3ae7f55daf29a918ae05001cc391711d465959d95b5f504cca545ce24e341c64

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_956317801158ec4873ccf05ba24fe336_elex_rhadamanthys_stop.exe
Size 243KB
Sample260715-e7ch5abx4p
SHA256 3ae7f55daf29a918ae05001cc391711d465959d95b5f504cca545ce24e341c64
MD5 956317801158ec4873ccf05ba24fe336
SHA1 2559ac2f2e05891a1b68d1b85b9221f4d3c8a4d6
SHA512 e9b7c1a02a60e853f5560971a0b251903375dac2445bac177d65194dd39989a79a562b9460ac333f9fbff9d0fb167529ac0511da9729ebc34994bee6a7842d0d
SSDEEP 3072:BCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7X:cvMsLaOa3lLNngoqRttA7X
TLSH
T132345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4856	CP.exe
3024	pmhczusmhe.exe
2764	CP.exe
4432	CP.exe
3544	i_pmhczusmhe.exe
2432	rojhbztrmj.sys
472	CP.exe
3156	gezwromgec.exe
2516	CP.exe
4168	CP.exe
5620	i_gezwromgec.exe
4492	ztrljetolg.sys
3828	CP.exe
5604	jgbztrljdb.exe
1696	CP.exe
5744	CP.exe
3576	i_jgbztrljdb.exe
1316	bytrljdbvt.sys
5320	CP.exe
5964	lgeywqojgb.exe
4192	CP.exe
3396	CP.exe
1356	i_lgeywqojgb.exe
1572	tqljdbvtnl.sys
2856	CP.exe
4612	lidbvtqljd.exe
1008	CP.exe
1908	CP.exe
2912	i_lidbvtqljd.exe
2384	ysqlidavtn.sys
1688	CP.exe
2388	qnlfdxvqnl.exe
796	CP.exe
4872	CP.exe
1720	i_qnlfdxvqnl.exe
4340	nhfaxsqkic.sys
2312	CP.exe
2600	causpnkfdx.exe
4324	CP.exe
4124	CP.exe
2540	i_causpnkfdx.exe
4108	nhfzxspkic.sys
2092	CP.exe
5984	fcaupmkfcx.exe
4764	CP.exe
1884	CP.exe
4800	i_fcaupmkfcx.exe
4500	rpkhczusmk.sys
2928	CP.exe
5404	pkhczurpjh.exe
4448	CP.exe
4588	CP.exe
4696	i_pkhczurpjh.exe
3104	hcztrpmhec.sys
3472	CP.exe
2592	bztrmjecwu.exe
4524	CP.exe
1716	CP.exe
2540	i_bztrmjecwu.exe
880	bwtrmjebwu.sys
4688	CP.exe
2172	ztrljgbzwr.exe
1992	CP.exe
5396	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5892_767632007\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5892_2023420305\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5892_2023420305\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5892_767632007\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5892_2023420305\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5892_2023420305\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5892_89500864\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5892_111649839\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5892_111649839\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbztrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causpnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrmjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrljgbzwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlgdywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jeywuomjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gezwromgec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhczurpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eczxrpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gezwromgec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidbvtqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcaupmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvqnigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axupnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhczusmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidbvtqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlfdxvqnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgdyvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbolgebzwq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_956317801158ec4873ccf05ba24fe336_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhczurpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrmjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlgdywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axupnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhczusmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlfdxvqnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcaupmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgdyvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvqnigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jeywuomjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbolgebzwq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbztrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causpnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrljgbzwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eczxrpjhcz.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3212	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4436	ipconfig.exe
5996	ipconfig.exe
6032	ipconfig.exe
5100	ipconfig.exe
4276	ipconfig.exe
2768	ipconfig.exe
4324	ipconfig.exe
4520	ipconfig.exe
5836	ipconfig.exe
4584	ipconfig.exe
2096	ipconfig.exe
1036	ipconfig.exe
624	ipconfig.exe
3544	ipconfig.exe
6004	ipconfig.exe
4760	ipconfig.exe
2332	ipconfig.exe
3852	ipconfig.exe
5040	ipconfig.exe
3544	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134285636799224305"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{B9AD7F76-0FF6-494C-BD90-97C647D647C1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5332	msedge.exe
5332	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3544	i_pmhczusmhe.exe
Token: SeDebugPrivilege	5620	i_gezwromgec.exe
Token: SeDebugPrivilege	3576	i_jgbztrljdb.exe
Token: SeDebugPrivilege	1356	i_lgeywqojgb.exe
Token: SeDebugPrivilege	2912	i_lidbvtqljd.exe
Token: SeDebugPrivilege	1720	i_qnlfdxvqnl.exe
Token: SeDebugPrivilege	2540	i_causpnkfdx.exe
Token: SeDebugPrivilege	4800	i_fcaupmkfcx.exe
Token: SeDebugPrivilege	4696	i_pkhczurpjh.exe
Token: SeDebugPrivilege	2540	i_bztrmjecwu.exe
Token: SeDebugPrivilege	256	i_ztrljgbzwr.exe
Token: SeDebugPrivilege	5208	i_olgdyvtolg.exe
Token: SeDebugPrivilege	5648	i_tnlgdywqoi.exe
Token: SeDebugPrivilege	1260	i_dxvqnigays.exe
Token: SeDebugPrivilege	4304	i_aysqkicaus.exe
Token: SeDebugPrivilege	2176	i_axupnhfzxs.exe
Token: SeDebugPrivilege	4280	i_ausmkecxup.exe
Token: SeDebugPrivilege	2316	i_eczxrpjhcz.exe
Token: SeDebugPrivilege	3848	i_jeywuomjhb.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5892	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 5376	4160	2026-07-15_956317801158ec4873ccf05ba24fe336_elex_rhadamanthys_stop.exe	87
PID 5376 wrote to memory of 5892	5376	iexplore.exe	88
PID 5892 wrote to memory of 4600	5892	msedge.exe	89
PID 5892 wrote to memory of 1120	5892	msedge.exe	90
PID 5892 wrote to memory of 3212	5892	msedge.exe	92
PID 5892 wrote to memory of 1120	5892	msedge.exe	90
PID 5892 wrote to memory of 1120	5892	msedge.exe	90
PID 5892 wrote to memory of 4796	5892	msedge.exe	94
PID 5892 wrote to memory of 4796	5892	msedge.exe	94
PID 5892 wrote to memory of 4796	5892	msedge.exe	94
PID 5892 wrote to memory of 5132	5892	msedge.exe	95
PID 5892 wrote to memory of 5132	5892	msedge.exe	95
PID 5892 wrote to memory of 5132	5892	msedge.exe	95
PID 5892 wrote to memory of 3488	5892	msedge.exe	93
PID 5892 wrote to memory of 3488	5892	msedge.exe	93
PID 5892 wrote to memory of 1652	5892	msedge.exe	96
PID 5892 wrote to memory of 1652	5892	msedge.exe	96
PID 5892 wrote to memory of 1652	5892	msedge.exe	96
PID 5892 wrote to memory of 4916	5892	msedge.exe	97
PID 5892 wrote to memory of 4916	5892	msedge.exe	97
PID 5892 wrote to memory of 4916	5892	msedge.exe	97
PID 4160 wrote to memory of 4856	4160	2026-07-15_956317801158ec4873ccf05ba24fe336_elex_rhadamanthys_stop.exe	99
PID 3024 wrote to memory of 2764	3024	pmhczusmhe.exe	102
PID 5892 wrote to memory of 3928	5892	msedge.exe	105
PID 5892 wrote to memory of 4564	5892	msedge.exe	106
PID 5892 wrote to memory of 3928	5892	msedge.exe	105
PID 5892 wrote to memory of 4564	5892	msedge.exe	106
PID 5892 wrote to memory of 2536	5892	msedge.exe	108
PID 5892 wrote to memory of 4308	5892	msedge.exe	111
PID 5892 wrote to memory of 4308	5892	msedge.exe	111
PID 4160 wrote to memory of 4432	4160	2026-07-15_956317801158ec4873ccf05ba24fe336_elex_rhadamanthys_stop.exe	112
PID 5892 wrote to memory of 880	5892	msedge.exe	114
PID 5892 wrote to memory of 880	5892	msedge.exe	114
PID 5892 wrote to memory of 4108	5892	msedge.exe	115
PID 5892 wrote to memory of 4108	5892	msedge.exe	115
PID 4160 wrote to memory of 472	4160	2026-07-15_956317801158ec4873ccf05ba24fe336_elex_rhadamanthys_stop.exe	118
PID 3156 wrote to memory of 2516	3156	gezwromgec.exe	120
PID 4160 wrote to memory of 4168	4160	2026-07-15_956317801158ec4873ccf05ba24fe336_elex_rhadamanthys_stop.exe	123
PID 4160 wrote to memory of 3828	4160	2026-07-15_956317801158ec4873ccf05ba24fe336_elex_rhadamanthys_stop.exe	127
PID 5604 wrote to memory of 1696	5604	jgbztrljdb.exe	129
PID 4160 wrote to memory of 5744	4160	2026-07-15_956317801158ec4873ccf05ba24fe336_elex_rhadamanthys_stop.exe	132
PID 4160 wrote to memory of 5320	4160	2026-07-15_956317801158ec4873ccf05ba24fe336_elex_rhadamanthys_stop.exe	136
PID 5964 wrote to memory of 4192	5964	lgeywqojgb.exe	138
PID 4160 wrote to memory of 3396	4160	2026-07-15_956317801158ec4873ccf05ba24fe336_elex_rhadamanthys_stop.exe	142
PID 5892 wrote to memory of 2084	5892	msedge.exe	144
PID 5892 wrote to memory of 2544	5892	msedge.exe	145
PID 5892 wrote to memory of 5984	5892	msedge.exe	146
PID 5892 wrote to memory of 1724	5892	msedge.exe	147
PID 5892 wrote to memory of 1724	5892	msedge.exe	147
PID 5892 wrote to memory of 1724	5892	msedge.exe	147
PID 5892 wrote to memory of 2072	5892	msedge.exe	148
PID 5892 wrote to memory of 2072	5892	msedge.exe	148
PID 5892 wrote to memory of 2072	5892	msedge.exe	148
PID 4160 wrote to memory of 2856	4160	2026-07-15_956317801158ec4873ccf05ba24fe336_elex_rhadamanthys_stop.exe	151
PID 4612 wrote to memory of 1008	4612	lidbvtqljd.exe	153
PID 4160 wrote to memory of 1908	4160	2026-07-15_956317801158ec4873ccf05ba24fe336_elex_rhadamanthys_stop.exe	156
PID 4160 wrote to memory of 1688	4160	2026-07-15_956317801158ec4873ccf05ba24fe336_elex_rhadamanthys_stop.exe	160
PID 2388 wrote to memory of 796	2388	qnlfdxvqnl.exe	162
PID 4160 wrote to memory of 4872	4160	2026-07-15_956317801158ec4873ccf05ba24fe336_elex_rhadamanthys_stop.exe	165
PID 4160 wrote to memory of 2312	4160	2026-07-15_956317801158ec4873ccf05ba24fe336_elex_rhadamanthys_stop.exe	169
PID 2600 wrote to memory of 4324	2600	causpnkfdx.exe	171
PID 4160 wrote to memory of 4124	4160	2026-07-15_956317801158ec4873ccf05ba24fe336_elex_rhadamanthys_stop.exe	174
PID 4160 wrote to memory of 2092	4160	2026-07-15_956317801158ec4873ccf05ba24fe336_elex_rhadamanthys_stop.exe	178
PID 5984 wrote to memory of 4764	5984	fcaupmkfcx.exe	180

C:\Users\Admin\AppData\Local\Temp\2026-07-15_956317801158ec4873ccf05ba24fe336_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_956317801158ec4873ccf05ba24fe336_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ff9628ac188,0x7ff9628ac194,0x7ff9628ac1a0
      4⤵
      PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,4125594549018668893,12850929535566496862,262144 --field-trial-handle=2248,i,5758921142506136523,10920914348398460415,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
      4⤵
      PID:1120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,11708783996354828123,10609772760187031356,524288 --field-trial-handle=2248,i,5758921142506136523,10920914348398460415,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:11
      4⤵
      System Time Discovery
      PID:3212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,5821854660255280925,738760085059089196,524288 --field-trial-handle=2248,i,5758921142506136523,10920914348398460415,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:13
      4⤵
      PID:3488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,16888820912254222370,1533144095404336918,2097152 --field-trial-handle=2248,i,5758921142506136523,10920914348398460415,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
      4⤵
      PID:4796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,2084493847015451594,8533053747914791860,2097152 --field-trial-handle=2248,i,5758921142506136523,10920914348398460415,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      PID:5132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,4448025744224472846,12794121868270342962,2097152 --field-trial-handle=2248,i,5758921142506136523,10920914348398460415,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:9
      4⤵
      PID:1652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,5075084338510056917,10952010050240131417,2097152 --field-trial-handle=2248,i,5758921142506136523,10920914348398460415,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:1
      4⤵
      PID:4916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,7936872266437556633,9581798565420868533,524288 --field-trial-handle=2248,i,5758921142506136523,10920914348398460415,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:14
      4⤵
      PID:3928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3540,i,10895995248890670602,9378364479391090785,524288 --field-trial-handle=2248,i,5758921142506136523,10920914348398460415,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:14
      4⤵
      PID:4564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,12552461913310682509,11692217300922013529,524288 --field-trial-handle=2248,i,5758921142506136523,10920914348398460415,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
      4⤵
      PID:2320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,12552461913310682509,11692217300922013529,524288 --field-trial-handle=2248,i,5758921142506136523,10920914348398460415,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
      4⤵
      PID:2536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,11363813084219769583,4747879414316233815,524288 --field-trial-handle=2248,i,5758921142506136523,10920914348398460415,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
      4⤵
      PID:4308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,12265231145138271617,5539864456751459500,524288 --field-trial-handle=2248,i,5758921142506136523,10920914348398460415,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
      4⤵
      PID:880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,14374397509191586978,16600254893429886660,524288 --field-trial-handle=2248,i,5758921142506136523,10920914348398460415,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
      4⤵
      PID:4108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,7511539829707539689,4152061081665167764,524288 --field-trial-handle=2248,i,5758921142506136523,10920914348398460415,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:14
      4⤵
      PID:2084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,5524841298029289497,16229155173854711373,524288 --field-trial-handle=2248,i,5758921142506136523,10920914348398460415,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
      4⤵
      PID:2544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,10062320850107530761,11445542867342219133,524288 --field-trial-handle=2248,i,5758921142506136523,10920914348398460415,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
      4⤵
      PID:5984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6116,i,174384977754546598,18035485141031564361,2097152 --field-trial-handle=2248,i,5758921142506136523,10920914348398460415,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:1
      4⤵
      PID:1724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3228,i,7643631645554725385,9109675726883962867,2097152 --field-trial-handle=2248,i,5758921142506136523,10920914348398460415,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:1
      4⤵
      PID:2072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,14529517155251642026,1253076336641039148,524288 --field-trial-handle=2248,i,5758921142506136523,10920914348398460415,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
      4⤵
      PID:5792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,14005976683934894523,12688307162438294029,524288 --field-trial-handle=2248,i,5758921142506136523,10920914348398460415,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:14
      4⤵
      PID:3124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,17855959409704779369,18043999082994566248,524288 --field-trial-handle=2248,i,5758921142506136523,10920914348398460415,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14
      4⤵
      PID:4916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,11661294059565723536,13520212625236857591,524288 --field-trial-handle=2248,i,5758921142506136523,10920914348398460415,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
      4⤵
      PID:5976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6512,i,12800458898595136642,7843904151869352400,262144 --field-trial-handle=2248,i,5758921142506136523,10920914348398460415,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,6470520153868004187,16630090991408090995,524288 --field-trial-handle=2248,i,5758921142506136523,10920914348398460415,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
      4⤵
      PID:256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmhczusmhe.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4856
- - C:\Temp\pmhczusmhe.exe
    C:\Temp\pmhczusmhe.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3024
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2764
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmhczusmhe.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4432
- - C:\Temp\i_pmhczusmhe.exe
    C:\Temp\i_pmhczusmhe.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gezwromgec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:472
- - C:\Temp\gezwromgec.exe
    C:\Temp\gezwromgec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3156
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2516
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2332
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gezwromgec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4168
- - C:\Temp\i_gezwromgec.exe
    C:\Temp\i_gezwromgec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5620
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgbztrljdb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3828
- - C:\Temp\jgbztrljdb.exe
    C:\Temp\jgbztrljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5604
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1696
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgbztrljdb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5744
- - C:\Temp\i_jgbztrljdb.exe
    C:\Temp\i_jgbztrljdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgeywqojgb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5320
- - C:\Temp\lgeywqojgb.exe
    C:\Temp\lgeywqojgb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5964
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4192
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgeywqojgb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3396
- - C:\Temp\i_lgeywqojgb.exe
    C:\Temp\i_lgeywqojgb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1356
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lidbvtqljd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2856
- - C:\Temp\lidbvtqljd.exe
    C:\Temp\lidbvtqljd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4612
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1008
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4436
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lidbvtqljd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1908
- - C:\Temp\i_lidbvtqljd.exe
    C:\Temp\i_lidbvtqljd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnlfdxvqnl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1688
- - C:\Temp\qnlfdxvqnl.exe
    C:\Temp\qnlfdxvqnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2388
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:796
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnlfdxvqnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4872
- - C:\Temp\i_qnlfdxvqnl.exe
    C:\Temp\i_qnlfdxvqnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\causpnkfdx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2312
- - C:\Temp\causpnkfdx.exe
    C:\Temp\causpnkfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2600
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4324
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_causpnkfdx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4124
- - C:\Temp\i_causpnkfdx.exe
    C:\Temp\i_causpnkfdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fcaupmkfcx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2092
- - C:\Temp\fcaupmkfcx.exe
    C:\Temp\fcaupmkfcx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5984
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4764
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fcaupmkfcx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1884
- - C:\Temp\i_fcaupmkfcx.exe
    C:\Temp\i_fcaupmkfcx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkhczurpjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2928
- - C:\Temp\pkhczurpjh.exe
    C:\Temp\pkhczurpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5404
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4448
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4520
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkhczurpjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4588
- - C:\Temp\i_pkhczurpjh.exe
    C:\Temp\i_pkhczurpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrmjecwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3472
- - C:\Temp\bztrmjecwu.exe
    C:\Temp\bztrmjecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2592
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4524
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrmjecwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1716
- - C:\Temp\i_bztrmjecwu.exe
    C:\Temp\i_bztrmjecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrljgbzwr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4688
- - C:\Temp\ztrljgbzwr.exe
    C:\Temp\ztrljgbzwr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2172
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1992
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrljgbzwr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5396
- - C:\Temp\i_ztrljgbzwr.exe
    C:\Temp\i_ztrljgbzwr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\olgdyvtolg.exe ups_run
  2⤵
  PID:5348
- - C:\Temp\olgdyvtolg.exe
    C:\Temp\olgdyvtolg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3344
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5988
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_olgdyvtolg.exe ups_ins
  2⤵
  PID:3852
- - C:\Temp\i_olgdyvtolg.exe
    C:\Temp\i_olgdyvtolg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5208
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlgdywqoi.exe ups_run
  2⤵
  PID:2968
- - C:\Temp\tnlgdywqoi.exe
    C:\Temp\tnlgdywqoi.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3680
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:200
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlgdywqoi.exe ups_ins
  2⤵
  PID:1100
- - C:\Temp\i_tnlgdywqoi.exe
    C:\Temp\i_tnlgdywqoi.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5648
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dxvqnigays.exe ups_run
  2⤵
  PID:4692
- - C:\Temp\dxvqnigays.exe
    C:\Temp\dxvqnigays.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5100
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1816
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dxvqnigays.exe ups_ins
  2⤵
  PID:4452
- - C:\Temp\i_dxvqnigays.exe
    C:\Temp\i_dxvqnigays.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1260
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqkicaus.exe ups_run
  2⤵
  PID:3940
- - C:\Temp\aysqkicaus.exe
    C:\Temp\aysqkicaus.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:764
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4276
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqkicaus.exe ups_ins
  2⤵
  PID:4176
- - C:\Temp\i_aysqkicaus.exe
    C:\Temp\i_aysqkicaus.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axupnhfzxs.exe ups_run
  2⤵
  PID:3540
- - C:\Temp\axupnhfzxs.exe
    C:\Temp\axupnhfzxs.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1984
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3272
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4584
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axupnhfzxs.exe ups_ins
  2⤵
  PID:5316
- - C:\Temp\i_axupnhfzxs.exe
    C:\Temp\i_axupnhfzxs.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausmkecxup.exe ups_run
  2⤵
  PID:4628
- - C:\Temp\ausmkecxup.exe
    C:\Temp\ausmkecxup.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2680
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5972
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2096
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausmkecxup.exe ups_ins
  2⤵
  PID:1324
- - C:\Temp\i_ausmkecxup.exe
    C:\Temp\i_ausmkecxup.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4280
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eczxrpjhcz.exe ups_run
  2⤵
  PID:124
- - C:\Temp\eczxrpjhcz.exe
    C:\Temp\eczxrpjhcz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2496
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4316
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eczxrpjhcz.exe ups_ins
  2⤵
  PID:1148
- - C:\Temp\i_eczxrpjhcz.exe
    C:\Temp\i_eczxrpjhcz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jeywuomjhb.exe ups_run
  2⤵
  PID:3844
- - C:\Temp\jeywuomjhb.exe
    C:\Temp\jeywuomjhb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1664
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5424
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1036
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jeywuomjhb.exe ups_ins
  2⤵
  PID:4760
- - C:\Temp\i_jeywuomjhb.exe
    C:\Temp\i_jeywuomjhb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbolgebzwq.exe ups_run
  2⤵
  PID:700
- - C:\Temp\dbolgebzwq.exe
    C:\Temp\dbolgebzwq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4396
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1208
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbolgebzwq.exe ups_ins
  2⤵
  PID:3444
- - C:\Temp\i_dbolgebzwq.exe
    C:\Temp\i_dbolgebzwq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4140

C:\Temp\rojhbztrmj.sys
C:\Temp\rojhbztrmj.sys
1⤵
- Executes dropped EXE
PID:2432

C:\Temp\ztrljetolg.sys
C:\Temp\ztrljetolg.sys
1⤵
- Executes dropped EXE
PID:4492

C:\Temp\bytrljdbvt.sys
C:\Temp\bytrljdbvt.sys
1⤵
- Executes dropped EXE
PID:1316

C:\Temp\tqljdbvtnl.sys
C:\Temp\tqljdbvtnl.sys
1⤵
- Executes dropped EXE
PID:1572

C:\Temp\ysqlidavtn.sys
C:\Temp\ysqlidavtn.sys
1⤵
- Executes dropped EXE
PID:2384

C:\Temp\nhfaxsqkic.sys
C:\Temp\nhfaxsqkic.sys
1⤵
- Executes dropped EXE
PID:4340

C:\Temp\nhfzxspkic.sys
C:\Temp\nhfzxspkic.sys
1⤵
- Executes dropped EXE
PID:4108

C:\Temp\rpkhczusmk.sys
C:\Temp\rpkhczusmk.sys
1⤵
- Executes dropped EXE
PID:4500

C:\Temp\hcztrpmhec.sys
C:\Temp\hcztrpmhec.sys
1⤵
- Executes dropped EXE
PID:3104

C:\Temp\bwtrmjebwu.sys
C:\Temp\bwtrmjebwu.sys
1⤵
- Executes dropped EXE
PID:880

C:\Temp\eywtrljgeb.sys
C:\Temp\eywtrljgeb.sys
1⤵
PID:5140

C:\Temp\ywqoigbytq.sys
C:\Temp\ywqoigbytq.sys
1⤵
PID:3540

C:\Temp\qlidbvtnlf.sys
C:\Temp\qlidbvtnlf.sys
1⤵
PID:244

C:\Temp\axvpnifdxv.sys
C:\Temp\axvpnifdxv.sys
1⤵
PID:940

C:\Temp\faxusqkica.sys
C:\Temp\faxusqkica.sys
1⤵
PID:5208

C:\Temp\cxusmkicau.sys
C:\Temp\cxusmkicau.sys
1⤵
PID:5840

C:\Temp\cwurpjhecz.sys
C:\Temp\cwurpjhecz.sys
1⤵
PID:2688

C:\Temp\mgeywuomge.sys
C:\Temp\mgeywuomge.sys
1⤵
PID:4988

C:\Temp\bwtomgebwt.sys
C:\Temp\bwtomgebwt.sys
1⤵
PID:3176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bytrljdbvt.sys

Path C:\Temp\bytrljdbvt.sys
Size 141KB
SHA256 f9e08a0fb247e5354e26eb20152c3eb036253551a42cff8a820164a83e689a47
MD5 8b0bb6df630e91dcabd909d21f27af75
SHA1 09c0cf76f7b3648da0ab8436f621f695119f9152
SHA512 dbfa474d8ce8f790b28934ee7beaf92a7807ddfbfa1445f1f8575be10c1f112458635a1af54bf2bae63e94a9b692e94fb51c6f5dad99f54d4e06e67db6b9a7e9
SSDEEP 1536:Ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T196E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gezwromgec.exe

Path C:\Temp\gezwromgec.exe
Size 243KB
SHA256 c5f07f5a61e4f6ca8ec8a3675300f524c818885775494b12ab94e792cfecf500
MD5 168469daf5f972572b5c56a495dfed87
SHA1 56d1bb8aaa3bfb6f9f001496200b6e18a9e07294
SHA512 56404457ae8b33136fb73585484c60e5392cdc617ed50b13f7e259b7cdbca4cb945256212ca4a08ce02aaa45577602a219a69913bcab2a0a01879a5a0ebd3aa0
SSDEEP 3072:1CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA73:4vMsLaOa3lLNngoqRttA73
TLSH
T18C345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gezwromgec.exe

Path C:\Temp\i_gezwromgec.exe
Size 243KB
SHA256 fa4bb50e1b0514d6dc5da642f05f6f41b2a8860f364d07b3b52b377dae29c102
MD5 afe155fe11d91d0ab8cce6d218008595
SHA1 4be316a46ef84f4008e3fc0247f7e9a5bc1439e8
SHA512 97a88c1fc4921b625b468df6a6b4d9e7408b33b1149327ff50ecd8f3dc654c72ada2b8fe484aec2a68f3899d1f54f1c7283764a97674e8e8b9637f1c6eb00519
SSDEEP 3072:kCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7i:3vMsLaOa3lLNngoqRttA7i
TLSH
T1A0345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jgbztrljdb.exe

Path C:\Temp\i_jgbztrljdb.exe
Size 243KB
SHA256 fcbabe4c658cee8730cf3a35348944a2571ee0d45471f048cd01104269454795
MD5 6a40be0000056c86140772b51b9185e5
SHA1 86763f71b061005b87ccf4e89c34461daded3b51
SHA512 3d0a2f4dd8997b45a62db57c075fbb298f6e1196a7439bc5426dd73946a687c575e3134e7a64b7931707232fd278f52a75268415cf1b9074023a1b1af2baddcb
SSDEEP 3072:xCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7X:MvMsLaOa3lLNngoqRttA7X
TLSH
T176345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lgeywqojgb.exe

Path C:\Temp\i_lgeywqojgb.exe
Size 243KB
SHA256 93a6a199bccf58477834154521bad74b19201b86509b89cad7624b347519fedb
MD5 1f5e610b71ef96f9387bc230260272c3
SHA1 5b73689c629164f1092e0a9e45d5ed83c146099d
SHA512 2082388baa7e115519860040589636708e3d61d680c711fff0e8fd2e92751899e6a38707f15e61a7270e734a152a47e3a20cf1b9440aefe5f73a0dbc14bb5242
SSDEEP 3072:jCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7x:mvMsLaOa3lLNngoqRttA7x
TLSH
T10C345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lidbvtqljd.exe

Path C:\Temp\i_lidbvtqljd.exe
Size 243KB
SHA256 b5f2fbe186bcc5d90330411c4638e8de230278b34676f8ac3d71b6140b85beba
MD5 d056418a6a7a38e566ed7ed6a89ca211
SHA1 93a20286ab69d3f873080207c3808709a3e5c70c
SHA512 9cc3e28eb2037ac2b2d19be7c48bc3f842b56411a5aa0a5ec2d5b3c731d7d157c869bcfce22b83bf59b42ae864fd559632f23deb399efedc043bcddbfcb89b35
SSDEEP 3072:0gCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA764:svMsLaOa3lLNngoqRttA7P
TLSH
T1CE345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pmhczusmhe.exe

Path C:\Temp\i_pmhczusmhe.exe
Size 243KB
SHA256 7f81c7bcccbd46e8f51cf38ab5ad243dcce9c196e601eafa9858977aebb111bd
MD5 99d063eee64dd552fe7aca223251905e
SHA1 02fa07d7ce3a76317f71e48a9891a8cdf843549e
SHA512 87840360df7204126d3e167df5e11f12a391768a6c7e5de0a8339ba29b721f90981fbee50aebd364bcb53c4aa45eb6e4e84c8fe31fc507a277617f3844014e2a
SSDEEP 3072:8CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7i:fvMsLaOa3lLNngoqRttA7i
TLSH
T149345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qnlfdxvqnl.exe

Path C:\Temp\i_qnlfdxvqnl.exe
Size 243KB
SHA256 9974bc9eb6722825148b290202d6ff055c15a5f99e6ea432b8143251116d349e
MD5 f2b03b6267e7ffbfc107a5db728186bc
SHA1 b37e81e0f6f93a10220f05398b1e33efcbca63d3
SHA512 5672b2414eafea0acec67a7bfec8f511d66ebefa72b19f88d6fbeae4dd9c11aa50b3ec1eb42ab376e6905224b0c5a5eb3ec992394ba334988cd4d545a2d21e4b
SSDEEP 3072:GCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7c:pvMsLaOa3lLNngoqRttA7c
TLSH
T1AB345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgbztrljdb.exe

Path C:\Temp\jgbztrljdb.exe
Size 243KB
SHA256 2ddeefceeab56ce67368b6a775293d8f2c4dd1549bf515e32cfb91b8e9ce85d1
MD5 38102c28e4e516170ed82e1d164c1bf2
SHA1 995d9d3153e3ef2e6f402ce4ce87028b15ad8187
SHA512 becafa9257cf75e3cbc3d352b9269dd1d4616c3b9a7790564467d2c13adae1d245cf32c8c05e1bad5cc8bf2723db401a4b03d467cca757f3ae338649ce6757c0
SSDEEP 3072:qCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k:VvMsLaOa3lLNngoqRttA7k
TLSH
T1B0345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgeywqojgb.exe

Path C:\Temp\lgeywqojgb.exe
Size 243KB
SHA256 0d8bed54480ebf2b754bef6870e20c52a4910675babc62ed7fbc0c273ed66bd5
MD5 e2de0e27aff49c47861a542fad5869b1
SHA1 d76af98656754f4178ce18b779a20b7df69e4c41
SHA512 c35636e7c6bedb171e018b326a2f9ae3de56b18e6cfd8fb20a4fba51013478930e11abaa0e8792ccf2f5bce5c7c72dfe71dce986f7bf5652b123134e818d94de
SSDEEP 3072:yCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:tvMsLaOa3lLNngoqRttA7o
TLSH
T1DB345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidbvtqljd.exe

Path C:\Temp\lidbvtqljd.exe
Size 243KB
SHA256 16ff68ae218dd925055d992aa0053f4d873f1e7a4bcddccfd2e45562b08362c8
MD5 5c21fa56f7533014e7a2981fe028062e
SHA1 7c0d425b2c5c9c68928c3af7d7fd7c45f48ddbfc
SHA512 8532cd8b933c58551f5041ff5e65862cc46ca759d36c36e4f72683e4f3caf63b0546014ff275c086717e643a00052596b85e4943fe7089ccabf9d0382f9329a0
SSDEEP 3072:ZCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA73:EvMsLaOa3lLNngoqRttA73
TLSH
T1A7345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmhczusmhe.exe

Path C:\Temp\pmhczusmhe.exe
Size 243KB
SHA256 a0350ecbcb512b6cc08ddc6ad0dec55ef23a613a3ea75e660c75473a0bac771a
MD5 f1d5a7c0762fc176d67b2df697626792
SHA1 37fcf41d822bad3f46c451d8aab8603d386be254
SHA512 d47658b0792b42aee252b319228a22a9c24d49ce8d8c478e2f09d90e7c2076ceafdb513c0fb29883a6f73e5aba8e8829484e2a206594456f0d97da468c911e3e
SSDEEP 3072:DCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Z:GvMsLaOa3lLNngoqRttA7Z
TLSH
T13E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnlfdxvqnl.exe

Path C:\Temp\qnlfdxvqnl.exe
Size 243KB
SHA256 86bfdf20bb47bc94ff0a78992119828b84e758a7675cd3a4b8266155782876a4
MD5 ebf19773b01b75310b27cf565f33ae27
SHA1 bcd96c5c611db3717ae366fb3748550872d2a039
SHA512 1633235b11994c15c14566a8d0979595a187a977b742e6ac45dbbc5809000c631d4e6f0478225b342ad64ade7a486967ff4f42e57b83bc79758505ffaaa4229e
SSDEEP 3072:BCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7r:cvMsLaOa3lLNngoqRttA7r
TLSH
T1D2345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rojhbztrmj.sys

Path C:\Temp\rojhbztrmj.sys
Size 141KB
SHA256 f154a54425e61975d0f1f902b90a6e5faf008d59190086d3053402657df64a0e
MD5 e1027d03a8f52d028fada443193db251
SHA1 a783a82a985acd820ac9f587480e43c3bd57c9dd
SHA512 5e2d56ed7e2891080620e8c8c7dde1a5a20842a70f61c85ddd1fbfc0d81fead74773ea2bbde3067e721338026c5e5e28479a7c7b499b01031edb25d9433bac7b
SSDEEP 1536:ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T105E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqljdbvtnl.sys

Path C:\Temp\tqljdbvtnl.sys
Size 141KB
SHA256 5f5c570f7377caf480945d3b4e928367b03410c9b3c6273275999ef90d6126e7
MD5 8f086288f7f88a4a5d5622e3103c250c
SHA1 7fa2ab8df695ed5bae826a8fc6f550cc86be6ca8
SHA512 4508a96347f4e371eea1a33cb6937bd6c22ec2ef5498bd845acb11de0ca9dd4f4e8388e6401221ac9760660d1de470e88fcdfea3123380708f4429a926fd7fdf
SSDEEP 1536:Ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T151E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqlidavtn.sys

Path C:\Temp\ysqlidavtn.sys
Size 141KB
SHA256 943961fa07b74b510117e6b00d33ab72745c1d06da7a051a35e354559c671041
MD5 66000800f5a79f399a90fd2f26347e18
SHA1 3ea0b883cf7ee1866a6a6b600791c45acc293379
SHA512 2a4e56328332a179febf9e9c5409c5382786d1c7ea130ac4c974eb088de187b395cf9ef4ba04c357299feee79c76a268ab79dbefe2a52f1af834235a9437711e
SSDEEP 1536:7a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:7a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T18EE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljetolg.sys

Path C:\Temp\ztrljetolg.sys
Size 141KB
SHA256 ff806db8a587277a173fd889eeee040c175988cee29b08077419f6934e94392a
MD5 b5ab97587be86de021e857e9b1500f2c
SHA1 e71f4f8d61ae4322f1efd82310aa213fa9d05fc9
SHA512 4dece80b3aff669e67c0ea519303d693108176efb720d831b3f23fa43fcb1daec7c6f80f1dfe6bed0a10631a549c065ad5e07f769881022fe8794f42c4f60d81
SSDEEP 1536:xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T169E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4864e2a6-b6f3-40eb-b2c2-f019a231b6b0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4864e2a6-b6f3-40eb-b2c2-f019a231b6b0.tmp
Size 35KB
SHA256 d430a0122ff40c4dabbfce50420330c3f6b56bfdbcff5d08f199087cc821a556
MD5 d57cca1490e1dd45f5cd1cea21813419
SHA1 cd9e2516120e27ae04338f66ec0c51e2d45c0ed2
SHA512 6167d8ba0a900c9c834af3b09e2eee38155e1f3fa907231e41d998b5618ca69f1efdbd56b88ed4ea0eb880e3ac0563ed79eaf9df35734eb7fea697db8cec04ae
SSDEEP 768:Yj+9v3d8elb+DIi8p8+p3bd66j+4BRv86aLIWRMjfZ:H9v3uYcJa8+p3Z6n4yHcZ
TLSH
T157F29E72E8AADD679CE5C648B64637C3AFB411B345C01ED9E9D96F0D00C72AD170B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 42587a6070ec08916e767a96952d17faafec4058bbaa485f0edc027d776b1cff
MD5 46d0e997de2cb46d0466d3315fe28a15
SHA1 6bb050c713d9d15b95cfd5bf7e7f557c4df7779b
SHA512 baab7a93071e98cec4703a7a5a08ce49edc01d4f31de55542849da4ad350f511d88142328514725b09bfb9286848deb2a8c8682c839c44cbaec864b95c6dbf21
TLSH
T12B41B81CA36A06E2D3F585B72AE1925433F1D43E910BAF6110409DFC8AE6F4820F693B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2ae90f38e2e202f502aa8b1d4fc3f5227b946ee18ef08d8d16525f80b74d7ae6
MD5 e6c421e7fa292409115f4554d99dab8f
SHA1 d41fea1a0ff82c9a5f1c48a169f88b63f1272759
SHA512 4aac918a38191a2d285a90e15a98410f05ce846d85dac766a00b3658a52074643295661f4cb2e1971da0be33b70a2f2c3ee7da45d0aae197b2416467bf53bf6e
TLSH
T196519CF3C6E8863EC90156F0AB187E2BDE1D0914832C3D5AC9E4AF1BA7E2471D14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2f3b80100b92dc0afec26c7c73e35ae78355ca984d00028dc6c9b755406c46df
MD5 776ea7768d794512dc73c4723c652975
SHA1 f877e877d1b87764f98d3d20ad61cb75d733ce93
SHA512 af965d1047eb48e303fef9e9fec1e282ced20321b72d68a69f14030b106cfb0d40ff440b7b8d56705af24932b631c1a57c9216fe42c15cec475e66fd4ee90ab3
SSDEEP 192:sxRdRlyM/jK1Ml8wCN/frs9fDSZnlNzoD8pi/g6+WNIYCsuOvG5IgtJ:sxRdV8N/frshD0lpi/5IeM3
TLSH
T1EE52FA156A28597BDCCBD20DFA557F53D6F81473A2945E44AAFCCA0C00E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 674198282879b88227b59182aa1d2ef618b0a89cef92bd1124495a875596b322
MD5 18439a359264244c2712e027c83313ee
SHA1 da9262ed27685b87258aed1d9024e85cd7fd6b9c
SHA512 3b54495864600f17232b5dc83ab26d1e91135f7f9be03d4b0bc3809056ab14d872f1882aa7d6e39d12a3e8cc297eb3acc9ed0bbfe48be5105a93e0cb563ec8f0
SSDEEP 192:sxRuRlyM/jK1Ml8wCN/frsxfDSZnlNzoD8pi/g6+WNIYCsuOvG5IgDQJ:sxRuV8N/frstD0lpi/5IeMQ
TLSH
T13E52EA156A34597BDCCBD20DFA557F53D6F81473A2945E44AAFCCA0C00E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 cf95341d6e461ad036133c5f01990b157c5c927af692f4652f2d836cfd3292d5
MD5 cecefa753343705e74edfa0db8950a89
SHA1 8d7f8b30c9b07654633f0a21620f36e00f2f86eb
SHA512 94b77e3c37ae41864b9c548a8cd1a5f4c12e28ddac2b00bdb73279e29722253c6f9044e4d556ab578b58136d37def980f784568c5eaff5cda00d29748a018bb4
SSDEEP 192:sxRuRlyM/jK1Ml8wCN/frsxfOSZnl1zoD8p9A/g6+WNCRe/YCbuOvG5IgDGJ:sxRuH8N/frstO0lhq/5F//M+
TLSH
T1BE62E916AA245D7BDCD7D209FA517F53D6F81473E2945E44ABFCCA0C00E6ADD221382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 93fc83acd96bd49e688c85989ba088f457cd0a248f8269afcefb3b1138c84b0e
MD5 d73886f28429049ad41d7d3039dbd0bb
SHA1 d472f91a00b2d36a3ad980185b51d6158f90a273
SHA512 bd30e39efbbe8c04778fd71841fcd9cfa3893d00cf11cee98b805a77e2fae56cf55fbe1f16bd4ee8f4cb68390ae566606e72920e017eea53c62513144ac2fbbc
SSDEEP 192:sxRuRlyM/jK1Ml8UQDNCN/frsxfOSZnl1zoD8prA/g6+WNCRe/YCbuOvG5IgDGJ:sxRuHqAN/frstO0lhU/5F//M+
TLSH
T19A62E916AA245D7BDCD7D209FA517F93D6F81473E2945E44AAFCCA0C00E6ADD221382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 52e7a23d742e645751115f04445148ad0e4f48d998a3bcb9e1296db1fd42b8b7
MD5 6569b5ca0d24cb31685b7f7fb40917c8
SHA1 5c6f094135dcfdba7c46f0e628b91ebebdcdde96
SHA512 c0e0b4a02f0661c6d2eb9b0147dffae13bdc74718fc4e8042afc4e1096abd58a8e39bb7708f937a9a396f0a8aaabc9dda59d2863c6e31184d1140979919b65b1
SSDEEP 768:j/8vNN7pLuL7tQWgQ+fB+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVcjTQqq8rovf:j/8vN7E7tQWgQ+fB+u1jaHjTVqn3
TLSH
T1A7E2FB3B680CCB7E4F804E9DEC29BD9AADE801CF5698CD5447EA840C03C57EB561A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7e535656d1cd84573bc9663a97c60ceaefe0ab0dddf3ac843e28fe359820d2fa
MD5 359df6d9ebc5a62c419ddc3b413737c0
SHA1 d241a104bb6bd4096259354d66c285b9c0be9d24
SHA512 e0ffe76a21516aa89f752a1a5ad130afa6c9413fb3ca3bc182d522607a68e1834698f90be593b8b89bf44ea8ecb5953740e16ef661e013a2b8833f383fdf9225
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHQCQHQuQCQ0QUQEQCWQMQZQxgQyQCK4Qnc:CbEBVj5JAdSp9/EgTK7j6dJOHQCQHQuL
TLSH
T166910545307A0251387DAA0D847D8C2AD6C278733715F92B3BE846571F6AE43ADFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a0754.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a0754.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 fe6f801501737cf8bd6629eee2c7c9ebab6302ef5dd71afac9388220e9b7b30a
MD5 aefc7a63ca0737066620579208b15def
SHA1 579df1117ecc84547a983ffac6da7b5dbb146c71
SHA512 e681b106396856e5f0a842d12744bc6e4371b134c61900e3c21d7f9818be5f20b2f800cb0236b210c287eb8ef55b1430086df3b5068ad7f32dd60bfd79c5f694
SSDEEP 768:Hrv+4UNbdd3E8Slb+DIi8p8+p3bd66j+4BRv86aLIWR2bwClP:HbsbL3NscJa8+p3Z6n4yH0w6
TLSH
T1D713BF72E8AD9D739CF6C604B2467B83BFB811A395C10ED4E5D96B4E005A19E270F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c50a96b68186a16ea9718b0b54316aefdeb40f2edd96304003ac27dabe883c30
MD5 6e394562d3fcf7e474f100823a35a42a
SHA1 06f965331174fff21fed0e6257b61f9261a03b50
SHA512 7e65ef39d8746dea77e4a2b439f79a5117d97ff317e52b161f0dae2e7b5e574d30301d8759b6243d80d141dd896e83f1f493dd8f3d7dc65a5445356f85a2e1a7
SSDEEP 768:Irv+4UNbdD3Hcb+NNp8+p3bd66j+4BRv86aLIiB2bwCl1:Ibsbp3YML8+p3Z6n4yn0ww
TLSH
T1C803CE33E8A899739CF6C644B2467B437FF851A396C10EC4E4DD2B4E419A19E630BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 43f70501d22779588c0a7a03bdf3f6f5ce9f988bd0c7761b4da8266f4af73467
MD5 c2a4c1f2297bcb23bccf554978ae07d4
SHA1 4e6631309b3866a6880a74db5510c16b84e8605e
SHA512 30afc72cddc702419a3a9f2f6a78586335959eb3410049fc221f5aed15a0e664aed247017d811ffbed4c3ec4d451c63329e3eb7824121d1e27ba3a4bb07f59ce
SSDEEP 768:fF1j+9y37wgZ8++w+DIMp8+p3bd66j+4BRv86aLIWRMjfZ:W9y3QAc18+p3Z6n4yHcZ
TLSH
T14D1318F298D78936D8AD8747A73D2E829EBCD16375844994FBC85E4CCC821BFC706825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

3ff16a86-aa86-46f9-91db-f3ea698c5ec5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3ff16a86-aa86-46f9-91db-f3ea698c5ec5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5892_1272033092\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/244-436-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/880-376-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/940-440-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1316-259-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1572-275-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2384-305-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2432-187-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2688-476-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3104-347-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3176-505-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3540-416-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4108-319-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4108-344-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4340-315-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4492-234-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4500-342-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4988-501-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5140-396-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5208-451-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5840-472-0x0000000000010000-0x0000000000083000-memory.dmp

Download