530dc9197c3b0ac1ae59f397925b293ba69fe5a9fe56c7606b9f590151bc0d50

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 18:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_0bad8babb4692268fc5ba94b519ea8e7_elex_rhadamanthys_stop.exe
Size 243KB
Sample260709-wrrrjsft6r
SHA256 530dc9197c3b0ac1ae59f397925b293ba69fe5a9fe56c7606b9f590151bc0d50
MD5 0bad8babb4692268fc5ba94b519ea8e7
SHA1 67da818d38e782969af33a5a700fc540161af48c
SHA512 ab9c8602a077b61fd2526fd20f44cafe0e82a3bc86d5fbddc2dfc9106827eba83d905405faf5134eeb80dda8df1850e3a02561ac437f91e5ebc1e4b34265308e
SSDEEP 3072:NCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7/:AvMsLaOa3lLNngoqRttA7/
TLSH
T166345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1940	CP.exe
4124	bztrmjecwu.exe
2936	CP.exe
2656	CP.exe
4724	i_bztrmjecwu.exe
2256	gebztrmjeb.sys
4684	CP.exe
5796	ljhbztrlje.exe
4428	CP.exe
976	CP.exe
5812	i_ljhbztrlje.exe
760	ztrljdbvto.sys
1828	CP.exe
4116	ligbytrljd.exe
3264	CP.exe
5920	CP.exe
3648	i_ligbytrljd.exe
4868	wqoigaytnl.sys
1272	CP.exe
5732	igdywqoigb.exe
4680	CP.exe
6132	CP.exe
1604	i_igdywqoigb.exe
4248	sqnigavsql.sys
3416	CP.exe
3260	ifaysqkica.exe
2964	CP.exe
6136	CP.exe
5456	i_ifaysqkica.exe
5076	kigaysqkid.sys
1592	CP.exe
2772	vpnhfaxspk.exe
5684	CP.exe
5332	CP.exe
2044	i_vpnhfaxspk.exe
4772	khfzxspkic.sys
248	CP.exe
5656	caxspkhfzx.exe
3092	CP.exe
2092	CP.exe
3192	i_caxspkhfzx.exe
4924	czxrpkhczu.sys
4600	CP.exe
2700	upmkecxupn.exe
4904	CP.exe
2904	CP.exe
1604	i_upmkecxupn.exe
6052	pmhcwuomge.sys
5456	CP.exe
4200	ecwuomhezx.exe
4728	CP.exe
4588	CP.exe
4456	i_ecwuomhezx.exe
1380	wtrmjecwug.sys
3732	CP.exe
3664	ebztrljhbz.exe
704	CP.exe
3332	CP.exe
4092	i_ebztrljhbz.exe
2228	jgbzwrojge.sys
4948	CP.exe
3244	gebztromyv.exe
2820	CP.exe
4104	CP.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3932_533370422\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3932_533370422\protocols.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3932_2142443477\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnhfaxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qolgeywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qolgeywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czusmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebwuomjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_0bad8babb4692268fc5ba94b519ea8e7_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljhbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caxspkhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebztrljhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czusmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaysqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnhfaxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmkecxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgeywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igdywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaysqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caxspkhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebztrljhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtolgdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czxspkhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebwuomjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgeywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrmjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrmjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljhbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ligbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igdywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gebztromyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ligbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdxvqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cavsqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cavsqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usqkicausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czxspkhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmkecxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gebztromyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdxvqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usqkicausn.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
752	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3416	ipconfig.exe
4536	ipconfig.exe
4180	ipconfig.exe
4672	ipconfig.exe
4536	ipconfig.exe
4184	ipconfig.exe
3184	ipconfig.exe
3568	ipconfig.exe
3960	ipconfig.exe
3256	ipconfig.exe
3924	ipconfig.exe
4648	ipconfig.exe
4448	ipconfig.exe
4504	ipconfig.exe
1476	ipconfig.exe
984	ipconfig.exe
5968	ipconfig.exe
1952	ipconfig.exe
5632	ipconfig.exe
3888	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{C5B31087-9C67-4D44-9748-A8BB8F557B25}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5152	msedge.exe
5152	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4724	i_bztrmjecwu.exe
Token: SeDebugPrivilege	5812	i_ljhbztrlje.exe
Token: SeDebugPrivilege	3648	i_ligbytrljd.exe
Token: SeDebugPrivilege	1604	i_igdywqoigb.exe
Token: SeDebugPrivilege	5456	i_ifaysqkica.exe
Token: SeDebugPrivilege	2044	i_vpnhfaxspk.exe
Token: SeDebugPrivilege	3192	i_caxspkhfzx.exe
Token: SeDebugPrivilege	1604	i_upmkecxupn.exe
Token: SeDebugPrivilege	4456	i_ecwuomhezx.exe
Token: SeDebugPrivilege	4092	i_ebztrljhbz.exe
Token: SeDebugPrivilege	3172	i_gebztromyv.exe
Token: SeDebugPrivilege	3316	i_qolgeywqoi.exe
Token: SeDebugPrivilege	2028	i_nlfdxvqnig.exe
Token: SeDebugPrivilege	4660	i_cavsqkicav.exe
Token: SeDebugPrivilege	2184	i_usqkicausn.exe
Token: SeDebugPrivilege	4816	i_czxspkhczu.exe
Token: SeDebugPrivilege	3132	i_czusmkecwu.exe
Token: SeDebugPrivilege	5572	i_jebwuomjhb.exe
Token: SeDebugPrivilege	760	i_olgeywqoig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3932	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 3644	1356	2026-07-09_0bad8babb4692268fc5ba94b519ea8e7_elex_rhadamanthys_stop.exe	86
PID 3644 wrote to memory of 3932	3644	iexplore.exe	87
PID 3932 wrote to memory of 5524	3932	msedge.exe	88
PID 3932 wrote to memory of 1680	3932	msedge.exe	89
PID 3932 wrote to memory of 752	3932	msedge.exe	90
PID 3932 wrote to memory of 1680	3932	msedge.exe	89
PID 3932 wrote to memory of 1680	3932	msedge.exe	89
PID 3932 wrote to memory of 3892	3932	msedge.exe	91
PID 3932 wrote to memory of 3892	3932	msedge.exe	91
PID 3932 wrote to memory of 2876	3932	msedge.exe	92
PID 3932 wrote to memory of 2876	3932	msedge.exe	92
PID 3932 wrote to memory of 2876	3932	msedge.exe	92
PID 3932 wrote to memory of 3272	3932	msedge.exe	93
PID 3932 wrote to memory of 3272	3932	msedge.exe	93
PID 3932 wrote to memory of 3272	3932	msedge.exe	93
PID 3932 wrote to memory of 5500	3932	msedge.exe	95
PID 3932 wrote to memory of 5500	3932	msedge.exe	95
PID 3932 wrote to memory of 5500	3932	msedge.exe	95
PID 3932 wrote to memory of 5908	3932	msedge.exe	96
PID 3932 wrote to memory of 5908	3932	msedge.exe	96
PID 3932 wrote to memory of 5908	3932	msedge.exe	96
PID 3932 wrote to memory of 4620	3932	msedge.exe	97
PID 3932 wrote to memory of 4620	3932	msedge.exe	97
PID 1356 wrote to memory of 1940	1356	2026-07-09_0bad8babb4692268fc5ba94b519ea8e7_elex_rhadamanthys_stop.exe	99
PID 4124 wrote to memory of 2936	4124	bztrmjecwu.exe	102
PID 3932 wrote to memory of 4320	3932	msedge.exe	105
PID 3932 wrote to memory of 2612	3932	msedge.exe	106
PID 3932 wrote to memory of 4320	3932	msedge.exe	105
PID 3932 wrote to memory of 2612	3932	msedge.exe	106
PID 3932 wrote to memory of 2368	3932	msedge.exe	108
PID 3932 wrote to memory of 3256	3932	msedge.exe	109
PID 3932 wrote to memory of 3256	3932	msedge.exe	109
PID 3932 wrote to memory of 3288	3932	msedge.exe	110
PID 3932 wrote to memory of 3288	3932	msedge.exe	110
PID 1356 wrote to memory of 2656	1356	2026-07-09_0bad8babb4692268fc5ba94b519ea8e7_elex_rhadamanthys_stop.exe	113
PID 1356 wrote to memory of 4684	1356	2026-07-09_0bad8babb4692268fc5ba94b519ea8e7_elex_rhadamanthys_stop.exe	117
PID 5796 wrote to memory of 4428	5796	ljhbztrlje.exe	119
PID 1356 wrote to memory of 976	1356	2026-07-09_0bad8babb4692268fc5ba94b519ea8e7_elex_rhadamanthys_stop.exe	122
PID 1356 wrote to memory of 1828	1356	2026-07-09_0bad8babb4692268fc5ba94b519ea8e7_elex_rhadamanthys_stop.exe	126
PID 4116 wrote to memory of 3264	4116	ligbytrljd.exe	128
PID 1356 wrote to memory of 5920	1356	2026-07-09_0bad8babb4692268fc5ba94b519ea8e7_elex_rhadamanthys_stop.exe	131
PID 3932 wrote to memory of 996	3932	msedge.exe	133
PID 3932 wrote to memory of 996	3932	msedge.exe	133
PID 3932 wrote to memory of 996	3932	msedge.exe	133
PID 3932 wrote to memory of 5340	3932	msedge.exe	136
PID 3932 wrote to memory of 5340	3932	msedge.exe	136
PID 3932 wrote to memory of 5340	3932	msedge.exe	136
PID 1356 wrote to memory of 1272	1356	2026-07-09_0bad8babb4692268fc5ba94b519ea8e7_elex_rhadamanthys_stop.exe	137
PID 5732 wrote to memory of 4680	5732	igdywqoigb.exe	139
PID 1356 wrote to memory of 6132	1356	2026-07-09_0bad8babb4692268fc5ba94b519ea8e7_elex_rhadamanthys_stop.exe	142
PID 3932 wrote to memory of 4724	3932	msedge.exe	144
PID 3932 wrote to memory of 1440	3932	msedge.exe	145
PID 3932 wrote to memory of 916	3932	msedge.exe	146
PID 1356 wrote to memory of 3416	1356	2026-07-09_0bad8babb4692268fc5ba94b519ea8e7_elex_rhadamanthys_stop.exe	149
PID 3260 wrote to memory of 2964	3260	ifaysqkica.exe	151
PID 1356 wrote to memory of 6136	1356	2026-07-09_0bad8babb4692268fc5ba94b519ea8e7_elex_rhadamanthys_stop.exe	154
PID 1356 wrote to memory of 1592	1356	2026-07-09_0bad8babb4692268fc5ba94b519ea8e7_elex_rhadamanthys_stop.exe	158
PID 2772 wrote to memory of 5684	2772	vpnhfaxspk.exe	160
PID 1356 wrote to memory of 5332	1356	2026-07-09_0bad8babb4692268fc5ba94b519ea8e7_elex_rhadamanthys_stop.exe	163
PID 1356 wrote to memory of 248	1356	2026-07-09_0bad8babb4692268fc5ba94b519ea8e7_elex_rhadamanthys_stop.exe	167
PID 5656 wrote to memory of 3092	5656	caxspkhfzx.exe	169
PID 3932 wrote to memory of 2952	3932	msedge.exe	172
PID 3932 wrote to memory of 2952	3932	msedge.exe	172
PID 3932 wrote to memory of 2952	3932	msedge.exe	172

C:\Users\Admin\AppData\Local\Temp\2026-07-09_0bad8babb4692268fc5ba94b519ea8e7_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_0bad8babb4692268fc5ba94b519ea8e7_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffe2b95c188,0x7ffe2b95c194,0x7ffe2b95c1a0
      4⤵
      PID:5524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,15382662231886730756,1300386780789498924,262144 --field-trial-handle=2704,i,6126735508299729560,15592815584547771077,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:2
      4⤵
      PID:1680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,15964358791942396575,13873360457798660172,524288 --field-trial-handle=2704,i,6126735508299729560,15592815584547771077,262144 --variations-seed-version --mojo-platform-channel-handle=2808 /prefetch:11
      4⤵
      System Time Discovery
      PID:752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,8347814278759552468,7530232074083336448,524288 --field-trial-handle=2704,i,6126735508299729560,15592815584547771077,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:13
      4⤵
      PID:3892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,14880281473357166384,16383488983447156969,2097152 --field-trial-handle=2704,i,6126735508299729560,15592815584547771077,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:2876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,11467076512310452099,13156663512484160100,2097152 --field-trial-handle=2704,i,6126735508299729560,15592815584547771077,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:3272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,209073623075453009,2521466060071125178,2097152 --field-trial-handle=2704,i,6126735508299729560,15592815584547771077,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:9
      4⤵
      PID:5500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,730287535388804177,17535027363490631021,2097152 --field-trial-handle=2704,i,6126735508299729560,15592815584547771077,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
      4⤵
      PID:5908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,4417225018025406862,7138115849487099931,524288 --field-trial-handle=2704,i,6126735508299729560,15592815584547771077,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:14
      4⤵
      PID:4620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,2463255676275740474,1933282781709817894,524288 --field-trial-handle=2704,i,6126735508299729560,15592815584547771077,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
      4⤵
      PID:4320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,359418373039226944,10948818880409244704,524288 --field-trial-handle=2704,i,6126735508299729560,15592815584547771077,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
      4⤵
      PID:2612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,13253549180320778964,8702431079147592828,524288 --field-trial-handle=2704,i,6126735508299729560,15592815584547771077,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
      4⤵
      PID:2664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,13253549180320778964,8702431079147592828,524288 --field-trial-handle=2704,i,6126735508299729560,15592815584547771077,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
      4⤵
      PID:2368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,8191397567922385386,14795815043440062423,524288 --field-trial-handle=2704,i,6126735508299729560,15592815584547771077,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
      4⤵
      PID:3256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,13195841400586803198,15760770063599776914,524288 --field-trial-handle=2704,i,6126735508299729560,15592815584547771077,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
      4⤵
      PID:3288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4488,i,2940809898698474714,14720764232315320045,2097152 --field-trial-handle=2704,i,6126735508299729560,15592815584547771077,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:1
      4⤵
      PID:996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3604,i,6284759983158265813,3503388312451001777,2097152 --field-trial-handle=2704,i,6126735508299729560,15592815584547771077,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:1
      4⤵
      PID:5340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,9017135558386249065,16772866064270323374,524288 --field-trial-handle=2704,i,6126735508299729560,15592815584547771077,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:14
      4⤵
      PID:4724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3824,i,9671790972586268192,17062175171681840773,524288 --field-trial-handle=2704,i,6126735508299729560,15592815584547771077,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:14
      4⤵
      PID:1440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3828,i,10995066287967969142,8639043471091275920,524288 --field-trial-handle=2704,i,6126735508299729560,15592815584547771077,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:14
      4⤵
      PID:916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4988,i,336900418525472735,9076826318440596532,2097152 --field-trial-handle=2704,i,6126735508299729560,15592815584547771077,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
      4⤵
      PID:2952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,7246747140445476792,11128271421261854373,524288 --field-trial-handle=2704,i,6126735508299729560,15592815584547771077,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:14
      4⤵
      PID:4228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,8032363237264789913,13322084680956724103,524288 --field-trial-handle=2704,i,6126735508299729560,15592815584547771077,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
      4⤵
      PID:2024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5848,i,1601089877791377720,10120739091016134724,2097152 --field-trial-handle=2704,i,6126735508299729560,15592815584547771077,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:1
      4⤵
      PID:508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6232,i,4614669313894969361,988840908578150717,262144 --field-trial-handle=2704,i,6126735508299729560,15592815584547771077,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,16342673519565437533,18000328502191234953,524288 --field-trial-handle=2704,i,6126735508299729560,15592815584547771077,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:14
      4⤵
      PID:2916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrmjecwu.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1940
- - C:\Temp\bztrmjecwu.exe
    C:\Temp\bztrmjecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4124
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2936
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrmjecwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2656
- - C:\Temp\i_bztrmjecwu.exe
    C:\Temp\i_bztrmjecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljhbztrlje.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4684
- - C:\Temp\ljhbztrlje.exe
    C:\Temp\ljhbztrlje.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5796
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4428
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljhbztrlje.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:976
- - C:\Temp\i_ljhbztrlje.exe
    C:\Temp\i_ljhbztrlje.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ligbytrljd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1828
- - C:\Temp\ligbytrljd.exe
    C:\Temp\ligbytrljd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4116
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3264
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ligbytrljd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5920
- - C:\Temp\i_ligbytrljd.exe
    C:\Temp\i_ligbytrljd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3648
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igdywqoigb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1272
- - C:\Temp\igdywqoigb.exe
    C:\Temp\igdywqoigb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5732
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4680
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igdywqoigb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6132
- - C:\Temp\i_igdywqoigb.exe
    C:\Temp\i_igdywqoigb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifaysqkica.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3416
- - C:\Temp\ifaysqkica.exe
    C:\Temp\ifaysqkica.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3260
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2964
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifaysqkica.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6136
- - C:\Temp\i_ifaysqkica.exe
    C:\Temp\i_ifaysqkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnhfaxspk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1592
- - C:\Temp\vpnhfaxspk.exe
    C:\Temp\vpnhfaxspk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5684
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnhfaxspk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5332
- - C:\Temp\i_vpnhfaxspk.exe
    C:\Temp\i_vpnhfaxspk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\caxspkhfzx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:248
- - C:\Temp\caxspkhfzx.exe
    C:\Temp\caxspkhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5656
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3092
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4180
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_caxspkhfzx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2092
- - C:\Temp\i_caxspkhfzx.exe
    C:\Temp\i_caxspkhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upmkecxupn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4600
- - C:\Temp\upmkecxupn.exe
    C:\Temp\upmkecxupn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2700
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4904
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upmkecxupn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2904
- - C:\Temp\i_upmkecxupn.exe
    C:\Temp\i_upmkecxupn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwuomhezx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5456
- - C:\Temp\ecwuomhezx.exe
    C:\Temp\ecwuomhezx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4200
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4728
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4504
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwuomhezx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4588
- - C:\Temp\i_ecwuomhezx.exe
    C:\Temp\i_ecwuomhezx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebztrljhbz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3732
- - C:\Temp\ebztrljhbz.exe
    C:\Temp\ebztrljhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3664
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:704
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebztrljhbz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3332
- - C:\Temp\i_ebztrljhbz.exe
    C:\Temp\i_ebztrljhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gebztromyv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4948
- - C:\Temp\gebztromyv.exe
    C:\Temp\gebztromyv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3244
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2820
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gebztromyv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4104
- - C:\Temp\i_gebztromyv.exe
    C:\Temp\i_gebztromyv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qolgeywqoi.exe ups_run
  2⤵
  PID:2584
- - C:\Temp\qolgeywqoi.exe
    C:\Temp\qolgeywqoi.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3760
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1752
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qolgeywqoi.exe ups_ins
  2⤵
  PID:784
- - C:\Temp\i_qolgeywqoi.exe
    C:\Temp\i_qolgeywqoi.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlfdxvqnig.exe ups_run
  2⤵
  PID:624
- - C:\Temp\nlfdxvqnig.exe
    C:\Temp\nlfdxvqnig.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4916
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2776
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlfdxvqnig.exe ups_ins
  2⤵
  PID:3296
- - C:\Temp\i_nlfdxvqnig.exe
    C:\Temp\i_nlfdxvqnig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2028
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cavsqkicav.exe ups_run
  2⤵
  PID:476
- - C:\Temp\cavsqkicav.exe
    C:\Temp\cavsqkicav.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5504
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3268
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cavsqkicav.exe ups_ins
  2⤵
  PID:3408
- - C:\Temp\i_cavsqkicav.exe
    C:\Temp\i_cavsqkicav.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usqkicausn.exe ups_run
  2⤵
  PID:1664
- - C:\Temp\usqkicausn.exe
    C:\Temp\usqkicausn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:616
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4708
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usqkicausn.exe ups_ins
  2⤵
  PID:5100
- - C:\Temp\i_usqkicausn.exe
    C:\Temp\i_usqkicausn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\czxspkhczu.exe ups_run
  2⤵
  PID:1996
- - C:\Temp\czxspkhczu.exe
    C:\Temp\czxspkhczu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2608
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5612
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_czxspkhczu.exe ups_ins
  2⤵
  PID:5492
- - C:\Temp\i_czxspkhczu.exe
    C:\Temp\i_czxspkhczu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\czusmkecwu.exe ups_run
  2⤵
  PID:1756
- - C:\Temp\czusmkecwu.exe
    C:\Temp\czusmkecwu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5660
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4968
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_czusmkecwu.exe ups_ins
  2⤵
  PID:1000
- - C:\Temp\i_czusmkecwu.exe
    C:\Temp\i_czusmkecwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jebwuomjhb.exe ups_run
  2⤵
  PID:4528
- - C:\Temp\jebwuomjhb.exe
    C:\Temp\jebwuomjhb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1908
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1320
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jebwuomjhb.exe ups_ins
  2⤵
  PID:824
- - C:\Temp\i_jebwuomjhb.exe
    C:\Temp\i_jebwuomjhb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\olgeywqoig.exe ups_run
  2⤵
  PID:4444
- - C:\Temp\olgeywqoig.exe
    C:\Temp\olgeywqoig.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4156
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3912
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_olgeywqoig.exe ups_ins
  2⤵
  PID:2476
- - C:\Temp\i_olgeywqoig.exe
    C:\Temp\i_olgeywqoig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvtolgdbwt.exe ups_run
  2⤵
  PID:1264
- - C:\Temp\bvtolgdbwt.exe
    C:\Temp\bvtolgdbwt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6060
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5320
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4648

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2188

C:\Temp\gebztrmjeb.sys
C:\Temp\gebztrmjeb.sys
1⤵
- Executes dropped EXE
PID:2256

C:\Temp\ztrljdbvto.sys
C:\Temp\ztrljdbvto.sys
1⤵
- Executes dropped EXE
PID:760

C:\Temp\wqoigaytnl.sys
C:\Temp\wqoigaytnl.sys
1⤵
- Executes dropped EXE
PID:4868

C:\Temp\sqnigavsql.sys
C:\Temp\sqnigavsql.sys
1⤵
- Executes dropped EXE
PID:4248

C:\Temp\kigaysqkid.sys
C:\Temp\kigaysqkid.sys
1⤵
- Executes dropped EXE
PID:5076

C:\Temp\khfzxspkic.sys
C:\Temp\khfzxspkic.sys
1⤵
- Executes dropped EXE
PID:4772

C:\Temp\czxrpkhczu.sys
C:\Temp\czxrpkhczu.sys
1⤵
- Executes dropped EXE
PID:4924

C:\Temp\pmhcwuomge.sys
C:\Temp\pmhcwuomge.sys
1⤵
- Executes dropped EXE
PID:6052

C:\Temp\wtrmjecwug.sys
C:\Temp\wtrmjecwug.sys
1⤵
- Executes dropped EXE
PID:1380

C:\Temp\jgbzwrojge.sys
C:\Temp\jgbzwrojge.sys
1⤵
- Executes dropped EXE
PID:2228

C:\Temp\nljdbywqoi.sys
C:\Temp\nljdbywqoi.sys
1⤵
PID:5780

C:\Temp\tnlfdxvqni.sys
C:\Temp\tnlfdxvqni.sys
1⤵
PID:2608

C:\Temp\nlfdavsqnl.sys
C:\Temp\nlfdavsqnl.sys
1⤵
PID:4676

C:\Temp\fcxvsnkfdx.sys
C:\Temp\fcxvsnkfdx.sys
1⤵
PID:3764

C:\Temp\nkecxupnhf.sys
C:\Temp\nkecxupnhf.sys
1⤵
PID:4504

C:\Temp\mkecwupmhf.sys
C:\Temp\mkecwupmhf.sys
1⤵
PID:1380

C:\Temp\czurmjwuom.sys
C:\Temp\czurmjwuom.sys
1⤵
PID:4328

C:\Temp\geywrojhbz.sys
C:\Temp\geywrojhbz.sys
1⤵
PID:4832

C:\Temp\ljgbytrojg.sys
C:\Temp\ljgbytrojg.sys
1⤵
PID:4800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrmjecwu.exe

Path C:\Temp\bztrmjecwu.exe
Size 243KB
SHA256 ea72dfa302862b30c252fe432f3d90357f696c41136a9a7d7b89c7fc2b9d6d13
MD5 78011c4f4d42a2fd742fb917b806a70d
SHA1 422831b3b3507d84baaa4dc469e5949e9d9eac22
SHA512 d826335fae49852c2467a3a554eb7413091687c19bfd66a7ceb70cdc9f120e95aa73612fd9c83179b9331ecd4ad7c266bacc4f8401315985a31738d3fa4b3650
SSDEEP 3072:9CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA73:wvMsLaOa3lLNngoqRttA73
TLSH
T1E0345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gebztrmjeb.sys

Path C:\Temp\gebztrmjeb.sys
Size 141KB
SHA256 b17baff9f5a5d924f70a7f73d970e5036395554547c07418805cc389263a6aff
MD5 2265a3542c175d5ca0a2db7c1cb49bcd
SHA1 92c860fdca034974515bfe628d0a680e9490c323
SHA512 d90057ee0b958f61c58e3792eafd6b0fa31baf0fcb6e7ccf99c54ef1a420511cec59dc6a0c1493a323c4d1283c71020dfe0ed577dab298c69aa677e42376427b
SSDEEP 1536:za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T19BE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bztrmjecwu.exe

Path C:\Temp\i_bztrmjecwu.exe
Size 243KB
SHA256 f91ecad661d8d01004512ed712e8b9dbd9c208540292d36b2a38e061a048121c
MD5 a4e453970c53300c78bf3a4cc6f70fe5
SHA1 ff994e8e5138362dbe993c812c9377790a11bd55
SHA512 00a1e4010fdb8ded3e467f7256b3d3e8846ff079bbc83c510dd3832234d90d59738735bc154616b322aca59794d7238f9cbec4af79e60d8b05a1d5567c1967f3
SSDEEP 3072:iCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:dvMsLaOa3lLNngoqRttA7g
TLSH
T184345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ifaysqkica.exe

Path C:\Temp\i_ifaysqkica.exe
Size 243KB
SHA256 c12ceb9ce3f2375fc6080368a4b2770409f11a9e846aedc3d5d6fccc96408b11
MD5 867ca928c27da9910d8de8cbf98572ee
SHA1 b9484de13e0c012df4cb3649dddbbf9f6cec879a
SHA512 46f32fbb54d659d4f53e651e09fbaf15c995a1045879d7f458aea031dc118b6c603e6ea602ef741cf8a1264d054ebdf896835be6d1366bd96ebb00eb545873a2
SSDEEP 3072:yCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7U:tvMsLaOa3lLNngoqRttA7U
TLSH
T178345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igdywqoigb.exe

Path C:\Temp\i_igdywqoigb.exe
Size 243KB
SHA256 32742526e5a94f7b24bbc5336eec338f4139874e176ef67eb5e1ba7edad42835
MD5 b85298fb4a838944fdb2a97659abe91f
SHA1 402c8bbf1c0c4b7bb70ada024a8b77d6c7a2a7d9
SHA512 2e329818ce40d75af8c8ae55bdca4f9e4e44c380b016fa0112ff150178cb129bac0d0b32e3703226fcfa4f3b9f28777859d5036bd7d1e2e6966b01d3c5dad58a
SSDEEP 3072:aMCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Ik:avvMsLaOa3lLNngoqRttA7Ik
TLSH
T10F345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ligbytrljd.exe

Path C:\Temp\i_ligbytrljd.exe
Size 243KB
SHA256 bbcb77d8c429408a8dc9339966fe1a99e1ed811dbebd4c7e52e3ebc74462bf5b
MD5 89e29d240baa3e587fb46cb3a542c862
SHA1 e1c4865b8e4fcf5f06a1dca764874ffba6178a36
SHA512 7d1d9ac53c58184fc5b67f63f59f71aa28e614ac813299a4fb863d5d9f4d4329f18f0b11a46b5a23d5eeaced029d74f50880ad1b54ad91a4d8872e93fef061e6
SSDEEP 3072:cCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7O:/vMsLaOa3lLNngoqRttA7O
TLSH
T1DC345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljhbztrlje.exe

Path C:\Temp\i_ljhbztrlje.exe
Size 243KB
SHA256 adeb4386eabb81f7de989226dc4caa6db837b5c650b6417aa97fd117a3f69ab3
MD5 ff3ea33b6e1e4c53e97ae46c139ac4d4
SHA1 16e356e085d6d42d9c340905592857eb8d4ef3d7
SHA512 abf8b0ae4cf54adfe3ba07b8e762cca57024a443456f77582663a37213aa12721450a8f3fa805defc7ab9d7d224f7663c9f9a1738e22f28096880424987c9729
SSDEEP 3072:nCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA79:CvMsLaOa3lLNngoqRttA79
TLSH
T1AA345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaysqkica.exe

Path C:\Temp\ifaysqkica.exe
Size 243KB
SHA256 b309deb4821acf89cfaf6b5ca9db86133ae6e72599e8c2948b9ff416bc59ebe3
MD5 a42e659f030350ced0aba18f710cb16d
SHA1 55f944837c2bfc6941c796ecf8ed03790c6e4638
SHA512 75625864a4472a1f362d3e1ffb9144b2900cddb6abb3ae0cbe4e850a43b7db0c33148271da360500ab8b5cd417ba72e44add1bba94bfa0b6544401ef3fe7a3bf
SSDEEP 3072:uCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA70:hvMsLaOa3lLNngoqRttA70
TLSH
T173345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igdywqoigb.exe

Path C:\Temp\igdywqoigb.exe
Size 243KB
SHA256 d574b601b96f38b797f392faebb24ca2f26d00e395cb596fb68fb08602b5bd12
MD5 34644226a877f06b7ae44e8da6ae662a
SHA1 08ec685102b3f58f6cdb1a2d46bb2651927085e1
SHA512 4435237b6cf7e4f9e5590f2a86c18e6a7b4a02540205cf1001584d3abfd4c17090c74604a23b5dde890898b81fa9288b468f30d250a02b20aa504d415c5c9263
SSDEEP 3072:uCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7w:hvMsLaOa3lLNngoqRttA7w
TLSH
T16D345A017281C031E7160B78045AE7A1467EBC384BA9E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kigaysqkid.sys

Path C:\Temp\kigaysqkid.sys
Size 141KB
SHA256 e63d6d03dd2fffc676196170e9ece38abf00bbcdea2c9f3644e96751ab2ad390
MD5 dd90c65ff666ce4663d12a270dc20609
SHA1 e08d5ddd92ac221fa0c20e61ee32651857fd9ff8
SHA512 42d167107ce1d8e423190ec9b4642efdf7bd021e60e6f66dd7b1c24718f5a3cb7e9f5f6f1c30b4dfd020d7f4d90d4c9e291df06aa50520908a44f0e35f7c0bd1
SSDEEP 1536:na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T11EE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ligbytrljd.exe

Path C:\Temp\ligbytrljd.exe
Size 243KB
SHA256 68485599337530dc6293d4a374ab4c6815a009264edb3d479689ac5d6e79adc1
MD5 0577348c808513e2ebab84bda5641037
SHA1 397f19872fcdbc957ce882aa9bbbef3d92ad4d5d
SHA512 05bdb808096fae5a3b88f85bce0cabb437746c9d1c1a271da0b220cfc2ff0acc8afd797af725800d101f3ccc189d3480e03bf8d8204b84da4e69dbfb15de3f42
SSDEEP 3072:5CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7L:kvMsLaOa3lLNngoqRttA7L
TLSH
T13C345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljhbztrlje.exe

Path C:\Temp\ljhbztrlje.exe
Size 243KB
SHA256 6c3113dc11334f7fe9b5a10206d4b82b0feaada6c31c1ac6b63b64d63d494fc5
MD5 e7bbfe52e9787ef40cffb6022e67b1a2
SHA1 dac48f646ac73ae330266208acec83e746d374e6
SHA512 b0927c9c73a359d42cc504c25f3f4ea848e6756f3516a65720e5ae21169026eac6c9416189a16f3e520294519e2561704bf21ad525f6bd4ef2c69a9f7453fe41
SSDEEP 3072:aCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7U:FvMsLaOa3lLNngoqRttA7U
TLSH
T14B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqnigavsql.sys

Path C:\Temp\sqnigavsql.sys
Size 141KB
SHA256 b5b0b9023293aef3b28c17a023f2ab9d9c15080eb150b178dacdfef9083d5bc4
MD5 aba167ac80fea39163708365c2e22e45
SHA1 311b79c778113e423f949da38885c2c7cad1a1cf
SHA512 2a72ca1c206565d4011dc50699411381eeed6c37a6b8810f3fe4e59a41336861709ac35ef139631f632c015a0fd1a092b712d51dce6bcdf211df3b0584b410c4
SSDEEP 1536:ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T128E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnhfaxspk.exe

Path C:\Temp\vpnhfaxspk.exe
Size 243KB
SHA256 5f2bbf78b1419e34b610a9a58fea372a40218f1e7940a0512662f85e379094c7
MD5 403549da454df00fb7b9a306413c099e
SHA1 9c1adf7521acafaee335263ed73571a02c4b9052
SHA512 23de9d12c05a2482d77caaebfa5ad11d1cf32020e3b8712a171e7b509b570954583d32c55207b2b4b89c51941fd6cb81deb69e07bf6f2bbb1a5903c1f9d211fa
SSDEEP 3072:uCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:hvMsLaOa3lLNngoqRttA7Y
TLSH
T11C345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqoigaytnl.sys

Path C:\Temp\wqoigaytnl.sys
Size 141KB
SHA256 765e0fbf8c7d4d028ea5ce1b160e273ec2c45a8742850af97f6e4dee719b62df
MD5 d57b558ae0daa5fe49754e0fe49722a6
SHA1 da74cad73220f2f226cb8247d76ec3230b74fbdd
SHA512 3eab810690c1461119c04412351def306d966820a0fb39dd87939a1c46e6cb8e3820cd4f1d9b583988c27071ae5d3065b5f6a19b39d506bd7b3fd3026e35ca24
SSDEEP 1536:qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T190E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljdbvto.sys

Path C:\Temp\ztrljdbvto.sys
Size 141KB
SHA256 0e4c3118d6beed9ea2b68a0a82cc94d22da6496b9a32dd99436e072e78795dfc
MD5 4fc12e032da910d2965f18d030f42d2e
SHA1 9708a9d33ead2fbe20b1f8d7dc82408873773f41
SHA512 c4adaa16ca86192cd81a72b66112b478db461ed9ed8ed89296277e050c9c37701a9c27e1da83178a0763e5e97d80cfca99ae3010b450b2a2795ab174da0588c2
SSDEEP 1536:Ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T151E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee3af991fa1719733ca1e3ac746d5b605f4205e269bf244bd9ae780ceadb9bd8
MD5 a044f6413820c4c3fbd300ee9b379ebc
SHA1 94fc91536a25274f06d3a6e89322dec7fde7912e
SHA512 ced4374c54d7b4ea2b76afe4ca5d8841dfb55d8cb5db96de4ed49e64bd3850a817db5301787c268756641c94c0bf85eb4ee188f04fc891fa2e45ad48284985a5
TLSH
T13AD02BA433044D0CCE40203215B8A210720484209C49031A8D41B01C8C6FD4387171FB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22c1d58ffa7df77a7e0440ce3b2c474b1e03f30b60355bbf5dd6392fefb641fd
MD5 b9f45a900b1f64efbf90731f41c6ad44
SHA1 0c28e85e464e328fbbc07373b05113d39f83bdcc
SHA512 132313545c55ea809da0e811d6d5d324ecf5b6cfaefadb3fa4a29df5e6266dfeca7cffa4daf21754b4b37771504d3692189b5660a468784b5eaf80bf92f59ae0
TLSH
T11ED02BA033044C0CCE40203215B9A210720484204849031A8E41F02C8C6FD4387161F7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 a67f32f8c7f60df790f4f7d16b39a7d20f447cb93e196264ced49876678a516c
MD5 4570ded166d7c3b8202a93d85e8bc116
SHA1 06ea41b90a5d7fc71cccfd9c5bd84292ffb7da7c
SHA512 5714b37fcc55618253e9046ff43982f720486910e5e1de16b00b068f2ae91cd9433e4eb036643c433568e66787a3e879d8c608ee0e7dcdf06245e44893b5eb66
TLSH
T1F9313F57C33798D6E7B1E1F735D14A5BB2778859CE0BAF50000362F08A823EC13690C8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f57cdc9f35942edf3be7f7aff635663e9a95479aeb5024582b4b2452e52001b8
MD5 ce9209e0a3156168621c6050a8b17ca5
SHA1 72e885d3822009a967ed87f3b17ba809a3192df7
SHA512 f990e66713ae688a5363dfece46bcd1d9d1abc20f1e6e884721f2da9d2e1f7a64a36d1789e4a401ed2534b114a06372aecef8b823bae3527eec5d17e40497082
TLSH
T19D51ECF3C6E4862EC90156F0AA187E2BCE1C0910432C3C5AC9E0AE1B93E2471E141A5E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1ef76ad80bba5d1f24a60cfd429e2eb3f1fc436450af9aa539328c6ed4cb2bf2
MD5 004bd591eb9b8ac7bfb079a0ecd64fd9
SHA1 b43b44270a542c7814c209e3a70e05c2ed5ac55e
SHA512 d1eae79306e9213cb4b0709fdb2df37825a63143f9415b277427fd018ed51b556af10596aeaa7b5c7d3b78ca6b6bbc6161738a40653e0cbffa49308422c29087
SSDEEP 192:sxRSARFyM/jK1Ml8wCe/fIs/vCM8pZPXePMzoD8pi/g6+WNIYGPkk9GMIgtJ:sxRbd8e/fIsC7nMki/5I/j3
TLSH
T18E52EA15AA34593BDCCBD208FA557F93D6F95573A2901E44AAFC8A0C04E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c06f36142c0a185fb1d37318ef8f689e2294b79d301de26837af32c83ccb79b6
MD5 19e2efeb437a8f6e95346d6cfddbb29a
SHA1 db4ace8433693fbb46aff6332e7ed176d0fa7579
SHA512 5212c3acd9f1345a914ec7857f658c77e76389769d1aaf1510cace4445b6c02b1d1e5445606432f7290b3d0a70ea650607f723aa8a4aa289cb1abecadedad2a3
SSDEEP 192:sxRvARFyM/jK1Ml8wCe/fIsgvCM8pZPXePMzoD8pi/g6+WNIYGPkk9GMIgDPJ:sxRId8e/fIsj7nMki/5I/j9
TLSH
T11152EA16A634593BDCDBD208FA557F93D6F95473A2901E44ABFC8A0C04E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 96a4a0349060238c45079c2844e80bde33fb5f21741f3731795ae3fb0882f4df
MD5 b3a529913353b533197af3444a5a3a74
SHA1 01999a7a808680ca392eb213a8e3b18aa4329b69
SHA512 543ef66c02a8fbcc651af1ec224ae070d5aab6ca47320812186c3445155d95f1eb1799760f45f4ac222c7b6b6029c638a9aa89869797bfeb5c9b00d05629c0cc
SSDEEP 192:sxRvARFyM/jK1Ml8UQrCe/fIsgvCM8pZPXe7MzoD8pr6/g6+WNIYGlgk9GMIgDPJ:sxRIdqee/fIsj7nkkm/5I5j9
TLSH
T1FF62EA16A634593BDCCBD209FA557F93D6F95473A1901E44ABFC8A0C04E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 17e9b647a4f1cc51430b5a510fbf9ea130d0424d90d2e5fb96eec5a599404100
MD5 c250801ae32d07b68fcc2c27678b3091
SHA1 d4dd2aa12f844dd3dea4ea90b534abbccee6a796
SHA512 912ff916ce0080cdd34ac4bee19eefd06c02ac30123e8609fa296fd33a7e454a683aa9f8d5ea0a08599c8b17b2296c6302d85627a01bdd6974904bc3b2775182
SSDEEP 768:UtiiB37pLuL7ANWgv7fgJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpRxpN0VroY1Y:UtiiBxE7ANWgv7fgJu1jaKRxf0usY
TLSH
T1C6E20B3B680CCB7E4F804A9CEC29BD9E6DD801CB56D8CD9447EA881C03C67EB551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7e916a35bedfb771c8baf9540c274cb118b31eadaa5484daf36433032acbda71
MD5 64572d5ace3a7b7d430da8c7c541bdf7
SHA1 f7de1ea6a01f4af64c994ac7a287d689c0d96417
SHA512 a6f009bc3ae48e5e55228afc1f92415e8942f231959562e8900ac6c428f0834be68c37775853f86b56d09b483f3edad15803cd6a764c5d970b6cd52f565a4d08
SSDEEP 96:KRm7KmgIIOW4tVgGOK47g0OcOGlkYp8IamqwWuzjgwwK4lgSwcgwDyYdH/oNJ/9L:Cm7KmgIIJ4tWGm7g09OGlkYp8IamqXuX
TLSH
T19F91E155333B1250383DAD4891B9C51F92C1B0A33059A83B7BEC56A65F6AE038EFE5CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75804bb6-3119-43c3-88e3-7d3dad4148c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\75804bb6-3119-43c3-88e3-7d3dad4148c2.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c8bc9387846405ce77d570fce0df973d2d21a04a9fd6c45192c15d2e73f1d903
MD5 eae57b80e3fbdfd8129a14bd614f7804
SHA1 fcffab9b6448f9283644c44cdfe879e3acef35f5
SHA512 0515ea9355387294889396979a0e49d98450f835016c9cfea9ebc21fcf9c313c99bf2bed8915c2efeacfcd817743f7496ff256f752aeb2e6257e7ce61e3a314a
SSDEEP 768:xGrv+4UNbdS3OwplYy1Bo7Hucys6BRvi82oP4/z6himo+12bwn+h:xGbsbw3OmD3imOz6Imo+0w+
TLSH
T13703C036F4548973EDE7818874467A637FF4522345C91A80E6DE6F0E528B95E130BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 4f074ebb002331ba5da683b60e2d1bdc394e97cbe6538c3733f261052720336b
MD5 e5e6a2012b7925f23124ef6efce1fc29
SHA1 65caf2600e2e19bf9c8bfa53d8e0e3136b95dba2
SHA512 2f95bee061ca1f0b72bb6d4f6d1aa2c0f8c7478822c96686a5a096e7409c41210d7d356b0f91fcc5720ceae2071202f3c7f7bc9d82ab14add07187a33204e25b
SSDEEP 768:hlj+9Ps3MiYLlYy1B6CnA7Hucys6BRvi82oP4/z6himo6nrb9Mx:hQ9Ps33QICV3imOz6Imosb+x
TLSH
T1BEF2C030E8568E73DCE7C298B4463BD26FE0227745CC2D94E6E9AF0E05C37AD0716826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

ed2d9f05-decd-40d5-91af-1e5913dac636.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ed2d9f05-decd-40d5-91af-1e5913dac636.tmp
Size 38KB
SHA256 c2adc8568171619382d1b7e925a4ec8b50e0a848371cc15cb72bea8fe2bbf5ad
MD5 410e07489f166dbbe1914d28f7ff881e
SHA1 726d42535c4e5fd3f27f9153b82c77fa549bbf37
SHA512 3919b0d4213428594ca066ee2288d1423dc6d5a47cfbdd02269e826bdbc6f4a0e140933042e3f830d05891e34039db4d269e26f559d61844bdbe23750d5608a3
SSDEEP 768:50F1j+9Ps3pwgnizKSRB6CnR7Hucys6BRvi82oP4/z6himo6nrb9Mx:5Z9Ps3q1ICQ3imOz6Imosb+x
TLSH
T1D0039D36E855CE77ECE787D9B64A3A96AEE0127385CC6CD4EAD95E0D00C36ED070AC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75601ac6-4cfc-4c17-8c69-42e1cfae6213.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\75601ac6-4cfc-4c17-8c69-42e1cfae6213.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3932_386624709\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/760-236-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1380-424-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1380-352-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2228-361-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2256-189-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2608-386-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3764-414-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3764-419-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4248-273-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4328-435-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4504-418-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4676-394-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4772-313-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4800-467-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4832-447-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4832-468-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4868-261-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4924-317-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5076-304-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5780-373-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6052-332-0x0000000000010000-0x0000000000083000-memory.dmp

Download