a8c3e99d558109b3a6ec9a69ffb910b852164b9e4edb7499211c7386aed27851

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 15:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_0dfd5f26021c0eac7d47099b6341fa0c_elex_rhadamanthys_stop.exe
Size 243KB
Sample260709-sfljlsdv5y
SHA256 a8c3e99d558109b3a6ec9a69ffb910b852164b9e4edb7499211c7386aed27851
MD5 0dfd5f26021c0eac7d47099b6341fa0c
SHA1 f356cbcebfdebfcb4322e7d97bc8309cca037e74
SHA512 d9b5de1a715b343675f1a80048d3f1930f5b410c09f19f8dd6066fc3788f182e124dc4940948f8c047aaf49b88412a534418ddb5659cb3c09bea82c42fabed1a
SSDEEP 3072:RCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:svMsLaOa3lLNngoqRttA7D
TLSH
T11E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3792	CP.exe
4488	igbztrlgey.exe
4812	CP.exe
1204	CP.exe
1528	i_igbztrlgey.exe
4664	lgdyvqoiga.sys
6068	CP.exe
1508	idbvtnlfdy.exe
6016	CP.exe
200	CP.exe
1896	i_idbvtnlfdy.exe
3356	qkidaysqli.sys
4764	CP.exe
1632	fayvqnlfdx.exe
1220	CP.exe
2476	CP.exe
6000	i_fayvqnlfdx.exe
3492	vpnkfdxvpn.sys
1212	CP.exe
1504	khcavsmkfc.exe
6084	CP.exe
1552	CP.exe
2568	i_khcavsmkfc.exe
3976	fzxsmkfcax.sys
5548	CP.exe
5112	mkecwupmhf.exe
4044	CP.exe
2012	CP.exe
1892	i_mkecwupmhf.exe
2136	kecwusmhfz.sys
2728	CP.exe
1192	zxupkhezxr.exe
2164	CP.exe
1352	CP.exe
5600	i_zxupkhezxr.exe
5412	ecwuomkecw.sys
5812	CP.exe
4036	urmjhbzurm.exe
1288	CP.exe
2156	CP.exe
5624	i_urmjhbzurm.exe
2372	geywuomgey.sys
1004	CP.exe
2548	wrljdbwuom.exe
6028	CP.exe
1148	CP.exe
5424	i_wrljdbwuom.exe
1180	ljgbztrljd.sys
1276	CP.exe
2756	ytqojdbvto.exe
5828	CP.exe
4712	CP.exe
5444	i_ytqojdbvto.exe
1596	olgeywqoig.sys
5304	CP.exe
1776	gdywqoigbq.exe
2700	CP.exe
5412	CP.exe
5916	i_gdywqoigbq.exe
2072	qlidavtqlf.sys
3840	CP.exe
4324	fdxvqkigay.exe
3548	CP.exe
5036	CP.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6088_1405823091\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6088_478727387\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6088_748517763\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6088_748517763\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6088_478727387\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6088_478727387\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6088_478727387\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6088_1301203750\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6088_1405823091\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrljdbwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxupkhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdywqoigbq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trmjecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igbztrlgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvqkigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvqkigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezxrpmhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidaytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_0dfd5f26021c0eac7d47099b6341fa0c_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqojdbvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idbvtnlfdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmjhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmjhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxsmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fayvqnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khcavsmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdywqoigbq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxsmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trmjecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fayvqnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfaxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezxrpmhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmhezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidaytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khcavsmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrljdbwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytqojdbvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfaxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmhezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igbztrlgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idbvtnlfdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxupkhezxr.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2708	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1532	ipconfig.exe
4372	ipconfig.exe
3884	ipconfig.exe
2552	ipconfig.exe
1492	ipconfig.exe
1896	ipconfig.exe
3960	ipconfig.exe
2372	ipconfig.exe
3404	ipconfig.exe
3728	ipconfig.exe
4028	ipconfig.exe
4072	ipconfig.exe
5384	ipconfig.exe
5728	ipconfig.exe
2696	ipconfig.exe
5428	ipconfig.exe
2908	ipconfig.exe
3532	ipconfig.exe
4456	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280830564037235"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2626306573-1585762579-411806764-1000\{FBBCD6B6-8F39-4863-812C-FA2D7B1CF13D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4064	msedge.exe
4064	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1528	i_igbztrlgey.exe
Token: SeDebugPrivilege	1896	i_idbvtnlfdy.exe
Token: SeDebugPrivilege	6000	i_fayvqnlfdx.exe
Token: SeDebugPrivilege	2568	i_khcavsmkfc.exe
Token: SeDebugPrivilege	1892	i_mkecwupmhf.exe
Token: SeDebugPrivilege	5600	i_zxupkhezxr.exe
Token: SeDebugPrivilege	5624	i_urmjhbzurm.exe
Token: SeDebugPrivilege	5424	i_wrljdbwuom.exe
Token: SeDebugPrivilege	5444	i_ytqojdbvto.exe
Token: SeDebugPrivilege	5916	i_gdywqoigbq.exe
Token: SeDebugPrivilege	4188	i_fdxvqkigay.exe
Token: SeDebugPrivilege	3988	i_hfaxvpnifa.exe
Token: SeDebugPrivilege	5564	i_hfzxsmkecx.exe
Token: SeDebugPrivilege	5040	i_hezxrpmhez.exe
Token: SeDebugPrivilege	700	i_rmhezwrpjh.exe
Token: SeDebugPrivilege	4532	i_trmjecwuom.exe
Token: SeDebugPrivilege	3972	i_ljdbvtolge.exe
Token: SeDebugPrivilege	5336	i_lidaytqljd.exe
Token: SeDebugPrivilege	3560	i_vtnlfdyvqo.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6088	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 5608	628	2026-07-09_0dfd5f26021c0eac7d47099b6341fa0c_elex_rhadamanthys_stop.exe	88
PID 5608 wrote to memory of 6088	5608	iexplore.exe	89
PID 6088 wrote to memory of 4552	6088	msedge.exe	90
PID 6088 wrote to memory of 2708	6088	msedge.exe	91
PID 6088 wrote to memory of 2016	6088	msedge.exe	92
PID 6088 wrote to memory of 2016	6088	msedge.exe	92
PID 6088 wrote to memory of 2016	6088	msedge.exe	92
PID 6088 wrote to memory of 5236	6088	msedge.exe	94
PID 6088 wrote to memory of 5236	6088	msedge.exe	94
PID 6088 wrote to memory of 5424	6088	msedge.exe	95
PID 6088 wrote to memory of 3856	6088	msedge.exe	96
PID 6088 wrote to memory of 5424	6088	msedge.exe	95
PID 6088 wrote to memory of 5424	6088	msedge.exe	95
PID 6088 wrote to memory of 3856	6088	msedge.exe	96
PID 6088 wrote to memory of 3856	6088	msedge.exe	96
PID 6088 wrote to memory of 1976	6088	msedge.exe	98
PID 6088 wrote to memory of 3716	6088	msedge.exe	97
PID 6088 wrote to memory of 1976	6088	msedge.exe	98
PID 6088 wrote to memory of 1976	6088	msedge.exe	98
PID 6088 wrote to memory of 3716	6088	msedge.exe	97
PID 6088 wrote to memory of 3716	6088	msedge.exe	97
PID 6088 wrote to memory of 2196	6088	msedge.exe	99
PID 6088 wrote to memory of 2196	6088	msedge.exe	99
PID 628 wrote to memory of 3792	628	2026-07-09_0dfd5f26021c0eac7d47099b6341fa0c_elex_rhadamanthys_stop.exe	101
PID 4488 wrote to memory of 4812	4488	igbztrlgey.exe	104
PID 6088 wrote to memory of 1548	6088	msedge.exe	107
PID 6088 wrote to memory of 4844	6088	msedge.exe	108
PID 6088 wrote to memory of 1548	6088	msedge.exe	107
PID 6088 wrote to memory of 4844	6088	msedge.exe	108
PID 6088 wrote to memory of 5460	6088	msedge.exe	110
PID 6088 wrote to memory of 5636	6088	msedge.exe	111
PID 6088 wrote to memory of 5636	6088	msedge.exe	111
PID 6088 wrote to memory of 5308	6088	msedge.exe	114
PID 6088 wrote to memory of 5308	6088	msedge.exe	114
PID 628 wrote to memory of 1204	628	2026-07-09_0dfd5f26021c0eac7d47099b6341fa0c_elex_rhadamanthys_stop.exe	115
PID 628 wrote to memory of 6068	628	2026-07-09_0dfd5f26021c0eac7d47099b6341fa0c_elex_rhadamanthys_stop.exe	119
PID 1508 wrote to memory of 6016	1508	idbvtnlfdy.exe	121
PID 628 wrote to memory of 200	628	2026-07-09_0dfd5f26021c0eac7d47099b6341fa0c_elex_rhadamanthys_stop.exe	124
PID 628 wrote to memory of 4764	628	2026-07-09_0dfd5f26021c0eac7d47099b6341fa0c_elex_rhadamanthys_stop.exe	128
PID 1632 wrote to memory of 1220	1632	fayvqnlfdx.exe	130
PID 628 wrote to memory of 2476	628	2026-07-09_0dfd5f26021c0eac7d47099b6341fa0c_elex_rhadamanthys_stop.exe	133
PID 628 wrote to memory of 1212	628	2026-07-09_0dfd5f26021c0eac7d47099b6341fa0c_elex_rhadamanthys_stop.exe	137
PID 1504 wrote to memory of 6084	1504	khcavsmkfc.exe	139
PID 628 wrote to memory of 1552	628	2026-07-09_0dfd5f26021c0eac7d47099b6341fa0c_elex_rhadamanthys_stop.exe	143
PID 6088 wrote to memory of 4532	6088	msedge.exe	145
PID 6088 wrote to memory of 2828	6088	msedge.exe	146
PID 6088 wrote to memory of 3540	6088	msedge.exe	147
PID 628 wrote to memory of 5548	628	2026-07-09_0dfd5f26021c0eac7d47099b6341fa0c_elex_rhadamanthys_stop.exe	150
PID 5112 wrote to memory of 4044	5112	mkecwupmhf.exe	152
PID 628 wrote to memory of 2012	628	2026-07-09_0dfd5f26021c0eac7d47099b6341fa0c_elex_rhadamanthys_stop.exe	155
PID 628 wrote to memory of 2728	628	2026-07-09_0dfd5f26021c0eac7d47099b6341fa0c_elex_rhadamanthys_stop.exe	159
PID 1192 wrote to memory of 2164	1192	zxupkhezxr.exe	161
PID 628 wrote to memory of 1352	628	2026-07-09_0dfd5f26021c0eac7d47099b6341fa0c_elex_rhadamanthys_stop.exe	164
PID 628 wrote to memory of 5812	628	2026-07-09_0dfd5f26021c0eac7d47099b6341fa0c_elex_rhadamanthys_stop.exe	168
PID 4036 wrote to memory of 1288	4036	urmjhbzurm.exe	170
PID 628 wrote to memory of 2156	628	2026-07-09_0dfd5f26021c0eac7d47099b6341fa0c_elex_rhadamanthys_stop.exe	173
PID 628 wrote to memory of 1004	628	2026-07-09_0dfd5f26021c0eac7d47099b6341fa0c_elex_rhadamanthys_stop.exe	177
PID 2548 wrote to memory of 6028	2548	wrljdbwuom.exe	179
PID 6088 wrote to memory of 4652	6088	msedge.exe	182
PID 6088 wrote to memory of 4652	6088	msedge.exe	182
PID 628 wrote to memory of 1148	628	2026-07-09_0dfd5f26021c0eac7d47099b6341fa0c_elex_rhadamanthys_stop.exe	184
PID 628 wrote to memory of 1276	628	2026-07-09_0dfd5f26021c0eac7d47099b6341fa0c_elex_rhadamanthys_stop.exe	190
PID 2756 wrote to memory of 5828	2756	ytqojdbvto.exe	192
PID 628 wrote to memory of 4712	628	2026-07-09_0dfd5f26021c0eac7d47099b6341fa0c_elex_rhadamanthys_stop.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-09_0dfd5f26021c0eac7d47099b6341fa0c_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_0dfd5f26021c0eac7d47099b6341fa0c_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:628
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x320,0x7fff4ffdc188,0x7fff4ffdc194,0x7fff4ffdc1a0
      4⤵
      PID:4552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,1476804280201367989,11657199841284351397,524288 --field-trial-handle=2112,i,10842927432011613917,8062521067577386138,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:11
      4⤵
      System Time Discovery
      PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,16724884482022709457,4252552250328813982,262144 --field-trial-handle=2112,i,10842927432011613917,8062521067577386138,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:2
      4⤵
      PID:2016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,16798849714780086567,11221777876514986720,524288 --field-trial-handle=2112,i,10842927432011613917,8062521067577386138,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:13
      4⤵
      PID:5236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,3525873611780616267,10231211250014666478,2097152 --field-trial-handle=2112,i,10842927432011613917,8062521067577386138,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:5424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,15072137988895467366,9753521609176170137,2097152 --field-trial-handle=2112,i,10842927432011613917,8062521067577386138,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:3856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,8481756854121609285,7158049649088370520,2097152 --field-trial-handle=2112,i,10842927432011613917,8062521067577386138,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:1
      4⤵
      PID:3716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,9006648670718505950,15535491031844740409,2097152 --field-trial-handle=2112,i,10842927432011613917,8062521067577386138,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:9
      4⤵
      PID:1976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,13344717756817094794,10510969864552822745,524288 --field-trial-handle=2112,i,10842927432011613917,8062521067577386138,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
      4⤵
      PID:2196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,11588445540186929418,8515799495828778828,524288 --field-trial-handle=2112,i,10842927432011613917,8062521067577386138,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:14
      4⤵
      PID:1548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,14332290884633058421,11472530899872645885,524288 --field-trial-handle=2112,i,10842927432011613917,8062521067577386138,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:14
      4⤵
      PID:4844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,5796127558866288804,7460271847556001384,524288 --field-trial-handle=2112,i,10842927432011613917,8062521067577386138,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
      4⤵
      PID:2820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,5796127558866288804,7460271847556001384,524288 --field-trial-handle=2112,i,10842927432011613917,8062521067577386138,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
      4⤵
      PID:5460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,15613919279348861796,5544312992951260271,524288 --field-trial-handle=2112,i,10842927432011613917,8062521067577386138,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:5636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,7207108132000631355,1586881628047562881,524288 --field-trial-handle=2112,i,10842927432011613917,8062521067577386138,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
      4⤵
      PID:5308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,16094563456106262404,18172068978426636185,524288 --field-trial-handle=2112,i,10842927432011613917,8062521067577386138,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
      4⤵
      PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,8135897705431094736,6901349065875789642,524288 --field-trial-handle=2112,i,10842927432011613917,8062521067577386138,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
      4⤵
      PID:2828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,7502031773739503939,16221884706356068278,524288 --field-trial-handle=2112,i,10842927432011613917,8062521067577386138,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14
      4⤵
      PID:3540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2756,i,4435927265455789584,9371328888189447273,524288 --field-trial-handle=2112,i,10842927432011613917,8062521067577386138,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
      4⤵
      PID:4652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,12163580580758768518,13755239742025156912,524288 --field-trial-handle=2112,i,10842927432011613917,8062521067577386138,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14
      4⤵
      PID:3340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,12543496904124957004,15146846563781704622,524288 --field-trial-handle=2112,i,10842927432011613917,8062521067577386138,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
      4⤵
      PID:3956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,14776067803668397449,4465531506982453179,524288 --field-trial-handle=2112,i,10842927432011613917,8062521067577386138,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
      4⤵
      PID:5672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4916,i,5495814158970033942,10958893424903856969,262144 --field-trial-handle=2112,i,10842927432011613917,8062521067577386138,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,9630875994072713693,886991837601421808,524288 --field-trial-handle=2112,i,10842927432011613917,8062521067577386138,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:14
      4⤵
      PID:3572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igbztrlgey.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3792
- - C:\Temp\igbztrlgey.exe
    C:\Temp\igbztrlgey.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4488
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4812
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igbztrlgey.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1204
- - C:\Temp\i_igbztrlgey.exe
    C:\Temp\i_igbztrlgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\idbvtnlfdy.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6068
- - C:\Temp\idbvtnlfdy.exe
    C:\Temp\idbvtnlfdy.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1508
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6016
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_idbvtnlfdy.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:200
- - C:\Temp\i_idbvtnlfdy.exe
    C:\Temp\i_idbvtnlfdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1896
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fayvqnlfdx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4764
- - C:\Temp\fayvqnlfdx.exe
    C:\Temp\fayvqnlfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1632
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1220
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fayvqnlfdx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2476
- - C:\Temp\i_fayvqnlfdx.exe
    C:\Temp\i_fayvqnlfdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\khcavsmkfc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1212
- - C:\Temp\khcavsmkfc.exe
    C:\Temp\khcavsmkfc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1504
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6084
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_khcavsmkfc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1552
- - C:\Temp\i_khcavsmkfc.exe
    C:\Temp\i_khcavsmkfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkecwupmhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5548
- - C:\Temp\mkecwupmhf.exe
    C:\Temp\mkecwupmhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4044
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkecwupmhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2012
- - C:\Temp\i_mkecwupmhf.exe
    C:\Temp\i_mkecwupmhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxupkhezxr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2728
- - C:\Temp\zxupkhezxr.exe
    C:\Temp\zxupkhezxr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1192
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2164
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxupkhezxr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1352
- - C:\Temp\i_zxupkhezxr.exe
    C:\Temp\i_zxupkhezxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5600
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urmjhbzurm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5812
- - C:\Temp\urmjhbzurm.exe
    C:\Temp\urmjhbzurm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4036
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1288
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urmjhbzurm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2156
- - C:\Temp\i_urmjhbzurm.exe
    C:\Temp\i_urmjhbzurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrljdbwuom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1004
- - C:\Temp\wrljdbwuom.exe
    C:\Temp\wrljdbwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2548
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6028
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrljdbwuom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1148
- - C:\Temp\i_wrljdbwuom.exe
    C:\Temp\i_wrljdbwuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytqojdbvto.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1276
- - C:\Temp\ytqojdbvto.exe
    C:\Temp\ytqojdbvto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2756
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5828
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytqojdbvto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4712
- - C:\Temp\i_ytqojdbvto.exe
    C:\Temp\i_ytqojdbvto.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdywqoigbq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5304
- - C:\Temp\gdywqoigbq.exe
    C:\Temp\gdywqoigbq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1776
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2700
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1896
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdywqoigbq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5412
- - C:\Temp\i_gdywqoigbq.exe
    C:\Temp\i_gdywqoigbq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvqkigay.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3840
- - C:\Temp\fdxvqkigay.exe
    C:\Temp\fdxvqkigay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4324
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3548
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvqkigay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5036
- - C:\Temp\i_fdxvqkigay.exe
    C:\Temp\i_fdxvqkigay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfaxvpnifa.exe ups_run
  2⤵
  PID:3976
- - C:\Temp\hfaxvpnifa.exe
    C:\Temp\hfaxvpnifa.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5808
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1512
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfaxvpnifa.exe ups_ins
  2⤵
  PID:1548
- - C:\Temp\i_hfaxvpnifa.exe
    C:\Temp\i_hfaxvpnifa.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxsmkecx.exe ups_run
  2⤵
  PID:244
- - C:\Temp\hfzxsmkecx.exe
    C:\Temp\hfzxsmkecx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2880
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5460
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxsmkecx.exe ups_ins
  2⤵
  PID:3724
- - C:\Temp\i_hfzxsmkecx.exe
    C:\Temp\i_hfzxsmkecx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hezxrpmhez.exe ups_run
  2⤵
  PID:5616
- - C:\Temp\hezxrpmhez.exe
    C:\Temp\hezxrpmhez.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:360
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5928
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hezxrpmhez.exe ups_ins
  2⤵
  PID:3496
- - C:\Temp\i_hezxrpmhez.exe
    C:\Temp\i_hezxrpmhez.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmhezwrpjh.exe ups_run
  2⤵
  PID:4748
- - C:\Temp\rmhezwrpjh.exe
    C:\Temp\rmhezwrpjh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5680
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3484
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmhezwrpjh.exe ups_ins
  2⤵
  PID:5268
- - C:\Temp\i_rmhezwrpjh.exe
    C:\Temp\i_rmhezwrpjh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trmjecwuom.exe ups_run
  2⤵
  PID:4768
- - C:\Temp\trmjecwuom.exe
    C:\Temp\trmjecwuom.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4188
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1628
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trmjecwuom.exe ups_ins
  2⤵
  PID:4720
- - C:\Temp\i_trmjecwuom.exe
    C:\Temp\i_trmjecwuom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbvtolge.exe ups_run
  2⤵
  PID:1304
- - C:\Temp\ljdbvtolge.exe
    C:\Temp\ljdbvtolge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:620
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4028
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbvtolge.exe ups_ins
  2⤵
  PID:468
- - C:\Temp\i_ljdbvtolge.exe
    C:\Temp\i_ljdbvtolge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lidaytqljd.exe ups_run
  2⤵
  PID:5084
- - C:\Temp\lidaytqljd.exe
    C:\Temp\lidaytqljd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:364
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1492
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4072
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lidaytqljd.exe ups_ins
  2⤵
  PID:1060
- - C:\Temp\i_lidaytqljd.exe
    C:\Temp\i_lidaytqljd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnlfdyvqo.exe ups_run
  2⤵
  PID:4848
- - C:\Temp\vtnlfdyvqo.exe
    C:\Temp\vtnlfdyvqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5672
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2196
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnlfdyvqo.exe ups_ins
  2⤵
  PID:5100
- - C:\Temp\i_vtnlfdyvqo.exe
    C:\Temp\i_vtnlfdyvqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3560

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4268

C:\Temp\lgdyvqoiga.sys
C:\Temp\lgdyvqoiga.sys
1⤵
- Executes dropped EXE
PID:4664

C:\Temp\qkidaysqli.sys
C:\Temp\qkidaysqli.sys
1⤵
- Executes dropped EXE
PID:3356

C:\Temp\vpnkfdxvpn.sys
C:\Temp\vpnkfdxvpn.sys
1⤵
- Executes dropped EXE
PID:3492

C:\Temp\fzxsmkfcax.sys
C:\Temp\fzxsmkfcax.sys
1⤵
- Executes dropped EXE
PID:3976

C:\Temp\kecwusmhfz.sys
C:\Temp\kecwusmhfz.sys
1⤵
- Executes dropped EXE
PID:2136

C:\Temp\ecwuomkecw.sys
C:\Temp\ecwuomkecw.sys
1⤵
- Executes dropped EXE
PID:5412

C:\Temp\geywuomgey.sys
C:\Temp\geywuomgey.sys
1⤵
- Executes dropped EXE
PID:2372

C:\Temp\ljgbztrljd.sys
C:\Temp\ljgbztrljd.sys
1⤵
- Executes dropped EXE
PID:1180

C:\Temp\olgeywqoig.sys
C:\Temp\olgeywqoig.sys
1⤵
- Executes dropped EXE
PID:1596

C:\Temp\qlidavtqlf.sys
C:\Temp\qlidavtqlf.sys
1⤵
- Executes dropped EXE
PID:2072

C:\Temp\vqnifaxsqk.sys
C:\Temp\vqnifaxsqk.sys
1⤵
PID:3372

C:\Temp\smkhcausmk.sys
C:\Temp\smkhcausmk.sys
1⤵
PID:5956

C:\Temp\cxupmhfzxr.sys
C:\Temp\cxupmhfzxr.sys
1⤵
PID:3032

C:\Temp\zxrpjhczur.sys
C:\Temp\zxrpjhczur.sys
1⤵
PID:4076

C:\Temp\eywromjecw.sys
C:\Temp\eywromjecw.sys
1⤵
PID:6008

C:\Temp\wqojgbztrl.sys
C:\Temp\wqojgbztrl.sys
1⤵
PID:5004

C:\Temp\dbytrlidbv.sys
C:\Temp\dbytrlidbv.sys
1⤵
PID:4788

C:\Temp\gaytqlidbv.sys
C:\Temp\gaytqlidbv.sys
1⤵
PID:5544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwuomkecw.sys

Path C:\Temp\ecwuomkecw.sys
Size 141KB
SHA256 9cd8008fa779393fb4966faddd2fe83c0e18394f1e5637b5fe7a53a782a4d23b
MD5 e4cc04ff1d0f942fd0eaa1be63efb1ad
SHA1 1293f76d868fde6734dd6e55fcee312bba9f65b4
SHA512 7464bd3c10c0d559640bdfe74fc380a5aac9a33f4d09d3c488850e16dffec2e8fec99e366e366da992d0248d3ac3a7d893dc9cf648aaeb72fbfd99571903ab6d
SSDEEP 1536:Sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltO:Sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T19BE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fayvqnlfdx.exe

Path C:\Temp\fayvqnlfdx.exe
Size 243KB
SHA256 f748b6e89a12610eeeb4e75cb7d906abdb8d5e58d8e387e3aca36d2401d95b41
MD5 89d3f9486c6bd0b6baf758dfa0ceb0d5
SHA1 061dc458441d3de200d0cb8d94c8acf3e1c2e67f
SHA512 966edbac237e6107a9411a4d2e3beff1f5109e629909ff32be7f4b746f12620a56658a7c9703ecca49a79309b423c2569d9b006dcb336dc10b5d1604a863a777
SSDEEP 3072:0CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7a:HvMsLaOa3lLNngoqRttA7a
TLSH
T1B8345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxsmkfcax.sys

Path C:\Temp\fzxsmkfcax.sys
Size 141KB
SHA256 6ea48636de7aa9937e23c4518c05d5309af2947c9a3aa22a2618868c40cd2711
MD5 bf19679d2586aab52ba56404cca50027
SHA1 2e86736f7cd93dba942c475012210da68d69c2aa
SHA512 97548a78e3bc3c9f2aa04ad4c2edd490d91fccefbc1702038e6f57d932afcce9b0baa7307a2848edfce15f02e69f85622078abee5054627c2990ec1b382f5c54
SSDEEP 1536:da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T105E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fayvqnlfdx.exe

Path C:\Temp\i_fayvqnlfdx.exe
Size 243KB
SHA256 50eacdf583e786001ddf4022ddfd4b809ad8866d91b45252633f0e658700377c
MD5 3d6e041982cb26565905872c2ff5f8ae
SHA1 b71454916560e6cd214bb794b4eaf68fbc10921c
SHA512 846ed48bc4cca1d20391da6b2333ce6c0f64785acbea4fc617a715f5d7b5c84939b744672cdb5709e84db34c4a88ce4eab96c09616350fb61f104976e1256a9b
SSDEEP 3072:MCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA72:vvMsLaOa3lLNngoqRttA72
TLSH
T1AB345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_idbvtnlfdy.exe

Path C:\Temp\i_idbvtnlfdy.exe
Size 243KB
SHA256 1dc7bdf2c879fa192722998dedab6ed34bc7ed36c070e8c98f42db44356f5e6f
MD5 8f11a952842fbaa69c01bb90f5c489ae
SHA1 e27daa51dffb4afbc19f92c77e6c04deea18764e
SHA512 d707a2baebc843bc1c7ab096546c9070e5ddb3ba0e9d331dd57b39efee101022cbc85a7c594dccf7d7dbc1b35115c29f641c98f424003574f369d3dadaa31423
SSDEEP 3072:HCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:ivMsLaOa3lLNngoqRttA71
TLSH
T110345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igbztrlgey.exe

Path C:\Temp\i_igbztrlgey.exe
Size 243KB
SHA256 da0f2495f22c74b59343cb96d2ad5b754607b57887cddf1131e2839824d5ec13
MD5 7a86db353eae6328ea8c0b8ffd3c1678
SHA1 06f60a5d582da286616596a46e364d8680517f74
SHA512 25295c646a45696266ef662adb51d2708babb4338d8a0096a3cb7df3146f58496106b17d45ea9aebaff186535741dba7ace18995618d046c7468e44fe7d6807e
SSDEEP 3072:ECvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:XvMsLaOa3lLNngoqRttA7W
TLSH
T14E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_khcavsmkfc.exe

Path C:\Temp\i_khcavsmkfc.exe
Size 243KB
SHA256 d8a150310948c7c6f1f76e5981fc61d8033a3f6ac70a8575a2a12dfda99aa232
MD5 ea48ca093082d5c60d55e76704290b79
SHA1 e6576a4debd67c3b1628dbe4edacd200ef14d3c8
SHA512 619fb9889a446cd61bb93d43c84b2dd50d88ba576413adeb353ee95412bd81e16e386b281ddf5bdf6b45bc058e886ab4c1985639a05a3d1bc3d5c032d6209f52
SSDEEP 3072:VCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA73:YvMsLaOa3lLNngoqRttA73
TLSH
T1A6345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkecwupmhf.exe

Path C:\Temp\i_mkecwupmhf.exe
Size 243KB
SHA256 4eacbe5f4a189bb93fc62f2aa1573f061849c7d0d1c38b0175fb28856b1af60b
MD5 827372c32dddfbf046a0fb5487132031
SHA1 75e16d37f5bd243e8685c85a61fd8bd062d1e7a1
SHA512 35dff7ff17b5a5e8d13f65c0d4eede7314ffc22cd9e9a511809e05dfc4f2b4bd5ca583c8063e7de37efe90bef560b4cacc08ff5cd64d6cc5e4331d4af01c3767
SSDEEP 3072:fCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7x:qvMsLaOa3lLNngoqRttA7x
TLSH
T195345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxupkhezxr.exe

Path C:\Temp\i_zxupkhezxr.exe
Size 243KB
SHA256 fd1961def1fd670d28722fa98828eb8a778196888cd4289b7625d88b869ecfa5
MD5 14c8377a8cd981c558c178cf4971a207
SHA1 36ddde34325bc3f3e44e94d3d77358bbf27457a0
SHA512 214bf9efad70280ff8c2774914d6950dd3d6ac7a9ac303f7178846f5b9b24189781ac46f9a71c9ce1411990cfff25eecce29db4d2001c0bbec7b1ef9e28d38ef
SSDEEP 3072:8CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7O:fvMsLaOa3lLNngoqRttA7O
TLSH
T1B0345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idbvtnlfdy.exe

Path C:\Temp\idbvtnlfdy.exe
Size 243KB
SHA256 4c55c40330c97c3eef3635918c09aa0322af9790a2c2e4e2b672de6ed95c1fcb
MD5 4ede98c6a67057fb1daccb79e66e838d
SHA1 0efb5c515c854faf320596c242dc276af1d57443
SHA512 62ca64aad9600e7355a5451c3127e33a219ab57d6cd4168ef4a12936f4b6edd82161cc1c550f220d17b6c64d44850bb834466134e4d082e19e1254810093ba0a
SSDEEP 3072:ACvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7+:7vMsLaOa3lLNngoqRttA7+
TLSH
T185345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igbztrlgey.exe

Path C:\Temp\igbztrlgey.exe
Size 243KB
SHA256 00a7704ae0bb4c5dcbd2ad90959b66e976b6abd82a5802c9a11f2f23e1b050c2
MD5 2f9992c8f6b63dddfaaf7cdb77bc1fc1
SHA1 c279a219722e8126f4b6cde587957698b1cf7e6a
SHA512 f7a653c75516c73f1a1e868137372ad42e43a980ec44a4c478ec27dc1f4c3d4915c7333d55aac540b3af36757d2e410c980e1ae98d4dda9e5849278a0a58b02a
SSDEEP 3072:3CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7R:SvMsLaOa3lLNngoqRttA7R
TLSH
T1D3345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecwusmhfz.sys

Path C:\Temp\kecwusmhfz.sys
Size 141KB
SHA256 87d8d39368a2f7e8e30bc1672f53aa6189b66d4a8138acd49e19aa4913952590
MD5 bfa0d8b7b6dfca4d20cbf19a260b7f73
SHA1 d293bdc0c9ca5c885635981574204cfcd0d75859
SHA512 2fdfb687c4a43663ce6f26772342de86a4506c9f3731c19e9fce521f23c341e86870547e33934ad701ef569e0c346f0bb0ed972eb924e71c79c94de28cf99080
SSDEEP 1536:da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T16DE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khcavsmkfc.exe

Path C:\Temp\khcavsmkfc.exe
Size 243KB
SHA256 252821f9b7489cb94f980d87a6d948c6c83c899898d53fcc10e7e81994929493
MD5 c8c049cd66716fc7524ffd1ef514db84
SHA1 6ed08dda06d99cda03d22d9d3726e64a3a5d2f09
SHA512 bf77726fbdadcb511e3632eac35161c7e626555554cc5699ea0f4d2446b0743f3647a1dfe4f0f1ca5db5de94620511a944de7ddcd851cefcdc7d8e70daccc229
SSDEEP 3072:mCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:JvMsLaOa3lLNngoqRttA7A
TLSH
T14E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdyvqoiga.sys

Path C:\Temp\lgdyvqoiga.sys
Size 141KB
SHA256 1bf9e2e382623106e26293ed71a78cf9e3f018f7e9470ef93bcfe5c23b4c4664
MD5 cab3e841715efed0377d2828594c4dea
SHA1 4ff993318cdc658ed9e0391c2b557effa036d86e
SHA512 d7855a71366eb2bd6db8f9339f1aba3fe41accba9082760c47f67921b8272c7bd4f43827fcc88735ca59664a3114a77e731fa73868484f2fd0c54b68f1778fd6
SSDEEP 1536:Ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXlt8:Ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C6E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkecwupmhf.exe

Path C:\Temp\mkecwupmhf.exe
Size 243KB
SHA256 1056d4c68f68900a8f372de388f7416d5176f4f274ff332dc353bbbe5d7b14b0
MD5 31734ac8420f971e09ca7f4df5dd8685
SHA1 6be8922c035d46dbc044900e206ecc8c135a98c1
SHA512 5e08380f86e72f37e66c952459dcc83ae637b2fefc54422fb2dea55b0e155fcd2ae19386b9d008435355b61b6d60c1f95af3d0dff0aaa5028d438843a9122931
SSDEEP 3072:/CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA79:KvMsLaOa3lLNngoqRttA79
TLSH
T17C345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkidaysqli.sys

Path C:\Temp\qkidaysqli.sys
Size 141KB
SHA256 5376ec5da772a2e96854fb19b4fde9e65aec7e2d2e8772dbbbd6152f7b2b9fb1
MD5 b03b2272ac197bc7bd4702cb1c07d53e
SHA1 b164ba85bcc3e555bf7f0d22264e78fb8d1b0b74
SHA512 c9a07de66416cae4bdc01c2b4abc51727bffe1574f0b7b25e11b7bacf619aca4be71b375db3c8b41f7684606250a20137d5576d82388fd06dd64be292314dcfe
SSDEEP 1536:4a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:4a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T12AE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnkfdxvpn.sys

Path C:\Temp\vpnkfdxvpn.sys
Size 141KB
SHA256 98738fdb8bbafe92659ba96c0f3b37692520952d546297efde588a5521e38297
MD5 1d64457aa277f573491555edb9d1bedc
SHA1 82ca5fe1eda22682b63e016b7b9d9e941ade602c
SHA512 d8c604cd1276573f049039a413626f6b7c20ab7546e3e477253be097911afcaac2a2265e65d547c3fbde4c9552d293a8ac4c17add7bb69a3580706d962904742
SSDEEP 1536:da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T198E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxupkhezxr.exe

Path C:\Temp\zxupkhezxr.exe
Size 243KB
SHA256 cfe0a1302374cc4d94a01ef9065f66d98dda9eef8bdeb101b5c61e641c466392
MD5 d0da00ca92c1ad57840f50146819314e
SHA1 62b10b71662d5c451d4b865f118b9c9ecb1cf4b3
SHA512 8cd131561e3a11d9cc0343442a8991522d9043b7f49378c76985fc0318a4e966f695ad60e9466c0c2b10c73db096f09e5065d42a1522f24ea732aa7bfa647845
SSDEEP 3072:gCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7y:bvMsLaOa3lLNngoqRttA7y
TLSH
T13A345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a54d1be6da491be16ecc22dac3ad8cfbe4eabb017451e32c26f2904977fde58e
MD5 9daa45ac0383b3b978ad8da2d5000b62
SHA1 f52083ce5d095366a6fa9406b8b49000fcb53bc0
SHA512 ac55ccfd63460f712cd2ffb1ff656349475683b1ec07abd198254ac469a634f7129cf280de184340d8314fe2b8f7e955f7a112deb1511d52de882ae801a7c1af
TLSH
T17DD09B9D6686AE54DD80343134A1E34B9A18F522642C464880177054CCA464246571FF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3f51b0e24e52d8511f72e348c132f84b6b8edb54027a5c8c4fbe2a976322a690
MD5 e32f775acc5ed08adf9d5f6678c2bc4d
SHA1 bd5f4d60c6c8f97a1fed276a8c02ca345e30bb2a
SHA512 2b2fef021516ee5e90b192840780767fff5c147cfb2dfe5b900a8b298d542111707f16c28e265447d090c61e8e091b3529eb29ff376abe03cd34315206805eba
TLSH
T1DAD09B996686AD54DD80343534A1E34B9A18F522102C46488117B064CCA464246561FF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 c6f02d54ef674462801d0dfb46eb66a23dc761b61ab2ad5f646c7d5f860060a9
MD5 9256c761876552f2212259e4801c430e
SHA1 2954ec1a34c8609f2d1fd00dac7198dda628d602
SHA512 5574bca08ae280da79f1fae474005f8f9f3125828f5c776b8b9c36b5ec8645a621a077bf27cb135238b7c51b1a60725bb23da63cc7067f23dfe83dce8f8b557e
TLSH
T10C511E5803F10EC1CFE30E732EF420E87670845A91CB4E243BB69170AD7E70EA48521C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c569.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c569.TMP
Size 2KB
SHA256 26b9319461ea549ab53ff402cb4fe548cd0851a14951c5054849bd2045e742fe
MD5 c734954333be9917023349a841327d20
SHA1 132f43bb424abef8989314c92741c4c75cc85165
SHA512 f6690fa02ea7526b8f9a345b764189522a34d1e8310638e65fce783d439b3d56962b5a7afde39c48e2dc8cd385e417365c9e76714a20ecc0724712d0210e8d63
TLSH
T1E1510B5803F20EC1CFE30E736EF420E87670849A91CB4E283BB69170AD7E70EA48521C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 eb9e62420ddc5419a3b4d60a8e6f7e064b92ecb0e0b1332f2b0598df3476eaab
MD5 5ea91acd320477f8ca85c80e2c04857c
SHA1 a723030aa3995984f0335e1c24becbcf05d27de7
SHA512 82a35927e7c917c9585bb84a1bc5d6e727d2a1e79611bec007dbc01a831ebc6835619bf98b841d45d3b8b40357860b98da453a0c4b70fc8a539f1c96e5503b6b
TLSH
T1F641BDF383E4866EC90156F0AB186E1BCE2C0A15432C3D5AC9E4AF1BA3E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ac158cb9096255bd7c0ba7ac3876456a174df0cde400fe7e8bbb5ad07c27be0a
MD5 0773e583e6f688bd486ebefd967cd310
SHA1 149a223a1a873469f50ab1bfd4dd0064802c6c87
SHA512 73dd4d3ec1b1a5d42bb1b4e2f1aa01576c8174d2257870abad13e4164635004dc030a1343cab66ba0ead38bd0cb8fbd506a91d7d2f683b37f9f60fd22ba73917
SSDEEP 192:sxR2R0yM/jK1Ml8wCK/flszB+kppZFWJs088x5zoA8pi/g6+WNIYDMDGLIgtJ:sxR2W8K/flszB/nFW48xEi/5I+3
TLSH
T15352C8156A28997BCCDBD209FA557F93C6F81573A2905E44AAFCCA0C04E7ADD2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b852232d40366ac84b2ef0524350094fbd5a56ff4b04200836c3f37f80218d28
MD5 6400f75e353777f9e49b180c6c680c35
SHA1 af4ab31c829b68c0e028610809ef6854f029d440
SHA512 6bd72b9e46116e681ff0842e06937cb230fab06ac0923d873431aad4b0bc7975465a35817ee990974d42f0c63344dcb419f19a832c21a00edec2fbe9b042f074
SSDEEP 192:sxRlR0yM/jK1Ml8wCK/flsqB+kppZFWJs088x5zoA8pi/g6+WNIYDMDGLIgDOJ:sxRlW8K/flsqB/nFW48xEi/5I+e
TLSH
T14252C9156A249977CCDBD209FA557F93C6F81573A2905E44AAFC8B0C04E7ADD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 dcae34a1e26c1462fa8e1f36354dfc7cade17cf331870a782ffe68f9c0966ce4
MD5 07caed72a1a5f53c05f74bdc994f9e33
SHA1 9b551236598d9fefc1de9a64e1c33853d188e7c5
SHA512 41ba796a73a0f9f894fc75d6294b0946dbfab6e5f9c21bcd73be8ce8d757d5973440ec9da091222f4a614369716db4a7991ce7b85199e47d56a2bb0774664b3e
SSDEEP 192:sxRlR0yM/jK1Ml8UQLCK/flsqB+klpZFWJs088x5zoA8pw/g6+WNIYDCDGLIgDAJ:sxRlWq+K/flsqBrnFW48xEw/5IO4
TLSH
T1A762D9166A249977DCDBD209FA517B93D6F81473A2905E44AAFCCB0C00E7ADD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 8f59a8f41a7cd9d76ab18e516369ccd1c72161921731ba203a44945494a689c3
MD5 a72a03c6a02c5c67313af95ca120b59c
SHA1 304aa46b2dd0e4e10de7167f7aeaeca0d15cb5a6
SHA512 116ebad663cfe61d2ee1149cd0322957ec8ab86790376d15a2fe2749ea954943990c259868dbf2991202b8666ca146d5aa4f9beb6055ae50a4c53dd1e3d49bcb
SSDEEP 768:f+4+zH7pLuL7eDWgb/fPI8F1+UoAYDCx9Tuqh0VfUC9xbog/OVRBkIn2Uro7k7:f+4+zBE7eDWgb/fPIu1jaWBkw2/7k7
TLSH
T132E2EB7B680CCB7E4F404A9DEC29BD9A6DE801CB96D8C95447FA880C03C7AEB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9e12cb73-ec8f-40d2-b304-4f3902ba1219.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9e12cb73-ec8f-40d2-b304-4f3902ba1219.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6cc09f77b4cc42718dc5cf01d6f639f03b3da50537893f1c1fe4d40018cacf2c
MD5 3c723b5bbcd2659b02711dfe548f3a5a
SHA1 9384160b06a39e9f638aa447e4a5d806f231b231
SHA512 dadb990facbb79396c40b0b069a353107db3d455c40df5bb73f63f2dd668d4ff2e8a12216e1b40a4284235cd233dd7ca80d551d0413f3104601bbc3cf3569df2
SSDEEP 768:0rv+4UNbdC3B10wif60tnaHuVboPzkZLNx9OZvUik4K:0bsbs3BxPNHOawZLNq9UVr
TLSH
T1A303BF35A8749D37DCF79289B18B3A877FF4201385840B98D9DC2B4E45AB4AD170BE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 df107b0c653ceb2db1618fbd1297b6655b7ad7a286963e0637eb8e37c0a3f248
MD5 bf175db5f7e359bf30ac7cefda1c955a
SHA1 7d69f784254410f23a3b7341eb7a38fb032557ee
SHA512 eee33b87e643c8eb62d763b919391296b7d29e60e746abd9e475c96c4968b8446f5b2543fff78560039b3ea9987f577971404da758113f7e0c4777e8252e8c3c
SSDEEP 768:Aj+9L3lBywif60t0uDaHuVboPzkZLNx9OF7b9MlB:/9L3lXP22HOawZLNq1b+lB
TLSH
T1D2F2B031B8259D338CAB86D9B2463AC7BFF0216785C41F88D9D86F0D05979AD1B0BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 7c32ea6f48f311da6b48476f0bd8bd6cdb152ed31c062b09fd6ad09e8802d67b
MD5 03938586dca5e4829b5b6ee1798aeafb
SHA1 4a0fae0ddc334dc623129af4472e2fc4dcc16ae6
SHA512 584af861fc1746bd8adc580d23fbe668ecadab0e6e98b512691fe8daf28139166661c4297c3e4aeda56f12b3f27d4f12d21ef4251f5ae9e0d838b804bf2738f1
SSDEEP 768:YF1j+9g3uwg8Brl0t0uhaHuVboPzkZLNx9OF7b9MlB:V9g3v/2cHOawZLNq1b+lB
TLSH
T122037C36E861CE37ACE787D5B3463A86AEF0116385C86EC4DAD86F4D00975AD0B0BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 72737e08acd4eba3a4a03d5f97c3434ecae62f7f2be759966e6f351e31416340
MD5 978a8b86f2e25bd764f2b05c083db587
SHA1 5d6af2e57dd8f75c2061fb5902632cf8733cf6d0
SHA512 89d6ce3892dd1759cbd70b8f953df49041e7310c814a99cc1f06b6e1327f27288e4fc6465a7c191a0b11a7c31feaeda3fab8b20c0af01389d502bedccf61ee86
SSDEEP 768:Aj+9L3A4ywif60t0unaHuVboPzkZLNx9OF7b9MlB:/9L3AmP2aHOawZLNq1b+lB
TLSH
T102F2BF31B8619D738CAB87D8B24A3AC7BFF0216785C41F88D9D86F0D05975AD1B0BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6088_1011430752\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1180-372-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1180-340-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1596-366-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2072-375-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2136-308-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2372-325-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2372-341-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3032-441-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3032-436-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3356-238-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3372-395-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3372-416-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3492-266-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3492-280-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3976-314-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3976-278-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4076-440-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4664-191-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4788-478-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5004-473-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5412-321-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5544-503-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5956-415-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6008-452-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6008-475-0x0000000000010000-0x0000000000083000-memory.dmp

Download