cc47011f0113a4405c5eb342636dddc6f6602e29c38d743c76ad52d98fb22bca

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 19:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_c784b17a1f31b45eca3f7b39d0512db9_elex_rhadamanthys_stop.exe
Size 243KB
Sample260710-x6hmvsfx2j
SHA256 cc47011f0113a4405c5eb342636dddc6f6602e29c38d743c76ad52d98fb22bca
MD5 c784b17a1f31b45eca3f7b39d0512db9
SHA1 b6c6407a854e00e6d5147dbaa6d2f1bcb2a7a83f
SHA512 3c4487022756592c7fd369fbedfae441b7216a92e2e6c17628757fbe7e6d53e2278109487d12042646725a7f4426f30ee4377049ed46310b11de41903c0006f6
SSDEEP 3072:ECvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7+:XvMsLaOa3lLNngoqRttA7+
TLSH
T1B8345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2784	CP.exe
4244	bvtolgbztr.exe
3736	CP.exe
864	CP.exe
5644	i_bvtolgbztr.exe
3872	ytqljdbvtn.sys
5756	CP.exe
3112	nljdbvtnli.exe
4400	CP.exe
3376	CP.exe
4164	i_nljdbvtnli.exe
5740	vsqkigaytn.sys
5860	CP.exe
1508	qkigaysqki.exe
2788	CP.exe
1236	CP.exe
4140	i_qkigaysqki.exe
1492	qkicxvpnlf.sys
5060	CP.exe
4492	ausnkfdxvp.exe
4148	CP.exe
5852	CP.exe
5012	i_ausnkfdxvp.exe
3504	vpnkfzxspn.sys
3532	CP.exe
5784	khcausqkic.exe
924	CP.exe
1512	CP.exe
4948	i_khcausqkic.exe
5920	rpmhczxrpk.sys
4348	CP.exe
2036	kecxusmkec.exe
200	CP.exe
1680	CP.exe
2776	i_kecxusmkec.exe
3236	wrpmhezxrp.sys
3828	CP.exe
472	mjhbzuomje.exe
5252	CP.exe
1036	CP.exe
3172	i_mjhbzuomje.exe
4460	ojgbzwromh.sys
3872	CP.exe
3512	wuomgeywqo.exe
2348	CP.exe
4632	CP.exe
4300	i_wuomgeywqo.exe
4500	wtoljdbztr.sys
5128	CP.exe
2612	ljdbztolyw.exe
3088	CP.exe
5204	CP.exe
3900	i_ljdbztolyw.exe
3340	nlgdbvqolg.sys
6080	CP.exe
3488	jdbytrljdb.exe
3808	CP.exe
5668	CP.exe
3336	i_jdbytrljdb.exe
5488	tnlfdyvqoi.sys
824	CP.exe
3140	xvtnlfayvq.exe
4752	CP.exe
3424	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4592_1346351814\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4592_1346351814\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4592_1479823093\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4592_1479823093\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4592_1361695900\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4592_1361695900\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4592_135851667\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4592_1361695900\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4592_1361695900\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_c784b17a1f31b45eca3f7b39d0512db9_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhbzuomje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhbzuomje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khcausqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecxusmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbztolyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbytrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvtnlfayvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtolgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khcausqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvtnlfayvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxsqkfcax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhczurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbwtomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtolgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nljdbvtnli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbytrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbwtomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gayvqoidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nljdbvtnli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbztolyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxsqkfcax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtodyvqolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtodyvqolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecxusmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkfcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhczurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrljebwtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrljebwtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gayvqoidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkfcau.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1408	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3864	ipconfig.exe
5884	ipconfig.exe
3936	ipconfig.exe
3728	ipconfig.exe
4528	ipconfig.exe
1084	ipconfig.exe
3496	ipconfig.exe
4516	ipconfig.exe
3556	ipconfig.exe
5320	ipconfig.exe
3408	ipconfig.exe
920	ipconfig.exe
3172	ipconfig.exe
1492	ipconfig.exe
4864	ipconfig.exe
4708	ipconfig.exe
2196	ipconfig.exe
4528	ipconfig.exe
4840	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134281852781302879"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{AF446AA9-FEB0-4233-8D03-DEEBAB563CEA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3484	msedge.exe
3484	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5644	i_bvtolgbztr.exe
Token: SeDebugPrivilege	4164	i_nljdbvtnli.exe
Token: SeDebugPrivilege	4140	i_qkigaysqki.exe
Token: SeDebugPrivilege	5012	i_ausnkfdxvp.exe
Token: SeDebugPrivilege	4948	i_khcausqkic.exe
Token: SeDebugPrivilege	2776	i_kecxusmkec.exe
Token: SeDebugPrivilege	3172	i_mjhbzuomje.exe
Token: SeDebugPrivilege	4300	i_wuomgeywqo.exe
Token: SeDebugPrivilege	3900	i_ljdbztolyw.exe
Token: SeDebugPrivilege	3336	i_jdbytrljdb.exe
Token: SeDebugPrivilege	1536	i_xvtnlfayvq.exe
Token: SeDebugPrivilege	2760	i_faxsqkfcax.exe
Token: SeDebugPrivilege	2168	i_causmkfcau.exe
Token: SeDebugPrivilege	3160	i_spkhcausmk.exe
Token: SeDebugPrivilege	3868	i_xrpjhczurm.exe
Token: SeDebugPrivilege	708	i_ztrljebwtr.exe
Token: SeDebugPrivilege	5992	i_dbwtomgeyw.exe
Token: SeDebugPrivilege	6044	i_vtodyvqolg.exe
Token: SeDebugPrivilege	3548	i_gayvqoidbv.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4592	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5396 wrote to memory of 3520	5396	2026-07-10_c784b17a1f31b45eca3f7b39d0512db9_elex_rhadamanthys_stop.exe	88
PID 3520 wrote to memory of 4592	3520	iexplore.exe	89
PID 4592 wrote to memory of 1088	4592	msedge.exe	90
PID 4592 wrote to memory of 5996	4592	msedge.exe	91
PID 4592 wrote to memory of 1408	4592	msedge.exe	92
PID 4592 wrote to memory of 5996	4592	msedge.exe	91
PID 4592 wrote to memory of 5996	4592	msedge.exe	91
PID 4592 wrote to memory of 2592	4592	msedge.exe	93
PID 4592 wrote to memory of 2592	4592	msedge.exe	93
PID 4592 wrote to memory of 3728	4592	msedge.exe	95
PID 4592 wrote to memory of 3728	4592	msedge.exe	95
PID 4592 wrote to memory of 3728	4592	msedge.exe	95
PID 4592 wrote to memory of 2932	4592	msedge.exe	96
PID 4592 wrote to memory of 2932	4592	msedge.exe	96
PID 4592 wrote to memory of 2932	4592	msedge.exe	96
PID 4592 wrote to memory of 5024	4592	msedge.exe	98
PID 4592 wrote to memory of 1888	4592	msedge.exe	97
PID 4592 wrote to memory of 5024	4592	msedge.exe	98
PID 4592 wrote to memory of 5024	4592	msedge.exe	98
PID 4592 wrote to memory of 1888	4592	msedge.exe	97
PID 4592 wrote to memory of 1888	4592	msedge.exe	97
PID 4592 wrote to memory of 1716	4592	msedge.exe	99
PID 4592 wrote to memory of 1716	4592	msedge.exe	99
PID 5396 wrote to memory of 2784	5396	2026-07-10_c784b17a1f31b45eca3f7b39d0512db9_elex_rhadamanthys_stop.exe	101
PID 4244 wrote to memory of 3736	4244	bvtolgbztr.exe	104
PID 4592 wrote to memory of 1040	4592	msedge.exe	107
PID 4592 wrote to memory of 5824	4592	msedge.exe	108
PID 4592 wrote to memory of 1040	4592	msedge.exe	107
PID 4592 wrote to memory of 5824	4592	msedge.exe	108
PID 4592 wrote to memory of 2280	4592	msedge.exe	110
PID 4592 wrote to memory of 5988	4592	msedge.exe	113
PID 4592 wrote to memory of 5988	4592	msedge.exe	113
PID 4592 wrote to memory of 1036	4592	msedge.exe	114
PID 4592 wrote to memory of 1036	4592	msedge.exe	114
PID 5396 wrote to memory of 864	5396	2026-07-10_c784b17a1f31b45eca3f7b39d0512db9_elex_rhadamanthys_stop.exe	115
PID 5396 wrote to memory of 5756	5396	2026-07-10_c784b17a1f31b45eca3f7b39d0512db9_elex_rhadamanthys_stop.exe	119
PID 3112 wrote to memory of 4400	3112	nljdbvtnli.exe	121
PID 5396 wrote to memory of 3376	5396	2026-07-10_c784b17a1f31b45eca3f7b39d0512db9_elex_rhadamanthys_stop.exe	124
PID 5396 wrote to memory of 5860	5396	2026-07-10_c784b17a1f31b45eca3f7b39d0512db9_elex_rhadamanthys_stop.exe	128
PID 1508 wrote to memory of 2788	1508	qkigaysqki.exe	130
PID 5396 wrote to memory of 1236	5396	2026-07-10_c784b17a1f31b45eca3f7b39d0512db9_elex_rhadamanthys_stop.exe	133
PID 5396 wrote to memory of 5060	5396	2026-07-10_c784b17a1f31b45eca3f7b39d0512db9_elex_rhadamanthys_stop.exe	137
PID 4492 wrote to memory of 4148	4492	ausnkfdxvp.exe	139
PID 5396 wrote to memory of 5852	5396	2026-07-10_c784b17a1f31b45eca3f7b39d0512db9_elex_rhadamanthys_stop.exe	143
PID 4592 wrote to memory of 4340	4592	msedge.exe	145
PID 4592 wrote to memory of 5644	4592	msedge.exe	146
PID 4592 wrote to memory of 5656	4592	msedge.exe	147
PID 5396 wrote to memory of 3532	5396	2026-07-10_c784b17a1f31b45eca3f7b39d0512db9_elex_rhadamanthys_stop.exe	150
PID 5784 wrote to memory of 924	5784	khcausqkic.exe	152
PID 5396 wrote to memory of 1512	5396	2026-07-10_c784b17a1f31b45eca3f7b39d0512db9_elex_rhadamanthys_stop.exe	155
PID 5396 wrote to memory of 4348	5396	2026-07-10_c784b17a1f31b45eca3f7b39d0512db9_elex_rhadamanthys_stop.exe	159
PID 2036 wrote to memory of 200	2036	kecxusmkec.exe	161
PID 5396 wrote to memory of 1680	5396	2026-07-10_c784b17a1f31b45eca3f7b39d0512db9_elex_rhadamanthys_stop.exe	164
PID 5396 wrote to memory of 3828	5396	2026-07-10_c784b17a1f31b45eca3f7b39d0512db9_elex_rhadamanthys_stop.exe	168
PID 472 wrote to memory of 5252	472	mjhbzuomje.exe	170
PID 5396 wrote to memory of 1036	5396	2026-07-10_c784b17a1f31b45eca3f7b39d0512db9_elex_rhadamanthys_stop.exe	173
PID 5396 wrote to memory of 3872	5396	2026-07-10_c784b17a1f31b45eca3f7b39d0512db9_elex_rhadamanthys_stop.exe	177
PID 3512 wrote to memory of 2348	3512	wuomgeywqo.exe	179
PID 5396 wrote to memory of 4632	5396	2026-07-10_c784b17a1f31b45eca3f7b39d0512db9_elex_rhadamanthys_stop.exe	182
PID 4592 wrote to memory of 244	4592	msedge.exe	184
PID 4592 wrote to memory of 244	4592	msedge.exe	184
PID 5396 wrote to memory of 5128	5396	2026-07-10_c784b17a1f31b45eca3f7b39d0512db9_elex_rhadamanthys_stop.exe	190
PID 2612 wrote to memory of 3088	2612	ljdbztolyw.exe	192
PID 5396 wrote to memory of 5204	5396	2026-07-10_c784b17a1f31b45eca3f7b39d0512db9_elex_rhadamanthys_stop.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-10_c784b17a1f31b45eca3f7b39d0512db9_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_c784b17a1f31b45eca3f7b39d0512db9_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5396
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x320,0x7ffdcc21c188,0x7ffdcc21c194,0x7ffdcc21c1a0
      4⤵
      PID:1088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,16744032549916403971,7346246929572308894,262144 --field-trial-handle=2324,i,13932888863017440201,9777516497510612355,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
      4⤵
      PID:5996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,8224989068423403517,14609709439175025416,524288 --field-trial-handle=2324,i,13932888863017440201,9777516497510612355,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:11
      4⤵
      System Time Discovery
      PID:1408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,16958144522457664958,5432440555340259955,524288 --field-trial-handle=2324,i,13932888863017440201,9777516497510612355,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:13
      4⤵
      PID:2592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,15336721455350540133,13723151480555710539,2097152 --field-trial-handle=2324,i,13932888863017440201,9777516497510612355,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:3728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,15329825740609193452,3714044157430392260,2097152 --field-trial-handle=2324,i,13932888863017440201,9777516497510612355,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:2932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,5388351453314480522,5241364529386145747,2097152 --field-trial-handle=2324,i,13932888863017440201,9777516497510612355,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:1
      4⤵
      PID:1888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,8104047629074581241,9411842870321205059,2097152 --field-trial-handle=2324,i,13932888863017440201,9777516497510612355,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:9
      4⤵
      PID:5024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,8038640097006755952,17119695762976221753,524288 --field-trial-handle=2324,i,13932888863017440201,9777516497510612355,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:14
      4⤵
      PID:1716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,13256563832202873472,615560070976918431,524288 --field-trial-handle=2324,i,13932888863017440201,9777516497510612355,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
      4⤵
      PID:1040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,13365160555414359697,925321149916475566,524288 --field-trial-handle=2324,i,13932888863017440201,9777516497510612355,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
      4⤵
      PID:5824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,2458605189508780160,14651373636388320199,524288 --field-trial-handle=2324,i,13932888863017440201,9777516497510612355,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
      4⤵
      PID:2324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,2458605189508780160,14651373636388320199,524288 --field-trial-handle=2324,i,13932888863017440201,9777516497510612355,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
      4⤵
      PID:2280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,7102747694706018274,4408951000166776607,524288 --field-trial-handle=2324,i,13932888863017440201,9777516497510612355,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
      4⤵
      PID:5988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,9918252880161339613,12898914188043522713,524288 --field-trial-handle=2324,i,13932888863017440201,9777516497510612355,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
      4⤵
      PID:1036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,5624094330592998967,18055923359296805993,524288 --field-trial-handle=2324,i,13932888863017440201,9777516497510612355,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:14
      4⤵
      PID:4340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,6512736674160978885,16227815085138703044,524288 --field-trial-handle=2324,i,13932888863017440201,9777516497510612355,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:14
      4⤵
      PID:5644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,11081762012393447830,16565601879907853731,524288 --field-trial-handle=2324,i,13932888863017440201,9777516497510612355,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
      4⤵
      PID:5656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,12377894575010381961,197201080843179921,524288 --field-trial-handle=2324,i,13932888863017440201,9777516497510612355,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
      4⤵
      PID:244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,4942372814451696955,5498022965469560678,524288 --field-trial-handle=2324,i,13932888863017440201,9777516497510612355,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
      4⤵
      PID:1492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,4612392118273557687,17554761535890009614,524288 --field-trial-handle=2324,i,13932888863017440201,9777516497510612355,262144 --variations-seed-version --mojo-platform-channel-handle=864 /prefetch:14
      4⤵
      PID:2664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,18015297239155934970,6991374469601565117,524288 --field-trial-handle=2324,i,13932888863017440201,9777516497510612355,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
      4⤵
      PID:1448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4436,i,11229570105835255278,2258687748128590215,262144 --field-trial-handle=2324,i,13932888863017440201,9777516497510612355,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,1785542673766599177,7725829811024796760,524288 --field-trial-handle=2324,i,13932888863017440201,9777516497510612355,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
      4⤵
      PID:892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvtolgbztr.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2784
- - C:\Temp\bvtolgbztr.exe
    C:\Temp\bvtolgbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4244
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3736
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bvtolgbztr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:864
- - C:\Temp\i_bvtolgbztr.exe
    C:\Temp\i_bvtolgbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nljdbvtnli.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5756
- - C:\Temp\nljdbvtnli.exe
    C:\Temp\nljdbvtnli.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3112
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4400
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nljdbvtnli.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3376
- - C:\Temp\i_nljdbvtnli.exe
    C:\Temp\i_nljdbvtnli.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkigaysqki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5860
- - C:\Temp\qkigaysqki.exe
    C:\Temp\qkigaysqki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1508
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2788
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkigaysqki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1236
- - C:\Temp\i_qkigaysqki.exe
    C:\Temp\i_qkigaysqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausnkfdxvp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5060
- - C:\Temp\ausnkfdxvp.exe
    C:\Temp\ausnkfdxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4492
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4148
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausnkfdxvp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5852
- - C:\Temp\i_ausnkfdxvp.exe
    C:\Temp\i_ausnkfdxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\khcausqkic.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3532
- - C:\Temp\khcausqkic.exe
    C:\Temp\khcausqkic.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5784
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:924
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_khcausqkic.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1512
- - C:\Temp\i_khcausqkic.exe
    C:\Temp\i_khcausqkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kecxusmkec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4348
- - C:\Temp\kecxusmkec.exe
    C:\Temp\kecxusmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2036
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:200
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kecxusmkec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1680
- - C:\Temp\i_kecxusmkec.exe
    C:\Temp\i_kecxusmkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjhbzuomje.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3828
- - C:\Temp\mjhbzuomje.exe
    C:\Temp\mjhbzuomje.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:472
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5252
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjhbzuomje.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1036
- - C:\Temp\i_mjhbzuomje.exe
    C:\Temp\i_mjhbzuomje.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomgeywqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3872
- - C:\Temp\wuomgeywqo.exe
    C:\Temp\wuomgeywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3512
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2348
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomgeywqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4632
- - C:\Temp\i_wuomgeywqo.exe
    C:\Temp\i_wuomgeywqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4300
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbztolyw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5128
- - C:\Temp\ljdbztolyw.exe
    C:\Temp\ljdbztolyw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3088
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbztolyw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5204
- - C:\Temp\i_ljdbztolyw.exe
    C:\Temp\i_ljdbztolyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbytrljdb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6080
- - C:\Temp\jdbytrljdb.exe
    C:\Temp\jdbytrljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3488
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3808
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbytrljdb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5668
- - C:\Temp\i_jdbytrljdb.exe
    C:\Temp\i_jdbytrljdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvtnlfayvq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:824
- - C:\Temp\xvtnlfayvq.exe
    C:\Temp\xvtnlfayvq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3140
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4752
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvtnlfayvq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3424
- - C:\Temp\i_xvtnlfayvq.exe
    C:\Temp\i_xvtnlfayvq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faxsqkfcax.exe ups_run
  2⤵
  PID:2996
- - C:\Temp\faxsqkfcax.exe
    C:\Temp\faxsqkfcax.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3004
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1552
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faxsqkfcax.exe ups_ins
  2⤵
  PID:6140
- - C:\Temp\i_faxsqkfcax.exe
    C:\Temp\i_faxsqkfcax.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\causmkfcau.exe ups_run
  2⤵
  PID:560
- - C:\Temp\causmkfcau.exe
    C:\Temp\causmkfcau.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4724
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4860
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_causmkfcau.exe ups_ins
  2⤵
  PID:1492
- - C:\Temp\i_causmkfcau.exe
    C:\Temp\i_causmkfcau.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spkhcausmk.exe ups_run
  2⤵
  PID:1548
- - C:\Temp\spkhcausmk.exe
    C:\Temp\spkhcausmk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2728
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2420
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spkhcausmk.exe ups_ins
  2⤵
  PID:1300
- - C:\Temp\i_spkhcausmk.exe
    C:\Temp\i_spkhcausmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpjhczurm.exe ups_run
  2⤵
  PID:2368
- - C:\Temp\xrpjhczurm.exe
    C:\Temp\xrpjhczurm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4656
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1936
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpjhczurm.exe ups_ins
  2⤵
  PID:3888
- - C:\Temp\i_xrpjhczurm.exe
    C:\Temp\i_xrpjhczurm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrljebwtr.exe ups_run
  2⤵
  PID:3272
- - C:\Temp\ztrljebwtr.exe
    C:\Temp\ztrljebwtr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4076
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1832
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrljebwtr.exe ups_ins
  2⤵
  PID:5740
- - C:\Temp\i_ztrljebwtr.exe
    C:\Temp\i_ztrljebwtr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbwtomgeyw.exe ups_run
  2⤵
  PID:5768
- - C:\Temp\dbwtomgeyw.exe
    C:\Temp\dbwtomgeyw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3276
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5988
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbwtomgeyw.exe ups_ins
  2⤵
  PID:4188
- - C:\Temp\i_dbwtomgeyw.exe
    C:\Temp\i_dbwtomgeyw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtodyvqolg.exe ups_run
  2⤵
  PID:2436
- - C:\Temp\vtodyvqolg.exe
    C:\Temp\vtodyvqolg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2396
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1636
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtodyvqolg.exe ups_ins
  2⤵
  PID:4304
- - C:\Temp\i_vtodyvqolg.exe
    C:\Temp\i_vtodyvqolg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gayvqoidbv.exe ups_run
  2⤵
  PID:1448
- - C:\Temp\gayvqoidbv.exe
    C:\Temp\gayvqoidbv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5800
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4064
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4840
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gayvqoidbv.exe ups_ins
  2⤵
  PID:3584
- - C:\Temp\i_gayvqoidbv.exe
    C:\Temp\i_gayvqoidbv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3548

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4044

C:\Temp\ytqljdbvtn.sys
C:\Temp\ytqljdbvtn.sys
1⤵
- Executes dropped EXE
PID:3872

C:\Temp\vsqkigaytn.sys
C:\Temp\vsqkigaytn.sys
1⤵
- Executes dropped EXE
PID:5740

C:\Temp\qkicxvpnlf.sys
C:\Temp\qkicxvpnlf.sys
1⤵
- Executes dropped EXE
PID:1492

C:\Temp\vpnkfzxspn.sys
C:\Temp\vpnkfzxspn.sys
1⤵
- Executes dropped EXE
PID:3504

C:\Temp\rpmhczxrpk.sys
C:\Temp\rpmhczxrpk.sys
1⤵
- Executes dropped EXE
PID:5920

C:\Temp\wrpmhezxrp.sys
C:\Temp\wrpmhezxrp.sys
1⤵
- Executes dropped EXE
PID:3236

C:\Temp\ojgbzwromh.sys
C:\Temp\ojgbzwromh.sys
1⤵
- Executes dropped EXE
PID:4460

C:\Temp\wtoljdbztr.sys
C:\Temp\wtoljdbztr.sys
1⤵
- Executes dropped EXE
PID:4500

C:\Temp\nlgdbvqolg.sys
C:\Temp\nlgdbvqolg.sys
1⤵
- Executes dropped EXE
PID:3340

C:\Temp\tnlfdyvqoi.sys
C:\Temp\tnlfdyvqoi.sys
1⤵
- Executes dropped EXE
PID:5488

C:\Temp\qkicausnkf.sys
C:\Temp\qkicausnkf.sys
1⤵
PID:2880

C:\Temp\xvqkhfaxsq.sys
C:\Temp\xvqkhfaxsq.sys
1⤵
PID:3664

C:\Temp\aurpkhcxus.sys
C:\Temp\aurpkhcxus.sys
1⤵
PID:1636

C:\Temp\eczurmhezx.sys
C:\Temp\eczurmhezx.sys
1⤵
PID:2880

C:\Temp\heztrljebw.sys
C:\Temp\heztrljebw.sys
1⤵
PID:1180

C:\Temp\trojgbzljd.sys
C:\Temp\trojgbzljd.sys
1⤵
PID:1924

C:\Temp\dbvtolgdyv.sys
C:\Temp\dbvtolgdyv.sys
1⤵
PID:1256

C:\Temp\nlfdyvqnig.sys
C:\Temp\nlfdyvqnig.sys
1⤵
PID:2136

C:\Temp\kidavsnlfd.sys
C:\Temp\kidavsnlfd.sys
1⤵
PID:4296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ausnkfdxvp.exe

Path C:\Temp\ausnkfdxvp.exe
Size 243KB
SHA256 d87c3195d04a6a806c12f359c286fe90559e7869dd4e6a886476e194f4ef3712
MD5 db81f6a91971adc3653cd74f1bc9f9c2
SHA1 388555fa38065b71e48ae200b5a6600d9c8b13e8
SHA512 a9f74695bc5e795dc4f21035789d7a7bcbae9b7cc3452e499d0d4b09655f9dc3bb11566e0345eab431e3ae8af6c6da275df4e2881fa82aea609b74b480ef4023
SSDEEP 3072:KCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7w:1vMsLaOa3lLNngoqRttA7w
TLSH
T1F4345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtolgbztr.exe

Path C:\Temp\bvtolgbztr.exe
Size 243KB
SHA256 7793480008b9bf2369ef578aad32a0d2c8ec0e01f42915dc77efda7a7e580de4
MD5 0b2122a0eb7a6d26c0726baf6e4f8885
SHA1 1409c008cacd54a11cb77f276835da7870f712bc
SHA512 c5ad7ec1861c0070d2c4c58d0809c358605ecf692f5c709f9679ab920a0d758cd1198d251aaf71d59dcfcf88de9f88a84bb4bf1e9c431abe10d14f9162766a68
SSDEEP 3072:BCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7z:cvMsLaOa3lLNngoqRttA7z
TLSH
T126345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ausnkfdxvp.exe

Path C:\Temp\i_ausnkfdxvp.exe
Size 243KB
SHA256 f98173b2cafff4843a6a3885c58a002ff7ce4d2b0d27b8464916353b0e501816
MD5 2358cd8748200be58d168dfc50c09a2b
SHA1 7138db84d6e691f87a20732161075da80ae1aa89
SHA512 909981ae61e34160c633f69273cad4243b77dd8f97ac958a0f46a171a8fef037bad4e7d8623179aa25796f955c2e4b111c7a63aba3fa7d9e234fb0e2ee26a742
SSDEEP 3072:HCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7p:ivMsLaOa3lLNngoqRttA7p
TLSH
T12F345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bvtolgbztr.exe

Path C:\Temp\i_bvtolgbztr.exe
Size 243KB
SHA256 8462d82bdd808b57dd8a6f9f993ba36811ede8697b850c7be3cfc1ad12a9c2b0
MD5 2bc780158bc0f8bc8d49f52da315e2ab
SHA1 e76afa765bc3315c96bd3085522c13b679a2400e
SHA512 c1ad48d2b181dcbee8dcc6d4ec4bd7c45828f974ed04fb3e014af2160bb351a4e273eb3c9dba7511df1e69f25c48d7eaefb8befdb4de846e7a5a40146c0018c9
SSDEEP 3072:wCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7+:rvMsLaOa3lLNngoqRttA7+
TLSH
T1AD345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kecxusmkec.exe

Path C:\Temp\i_kecxusmkec.exe
Size 243KB
SHA256 7f184b7727c4532f5684bc53656d3b27860a369c608ad2f9c88f75a121f60e79
MD5 2a7b82867f4dc82d89df82cd5daff8a2
SHA1 189e22abf2f921278e05f7d83c3abeea9a8b436b
SHA512 43111ac6c603bd1838dee1fe4391ab0bb590eae81b24758c36d3061be2584631306fb6f74b66ee408f67c32367e0bd3ff3f688b5485a08d15282ee67907f3229
SSDEEP 3072:jCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7l:mvMsLaOa3lLNngoqRttA7l
TLSH
T1FD345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_khcausqkic.exe

Path C:\Temp\i_khcausqkic.exe
Size 243KB
SHA256 d0e9e5f4e1c24c994bf76a1b7f15baca6822e1f60fc64b16341fb0364c580385
MD5 2f97c30394bfd5df9d996813c4ebc255
SHA1 859d4c220c9d6bd2a6e72c949ca3de079c6effba
SHA512 21259aa176fa8b7f6fe034f8ed0f9b955c62e899dc7b1ecc059ebd6550b111b9a3684e5c55289e6d745317555783450226a6ac7dfbb52e385584ac5153b9a137
SSDEEP 3072:XCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7l:yvMsLaOa3lLNngoqRttA7l
TLSH
T1E9345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nljdbvtnli.exe

Path C:\Temp\i_nljdbvtnli.exe
Size 243KB
SHA256 577f2fc8f61225d3eb353c6d83d02649505c5d2ed57651ae949ec5323b14abaa
MD5 858a38acb1fff1959d2aa18094ca6a57
SHA1 fbd8bf2c11f756d5bc5858dc94bdc044e806b4f6
SHA512 899244d0245e1db3ada5e6deda5e319359882a4110d05574dddad7f329f32afcd18322009f60e01e21b68fbd615eae77a06a727630a2f95bea9eecfcf5ad3dea
SSDEEP 3072:tCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:gvMsLaOa3lLNngoqRttA7b
TLSH
T1B0345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qkigaysqki.exe

Path C:\Temp\i_qkigaysqki.exe
Size 243KB
SHA256 6097681a7ee822fce2caed997f2c4f2ecc80228dbcee596bf19857084226e102
MD5 af84ddaa22e319ff1feaa9b6453509e7
SHA1 8b96b3d6d476beeb1e582b48faf443053a80409b
SHA512 d5a9061bc49245a1292a023fbec1c07fbfad47254f38d9ad89ae5cb795c0894ec6eb26b08a1f5269c5816e7afcac5f085244210a856d7f086ebfcfdad921ce59
SSDEEP 3072:DCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7N:GvMsLaOa3lLNngoqRttA7N
TLSH
T189345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecxusmkec.exe

Path C:\Temp\kecxusmkec.exe
Size 243KB
SHA256 b5aae17a6b5970ecc40e34936e4f47b24d01d8079d32d14441b17de709e40060
MD5 a0b7b003212d9626638582582bdee437
SHA1 ac461d74d8f580cda0ad2a6c8c13612ab8fe8a65
SHA512 8827911da43668b04d2ace9f0e44bb51392912b9c7234a31631546dd08ff88278454fcff9599ed8af068d7447db6ff202d5086aafe4b85a7d27eef48b01c9cfd
SSDEEP 3072:vCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7h:6vMsLaOa3lLNngoqRttA7h
TLSH
T1AD345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khcausqkic.exe

Path C:\Temp\khcausqkic.exe
Size 243KB
SHA256 a567225929f1835a0d27ae858a100aed08c74a3febbfac88bae0364d4f29a31c
MD5 eba50ccb961a8dab3c9c5eaaecd37688
SHA1 4e71b3ed6390f55d2dcd681e8148e4ab12a29055
SHA512 1eec711b036c2e06b453a528ad756cbccf33c8621eddb9f2b7cc4e1fa5abf01fbaf969948161a0e6f115fa82cfcda0ba644a52d56454d2d12658d3c455bb84e2
SSDEEP 3072:2CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:ZvMsLaOa3lLNngoqRttA7o
TLSH
T113345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nljdbvtnli.exe

Path C:\Temp\nljdbvtnli.exe
Size 243KB
SHA256 b95c90a632756b995def91b0795c4341d7469a5afaef24012d60ec78fefec0b9
MD5 e78df0a9acf3d214e50bc300f5a5714a
SHA1 1aaa5737ed1facdef89873c1fe940de17adf50d9
SHA512 37981ba7f79d8f1a260b5ad93391ccdfdefd455113c896e178eca9771320a0e12e4b2f1e75c3f09acd882ad4a217a07f34a4887cd893f19954a9096d12c7a378
SSDEEP 3072:wvCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7a/:LvMsLaOa3lLNngoqRttA7y
TLSH
T1B4345A017281C031E7160B78045AE7A1467EBC384BA9E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkicxvpnlf.sys

Path C:\Temp\qkicxvpnlf.sys
Size 141KB
SHA256 00a9e9b87742c40d2d92413b2956a5053acfd4dc0d2e2e8c76ea921a90815399
MD5 c2c3c066ab12daa07c1530111f183e6d
SHA1 6e062b82f83d029205980f474314a35fc1cbedd1
SHA512 ff8805845eef9ac6596953b84a332af05a2800f1c2fddcb4ae7af6b2a9026119e2094aa8d6ed7dd852775d6da3a233299cbb4b10a217c515fda49b6bdf0c1fdd
SSDEEP 1536:0a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:0a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E1E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkigaysqki.exe

Path C:\Temp\qkigaysqki.exe
Size 243KB
SHA256 3187311f1688ad60f650c5c337c611f3f55a64ba4320de3ee38551a9d18395a3
MD5 25f99542843ce36602a015975308ff9b
SHA1 db05e96a1344eddad009dc9d66c360c2983db970
SHA512 d0c76988803c046313a59ff6803bee35709355f72c2f1cbc43de65f9efaf4f78467b1465eeccf36909d7cc1cee4128d3d8ebb4e91cc8858f056f4f783c5da185
SSDEEP 3072:sCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7i:PvMsLaOa3lLNngoqRttA7i
TLSH
T138345A017281C031E7160B78045AE7A1467EBC384BA9E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpmhczxrpk.sys

Path C:\Temp\rpmhczxrpk.sys
Size 141KB
SHA256 93d6222d423874c7b6eb4c99d2670999691f1d021171e64e33ed349d5cd9c5a6
MD5 59d2cf92e0285df8a94ad90286ae1487
SHA1 e9f4198b38668bf318bace767d6065061d0f3be2
SHA512 dc93284882cc9e94553d5ceaae13e53717ece261ca65f9a4aea9b04569ffe4e5a05a06a94e8b36c78842e2a01ac4cbdc30e61013cb1425d71b36fd01b0af5bf5
SSDEEP 1536:7a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:7a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1BCE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnkfzxspn.sys

Path C:\Temp\vpnkfzxspn.sys
Size 141KB
SHA256 a4dcb77b023f62ec50df375321aba833aa60fce98747a56378df1cbef52df5d2
MD5 67b2c1435321644308f7a9ca47b369ee
SHA1 bb8307cefb767e7f3788e9a82801efeaca9bdc7f
SHA512 421bddd0cc40e916a37d7b33d07582e5de040decc64c5c14c463626d10fbee7643ae8a29bc8f355b632919bf5c51b356ba3aebd591048d38301561fc30a6f231
SSDEEP 1536:fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C2E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsqkigaytn.sys

Path C:\Temp\vsqkigaytn.sys
Size 141KB
SHA256 76d5632d57857d8e40e14819553312370a6f84d699c8802a23946d9728d2612d
MD5 d5ef1897b783e9b9fd8b45be80a930a7
SHA1 49ec37f51a94b9981148d1a6d76e81dc84b82a09
SHA512 b7773dc9188022a4c970936d57657c1ad5cf5141d449dce644490dbba7f31c0eb58db5f6c85d07a1d2c98bb48babf9cb34c478b9943ac322f93bac801b080aa9
SSDEEP 1536:na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T186E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrpmhezxrp.sys

Path C:\Temp\wrpmhezxrp.sys
Size 141KB
SHA256 30ccab0f57d669455dd57a6029af390def399a2fc1853251099b02c6e41fcd66
MD5 89cbd8ee1547e0528e54003aa7cfaadb
SHA1 f82c048b90bb758b1bdd52ebba053d20a512d838
SHA512 aaf527d4e9a5b3cdd1f9eae24b25def1f8d38a01c80f4f0f3ec0afadbfa16d34aafa220b3c97e523e91c30227051cf8b7bb1be74032bb5a17081e72acc0d3e99
SSDEEP 1536:Ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1BBE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytqljdbvtn.sys

Path C:\Temp\ytqljdbvtn.sys
Size 141KB
SHA256 c672530f69f818d4d7343af532d938ff12ff6a269c7dad3ea12197c018155eb4
MD5 d521804030a9c6bfabb49cea878c8adc
SHA1 dfa99669dd5eb8be430d930b28f4138bf567f3b8
SHA512 7339c3775a5c0ce1b75ba46239d194a3723a805d2e6a5bf70c628cbdf2520c89c8f8db131df5f01d696f59520b628f85b29ce228b56cccf7138d1aa935ccb447
SSDEEP 1536:+a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:+a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T110E37C12B2D2D172D8A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 3824be9fa29c73f1a3330b827c554edd07f5a32a501407e7452e61b18bea8b2f
MD5 b2e08e50e985e8c059dd567627c595e9
SHA1 cd900005fa077ee5ed859e50b0302df92d4412b4
SHA512 4ca15e38327d9283fdce1686d4f33dfe987890a63b9db101a61533d90a25fd30220c1e4e6ec9886e88e0744d16165de1cd22b8ca2199dde70dedad41e71b9a0d
TLSH
T11741DAD41BE90AC2DBFC8EF560E166DD37F0D49E41176E8164422E701B0AF9791D2973
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59be26.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59be26.TMP
Size 2KB
SHA256 640344a99d8e14e02ae5a5c106cece558c5c7c0ed3bd3248025d5a1d96d7791a
MD5 56b1a345cb91109f0aae000e013eb5f7
SHA1 6382ccef07213d92b5d9eff57112c4d83d2a2d8e
SHA512 7aa99402ae2e56228dd4bc996d2b142074360bb115e1ac2914484f7401d4147122be3bf928013ddb828da0b9767d8548a00e365d05295531e5346124a8e1dd2b
TLSH
T15C41FAD40BE90AC2DBFC8EF560E166DD37F0D49E01176E8164462E701B0AF9791D2973
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ab816fb8c016c212faf5fc18c7b0a140a541998ecd9bc8cc9ba24d5fdedebd61
MD5 45a3aedfa2b815ce4a4b27bcc25a55be
SHA1 4a1ba2ef4727cb147fb619898c9011b79cc58ded
SHA512 648dd77a29aaa300c2c74bbcb03ef511293077c3ac068742944678432523cfa22208fbd77cb3564158b590b565ed896538dc3d051e7e4e6596c234ac20770066
TLSH
T12F51AEF3C7E8866DC9115AF0AB187E2BCE1D0914432C3D5A89E4EF5BA3E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2e0c4b3342d41308261ada61133787c73018c59b0f306ef1f87cf77771b300e2
MD5 9c2239fbb01b7e0d9f4e178cfffa6b87
SHA1 1e7808698bf3a213c2c1adf7b6343d831ffe0861
SHA512 63b7cc4472020d3218f04b60d011ec417efa2d004108cc11db6c22740ffaa5d65487270100d36da1e0632eee11e015c9c027dc1a51c642a74336dc3e40f88b6d
SSDEEP 192:sxRARcyM/jK1Ml8wCb/f9sFtWOZPrLPb5zoD8pi/g6+WNIYCsuOIGYIgtJ:sxRA68b/f9snWoTLTti/5IeY3
TLSH
T1FA52DA166A245D7BDCDBD20DFA51BF53D6F85573A2901E44AAFCCA0C40E6AEC221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 74d72f215abf961eccbd6e0e5991b11107b24fa1de73988905af927ea426872f
MD5 337619e15e410a1e71e1d7506bf00824
SHA1 9f5f989e7cda3035cf8cc3e96540de9205c28822
SHA512 55abde69d18a8f33adf8b8f05c5b7425108829d604042aeb943a55e0739ad7e190de38d2ebc09da22b0e4e9d7ee8ca8e2cfd0710596c5b2cbefaef0cd19cf5bd
SSDEEP 192:sxRjRcyM/jK1Ml8UQNCb/f9sRttOZPrLPb5zoD8pw/g6+WNIYCFuOIGYIgDgJ:sxRj6qsb/f9sLtoTLTtw/5ItYg
TLSH
T1FE62D9166A245D7BDCDBD20DFA52BF93D6F85573A2901E44AAFCCA0C00E66DD121381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 852ef7569bb84f954f59694eadcf43bb49627d4c3f79dd74764ef6c498b1c205
MD5 481a87e87889794d08767c143751e69c
SHA1 1e3f76e8dfc540783f465461246e4ce6aa45fe24
SHA512 05f027f74b1c96ac00291c07eaf9dfcee12e734e7a07d36bad4222827d003617cc949ba5947bcbb77c60aa99281e287699426e1281128f2ddf9b1f904cd3b0e1
SSDEEP 192:sxRjRcyM/jK1Ml8wCb/f9sRtWOZPrLPb5zoD8pi/g6+WNIYCsuOIGYIgDuJ:sxRj68b/f9sLWoTLTti/5IeYW
TLSH
T16052DA166A245D7BDCDBD20DFA51BF93D6F85563A2901E44AAFCCA0C40E66EC221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 825c5cf50188e20eb8768e1353a0c04819d3109c68eb8e1ddbaef5863a65cfb6
MD5 c7cca1dc11af7d34a435b3b58df6cb2b
SHA1 71be423d12fdb819e25625a038f76bd709e9737e
SHA512 f67029fb8d3d7247c060760123437327f52b3e6a85b247b6f20a6c2c3791e6ed3a4a7d52e497f0922fe3df9f4d9784d6bbf045c64fabae122fb997452d37faa6
SSDEEP 768:j/8vNN7pLuL7tQWgQ+fB+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVSAMQqqhrovVwUn:j/8vN7E7tQWgQ+fB+u1japAMVqaGUn
TLSH
T1B1E2FC7B640CCB7E4F404E9DEC29BE9AADE801CF5698CD5447EA840C03C67EB56164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 d88980543bab194a0be22e8d965de03a4292e32f3848d082bd57a7e87c30ee3c
MD5 e16d655c9edebf2c07a1332ff4eb60df
SHA1 ebb6bdaf3591b2dfc14e22ccf61218370ba382ee
SHA512 1884a9f7a8966e08f889c5a85156abdfc9f81dbbab13d692089addacf655ecf1298f345e5ae4dba78ca0b705205704e970f2e0db2e41810406ca4b698d8a66a1
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHFSr/VPTXWbAOgHXK42gZXc9lsUgKte22n:CbEBVj5JAdSp9/EgTK7j6dJOHFSr/VPz
TLSH
T1AAB12021303A02C1787E6909C169C92B82C6B0B3341DE56B7FE941B60FA7E535DFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26c447ba-407e-434e-876d-9babe058672d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\26c447ba-407e-434e-876d-9babe058672d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1b1fda652410d93b2d2fa299afa3b18c0f27610d314fd781df572a2ef09b586c
MD5 6f1c05e82fc88418e9b7636db99a3410
SHA1 3a889a653bc837b28055978b8398f06e570b7e49
SHA512 056527b02932da71b3250139714f52917a5bef03ba566e1b82cf241e0d36110e09cc4377b2f923863d8787a73d37f57f1bdc8697b1287da1e3ff5e8f58402a6f
SSDEEP 768:Zrv+4UNbda3r+QVQTp8+p3bd66j+4BRv86aLIWpohS:Zbsbg3yl8+p3Z6n4yjoS
TLSH
T1FA03BF72E4A8DD739CF6C648B18737837EF8216385C00E94D9D96B4D448B1AE270F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6b84560b9a6e4975844dfd9090148fdd43116573d639cbdaa343b98ef0da38d6
MD5 dc7c6f02111df2f72b19404fece7eeaf
SHA1 31b6eab8e639c622bd2589410c4afc79ba6409f2
SHA512 09f5fe517353e3e80d334716b48ea20344262c3a35913cf7f65924a0a7777fac72b18ea4f44dbb34a06a7e6fef8ff85e7e26401fa822db0e6f32fab79f050aaa
SSDEEP 768:LF1j+9k36wgF9RVDp8+p3bd66j+4BRv86aLIWpb9Mn:K9k3k8+p3Z6n4yjb+n
TLSH
T1E5038D76D8A5CE7BACE68785B3473B87AEF411B386C45DD4D9C86E4D00871AD070BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9f359a2c8136c0b137bf03e7fff8fbc1c5233cdc3f9e4bdae853ece13bdb0e54
MD5 c13496e21bcb8223154b72e870223a8b
SHA1 9f5d2ad836d5dbee1a4e67eeefd47c31bc5ce7f6
SHA512 296adab2cbee76dab9043994d37d50e810a4acaea8406c74e34a9cde0b24c4124a8d2c562c806a5e277632bc9c7f3eae88184fe65dd4cc5b275a6f275133fd7b
SSDEEP 768:Irv+4UNbdD3ScQVTNp8+p3bd66j+4BRv86aLIiO2bwCl1:Ibsbp3IL8+p3Z6n4ys0ww
TLSH
T1B503BE33E9A899739CF6C648B2467B433FF851A396C10AC0D5DD2B4E419B19E230BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a372433bfc3495d77349ee938107f1583ecf9561f166a986c9ee047116f77e00
MD5 62895e3a6ead4184952263f14ef71bf9
SHA1 a5dd7914a3bfccfadac1a62ed4d95811934459e3
SHA512 d2005bc3ffa0c8a17cd7b7d96da6d6777164cb6bd0649c72526f5ac640e6fd7644907a3ee02a5253e59291e9a787cf6106c88f4d448fe0a1d4c6ca4b26e4039c
SSDEEP 768:ij+9U31+QVQPp8+p3bd66j+4BRv86aLIWpb9Mn:R9U3Uh8+p3Z6n4yjb+n
TLSH
T10DF2B072E8A59E739CE5C758B2973B876EF4217385C01E88D8DDAF0D448726D170B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

bb758e1a-0d63-4fc1-a5a7-13d87c97fafa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bb758e1a-0d63-4fc1-a5a7-13d87c97fafa.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4592_139466109\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1180-446-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1256-471-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1492-264-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1636-443-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1636-430-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1924-467-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2136-496-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2880-434-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2880-390-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3236-317-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3340-378-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3340-361-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3504-276-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3664-410-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3872-189-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4296-516-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4460-321-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4500-336-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5488-369-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5740-236-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5920-289-0x0000000000010000-0x0000000000083000-memory.dmp

Download