e18f397d56205a6f2befd177efd84c18652545fba8c5e1c8188571be813c9bb1

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 17:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe
Size 243KB
Sample260712-v2thfset8j
SHA256 e18f397d56205a6f2befd177efd84c18652545fba8c5e1c8188571be813c9bb1
MD5 300cc42a10dd9475274d0d80b56d5821
SHA1 ba8c43c2af2a6300310f56c5c1b89d9d36f2071f
SHA512 c34bad37562fe52ba1c1f4df6c235b0d86875229718d76f53a16a471c8761e2f4cbab3e9abcd27072f010e848259b3799ca186634760e4c2de26ba16ada117cc
SSDEEP 3072:BCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7/:cvMsLaOa3lLNngoqRttA7/
TLSH
T13A345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
6140	CP.exe
2436	ysqkicausn.exe
4120	CP.exe
3360	CP.exe
5344	i_ysqkicausn.exe
1404	fcxvsnhfcx.sys
2940	CP.exe
5800	xspkhfzusp.exe
4220	CP.exe
3932	CP.exe
2024	i_xspkhfzusp.exe
4936	cwusmhecwr.sys
2832	CP.exe
5144	hczxrpjhcz.exe
4420	CP.exe
5732	CP.exe
5576	i_hczxrpjhcz.exe
3768	ojhbztrmje.sys
4604	CP.exe
2544	ezwrpjhbzt.exe
3428	CP.exe
5348	CP.exe
2916	i_ezwrpjhbzt.exe
5644	trljebwuom.sys
5308	CP.exe
3904	bywqojgbzt.exe
1592	CP.exe
5804	CP.exe
4944	i_bywqojgbzt.exe
4860	vtrojgbztr.sys
2516	CP.exe
904	rljdbvtrlj.exe
1200	CP.exe
5880	CP.exe
2580	i_rljdbvtrlj.exe
256	dyvqoigays.sys
6036	CP.exe
4840	vtnlfdyvtq.exe
5768	CP.exe
3656	CP.exe
700	i_vtnlfdyvtq.exe
3692	qnifaysqni.sys
2416	CP.exe
3320	nigaysqkid.exe
1152	CP.exe
3232	CP.exe
5132	i_nigaysqkid.exe
4472	snlfdxvpni.sys
2808	CP.exe
5324	icaxspnica.exe
1952	CP.exe
5476	CP.exe
3524	i_icaxspnica.exe
1084	pmkfcaxspk.sys
4884	CP.exe
4596	upnhfzxspk.exe
5080	CP.exe
6124	CP.exe
5668	i_upnhfzxspk.exe
3508	xupmkecxup.sys
2892	CP.exe
3380	uspkhfzxus.exe
3420	CP.exe
1816	CP.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4328_730373304\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4328_730373304\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4328_730373304\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4328_1279320845\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4328_1279320845\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4328_1999137458\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4328_1999137458\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4328_730373304\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4328_1279320845\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4328_1279320845\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4328_1600956654\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4328_2010417910\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4328_2010417910\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspkhfzusp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwrpjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczxrpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwrpjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywqojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upnhfzxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgdbvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdxvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdxvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvqnkfcavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkicausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdyvtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tolgebwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tolgebwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axvpnkfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurpmhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbvtrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczxrpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvqnkfcavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurpmhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nigaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trojhbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axspnhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axspnhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdbvtrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywqojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icaxspnica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgdbvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axvpnkfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdyvtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icaxspnica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uspkhfzxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmjecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmjecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trojhbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkicausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nigaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upnhfzxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uspkhfzxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspkhfzusp.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1704	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5140	ipconfig.exe
996	ipconfig.exe
4624	ipconfig.exe
3404	ipconfig.exe
764	ipconfig.exe
5344	ipconfig.exe
4860	ipconfig.exe
4976	ipconfig.exe
5644	ipconfig.exe
1736	ipconfig.exe
4492	ipconfig.exe
5412	ipconfig.exe
2432	ipconfig.exe
4548	ipconfig.exe
424	ipconfig.exe
5036	ipconfig.exe
4952	ipconfig.exe
4272	ipconfig.exe
2928	ipconfig.exe
3576	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134283509820424063"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{E9D26696-2019-42E1-A7D8-C7B216714627}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5884	msedge.exe
5884	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5344	i_ysqkicausn.exe
Token: SeDebugPrivilege	2024	i_xspkhfzusp.exe
Token: SeDebugPrivilege	5576	i_hczxrpjhcz.exe
Token: SeDebugPrivilege	2916	i_ezwrpjhbzt.exe
Token: SeDebugPrivilege	4944	i_bywqojgbzt.exe
Token: SeDebugPrivilege	2580	i_rljdbvtrlj.exe
Token: SeDebugPrivilege	700	i_vtnlfdyvtq.exe
Token: SeDebugPrivilege	5132	i_nigaysqkid.exe
Token: SeDebugPrivilege	3524	i_icaxspnica.exe
Token: SeDebugPrivilege	5668	i_upnhfzxspk.exe
Token: SeDebugPrivilege	4472	i_uspkhfzxus.exe
Token: SeDebugPrivilege	4928	i_zurmjecwuo.exe
Token: SeDebugPrivilege	1092	i_trojhbztrl.exe
Token: SeDebugPrivilege	3008	i_tolgebwtom.exe
Token: SeDebugPrivilege	4488	i_olgdbvqoig.exe
Token: SeDebugPrivilege	5996	i_gdxvqnigay.exe
Token: SeDebugPrivilege	564	i_xvqnkfcavs.exe
Token: SeDebugPrivilege	1960	i_axvpnkfdxv.exe
Token: SeDebugPrivilege	2768	i_axspnhfzxr.exe
Token: SeDebugPrivilege	5416	i_zurpmhfzxr.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4328	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 5124	2660	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	87
PID 5124 wrote to memory of 4328	5124	iexplore.exe	88
PID 4328 wrote to memory of 4640	4328	msedge.exe	89
PID 4328 wrote to memory of 5108	4328	msedge.exe	90
PID 4328 wrote to memory of 1704	4328	msedge.exe	92
PID 4328 wrote to memory of 5108	4328	msedge.exe	90
PID 4328 wrote to memory of 5108	4328	msedge.exe	90
PID 4328 wrote to memory of 2284	4328	msedge.exe	93
PID 4328 wrote to memory of 2284	4328	msedge.exe	93
PID 4328 wrote to memory of 5736	4328	msedge.exe	94
PID 4328 wrote to memory of 5736	4328	msedge.exe	94
PID 4328 wrote to memory of 5736	4328	msedge.exe	94
PID 4328 wrote to memory of 3540	4328	msedge.exe	95
PID 4328 wrote to memory of 3540	4328	msedge.exe	95
PID 4328 wrote to memory of 3540	4328	msedge.exe	95
PID 4328 wrote to memory of 5744	4328	msedge.exe	96
PID 4328 wrote to memory of 5744	4328	msedge.exe	96
PID 4328 wrote to memory of 5744	4328	msedge.exe	96
PID 4328 wrote to memory of 2444	4328	msedge.exe	97
PID 4328 wrote to memory of 2444	4328	msedge.exe	97
PID 4328 wrote to memory of 2444	4328	msedge.exe	97
PID 4328 wrote to memory of 4656	4328	msedge.exe	98
PID 4328 wrote to memory of 4656	4328	msedge.exe	98
PID 2660 wrote to memory of 6140	2660	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	100
PID 2436 wrote to memory of 4120	2436	ysqkicausn.exe	103
PID 4328 wrote to memory of 4552	4328	msedge.exe	106
PID 4328 wrote to memory of 4652	4328	msedge.exe	107
PID 4328 wrote to memory of 4552	4328	msedge.exe	106
PID 4328 wrote to memory of 4652	4328	msedge.exe	107
PID 4328 wrote to memory of 4684	4328	msedge.exe	109
PID 4328 wrote to memory of 4256	4328	msedge.exe	110
PID 4328 wrote to memory of 4256	4328	msedge.exe	110
PID 2660 wrote to memory of 3360	2660	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	113
PID 4328 wrote to memory of 2564	4328	msedge.exe	115
PID 4328 wrote to memory of 2564	4328	msedge.exe	115
PID 2660 wrote to memory of 2940	2660	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	118
PID 5800 wrote to memory of 4220	5800	xspkhfzusp.exe	120
PID 2660 wrote to memory of 3932	2660	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	123
PID 2660 wrote to memory of 2832	2660	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	127
PID 5144 wrote to memory of 4420	5144	hczxrpjhcz.exe	129
PID 2660 wrote to memory of 5732	2660	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	132
PID 4328 wrote to memory of 5148	4328	msedge.exe	136
PID 4328 wrote to memory of 5148	4328	msedge.exe	136
PID 4328 wrote to memory of 5148	4328	msedge.exe	136
PID 4328 wrote to memory of 3188	4328	msedge.exe	137
PID 4328 wrote to memory of 3188	4328	msedge.exe	137
PID 4328 wrote to memory of 3188	4328	msedge.exe	137
PID 2660 wrote to memory of 4604	2660	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	138
PID 2544 wrote to memory of 3428	2544	ezwrpjhbzt.exe	140
PID 2660 wrote to memory of 5348	2660	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	144
PID 4328 wrote to memory of 2456	4328	msedge.exe	146
PID 4328 wrote to memory of 5040	4328	msedge.exe	147
PID 4328 wrote to memory of 5416	4328	msedge.exe	148
PID 2660 wrote to memory of 5308	2660	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	151
PID 3904 wrote to memory of 1592	3904	bywqojgbzt.exe	153
PID 2660 wrote to memory of 5804	2660	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	156
PID 4328 wrote to memory of 3192	4328	msedge.exe	158
PID 4328 wrote to memory of 3192	4328	msedge.exe	158
PID 4328 wrote to memory of 3192	4328	msedge.exe	158
PID 2660 wrote to memory of 2516	2660	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	161
PID 904 wrote to memory of 1200	904	rljdbvtrlj.exe	163
PID 2660 wrote to memory of 5880	2660	2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe	166
PID 4328 wrote to memory of 4416	4328	msedge.exe	170
PID 4328 wrote to memory of 4416	4328	msedge.exe	170

C:\Users\Admin\AppData\Local\Temp\2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_300cc42a10dd9475274d0d80b56d5821_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffea74fc188,0x7ffea74fc194,0x7ffea74fc1a0
      4⤵
      PID:4640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,15429002753108752004,17965790201217812492,262144 --field-trial-handle=2264,i,17034701274606054966,1541252098993133234,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
      4⤵
      PID:5108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,12444911088697298206,157443325101078983,524288 --field-trial-handle=2264,i,17034701274606054966,1541252098993133234,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:11
      4⤵
      System Time Discovery
      PID:1704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,4684154222325678715,12871103971789971631,524288 --field-trial-handle=2264,i,17034701274606054966,1541252098993133234,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:13
      4⤵
      PID:2284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,1451480982594698177,15264143209952575141,2097152 --field-trial-handle=2264,i,17034701274606054966,1541252098993133234,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:5736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,11091740103093094698,17121872372677300301,2097152 --field-trial-handle=2264,i,17034701274606054966,1541252098993133234,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:3540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,4375074703456196805,2918539765793879390,2097152 --field-trial-handle=2264,i,17034701274606054966,1541252098993133234,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
      4⤵
      PID:5744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,16572724012055310088,16524897540222249579,2097152 --field-trial-handle=2264,i,17034701274606054966,1541252098993133234,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:9
      4⤵
      PID:2444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,11217983115071881148,8169823393684190612,524288 --field-trial-handle=2264,i,17034701274606054966,1541252098993133234,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
      4⤵
      PID:4656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,988048358472547964,17939954328636237578,524288 --field-trial-handle=2264,i,17034701274606054966,1541252098993133234,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
      4⤵
      PID:4552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,23286204660050333,10374914336191085610,524288 --field-trial-handle=2264,i,17034701274606054966,1541252098993133234,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:14
      4⤵
      PID:4652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,124315751489193944,9914176275464606,524288 --field-trial-handle=2264,i,17034701274606054966,1541252098993133234,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
      4⤵
      PID:5848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,124315751489193944,9914176275464606,524288 --field-trial-handle=2264,i,17034701274606054966,1541252098993133234,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
      4⤵
      PID:4684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,12304476924255067090,6727675761498740665,524288 --field-trial-handle=2264,i,17034701274606054966,1541252098993133234,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
      4⤵
      PID:4256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,3185070752878842741,16479488617470110314,524288 --field-trial-handle=2264,i,17034701274606054966,1541252098993133234,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
      4⤵
      PID:2564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6312,i,1737298459167088845,1582974120083989728,2097152 --field-trial-handle=2264,i,17034701274606054966,1541252098993133234,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:1
      4⤵
      PID:5148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6424,i,3557065343762772079,6797966642323293284,2097152 --field-trial-handle=2264,i,17034701274606054966,1541252098993133234,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:1
      4⤵
      PID:3188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,12016092582666541512,1521472848545785733,524288 --field-trial-handle=2264,i,17034701274606054966,1541252098993133234,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:14
      4⤵
      PID:2456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,5475538742475621125,10503837453965701882,524288 --field-trial-handle=2264,i,17034701274606054966,1541252098993133234,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
      4⤵
      PID:5040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,12472520019427175581,6172303887809528593,524288 --field-trial-handle=2264,i,17034701274606054966,1541252098993133234,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
      4⤵
      PID:5416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5084,i,467864337624216623,17972608690003335302,2097152 --field-trial-handle=2264,i,17034701274606054966,1541252098993133234,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:1
      4⤵
      PID:3192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5168,i,16981297110496627952,15206085967214213659,2097152 --field-trial-handle=2264,i,17034701274606054966,1541252098993133234,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:1
      4⤵
      PID:4416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,5576974466155339634,12743928010880125160,524288 --field-trial-handle=2264,i,17034701274606054966,1541252098993133234,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
      4⤵
      PID:6020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,4921246896964765911,12569702158076722828,524288 --field-trial-handle=2264,i,17034701274606054966,1541252098993133234,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
      4⤵
      PID:2524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,8413911535215287466,11532530044539506191,524288 --field-trial-handle=2264,i,17034701274606054966,1541252098993133234,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:14
      4⤵
      PID:4772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2832,i,9675363879946414341,16900348127762029262,524288 --field-trial-handle=2264,i,17034701274606054966,1541252098993133234,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
      4⤵
      PID:5116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6332,i,1014030017950164930,18331903754997372215,262144 --field-trial-handle=2264,i,17034701274606054966,1541252098993133234,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,2415586758257438741,14544204576627223108,524288 --field-trial-handle=2264,i,17034701274606054966,1541252098993133234,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:14
      4⤵
      PID:1736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,13594180064312673189,4029237571600171053,524288 --field-trial-handle=2264,i,17034701274606054966,1541252098993133234,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
      4⤵
      PID:2272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqkicausn.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6140
- - C:\Temp\ysqkicausn.exe
    C:\Temp\ysqkicausn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2436
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4120
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqkicausn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3360
- - C:\Temp\i_ysqkicausn.exe
    C:\Temp\i_ysqkicausn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xspkhfzusp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2940
- - C:\Temp\xspkhfzusp.exe
    C:\Temp\xspkhfzusp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5800
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4220
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xspkhfzusp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3932
- - C:\Temp\i_xspkhfzusp.exe
    C:\Temp\i_xspkhfzusp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hczxrpjhcz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2832
- - C:\Temp\hczxrpjhcz.exe
    C:\Temp\hczxrpjhcz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5144
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4420
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hczxrpjhcz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5732
- - C:\Temp\i_hczxrpjhcz.exe
    C:\Temp\i_hczxrpjhcz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezwrpjhbzt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4604
- - C:\Temp\ezwrpjhbzt.exe
    C:\Temp\ezwrpjhbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2544
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3428
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezwrpjhbzt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5348
- - C:\Temp\i_ezwrpjhbzt.exe
    C:\Temp\i_ezwrpjhbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bywqojgbzt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5308
- - C:\Temp\bywqojgbzt.exe
    C:\Temp\bywqojgbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3904
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1592
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bywqojgbzt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5804
- - C:\Temp\i_bywqojgbzt.exe
    C:\Temp\i_bywqojgbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljdbvtrlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2516
- - C:\Temp\rljdbvtrlj.exe
    C:\Temp\rljdbvtrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:904
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1200
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljdbvtrlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5880
- - C:\Temp\i_rljdbvtrlj.exe
    C:\Temp\i_rljdbvtrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnlfdyvtq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6036
- - C:\Temp\vtnlfdyvtq.exe
    C:\Temp\vtnlfdyvtq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4840
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5768
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnlfdyvtq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3656
- - C:\Temp\i_vtnlfdyvtq.exe
    C:\Temp\i_vtnlfdyvtq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nigaysqkid.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2416
- - C:\Temp\nigaysqkid.exe
    C:\Temp\nigaysqkid.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3320
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1152
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nigaysqkid.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3232
- - C:\Temp\i_nigaysqkid.exe
    C:\Temp\i_nigaysqkid.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icaxspnica.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2808
- - C:\Temp\icaxspnica.exe
    C:\Temp\icaxspnica.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5324
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1952
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icaxspnica.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5476
- - C:\Temp\i_icaxspnica.exe
    C:\Temp\i_icaxspnica.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upnhfzxspk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4884
- - C:\Temp\upnhfzxspk.exe
    C:\Temp\upnhfzxspk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4596
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5080
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5036
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upnhfzxspk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6124
- - C:\Temp\i_upnhfzxspk.exe
    C:\Temp\i_upnhfzxspk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uspkhfzxus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2892
- - C:\Temp\uspkhfzxus.exe
    C:\Temp\uspkhfzxus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3380
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3420
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uspkhfzxus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1816
- - C:\Temp\i_uspkhfzxus.exe
    C:\Temp\i_uspkhfzxus.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zurmjecwuo.exe ups_run
  2⤵
  PID:4384
- - C:\Temp\zurmjecwuo.exe
    C:\Temp\zurmjecwuo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4300
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4276
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zurmjecwuo.exe ups_ins
  2⤵
  PID:4512
- - C:\Temp\i_zurmjecwuo.exe
    C:\Temp\i_zurmjecwuo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trojhbztrl.exe ups_run
  2⤵
  PID:3436
- - C:\Temp\trojhbztrl.exe
    C:\Temp\trojhbztrl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5344
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4056
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trojhbztrl.exe ups_ins
  2⤵
  PID:3400
- - C:\Temp\i_trojhbztrl.exe
    C:\Temp\i_trojhbztrl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tolgebwtom.exe ups_run
  2⤵
  PID:4264
- - C:\Temp\tolgebwtom.exe
    C:\Temp\tolgebwtom.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5228
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5660
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tolgebwtom.exe ups_ins
  2⤵
  PID:2352
- - C:\Temp\i_tolgebwtom.exe
    C:\Temp\i_tolgebwtom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\olgdbvqoig.exe ups_run
  2⤵
  PID:5412
- - C:\Temp\olgdbvqoig.exe
    C:\Temp\olgdbvqoig.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5756
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1240
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_olgdbvqoig.exe ups_ins
  2⤵
  PID:1084
- - C:\Temp\i_olgdbvqoig.exe
    C:\Temp\i_olgdbvqoig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4488
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdxvqnigay.exe ups_run
  2⤵
  PID:2548
- - C:\Temp\gdxvqnigay.exe
    C:\Temp\gdxvqnigay.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2184
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3496
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdxvqnigay.exe ups_ins
  2⤵
  PID:3508
- - C:\Temp\i_gdxvqnigay.exe
    C:\Temp\i_gdxvqnigay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvqnkfcavs.exe ups_run
  2⤵
  PID:1716
- - C:\Temp\xvqnkfcavs.exe
    C:\Temp\xvqnkfcavs.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4344
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4376
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvqnkfcavs.exe ups_ins
  2⤵
  PID:1236
- - C:\Temp\i_xvqnkfcavs.exe
    C:\Temp\i_xvqnkfcavs.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axvpnkfdxv.exe ups_run
  2⤵
  PID:5008
- - C:\Temp\axvpnkfdxv.exe
    C:\Temp\axvpnkfdxv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1948
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3500
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axvpnkfdxv.exe ups_ins
  2⤵
  PID:1272
- - C:\Temp\i_axvpnkfdxv.exe
    C:\Temp\i_axvpnkfdxv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axspnhfzxr.exe ups_run
  2⤵
  PID:3800
- - C:\Temp\axspnhfzxr.exe
    C:\Temp\axspnhfzxr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4388
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2728
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axspnhfzxr.exe ups_ins
  2⤵
  PID:5960
- - C:\Temp\i_axspnhfzxr.exe
    C:\Temp\i_axspnhfzxr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zurpmhfzxr.exe ups_run
  2⤵
  PID:2116
- - C:\Temp\zurpmhfzxr.exe
    C:\Temp\zurpmhfzxr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3700
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:436
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zurpmhfzxr.exe ups_ins
  2⤵
  PID:4616
- - C:\Temp\i_zurpmhfzxr.exe
    C:\Temp\i_zurpmhfzxr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5416

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3812

C:\Temp\fcxvsnhfcx.sys
C:\Temp\fcxvsnhfcx.sys
1⤵
- Executes dropped EXE
PID:1404

C:\Temp\cwusmhecwr.sys
C:\Temp\cwusmhecwr.sys
1⤵
- Executes dropped EXE
PID:4936

C:\Temp\ojhbztrmje.sys
C:\Temp\ojhbztrmje.sys
1⤵
- Executes dropped EXE
PID:3768

C:\Temp\trljebwuom.sys
C:\Temp\trljebwuom.sys
1⤵
- Executes dropped EXE
PID:5644

C:\Temp\vtrojgbztr.sys
C:\Temp\vtrojgbztr.sys
1⤵
- Executes dropped EXE
PID:4860

C:\Temp\dyvqoigays.sys
C:\Temp\dyvqoigays.sys
1⤵
- Executes dropped EXE
PID:256

C:\Temp\qnifaysqni.sys
C:\Temp\qnifaysqni.sys
1⤵
- Executes dropped EXE
PID:3692

C:\Temp\snlfdxvpni.sys
C:\Temp\snlfdxvpni.sys
1⤵
- Executes dropped EXE
PID:4472

C:\Temp\pmkfcaxspk.sys
C:\Temp\pmkfcaxspk.sys
1⤵
- Executes dropped EXE
PID:1084

C:\Temp\xupmkecxup.sys
C:\Temp\xupmkecxup.sys
1⤵
- Executes dropped EXE
PID:3508

C:\Temp\cwurmkeczu.sys
C:\Temp\cwurmkeczu.sys
1⤵
PID:2372

C:\Temp\ecwuomgecz.sys
C:\Temp\ecwuomgecz.sys
1⤵
PID:5068

C:\Temp\ztromgebwt.sys
C:\Temp\ztromgebwt.sys
1⤵
PID:5868

C:\Temp\qolgdywqol.sys
C:\Temp\qolgdywqol.sys
1⤵
PID:3104

C:\Temp\igdyvqoiga.sys
C:\Temp\igdyvqoiga.sys
1⤵
PID:3500

C:\Temp\lfdaysqkid.sys
C:\Temp\lfdaysqkid.sys
1⤵
PID:5132

C:\Temp\axvpnhfdav.sys
C:\Temp\axvpnhfdav.sys
1⤵
PID:3084

C:\Temp\axspkifzxs.sys
C:\Temp\axspkifzxs.sys
1⤵
PID:1232

C:\Temp\wurpmheczx.sys
C:\Temp\wurpmheczx.sys
1⤵
PID:5856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bywqojgbzt.exe

Path C:\Temp\bywqojgbzt.exe
Size 243KB
SHA256 ea51a1b60ebadaa8a24bcee4daa4fc474796b9597040921c0b66dbe19bb9f98b
MD5 fd8014203cfb4e3dd165e62ddffc95d3
SHA1 d1c09a1dd45de2320b0412d53183cae4cc8e94ec
SHA512 5ee67448fe46cb752eda68dcfce1a0e7620faa6fb1891eed3d2ab72407b3473648bf59d3fd5e7d9315557f39dbae43239ddc02e7f288e66a45d3d32a2ba8fe74
SSDEEP 3072:NCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7r:AvMsLaOa3lLNngoqRttA7r
TLSH
T104345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwusmhecwr.sys

Path C:\Temp\cwusmhecwr.sys
Size 141KB
SHA256 d34223b2db8a6daf1043bcb5f653042900ba2b84cf02efe2582d7498c126918c
MD5 2048b2090e993a802ed406f563bb010c
SHA1 0896663ff98672d2677bbf04ab0a3e669e6dcaf2
SHA512 726a17187f2d5b5eec160d21dee081dc38d543d05e393aea139f266340d46e02cba06617dbf2432bdd42ded98863a529413e946828e0bf441dcc62a67b1516ea
SSDEEP 1536:ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T132E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezwrpjhbzt.exe

Path C:\Temp\ezwrpjhbzt.exe
Size 243KB
SHA256 c5c7830651152fced101f15bbb74f2c0ac246aff249d4cd9b53dc23108634186
MD5 16f87d77c0b9dc77b5a426b83049e362
SHA1 9cfaebd930467f9afaa191dfa803e7879dcfbf56
SHA512 5ecefc4565358367129283cd39cafbe612a97d07b94d0fdc10b847a2e53732c2ebdcdd9362b4bb9f0d44d8c2a88c3bd197d9b32f35671049331b0ba8f5060d95
SSDEEP 3072:cCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7S:/vMsLaOa3lLNngoqRttA7S
TLSH
T17C345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcxvsnhfcx.sys

Path C:\Temp\fcxvsnhfcx.sys
Size 141KB
SHA256 8d42067d9ac59e69a19bde7ac673a014873c9e4fdba8db95e982ea54c5387e2c
MD5 36845c810deb80810b9f522f743fc160
SHA1 6c5fcfb08dea41ab8c2951d2b2b2ea7742d693f2
SHA512 43e7b382d9d2444d069a1b1b48fb988eea802372ca47bd313ed23c97c3c74b6d4743e4de2d9615a187c629b7beefae09b3c090c002073e2b56c4ac5dcea4febc
SSDEEP 1536:ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1EFE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hczxrpjhcz.exe

Path C:\Temp\hczxrpjhcz.exe
Size 243KB
SHA256 a769ac5a111a8a3ed74e1837721fc9c171b1c0c88b9bce7329df92701317cbd3
MD5 039cc7ba4823e453cfa0f5ece78232d6
SHA1 b5b146cee9b10f29f0a4e01ef42dcaada4fb4504
SHA512 da2bfee8173d861ab48857d67d1a59aacd440be9cc31d3fa5808072f35d2f69f6ca45aa6a9b2cfb3e5e40283fcdb294749859c2dc6ac86fecd110726828801a0
SSDEEP 3072:1CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7f:4vMsLaOa3lLNngoqRttA7f
TLSH
T1FF345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bywqojgbzt.exe

Path C:\Temp\i_bywqojgbzt.exe
Size 243KB
SHA256 4dbe59bc6e3e93f322d82419837de912d97aeebc8895f95a5dcaba76868b5fba
MD5 c0f71aa3a042337b4c9bab331caed3d6
SHA1 06f9e3f07bfa1b8d6a31424bc05a7aaedf9a66b9
SHA512 3ed7991262141fa1651b2d962c9623ef013091aa68ad5e07863da9156ed27219b3ce3af29972f05b1a6ce3e72980b35c981cd0f67021078fb79755be4dbc8423
SSDEEP 3072:VCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7z:YvMsLaOa3lLNngoqRttA7z
TLSH
T186345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ezwrpjhbzt.exe

Path C:\Temp\i_ezwrpjhbzt.exe
Size 243KB
SHA256 b302f566658a3ee66c70c9b8943f228ec942eebf7189ca8091d0b336957d0427
MD5 e29050551941682cf924578e6401db9b
SHA1 886ffbf9eeeb6cc7579cf885e45c039ef8747e84
SHA512 2a38480f35e073de74991ef50276df9099807c414af9fda3d6a21219f68a803f41609cd01095e4d072ce1ed28aa0743a14a45b5c02210d9dbcb1fb0fb4efa08d
SSDEEP 3072:mCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7M:JvMsLaOa3lLNngoqRttA7M
TLSH
T1D3345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hczxrpjhcz.exe

Path C:\Temp\i_hczxrpjhcz.exe
Size 243KB
SHA256 3c72ce802acda47901d6417862dd692ef88f8005a8bc69f67adcf64ec801abc2
MD5 7c43d2e90ca99f2aaa1719baacf1a03d
SHA1 53022058f7f06d1bf888e50fa71b5052e359fd79
SHA512 9e2f76d656b35c46256aa34e14d26e1655d42ec36aca374061896567d9d36616bcd2cd4b094ed46fcad2b150160a7a96fc8df93532725a2472de8cd7b23828e9
SSDEEP 3072:nCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7d:CvMsLaOa3lLNngoqRttA7d
TLSH
T10E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xspkhfzusp.exe

Path C:\Temp\i_xspkhfzusp.exe
Size 243KB
SHA256 44466fc65159b8f434466ddf9552cf9163adde8490ba84c9b6e3179506b3283b
MD5 de9f120805db4d309073cd6b085262b6
SHA1 784566f461c63063b8f1b5eb08dfcc86061e748f
SHA512 4472ce15f46818d8048a6aa6788b6c5452198689bebd39ee67441a0005b3c4dbd6883cfcdbf2917f261d4e5d272a96ded38f44099c9d172d8e7a1cee08f5b8b4
SSDEEP 3072:GCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:pvMsLaOa3lLNngoqRttA7Y
TLSH
T16E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ysqkicausn.exe

Path C:\Temp\i_ysqkicausn.exe
Size 243KB
SHA256 7d850b5eaa41db248a01ceecece00032d7fe7be6135f74bd563d960ad0ad5e16
MD5 bb59fe09b57a9d5f0841107679363ac3
SHA1 3ac16c146211aed71f95289dd4cebeedaa30bd61
SHA512 7584cb7240960239f13561880aca0696ce9ad5a97b76a55b4c9666e85839b189b0ef9e05b5050a10ab179ff4be63dc83baedb8e0dd0012df77784698d12ba8b6
SSDEEP 3072:9CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA77:wvMsLaOa3lLNngoqRttA77
TLSH
T133345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojhbztrmje.sys

Path C:\Temp\ojhbztrmje.sys
Size 141KB
SHA256 679b0d0dbdba6115c6cc42bf21677194db6da21bbde41454a1e23bdc7f5e8945
MD5 aa132c83b5c9ee128e84419904d81173
SHA1 ced097bb67d960542609666a7842a023da04fd43
SHA512 3883fc7e2bc8d507739fb599cc489cced5e88dce960269789917af628c26b3cd0fe8430bccabb5725bef9e56a5604a952abd03801bb211c874957950a85bf9ca
SSDEEP 1536:7a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:7a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E5E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljdbvtrlj.exe

Path C:\Temp\rljdbvtrlj.exe
Size 243KB
SHA256 3e1b07bc4abe96eed0040dfcf43cd49a2853de0fb0dd684de086057b7f2c3cf9
MD5 10831bb53a42fa479a4f472df950dbf4
SHA1 63d60d9664c36874013594aa33cc3f7a32d47659
SHA512 d9c56395c5ee3e226925f866ccea5424ab5975a6da6bf3473a1ce39b593d490cef8b03b513e913c2410206fe19ec96662143e6d725760f5844f2eb43ac3922a1
SSDEEP 3072:PCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7d:avMsLaOa3lLNngoqRttA7d
TLSH
T105345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljebwuom.sys

Path C:\Temp\trljebwuom.sys
Size 141KB
SHA256 b9f5764e727f99dcc6a79d182c9ae277a2e3c6a28118e1837506bc85fa4aa260
MD5 26218412379c8e7d54026a42008590d9
SHA1 a4ac215cd3a4b42859a6887c95cf226ba55eb156
SHA512 55ffe101f5d2e79c59ccd775790abf96f4472c9e293356b2a7b2391a013e372200b9d05bdab803ea24507c41fd1bb38a2f2349b53bbd33c3386ef76749943723
SSDEEP 1536:2a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:2a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F7E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtrojgbztr.sys

Path C:\Temp\vtrojgbztr.sys
Size 141KB
SHA256 2d60834864ac8c981d22cccad39d04d767ae4faa3d03cb587120cbecf7ad7cf1
MD5 54c2e528c6b73e936881f754047ffece
SHA1 2850278c686e6828d08fecd0b7dfd54a3484d7e0
SHA512 841b8251b949ee92a9cddce9ae2516e4663f7656ea757bfe0e295d9cc5b4d5df613a60671a4cb1213e4b61dbd671f2e0ac77cfb9d1339c931b3e07c775decd8a
SSDEEP 1536:3a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:3a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C5E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xspkhfzusp.exe

Path C:\Temp\xspkhfzusp.exe
Size 243KB
SHA256 611968cacc0fd1dea5a363a68ec793a045497c84184ee846e2c495a037b7933b
MD5 62e6cf1e23a445651451e181b1a769e3
SHA1 ae700d602cdc1423eda6bda75b47baa98c461c5d
SHA512 32c6cd0cb44f49d474c128a011ee42e1ba7cf9634d5e26e6ae316437c03f2d81c7040bd9090a458adbf676c5b33e7d75f4590f912deb2eab8873cdf71498155b
SSDEEP 3072:MCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7y:vvMsLaOa3lLNngoqRttA7y
TLSH
T163345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqkicausn.exe

Path C:\Temp\ysqkicausn.exe
Size 243KB
SHA256 3ab3d71a70917759368c1ddbf0833e9acd2f80ca8577bbff2191f7dfaebe48f3
MD5 d3b34f035a8f05db42cf4ed4bc9bc288
SHA1 3c384e2ecd526833d8be81aa3083d663038d8681
SHA512 185f5ea4e3c92ba96279277d9d234b8499041c07ff4712c0e12cbf237861e8fb697f8a5d76aa45a5c0d0884fb5c7efaa7d84bab00da27c9c3bef16773134850f
SSDEEP 3072:7CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7d:uvMsLaOa3lLNngoqRttA7d
TLSH
T1C6345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

8cb1ecd1-d9e4-4d1c-bd81-7e63b3a9ccbf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8cb1ecd1-d9e4-4d1c-bd81-7e63b3a9ccbf.tmp
Size 32KB
SHA256 8b8ae83da1df36b15871938b5bd3df77bc8bb2a0cc83b453b455a9d719cdc28b
MD5 5e8ecbc28964cbe25d0305eacde3631c
SHA1 2a0ba2b92ea08b5e00781eb31e14e9f445127b04
SHA512 498dc5b37f698f20c9aeefaad4385355e5178f02715253a1059a7cc60ff2786ded3816e780facb05eb54cc45f14b38a1e82a4d6c497096995c5eeaac5f81f96f
SSDEEP 768:kfISGS7pLuL7CvWgd5fWb8F1+UoAYDCx9Tuqh0VfUC9xbog/OVSJGSV2proHh0wB:kfISGqE7CvWgd5fWbu1jaNJGU2CHh0wB
TLSH
T134E2DC3B680CCB7F4F8049DCEC297E9AADE801CF96D8C99447EA850C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 401418e14686a7fc8060ddf01607154df22b8d322e5a8fac349811e4192088a8
MD5 70c702bda1e2a8ce046bd0147125919f
SHA1 53f01d77fb2b5a62fe461a2b4db4bc0fd256506f
SHA512 f03294739062e7405b45d6a5c41e773f73f0cbad8777b4b46945fe8eb81ab36d80eed2e9da5ae2e3a432b0589ce45d75bc28afa026c1e4188beb19142eb78417
TLSH
T12E615096133E0ED3DBA484BAE4E156F836F6849586673EC9D8706FF09C5630B5C34A70
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592b5c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592b5c.TMP
Size 3KB
SHA256 0fcb0302e9ee192c3be3b530d54c7dd9ee3fa7748ef53a39d217a6f8edf0841f
MD5 d5939ba4f6f574583f878f80ccac92f9
SHA1 830da4a5fead654463279bfc35c8f742769f246e
SHA512 749e5bd893ab19462165be66eef2ab9e43e66124eef0a15f44599b72330c281275c3c4bab1fe85e07ee42d7c37250b01d3a8b14fbddb8e93c084500feb7f5a6a
TLSH
T14B615FA6133D0ED3DBA484BAE4E156F836F2849586673EC9D8702FF09C4630B6C74A30
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

80549096-4ae7-40b4-871e-a32936242457.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\80549096-4ae7-40b4-871e-a32936242457.tmp
Size 2KB
SHA256 b613f57dbd3e59a0f73020952932f3dfd805dd3a15017d39df0f7498bc374993
MD5 8f3add36b7f4113defedbb3f26d22f39
SHA1 8bea483ee679c6544a5e1f1e255f9a3c39fc0ff0
SHA512 be6f6cb5b21642de560f1af0c7e43151a824685af4e7f6bf92c6c4d2b21b75b78b2231fd1087065b95f376c84d06b6d8abc23224cbe86513427b8728fb837183
TLSH
T101519CF3C3E8852E890156F0AA14AE1BDE1D0915832C3D5AC9E4EF5B93E3471E141A5E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e1f73d3c70d98cf04d2cdae03f65e1107e08606c796ccf193f8866796f643056
MD5 549204635dbb2a146d0e5c54f4fe1c08
SHA1 a8346f16a060e5c02e3c8d9ee107fbecdb8a7963
SHA512 94b7bb9394605ea87a8822b25ff2ac841d72296659cb24ec879868acdb84265512fc6e4ee24adc4df507ab45f2f6b18b2e9161da1b4a644c939231e068994db1
SSDEEP 192:sxRmRryM/jK1Ml8wCi/fHs2weThZzMbzoA8pi/g6+WNIYZ7BKsJ+GDIgtJ:sxRm78i/fHs2weTvg6i/5I+JB3
TLSH
T15052D9156A24993BDCDBD209FA557F93D6F81573E2901E44AAFCCA0C04E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3b71c4d13e0846342cae679a15b077be27a98acf1a79c42d172a55b1ba04eb12
MD5 5e6193fe45526dc566d6fd5a0a67ce21
SHA1 53dc2ad69bfb59d44bd50ef74e05b1da83b04ea9
SHA512 3e23a6b1fc987cae9006250cbbc6598705d1e71246c3b66b5e3cdfc86d234798ec9c76f4b3da3b7764a399db36e2a00fffdd36adb55015a779b84f67747a6257
SSDEEP 192:sxRtRryM/jK1Ml8wCi/fHspweThZzMbzoA8pi/g6+WNIYZ7BKsJ+GDIgDCJ:sxRt78i/fHspweTvg6i/5I+JBS
TLSH
T14652D9156A24993BDCDBD209FA557F93D6F81573E2901E449AFCDA0C04E7AEC221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ffc039a355be45f6b769a0093a28a4b8d32f9627403d6a6ac10508865136b567
MD5 5e4e19ecea046f1b4dcd72a862de024d
SHA1 a93012954a1ae35ec1e09a95d9b6766c8441ac21
SHA512 98d93e4d7214c5edcd38e97443d55b68d4136566b9c76de2d8cfc0fc185d5721bc568eb8eb8aa38fe80ee55d05f2ebb05b1520d3bf6bf8def9387a216550f589
SSDEEP 192:sxRtRryM/jK1Ml8UQUCi/fHspw4ThZz0bzoA8pr2/g6+WNCyU/YZ7ZQsJ+GDIgD4:sxRtVqDi/fHspw4Tvo6q/5A/yJBs
TLSH
T18962B91669249977DCDBD209FA51BB93D6F85573D1900E449BFCCA0C04E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 59b5b64bb72264907688a60db7a474679474b25603df78926b264ef5c525818f
MD5 7e2686f24f3f4b8d04d00465d5ea6f57
SHA1 bf219eb09bd5e68603d80da2c4fd0c196e6829dc
SHA512 014e7ca0e77b034983f001b3f9cf5fc04a5a38aeb834aa8a7ca76d599586f3c4e5b3eaa9631e086645572a700b6c77536addb23a1fc7f57eaa1af39172ad2524
SSDEEP 192:sxRtRryM/jK1Ml8wCi/fHspw4ThZz0bzoA8p92/g6+WNCyU/YZ7ZQsJ+GDIgD0J:sxRtV8i/fHspw4Tvo6U/5A/yJBs
TLSH
T1EC62B9156A24597BDCDBD209FA517F93D6F81573E2900E489BFCCA0C05E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8c2075d3a072848141b72592e201ea0a7266519acd647152dc8940be6d8caa14
MD5 a6e660fc7ddf0df672aac7d49563ad83
SHA1 bff3e0780b2bf4675ded1569bac0f9f99f1cee78
SHA512 8c398b314d31d375e26173dbbb42f527ea1c0ecb35e0a9efe8b5eb4d357acf4134503846166ed741791e17ec4da7e3258d9f45ba9643ea91c4e1ebfafda83c50
SSDEEP 48:KQrI1KU8QTyt/In/aLvRVBg1N0zIYngKv1nZgbXwOE5ftyl90Jd/Xn21Xe9IYd2H:KQrSKU8me/kEgKtSOCesKLqv
TLSH
T18691308571BB421439FE281990628A26C6C27077766CF46B3BE905B31F67E011FFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59c4ec.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59c4ec.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 0144c32fc52a72cc887f9964d02b5410c93b2168618554c2958186c0a745ea46
MD5 0f3d193f770e3f1134fe0c0409f4d60c
SHA1 7ec008495b5b8907c7aa751889a24cf37b80c118
SHA512 3f5d72757081101f9e797170ca5b6bae678d23a9fe8ae81118b333692fe6f3eec6d5a24df82bbc64d140b61a07726e8a36a7c495d42bfe875bda5231d05aae0d
SSDEEP 768:yj+9C3co19q55Aam6aQMGdjWca4Ghf9wzC:B9C3YrmaME6pwW
TLSH
T118D29E315878DC739CA79695F32B3783BEF011B388C80E84D9D99B0D069729E270B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 b03464f12e5d23ed05605a1cf1402c5f7fd619fef0437ee4da9f2a942a273bb4
MD5 44f6951b9edaa91eebfb21fc91e37724
SHA1 a2d7efdc84e7e2b3a359dd07d6afbe008c85de88
SHA512 530fe31a1ed65602d12d5abcd280ffcd0bee3e7c4234e3dc02a2d3f2e28d5749324fac97a9d2851c42811d90626220900a293e9f64a5677aeffa9374e39ea467
SSDEEP 768:/rv+4UNbdq3aIqMAAam6aQMGdjWca4GhfBUPeU/:/bsbc3ZKmaME6pcH
TLSH
T182F2AE31A8689973DDB79A89F21B7787BEF021A385D40E84C9D95B0D43971CE330792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 eb872a0b1ae5e5c4215fb49b6604fe7aa8bb1d316bcbeccce958b9361e9de3ac
MD5 ab0407e906a1cc30d38b2fac966ca639
SHA1 a4835a4292b5975cf7683d1debfe8829587b43f2
SHA512 dfa573c2f946cd091bd80c5833d9f36fe103be777d16ddfd86be11ab603861aadca18758908de4d6b2ce019caf6855413658c2ddd43372e03ee4e6983208d20c
SSDEEP 768:Zj+9C3hoI9q5UAam6aQMGdjWca4Ghf9wzC:E9C3I2maME6pwW
TLSH
T176D29E315878DC779CA79699F32B3787BEF011B388C40E84D9D99B0D069729E270791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 537223e35be63eede46ca14b5516fc2f22b7c9f7af8e90e9ae793a5cec03e1a9
MD5 c975874482a9695cc426a27cc6d110e2
SHA1 1d3c6ffe40ca0841b4eb615abc617c5978ab52e7
SHA512 db0b2f13ae0cefeba78a54440f8590392fefe72a83f02fff633340bf0e0491ea5e0fc057a8c4fcd823d3173a88e3418378f16818234c2536bce2500ade46fcfa
SSDEEP 768:7F1j+9U3XwgEoYs+Aam6aQMGdjWca4Ghf9wzC:a9U3UmaME6pwW
TLSH
T11B0308F198E78977D8AE4787A33E6E46A9BCD1A3B4884984F7C45D0CCD821BFD207815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

d9fefe03-5863-4cc0-8ed9-0cf1cfd9b793.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d9fefe03-5863-4cc0-8ed9-0cf1cfd9b793.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4328_2020910394\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/256-319-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1084-355-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1232-515-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1404-245-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1404-186-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2372-408-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3084-487-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3104-445-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3500-465-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3508-381-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3692-324-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3768-268-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4472-347-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4472-378-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4684-227-0x000002DCF39B0000-0x000002DCF3D6B000-memory.dmp

Download

memory/4684-236-0x000002DCF39B0000-0x000002DCF3D6B000-memory.dmp

Download

memory/4860-321-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4860-311-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4936-239-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5068-441-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5068-421-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5132-483-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5644-280-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5856-519-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5868-440-0x0000000000010000-0x0000000000083000-memory.dmp

Download