-handle=2272,i,11685906118293010629,1027730444555743753,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:3892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6280,i,14756477785260583490,859407790646293104,524288 --field-trial-handle=2272,i,11685906118293010629,1027730444555743753,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
      4⤵
      PID:1084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6036,i,9273444824904476524,14921954170179538635,2097152 --field-trial-handle=2272,i,11685906118293010629,1027730444555743753,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:1
      4⤵
      PID:5352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3732,i,10134792305395743914,16117118228993943461,2097152 --field-trial-handle=2272,i,11685906118293010629,1027730444555743753,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
      4⤵
      PID:2716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5292,i,6685760427449800640,1814831517615592983,524288 --field-trial-handle=2272,i,11685906118293010629,1027730444555743753,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
      4⤵
      PID:2856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5176,i,12404125974890849796,2827549989291937120,524288 --field-trial-handle=2272,i,11685906118293010629,1027730444555743753,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
      4⤵
      PID:2340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5152,i,11016093925138238608,13106293675587273352,524288 --field-trial-handle=2272,i,11685906118293010629,1027730444555743753,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:14
      4⤵
      PID:3544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5544,i,8575614983811837243,1229695814492077061,524288 --field-trial-handle=2272,i,11685906118293010629,1027730444555743753,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:14
      4⤵
      PID:5420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6092,i,6449619465820960080,7320209508305546674,2097152 --field-trial-handle=2272,i,11685906118293010629,1027730444555743753,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:4352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3896,i,2455985732497856644,13462478426128162643,524288 --field-trial-handle=2272,i,11685906118293010629,1027730444555743753,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:14
      4⤵
      PID:268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=3832,i,2861563412504669331,18200347929634486809,2097152 --field-trial-handle=2272,i,11685906118293010629,1027730444555743753,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:1
      4⤵
      PID:4456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6000,i,2512830976669746464,17488907435387926270,262144 --field-trial-handle=2272,i,11685906118293010629,1027730444555743753,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5132,i,16510727066719170964,14552208999500647252,2097152 --field-trial-handle=2272,i,11685906118293010629,1027730444555743753,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:1
      4⤵
      PID:2640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5136,i,4499967951745200602,5555967761735551384,524288 --field-trial-handle=2272,i,11685906118293010629,1027730444555743753,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
      4⤵
      PID:4552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqoigbywq.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6024
- - C:\Temp\ywqoigbywq.exe
    C:\Temp\ywqoigbywq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4412
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2376
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqoigbywq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4092
- - C:\Temp\i_ywqoigbywq.exe
    C:\Temp\i_ywqoigbywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqoidbvtn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4308
- - C:\Temp\ywqoidbvtn.exe
    C:\Temp\ywqoidbvtn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3156
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2408
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqoidbvtn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4688
- - C:\Temp\i_ywqoidbvtn.exe
    C:\Temp\i_ywqoidbvtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaytqlida.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2200
- - C:\Temp\igaytqlida.exe
    C:\Temp\igaytqlida.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:688
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6060
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaytqlida.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5060
- - C:\Temp\i_igaytqlida.exe
    C:\Temp\i_igaytqlida.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avsnlfdxvp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2868
- - C:\Temp\avsnlfdxvp.exe
    C:\Temp\avsnlfdxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3216
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1084
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avsnlfdxvp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3008
- - C:\Temp\i_avsnlfdxvp.exe
    C:\Temp\i_avsnlfdxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axspnhfaxs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:956
- - C:\Temp\axspnhfaxs.exe
    C:\Temp\axspnhfaxs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:628
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5796
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5520
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axspnhfaxs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4968
- - C:\Temp\i_axspnhfaxs.exe
    C:\Temp\i_axspnhfaxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hecxupmhcz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:200
- - C:\Temp\hecxupmhcz.exe
    C:\Temp\hecxupmhcz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5908
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2588
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hecxupmhcz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5948
- - C:\Temp\i_hecxupmhcz.exe
    C:\Temp\i_hecxupmhcz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhecwuomke.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5548
- - C:\Temp\jhecwuomke.exe
    C:\Temp\jhecwuomke.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:784
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2436
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhecwuomke.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4580
- - C:\Temp\i_jhecwuomke.exe
    C:\Temp\i_jhecwuomke.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrmjebwuo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1120
- - C:\Temp\ztrmjebwuo.exe
    C:\Temp\ztrmjebwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4560
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2304
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrmjebwuo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5884
- - C:\Temp\i_ztrmjebwuo.exe
    C:\Temp\i_ztrmjebwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjebwuomge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4824
- - C:\Temp\mjebwuomge.exe
    C:\Temp\mjebwuomge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4536
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2372
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4208
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjebwuomge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4156
- - C:\Temp\i_mjebwuomge.exe
    C:\Temp\i_mjebwuomge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\olgeywqoig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3844
- - C:\Temp\olgeywqoig.exe
    C:\Temp\olgeywqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1484
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2332
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_olgeywqoig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1760
- - C:\Temp\i_olgeywqoig.exe
    C:\Temp\i_olgeywqoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqlidbvtnl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3244
- - C:\Temp\sqlidbvtnl.exe
    C:\Temp\sqlidbvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6076
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3200
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqlidbvtnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2172
- - C:\Temp\i_sqlidbvtnl.exe
    C:\Temp\i_sqlidbvtnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\yvqnigaysq.exe ups_run
  2⤵
  PID:3608
- - C:\Temp\yvqnigaysq.exe
    C:\Temp\yvqnigaysq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4664
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1196
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_yvqnigaysq.exe ups_ins
  2⤵
  PID:2552
- - C:\Temp\i_yvqnigaysq.exe
    C:\Temp\i_yvqnigaysq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xspkicaxsq.exe ups_run
  2⤵
  PID:3520
- - C:\Temp\xspkicaxsq.exe
    C:\Temp\xspkicaxsq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4304
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5352
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xspkicaxsq.exe ups_ins
  2⤵
  PID:1864
- - C:\Temp\i_xspkicaxsq.exe
    C:\Temp\i_xspkicaxsq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2392
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxupnhfzx.exe ups_run
  2⤵
  PID:5820
- - C:\Temp\fzxupnhfzx.exe
    C:\Temp\fzxupnhfzx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3544
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1444
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxupnhfzx.exe ups_ins
  2⤵
  PID:4748
- - C:\Temp\i_fzxupnhfzx.exe
    C:\Temp\i_fzxupnhfzx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hecwupmhfz.exe ups_run
  2⤵
  PID:1340
- - C:\Temp\hecwupmhfz.exe
    C:\Temp\hecwupmhfz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5440
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5024
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hecwupmhfz.exe ups_ins
  2⤵
  PID:1860
- - C:\Temp\i_hecwupmhfz.exe
    C:\Temp\i_hecwupmhfz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4224
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjebwuomge.exe ups_run
  2⤵
  PID:4192
- - C:\Temp\mjebwuomge.exe
    C:\Temp\mjebwuomge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2556
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2908
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjebwuomge.exe ups_ins
  2⤵
  PID:5516
- - C:\Temp\i_mjebwuomge.exe
    C:\Temp\i_mjebwuomge.exe ups_ins
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrljeywu.exe ups_run
  2⤵
  PID:2984
- - C:\Temp\bztrljeywu.exe
    C:\Temp\bztrljeywu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5344
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4800
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrljeywu.exe ups_ins
  2⤵
  PID:3620
- - C:\Temp\i_bztrljeywu.exe
    C:\Temp\i_bztrljeywu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgbztrljdb.exe ups_run
  2⤵
  PID:3448
- - C:\Temp\jgbztrljdb.exe
    C:\Temp\jgbztrljdb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4452
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:108
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgbztrljdb.exe ups_ins
  2⤵
  PID:5856
- - C:\Temp\i_jgbztrljdb.exe
    C:\Temp\i_jgbztrljdb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqoigaysqo.exe ups_run
  2⤵
  PID:4980
- - C:\Temp\sqoigaysqo.exe
    C:\Temp\sqoigaysqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4756
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5224
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqoigaysqo.exe ups_ins
  2⤵
  PID:1424
- - C:\Temp\i_sqoigaysqo.exe
    C:\Temp\i_sqoigaysqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2612

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1796

C:\Temp\wogdywqoig.sys
C:\Temp\wogdywqoig.sys
1⤵
- Executes dropped EXE
PID:5020

C:\Temp\qljdaytqlj.sys
C:\Temp\qljdaytqlj.sys
1⤵
- Executes dropped EXE
PID:3372

C:\Temp\ifaysqkida.sys
C:\Temp\ifaysqkida.sys
1⤵
- Executes dropped EXE
PID:2556

C:\Temp\nkfdxvpnif.sys
C:\Temp\nkfdxvpnif.sys
1⤵
- Executes dropped EXE
PID:2396

C:\Temp\dxvpfzxrpk.sys
C:\Temp\dxvpfzxrpk.sys
1⤵
- Executes dropped EXE
PID:3336

C:\Temp\fzxrpkhczu.sys
C:\Temp\fzxrpkhczu.sys
1⤵
- Executes dropped EXE
PID:256

C:\Temp\khbzurmkec.sys
C:\Temp\khbzurmkec.sys
1⤵
- Executes dropped EXE
PID:2536

C:\Temp\romgeywroj.sys
C:\Temp\romgeywroj.sys
1⤵
- Executes dropped EXE
PID:2368

C:\Temp\vtnlgdywqo.sys
C:\Temp\vtnlgdywqo.sys
1⤵
- Executes dropped EXE
PID:4428

C:\Temp\ljdbytqljd.sys
C:\Temp\ljdbytqljd.sys
1⤵
- Executes dropped EXE
PID:4808

C:\Temp\igaysqlida.sys
C:\Temp\igaysqlida.sys
1⤵
PID:2632

C:\Temp\ifaysqkica.sys
C:\Temp\ifaysqkica.sys
1⤵
PID:244

C:\Temp\pkhcausmke.sys
C:\Temp\pkhcausmke.sys
1⤵
PID:3620

C:\Temp\cxuhfzxrpj.sys
C:\Temp\cxuhfzxrpj.sys
1⤵
PID:5288

C:\Temp\bzurmkecwu.sys
C:\Temp\bzurmkecwu.sys
1⤵
PID:4508

C:\Temp\mgezwrpjgb.sys
C:\Temp\mgezwrpjgb.sys
1⤵
PID:4808

C:\Temp\tqojgbztrl.sys
C:\Temp\tqojgbztrl.sys
1⤵
PID:5568

C:\Temp\bvtnlgdywq.sys
C:\Temp\bvtnlgdywq.sys
1⤵
PID:2656

C:\Temp\fdaytqlida.sys
C:\Temp\fdaytqlida.sys
1⤵
PID:1368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avsnlfdxvp.exe

Path C:\Temp\avsnlfdxvp.exe
Size 243KB
SHA256 be044f520b3fc4d233be9fe385e9837a3fec283921d53c13c23cc71aa973c0f4
MD5 c452f75d7783362635924f85e81f5a5d
SHA1 92090fe281a71ce05bdeff759a08d6a97f19b6e6
SHA512 ad2a859975241f691a392f0f9216fbea236a79d6ddd6616e2305f4e501527e86c3e03746d064a4fc7a1c28f8deb3bcfb2c0f05dcefa3d6918e9872b19783e3b7
SSDEEP 3072:wkruwzLLCJhj7yxa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:truiLSWa3lLNngoqRttA7W
TLSH
T1DB345A0172818072E71A0B78045AE7A1467E7C394BA5D5CFFB683F7A1A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

axspnhfaxs.exe

Path C:\Temp\axspnhfaxs.exe
Size 243KB
SHA256 3b51fbbd26458fec1a921d619a6316537e3351778a1ce862c22ac9a4460f5ceb
MD5 7e8aae930f8c7d23bc7828999574825e
SHA1 61578d688b8805c9fb09190e5ecb2f002026938d
SHA512 02dd47f4bc11c374191b98cb3def19ba75920da4ad0dd08e58882c8de1cca906c7e28f0b68aa69a364956ed89ccb96795561e2cd14026ee5a565e3f4fab7b7de
SSDEEP 3072:xkruwzLLCJhj7yxa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:CruiLSWa3lLNngoqRttA7D
TLSH
T1FA345A0172818072E71A0B78045AE7A1467E7C394BA5D5CFFB683F7A1A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvpfzxrpk.sys

Path C:\Temp\dxvpfzxrpk.sys
Size 141KB
SHA256 6cb2788f226152bee260fd119bf7bc5ba57219befe1022ed88da145cc26f974c
MD5 56842f8eb66fc0c91ad139fb4c04f64f
SHA1 094c02675066a4c1a952f9d32a2d00f5c1ead538
SHA512 6c48399467f65b38d6ab16739108da9c31ef66a8fb0697016d9a9a95a44579c8cb3713c8bc61eac9a8936707368b8c93e657df8950f6d545b68b4ec506d12076
SSDEEP 1536:ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E2E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hecxupmhcz.exe

Path C:\Temp\hecxupmhcz.exe
Size 243KB
SHA256 e5f0085ad3586a7e399dff767aed9641c471bc169b2ba7c2c3af5aafb9f4fb12
MD5 24469668ddd3e4367a516820c179c61f
SHA1 e6b287983dace726078764426de3ea6840ad70f0
SHA512 3138a06a4ddf1531ed21428c85ab1173a404c02dd20995dc41efb489ac21bbca548b1fc820e4d155e217d4a26e04df9eb80b7838ae3b5e4a7393bde4ba113eb5
SSDEEP 3072:nkruwzLLCJhj7yxa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7V:kruiLSWa3lLNngoqRttA7V
TLSH
T1C0345A0172818072E71A0B78045AE7A1467E7C394BA5D5CFFB683F7A1A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_avsnlfdxvp.exe

Path C:\Temp\i_avsnlfdxvp.exe
Size 243KB
SHA256 825872b7bfc15449b2026db8a9d99804cbf63d117649c42b9c91577a3267869c
MD5 e28fbb59275e8ab2d87227eece711b13
SHA1 3d78f9fbb73f49ce73a9ad9d442f5333caa2213b
SHA512 a64489225b4c7e6874d24766497013464c3b5e526ca0ccaef1526bbe6eb15382d933ab873c70a77346b97fc2dce857b0866f9189937b39f7d005e4005a5f1339
SSDEEP 3072:YkruwzLLCJhj7yxa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7K:FruiLSWa3lLNngoqRttA7K
TLSH
T142345A0172818072E71A0B78045AE7A1467E7C394BA5D5CFFB683F7A1A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_axspnhfaxs.exe

Path C:\Temp\i_axspnhfaxs.exe
Size 243KB
SHA256 4a3924a6cca74e42e0f00ff13237824579d5d7a64f96c451490bb44618872924
MD5 422c833964ef15425ce848367221536a
SHA1 9f9ae6a34a69ea3cddc99c8b87584161ca9e3e54
SHA512 28976c36b76be987a6c7a00535fb1bf1a0e35625a8e80955b97de760005195a1286651441179bea2549975f90053bdae0ba9cee754247e70b2962a9ab5204a51
SSDEEP 3072:4kruwzLLCJhj7yxa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7C:lruiLSWa3lLNngoqRttA7C
TLSH
T13A345A0172818072E71A0B78045AE7A1467E7C394BA5D5CFFB683F7A1A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hecxupmhcz.exe

Path C:\Temp\i_hecxupmhcz.exe
Size 243KB
SHA256 7b3c9ef103b41860215167586a3daf5e7b0f51db8206dc46aa141c8bbd44a419
MD5 624f205d1ef3df24c74f9ca0bba8ffac
SHA1 476e65888b26149803905c4b0e2c2a56c61a20ea
SHA512 addb855de47638d07872174091870cc66ccc028b415baf3b29c847dea42d7b730c91b258194cddb30e3a747deab2fb2bbd2e14af8fa270085e600fa922ee29d9
SSDEEP 3072:jkruwzLLCJhj7yxa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7J:oruiLSWa3lLNngoqRttA7J
TLSH
T1CD345A0172818072E71A0B78045AE7A1467E7C394BA5D5CFFB683F7A1A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igaytqlida.exe

Path C:\Temp\i_igaytqlida.exe
Size 243KB
SHA256 982423fa8530bba893607ab88d64069c709e5f19aca5155325a355cec145cce8
MD5 14617402e849e8ffaee6cbb9d009c8b7
SHA1 8fc5043641266b8e9279dd64bdc693ed14f8dae2
SHA512 d61e85e69189ead547e964fff9f8903e178ab2981308ffe4165f087bf381b900e9a7d796b707cb36527d028b9b27aba05a886f18fe6d45f5775efc53d15ec414
SSDEEP 3072:8kruwzLLCJhj7yxa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7C:RruiLSWa3lLNngoqRttA7C
TLSH
T135345A0172818072E71A0B78045AE7A1467E7C394BA5D5CFFB683F7A1A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywqoidbvtn.exe

Path C:\Temp\i_ywqoidbvtn.exe
Size 243KB
SHA256 d237dfbf75c4ef4b7443138e8e3a255ec88a500f6f31bf1fb8c804d5f470acac
MD5 77007693a21a44fb253315346ccaab5d
SHA1 263bb0db94878c830fe690ae8aa99d04a420dd8d
SHA512 eedcf0a36e7754d70374d3326f334a2c2b7ff63ca9dfc61bbaee5a3627d98e5d0528ddcfebf6038b29a91882e683b15a5bf80bb9f8d3170833c724bd307ac3d5
SSDEEP 3072:RkruwzLLCJhj7yxa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:iruiLSWa3lLNngoqRttA7b
TLSH
T1E8345A0172818072E71A0B78045AE7A1467E7C394BA5D5CFFB683F7A1A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywqoigbywq.exe

Path C:\Temp\i_ywqoigbywq.exe
Size 243KB
SHA256 1542255fc5e0ceac70fc61dcabbeee6fe7cea0b6ddfa39f97084f7cedadb77f3
MD5 c3025b754a64be9f78189cc2954a4782
SHA1 0a776c158e7b0c052970dafca231e74564100d54
SHA512 f894ba24acb2f5a605b09c7c224106c155938ed7bac470a66a13348460809d557e2dfa51d6617f9db4dc1d55d192ee0e9f5c0dbbf819cd5f8b1492ab7f0121dd
SSDEEP 3072:SkruwzLLCJhj7yxa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA74:jruiLSWa3lLNngoqRttA74
TLSH
T1BC345A0172818072E71A0B78045AE7A1467E7C394BA5D5CFFB683F7A1A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaysqkida.sys

Path C:\Temp\ifaysqkida.sys
Size 141KB
SHA256 8901e6c4a60f0fe31659cd124a04de86d54764243bf0825a62457419a9444607
MD5 29b614d951df41200965f98de4b44050
SHA1 fde35b7e1cf12b77bd55f6e59c06450aab1f7d8b
SHA512 cee9d25d025f5a3a951ed2f4eafd1105d4de573ae11bdb5adf25547760b716e94beec0c286cdc1b4ca6b0489e33ce2a76a72a3c374fdf14ce6695ef1df44bf97
SSDEEP 1536:8a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:8a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T168E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igaytqlida.exe

Path C:\Temp\igaytqlida.exe
Size 243KB
SHA256 317b9c0df508e205ba3fd0867b26301c2787b5cd5808cf46abc79e1e10b07540
MD5 45b6fe8854e73d0f0b261fc9837e98f4
SHA1 f415d83cc0dc8c405c00307d67f900288100c806
SHA512 e53a3675c9aa60e9b7d20beaf0f1fa61b64c51ca3e7f8c2fc4f2b4722b5e8cf36bbfbc5f826b80056fcab5eadc508955a0adca50d77bae8b762dd8e6b99969eb
SSDEEP 3072:pkruwzLLCJhj7yxa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7r:KruiLSWa3lLNngoqRttA7r
TLSH
T16D345A0172818072E71A0B78045AE7A1467E7C394BA5D5CFFB683F7A1A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkfdxvpnif.sys

Path C:\Temp\nkfdxvpnif.sys
Size 141KB
SHA256 e56bd047dfb51aa860339c324a138d7cb9d8f7e4ae099869825ca775824e89ba
MD5 9482bd48c90ba99c98ee3d9b6958eeed
SHA1 c4a6df42129f25ab06b5fc20e490a4af7d513c75
SHA512 cd2e560c2fdb0ab5fb424769967d517a844816395f6bbbf5c974064812c3b7be59068a7eff29002cdb78d552c0757e10fb82a0bd99512b595a6719eec700dd26
SSDEEP 1536:Da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A3E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qljdaytqlj.sys

Path C:\Temp\qljdaytqlj.sys
Size 141KB
SHA256 c8572ca1a2b171e906258869fb979b0551caef50b6d418379927f5276b7c46d1
MD5 89789d46d9898392b058d14ef7900025
SHA1 a69f3d11da034cb609c81a3c8bfb1b49b9280b74
SHA512 4c323688df908772cae292eb7dcb82bece3e3f9bce370a1b9ed798908f16953f7e06b5d1a3a8a1da7c859af609e3f4d881da593bb97ee088db295ef460966ec6
SSDEEP 1536:da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T185E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wogdywqoig.sys

Path C:\Temp\wogdywqoig.sys
Size 141KB
SHA256 b4356f4579ff08b0b701e51f3555cc878e9a38df4026d94d03c1ff218249992b
MD5 402fcced5a5240920be0d1ec53e5d7a8
SHA1 49596f0c60f8a2500ccfada2ec879b0f95d560b8
SHA512 c85092b51698972072faca3b3d4b761bd2fef0a88149e3fa06f5e6e249e8f56fd11d2e62d6cc61585e7e6a7c343b7ffbaa9872f73b3b142d9d27293931163570
SSDEEP 1536:wa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:wa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T190E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqoidbvtn.exe

Path C:\Temp\ywqoidbvtn.exe
Size 243KB
SHA256 71dad23271cc24a2717df7a73556ff29e0c688485bb506b13b332a8a426e17b2
MD5 bb99556c7719253e5b9f0e5ca5c3165c
SHA1 0921e8c99ab236f315604d5af66c3ffbfd87c597
SHA512 ce7cb5e374988ac61b2c432cb528b5c35dd259a18519a83a3cd6714cf50cd8cb86d9fdc8543a5e54981907fed1aaf835a6e076be947c99eaee64d07cdaebee97
SSDEEP 3072:tkruwzLLCJhj7yxa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7P:WruiLSWa3lLNngoqRttA7P
TLSH
T1F6345A0172818072E71A0B78045AE7A1467E7C394BA5D5CFFB683F7A1A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqoigbywq.exe

Path C:\Temp\ywqoigbywq.exe
Size 243KB
SHA256 b7c071f6d7bc39a6938d29edace750df59858b807b52fccd1b99a480f46800cc
MD5 bca5c5a1dd5fb46305d428c54efd52f5
SHA1 0f36ae76aa6b6aacf49a614e217fd3c03b138de7
SHA512 33bdf10a23c88edee65a761f79093707771d05c3739a25e487821c217fe1aae4c925027892c716e8f8855135c015211bae5fa8e9a49a5fb4ce4018c8812988b3
SSDEEP 3072:qkruwzLLCJhj7yxa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7I:rruiLSWa3lLNngoqRttA7I
TLSH
T1B3345A0172818072E71A0B78045AE7A1467E7C394BA5D5CFFB683F7A1A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 04de10cb82930e79f08535d557f64ac9621c6cda1d0eccfac6473c0104a0d637
MD5 dea6cb2606db8cdd2fabbd87e0a40db7
SHA1 c2098eca31b6920f57a11bd7cba61a0b491c4813
SHA512 f6292db5c9d79125ec3a39855ecfc244c3c4923eb58b067d4b707a04d5db627e491e5e836c8b067160f89ccf33eb15dca3b9d7fff40fd18590bc2a2ca2ba56e2
TLSH
T1C6D09B557244A94BCB81217235D4B2555214946654150658055171B8C9F62D305BB8ED
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5eeca2aa6e917b76d239047f52a1c2b6b37364fe74e84180ac7fdc9548b3be90
MD5 a153df1b2dbe0717abacfb5c09939775
SHA1 91c63971114b63dacf725afb7452bd3a26feb97e
SHA512 79f36c0948649f3fad8501147974bd9fd20b8a31fdfc130e22546c6adb15a9ea187ca804e252771bfe133494aa84c78a92d9352ebb50e60be11ddd64e17fcbcc
TLSH
T1DED09266B254A84BCB81217639E9B255A2189466401A0A580662B2B8C9F62D306BB8EA
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4e7463d3f7fed6c6b57760864fb01b35192fe042914d5f5714c0e0d9bd86b570
MD5 aca7ac7818520e23c99032440e84217a
SHA1 6d879b1c647352bfcd741dd12ac58e92e5b63aaf
SHA512 97c27d7875dc3e76e2345693de6191ae884281822d1acfa17da3458427a82d96ed9b3099edd856fe98f96738dd77b50b3d84ed7f65f499387280699b13ea6dfb
TLSH
T12D61613C33B6A7E2EB1D6FB231DD18983AB47447F2077D1004E1E0374A3A702AD68891
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b099.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b099.TMP
Size 3KB
SHA256 92ca60037ecc57801ee9b9ee221e7678fd4463231d174ae27f6e6255725826c9
MD5 8eb2c887611fda4b92fca184fea13824
SHA1 b5cbcf17561c56d8a7465fdd1df82730eca47421
SHA512 543d041d555fba15cef22f97361b6a9d8a1dfb2d630c6e4d4935919a35d72c7ee6927cc7c4b0d286bfa98388230ca63922753528aa2fa858db782016ceed5d5c
TLSH
T15861513D33B6A7E2EB1D6FB231DD18987AB47447F2077D1044E1E1374A3A702AD69891
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 76d142489e2805fe8822e1b8281bd898e5e37bbd9542fc3cd642d4d37c274ca6
MD5 c8dab24d742296d627c63c6e21341a68
SHA1 ac597c1ef20398f5d388297d4c073810ab6b9c05
SHA512 224c56f85af79e9bd33e88e2e6511d5ba6d5f076169bcbaa63e9e8d7b41021b17022ef509e3c7209cf87d69325e37f92173a0aa44bcb1deef61456dc0a3b329f
TLSH
T10F41BEF3C2E4C56E890156F0AB186E2BCE2D0915832C3D5AC9E4AF5B93E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9b1dd985ad520b56eb2d9b9910389f3134388d920b4b6ef5ed22ffd3905d8181
MD5 7fd454f47cbe442a829a5814eb62417f
SHA1 b82fdf5f3c56666d26a453d6603f4ce5b7d3f7fe
SHA512 e8bacd393357b648f53fb86a75b30c8e78be664d9a246cf10dffead1a767abcf8e550b307ddf193885d7aa7ecabab8542cbf6ddb8211886a755be25b867ebc1a
SSDEEP 192:sxRtsRByM/jK1Ml8wCn/flsGSVKZ+nohzoA8pi/g6+WNIYaUbwGuIgtJ:sxRtsV8n/flsGUc+Ri/5IeK3
TLSH
T12952EA156A389937CCDBD20DFA557F53D6F81563A2941E04AAFCDA0C00E76EC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 97e1b19d785976c8e65b3cf6e0876265606e3211314db576642088277e6f061e
MD5 a3db9065045d738c74fb7251771fcf69
SHA1 12580880e0088452150563529f0971648414bf75
SHA512 5250d43c8ea3555ef31e42547fdf6ea260db499081c3a592cdc9c0bbe712fb8bf5161f944ff07492d4ccf76865d68e63db810223018c18c8e85142c0ff6194e1
SSDEEP 192:sxRt3RByM/jK1Ml8UQrCn/flszES4KZ+nkhzoA8prVM/g6+WNCVvRx/Ya/6bwGuC:sxRt3Hqen/flszEhc+Vm/58/kKC
TLSH
T17E62D8156A389977CCDBD209FA557F93D6F81563A6541E04AAFCCB0C00E66ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 49d8f2b2f784401a4c96a31e8901872459bb4493734c43d8beaa03a8ce38e8de
MD5 88df695022e75e466d0c716c4564923c
SHA1 7c10e62e6b31bc871fc393958c91f15812a713fc
SHA512 18c7616d751ce1ebcaf26353b6d485e8b801335815b534475143774848fa8eb909242a04a15b958e0081b7ccb9b7854cb94df60977e6c900008d3054f6d799c5
SSDEEP 192:sxRt3RByM/jK1Ml8UQrCn/flszES4KZ+nkhzoA8pru/g6+WNIYa3bwGuIgDaJ:sxRt3Vqen/flszEhc+V6/5IVKC
TLSH
T19962D8156A389937DCDBD219FA557F93D6F81563A2541E04AAFCCB0C00E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 562f3f67c5d05a2bfefe6e5627def62cf77075c4d2dacfceb1005f93b02b60a3
MD5 b09357144340ba8af6b6c68701811619
SHA1 85e9507fca45b9b7423a01a6166f2fde1e1f09cb
SHA512 ff3066dcc081c5e2af7b15dd4db3af1d30843881010819510e076426c83eb86834b403a12a0459385e330f8f407942db35fedc588aa2df011a8117acb60d0fe7
SSDEEP 192:sxRt3RByM/jK1Ml8wCn/flszESVKZ+nohzoA8pi/g6+WNIYaUbwGuIgD0J:sxRt3V8n/flszEUc+Ri/5IeKk
TLSH
T13752D9156A34993BCCDBD20DFA557F93D6F81563A2941E04AAFCDA0C00E76EC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 830dc18bd76fc326d692b4fcd95dab0e9b4e2a4d2879d7f19cca203647bce4cf
MD5 7bfb5ea0896175862a445cb50e109d71
SHA1 f55c2b4e5a718d9352461985c0f8abfa0be2cdd1
SHA512 68946c84d06adefa425a111bf640824320314411a8cb4aa0ac13d80b5f4fbf9fdcd795451db02f0ffc3106b4e5c0870375615a8a2dbafab88c9ca7281ef18da7
SSDEEP 768:nTSdtH7pLuL7kFWg+wfla8F1+UoAYDCx9Tuqh0VfUC9xbog/OVes9B0UMroKig2:nTSdtBE7kFWg+wflau1jaRs9mUXe2
TLSH
T1D1E2EB7B280CCB7F4F444A9CEC29BE9AADE801CF56D8895447FA940C03C67EB52165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ee19e2ff52a5767422f03023e5314153f4d51206c9d50068b7b2336f08f8ad8b
MD5 c206a0bd2d98a8639cf34f6b40c9a955
SHA1 aa0d9b6920bf5944b14aa624a740150ba321ecef
SHA512 8b483fcd3a4daca2a235e8c19c7531288a2fc6744584e9a7f8d164e364a2f40b9edfb439e7b1a2cb1d452653761670e0ec498d11da10dfb5c34fbeb4d7b29d9f
SSDEEP 96:KRLuLDLSLOLoLwLgL2WLwL1L9gLOL2K4LTgLML2cLmLuLtL8LuLnHeTieYgQGWA8:CLuLDLSLOLoLwLgLBLwL1LOLOLeLTgLK
TLSH
T171919544763B02417A7E384C80D69C66A6C2F9A37096652F3BE812F61F67E01CEFD4D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f4b345e8-bc70-451a-b6c6-b05388628158.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f4b345e8-bc70-451a-b6c6-b05388628158.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 31d5b771ba92ea707d59c55b898f2f57acdb6f09cd4973b77b46270e49c161e2
MD5 e009d619b978815fec9fe3319b0594d5
SHA1 ccb3402099bf8337f19acc1a55ab488bd4fbecce
SHA512 5f4cc7c4221f82710d5264a5f6d5b22699a9f6813639d11b6e76401913a99915dbad5fd8cd1fe557323dc39b32b124502bbd3921bb83c1c1cc46154956d22591
SSDEEP 768:trv+4UNbdi3fIp75LBk93XVGRh9zb3bm5keVH1S7E:tbsbE3fyM9nVG1z5EH15
TLSH
T10403CF32A8A899738CF38684B10B36077FF84167D6C90A88D8EE1F4D439F58D6707963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 37d580c47ff3d2b9e549d32664210f92d72ed29c664187059d98afd12e7566f0
MD5 8bb2333704e6bc5cf2bd8bb9ce75169e
SHA1 df6758cfedabd2a6476f197c5c2d4b6935c732a1
SHA512 abb9a0c3f7ed4e70cedaa5a97b694ae423c53c359c737ef3eb497c3eeac2c52158cb9cb28e9328e76bf19959f5b798dd79ec32301117c16bd270b47c6a2e0bb2
SSDEEP 768:rj+9P30IpO5LBzi93XVGRh9zb3bmlpMj16:+9P307W9nVG1zU+6
TLSH
T16EF2BF31A9659C638CE78298B60B3786EFB411B3C4C91E48E9ED6F4E01C765D2B17827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 48308e3915fb0f3b0c0924432fb5f925aa56c74b0941dfd965155bb12b9d99ec
MD5 b0bffd13d98ddf78555de6f1e14ee4e6
SHA1 900bb083a31438610309cdffec857cb4754b5fd2
SHA512 aa68c231dffd03b944587130f5047e135270da9bcfa48412d29ee60d98dc05674837091231b4b89e0aefe1d8da00f16838a0aa9e11f7663cc93c5fc16889b785
SSDEEP 768:vj+9P30I1O5LBzm93XVGRh9zb3bmlpMj16:C9P30XC9nVG1zU+6
TLSH
T125F2BF31A9659C638CE78298B60B3786EFB411B3C4C91E48E9ED6F4E01C765D2B17827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 73251def8aea84317b63e495bfbf5797b4d56c5bea9bfa130086b109ce560700
MD5 333bb66ce4f9da31a711298e7469bcc7
SHA1 323aeb9ee078b6840074e675f1c1865eb088a4c4
SHA512 dd701241afef3737b2390f14183aad641ea2303d591b91c653564a02545f346bfc2337363d5393a3a30955748e1a5fc9fdc7ffd17f38116230f00001aaac8f26
SSDEEP 768:IF1j+9r3QwgKIpVGzG93XVGRh9zb3bmlpMj16:l9r3P29nVG1zU+6
TLSH
T1B9039D32E865DD67ACE787C9B70A7686DFE001B388C99DC8EAD95E4D00C729D1707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1fccb040ee3c062327a5409e7b263d41747ae266782dd2098854b6cd837c0d7d
MD5 f08bc0b2ddfcb85a1e83808652bfd3a8
SHA1 795305e574a30736f3dfd225dd2a6d60661cd142
SHA512 5f7d2cf74f6ca25f0658de1356971a56b80f5c16f0a9754a8e3469c46db6f59c43c35e4f851d7f59bdaaa9f3fa80a29028b7ed7b6d242cabeba9c47d4577dbe0
SSDEEP 768:qj+9P3xIpO5LBzi93XVGRh9zb3bmlpMj16:J9P3x7W9nVG1zU+6
TLSH
T145F2BF31A9259C638CE78698B60B3786EFF411B384C91E48E9ED6F4E01C765D2B17827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3300_1356592849\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/244-401-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/256-324-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1368-476-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2368-343-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2396-284-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2536-328-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2556-264-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2632-384-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2656-456-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3336-306-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3372-233-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3620-405-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4428-363-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4508-428-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4808-433-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4808-372-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5020-187-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5020-234-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5568-452-0x0000000000010000-0x0000000000083000-memory.dmp

Download