b41dfcd85a432268398447abb3707d174f1f58bc70a467c4c84599229f0b3277

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 00:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_9e9c05a50bbfadd70a67f28314d0de9a_elex_rhadamanthys_stop.exe
Size 243KB
Sample260720-a8yersds31
SHA256 b41dfcd85a432268398447abb3707d174f1f58bc70a467c4c84599229f0b3277
MD5 9e9c05a50bbfadd70a67f28314d0de9a
SHA1 8137d1649fa9d4db7c32d2091a8fdda846518c1e
SHA512 daa01ff2e1ba3a215934dc491eeb76ae765e5f6faa8507116aef0a794ee0d3f68f69026e929dbed8df92cc0c09ade2b996138d9d26020c4dcf71b4b18afde9d7
SSDEEP 3072:8CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7y:fvMsLaOa3lLNngoqRttA7y
TLSH
T177345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4420	CP.exe
2692	ecwuomgbzu.exe
1644	CP.exe
5972	CP.exe
4408	i_ecwuomgbzu.exe
3940	ojgbztrljd.sys
5708	CP.exe
4304	ywtojdbwto.exe
1488	CP.exe
3728	CP.exe
1752	i_ywtojdbwto.exe
3432	ytqligbvtn.sys
4448	CP.exe
2576	tnlfdbvqoi.exe
460	CP.exe
5624	CP.exe
1228	i_tnlfdbvqoi.exe
120	vqnlfdavtn.sys
4408	CP.exe
3720	nifdaysqni.exe
3940	CP.exe
6060	CP.exe
2564	i_nifdaysqni.exe
2452	kidaysnkid.sys
1544	CP.exe
1132	spkicausmk.exe
932	CP.exe
4816	CP.exe
1128	i_spkicausmk.exe
2796	caxspkicxu.sys
2476	CP.exe
4440	xspkfcausm.exe
5512	CP.exe
4696	CP.exe
108	i_xspkfcausm.exe
2236	xrpnhfcxup.sys
4552	CP.exe
3928	smkeczxrpn.exe
3864	CP.exe
3356	CP.exe
5324	i_smkeczxrpn.exe
4452	omkecwupmg.sys
3040	CP.exe
3680	omjhbzwuom.exe
5608	CP.exe
5028	CP.exe
3812	i_omjhbzwuom.exe
3444	rojgezwuom.sys
4828	CP.exe
2976	jdbwtrljhb.exe
4996	CP.exe
3612	CP.exe
2268	i_jdbwtrljhb.exe
1384	ojgbztrojg.sys
5700	CP.exe
1592	jgeywtolge.exe
4452	CP.exe
5580	CP.exe
5560	i_jgeywtolge.exe
264	wtolgdyvtn.sys
5588	CP.exe
5672	olgbytqljd.exe
1128	CP.exe
4500	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4132_1810477762\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4132_963502687\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4132_963502687\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4132_963502687\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4132_963502687\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4132_1200290249\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4132_505241243\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4132_505241243\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4132_1810477762\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhecwusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomheywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdbvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkicausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspkfcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgeywtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgbytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgbytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhecwusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomgbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbwtrljhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgeywtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywtojdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlfdbvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkicausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omjhbzwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywtrljgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_9e9c05a50bbfadd70a67f28314d0de9a_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifdaysqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifdaysqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkeczxrpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khfzxupmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbwtrljhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkidavqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khfzxupmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywtrljgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspkfcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkidavqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnlfdxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnlfdxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fusmkhcaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fusmkhcaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomheywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomgbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywtojdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkeczxrpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omjhbzwuom.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1392	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4844	ipconfig.exe
2660	ipconfig.exe
3452	ipconfig.exe
4524	ipconfig.exe
4104	ipconfig.exe
5760	ipconfig.exe
4524	ipconfig.exe
2924	ipconfig.exe
4672	ipconfig.exe
4080	ipconfig.exe
4292	ipconfig.exe
4400	ipconfig.exe
6032	ipconfig.exe
5420	ipconfig.exe
2192	ipconfig.exe
4080	ipconfig.exe
4552	ipconfig.exe
2456	ipconfig.exe
4628	ipconfig.exe
4296	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289824259638068"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{BBB0EE49-C10E-4E24-80F8-0AA40F42360A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
708	msedge.exe
708	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	4408	i_ecwuomgbzu.exe
Token: SeDebugPrivilege	1752	i_ywtojdbwto.exe
Token: SeDebugPrivilege	1228	i_tnlfdbvqoi.exe
Token: SeDebugPrivilege	2564	i_nifdaysqni.exe
Token: SeDebugPrivilege	1128	i_spkicausmk.exe
Token: SeDebugPrivilege	108	i_xspkfcausm.exe
Token: SeDebugPrivilege	5324	i_smkeczxrpn.exe
Token: SeDebugPrivilege	3812	i_omjhbzwuom.exe
Token: SeDebugPrivilege	2268	i_jdbwtrljhb.exe
Token: SeDebugPrivilege	5560	i_jgeywtolge.exe
Token: SeDebugPrivilege	5432	i_olgbytqljd.exe
Token: SeDebugPrivilege	5380	i_ysqkidavqn.exe
Token: SeDebugPrivilege	1732	i_xvpnlfdxsq.exe
Token: SeDebugPrivilege	4656	i_khfzxupmke.exe
Token: SeDebugPrivilege	5312	i_rpjhecwusm.exe
Token: SeDebugPrivilege	3388	i_wuomheywro.exe
Token: SeDebugPrivilege	5476	i_eywtrljgbz.exe
Token: SeDebugPrivilege	2328	i_rljdbytrlj.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4132	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 4176	996	2026-07-19_9e9c05a50bbfadd70a67f28314d0de9a_elex_rhadamanthys_stop.exe	88
PID 4176 wrote to memory of 4132	4176	iexplore.exe	90
PID 4132 wrote to memory of 4884	4132	msedge.exe	91
PID 4132 wrote to memory of 2728	4132	msedge.exe	93
PID 4132 wrote to memory of 1392	4132	msedge.exe	94
PID 4132 wrote to memory of 2728	4132	msedge.exe	93
PID 4132 wrote to memory of 2728	4132	msedge.exe	93
PID 4132 wrote to memory of 752	4132	msedge.exe	95
PID 4132 wrote to memory of 752	4132	msedge.exe	95
PID 4132 wrote to memory of 1640	4132	msedge.exe	96
PID 4132 wrote to memory of 3776	4132	msedge.exe	97
PID 4132 wrote to memory of 1640	4132	msedge.exe	96
PID 4132 wrote to memory of 1640	4132	msedge.exe	96
PID 4132 wrote to memory of 3776	4132	msedge.exe	97
PID 4132 wrote to memory of 3776	4132	msedge.exe	97
PID 4132 wrote to memory of 3952	4132	msedge.exe	98
PID 4132 wrote to memory of 2740	4132	msedge.exe	99
PID 4132 wrote to memory of 3952	4132	msedge.exe	98
PID 4132 wrote to memory of 3952	4132	msedge.exe	98
PID 4132 wrote to memory of 2740	4132	msedge.exe	99
PID 4132 wrote to memory of 2740	4132	msedge.exe	99
PID 4132 wrote to memory of 3912	4132	msedge.exe	101
PID 4132 wrote to memory of 3912	4132	msedge.exe	101
PID 996 wrote to memory of 4420	996	2026-07-19_9e9c05a50bbfadd70a67f28314d0de9a_elex_rhadamanthys_stop.exe	102
PID 2692 wrote to memory of 1644	2692	ecwuomgbzu.exe	105
PID 4132 wrote to memory of 2136	4132	msedge.exe	108
PID 4132 wrote to memory of 4620	4132	msedge.exe	109
PID 4132 wrote to memory of 2136	4132	msedge.exe	108
PID 4132 wrote to memory of 4620	4132	msedge.exe	109
PID 4132 wrote to memory of 1784	4132	msedge.exe	111
PID 4132 wrote to memory of 1228	4132	msedge.exe	112
PID 4132 wrote to memory of 1228	4132	msedge.exe	112
PID 996 wrote to memory of 5972	996	2026-07-19_9e9c05a50bbfadd70a67f28314d0de9a_elex_rhadamanthys_stop.exe	115
PID 4132 wrote to memory of 4696	4132	msedge.exe	117
PID 4132 wrote to memory of 4696	4132	msedge.exe	117
PID 4132 wrote to memory of 5512	4132	msedge.exe	120
PID 4132 wrote to memory of 5512	4132	msedge.exe	120
PID 4132 wrote to memory of 5512	4132	msedge.exe	120
PID 996 wrote to memory of 5708	996	2026-07-19_9e9c05a50bbfadd70a67f28314d0de9a_elex_rhadamanthys_stop.exe	121
PID 4304 wrote to memory of 1488	4304	ywtojdbwto.exe	123
PID 4132 wrote to memory of 828	4132	msedge.exe	126
PID 4132 wrote to memory of 828	4132	msedge.exe	126
PID 4132 wrote to memory of 828	4132	msedge.exe	126
PID 996 wrote to memory of 3728	996	2026-07-19_9e9c05a50bbfadd70a67f28314d0de9a_elex_rhadamanthys_stop.exe	127
PID 996 wrote to memory of 4448	996	2026-07-19_9e9c05a50bbfadd70a67f28314d0de9a_elex_rhadamanthys_stop.exe	131
PID 2576 wrote to memory of 460	2576	tnlfdbvqoi.exe	133
PID 996 wrote to memory of 5624	996	2026-07-19_9e9c05a50bbfadd70a67f28314d0de9a_elex_rhadamanthys_stop.exe	136
PID 996 wrote to memory of 4408	996	2026-07-19_9e9c05a50bbfadd70a67f28314d0de9a_elex_rhadamanthys_stop.exe	140
PID 3720 wrote to memory of 3940	3720	nifdaysqni.exe	142
PID 4132 wrote to memory of 2700	4132	msedge.exe	145
PID 4132 wrote to memory of 2700	4132	msedge.exe	145
PID 4132 wrote to memory of 2700	4132	msedge.exe	145
PID 996 wrote to memory of 6060	996	2026-07-19_9e9c05a50bbfadd70a67f28314d0de9a_elex_rhadamanthys_stop.exe	147
PID 4132 wrote to memory of 3348	4132	msedge.exe	149
PID 4132 wrote to memory of 5444	4132	msedge.exe	150
PID 4132 wrote to memory of 2324	4132	msedge.exe	151
PID 996 wrote to memory of 1544	996	2026-07-19_9e9c05a50bbfadd70a67f28314d0de9a_elex_rhadamanthys_stop.exe	154
PID 1132 wrote to memory of 932	1132	spkicausmk.exe	156
PID 996 wrote to memory of 4816	996	2026-07-19_9e9c05a50bbfadd70a67f28314d0de9a_elex_rhadamanthys_stop.exe	159
PID 996 wrote to memory of 2476	996	2026-07-19_9e9c05a50bbfadd70a67f28314d0de9a_elex_rhadamanthys_stop.exe	163
PID 4440 wrote to memory of 5512	4440	xspkfcausm.exe	165
PID 996 wrote to memory of 4696	996	2026-07-19_9e9c05a50bbfadd70a67f28314d0de9a_elex_rhadamanthys_stop.exe	168
PID 996 wrote to memory of 4552	996	2026-07-19_9e9c05a50bbfadd70a67f28314d0de9a_elex_rhadamanthys_stop.exe	172
PID 3928 wrote to memory of 3864	3928	smkeczxrpn.exe	174

C:\Users\Admin\AppData\Local\Temp\2026-07-19_9e9c05a50bbfadd70a67f28314d0de9a_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_9e9c05a50bbfadd70a67f28314d0de9a_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:996
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7fff263ec188,0x7fff263ec194,0x7fff263ec1a0
      4⤵
      PID:4884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1980,i,7982376110922356570,13983654547137327419,262144 --field-trial-handle=2488,i,13761095575090271289,11206547558004065338,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:2
      4⤵
      PID:2728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2144,i,1676957848853026882,8704124779065976825,524288 --field-trial-handle=2488,i,13761095575090271289,11206547558004065338,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:11
      4⤵
      System Time Discovery
      PID:1392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,5386018287327771223,11324662115587500869,524288 --field-trial-handle=2488,i,13761095575090271289,11206547558004065338,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:13
      4⤵
      PID:752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,16021817903934474276,15154963228254066169,2097152 --field-trial-handle=2488,i,13761095575090271289,11206547558004065338,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:1640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,8490676863990796948,12232220062429751691,2097152 --field-trial-handle=2488,i,13761095575090271289,11206547558004065338,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:3776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,11385426990595548209,18080387664063062030,2097152 --field-trial-handle=2488,i,13761095575090271289,11206547558004065338,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:1
      4⤵
      PID:3952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,14428178779238209276,15706329391106994357,2097152 --field-trial-handle=2488,i,13761095575090271289,11206547558004065338,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:9
      4⤵
      PID:2740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,10499827546533717233,5394851848444290248,524288 --field-trial-handle=2488,i,13761095575090271289,11206547558004065338,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
      4⤵
      PID:3912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,16980273098173454247,16160538006484705429,524288 --field-trial-handle=2488,i,13761095575090271289,11206547558004065338,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
      4⤵
      PID:2136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,12548627736702981208,11821366951753423064,524288 --field-trial-handle=2488,i,13761095575090271289,11206547558004065338,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
      4⤵
      PID:4620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,6900461314650745903,15193681076542181077,524288 --field-trial-handle=2488,i,13761095575090271289,11206547558004065338,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
      4⤵
      PID:1292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,6900461314650745903,15193681076542181077,524288 --field-trial-handle=2488,i,13761095575090271289,11206547558004065338,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
      4⤵
      PID:1784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,7580990701393399485,7294684673634355186,524288 --field-trial-handle=2488,i,13761095575090271289,11206547558004065338,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:1228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,5563045224667140997,12619965748395469795,524288 --field-trial-handle=2488,i,13761095575090271289,11206547558004065338,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
      4⤵
      PID:4696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6660,i,3019350769676636274,6620188677299259829,2097152 --field-trial-handle=2488,i,13761095575090271289,11206547558004065338,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:1
      4⤵
      PID:5512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=1972,i,595489571286744444,5989935884063257870,2097152 --field-trial-handle=2488,i,13761095575090271289,11206547558004065338,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
      4⤵
      PID:828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6216,i,6096564937467126000,6026646668391167718,2097152 --field-trial-handle=2488,i,13761095575090271289,11206547558004065338,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:1
      4⤵
      PID:2700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1300,i,4838884745979860050,9081510054036394382,524288 --field-trial-handle=2488,i,13761095575090271289,11206547558004065338,262144 --variations-seed-version --mojo-platform-channel-handle=1388 /prefetch:14
      4⤵
      PID:3348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,8169378038547859468,8912283935130621592,524288 --field-trial-handle=2488,i,13761095575090271289,11206547558004065338,262144 --variations-seed-version --mojo-platform-channel-handle=1304 /prefetch:14
      4⤵
      PID:5444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1256,i,5991869212391138738,14866296112253746134,524288 --field-trial-handle=2488,i,13761095575090271289,11206547558004065338,262144 --variations-seed-version --mojo-platform-channel-handle=1444 /prefetch:14
      4⤵
      PID:2324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3820,i,1367943827531656161,14141047321972924380,524288 --field-trial-handle=2488,i,13761095575090271289,11206547558004065338,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
      4⤵
      PID:4940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5388,i,3066895559385826330,2432920941176284734,2097152 --field-trial-handle=2488,i,13761095575090271289,11206547558004065338,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:1
      4⤵
      PID:2108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,16596840322095331652,13385107198120449605,524288 --field-trial-handle=2488,i,13761095575090271289,11206547558004065338,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:14
      4⤵
      PID:3248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,13049792010756720102,16596866589202049318,524288 --field-trial-handle=2488,i,13761095575090271289,11206547558004065338,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
      4⤵
      PID:4952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,12766082661342342,1519852248490732261,524288 --field-trial-handle=2488,i,13761095575090271289,11206547558004065338,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
      4⤵
      PID:3448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6720,i,16437177642885997838,15655679525775888387,262144 --field-trial-handle=2488,i,13761095575090271289,11206547558004065338,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1192,i,9439386922084758101,2416238525950986837,524288 --field-trial-handle=2488,i,13761095575090271289,11206547558004065338,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:14
      4⤵
      PID:4640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6572,i,14332476308865742829,4876252156349406382,2097152 --field-trial-handle=2488,i,13761095575090271289,11206547558004065338,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:1
      4⤵
      PID:3624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwuomgbzu.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4420
- - C:\Temp\ecwuomgbzu.exe
    C:\Temp\ecwuomgbzu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2692
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1644
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwuomgbzu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5972
- - C:\Temp\i_ecwuomgbzu.exe
    C:\Temp\i_ecwuomgbzu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywtojdbwto.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5708
- - C:\Temp\ywtojdbwto.exe
    C:\Temp\ywtojdbwto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4304
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1488
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywtojdbwto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3728
- - C:\Temp\i_ywtojdbwto.exe
    C:\Temp\i_ywtojdbwto.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlfdbvqoi.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4448
- - C:\Temp\tnlfdbvqoi.exe
    C:\Temp\tnlfdbvqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:460
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlfdbvqoi.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5624
- - C:\Temp\i_tnlfdbvqoi.exe
    C:\Temp\i_tnlfdbvqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nifdaysqni.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4408
- - C:\Temp\nifdaysqni.exe
    C:\Temp\nifdaysqni.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3720
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3940
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nifdaysqni.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6060
- - C:\Temp\i_nifdaysqni.exe
    C:\Temp\i_nifdaysqni.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spkicausmk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1544
- - C:\Temp\spkicausmk.exe
    C:\Temp\spkicausmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1132
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:932
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spkicausmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4816
- - C:\Temp\i_spkicausmk.exe
    C:\Temp\i_spkicausmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xspkfcausm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2476
- - C:\Temp\xspkfcausm.exe
    C:\Temp\xspkfcausm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4440
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5512
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xspkfcausm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4696
- - C:\Temp\i_xspkfcausm.exe
    C:\Temp\i_xspkfcausm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkeczxrpn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4552
- - C:\Temp\smkeczxrpn.exe
    C:\Temp\smkeczxrpn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3928
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3864
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkeczxrpn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3356
- - C:\Temp\i_smkeczxrpn.exe
    C:\Temp\i_smkeczxrpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omjhbzwuom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3040
- - C:\Temp\omjhbzwuom.exe
    C:\Temp\omjhbzwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3680
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5608
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omjhbzwuom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5028
- - C:\Temp\i_omjhbzwuom.exe
    C:\Temp\i_omjhbzwuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbwtrljhb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4828
- - C:\Temp\jdbwtrljhb.exe
    C:\Temp\jdbwtrljhb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2976
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4996
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbwtrljhb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3612
- - C:\Temp\i_jdbwtrljhb.exe
    C:\Temp\i_jdbwtrljhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgeywtolge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5700
- - C:\Temp\jgeywtolge.exe
    C:\Temp\jgeywtolge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1592
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4452
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgeywtolge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5580
- - C:\Temp\i_jgeywtolge.exe
    C:\Temp\i_jgeywtolge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\olgbytqljd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5588
- - C:\Temp\olgbytqljd.exe
    C:\Temp\olgbytqljd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5672
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1128
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4292
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_olgbytqljd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4500
- - C:\Temp\i_olgbytqljd.exe
    C:\Temp\i_olgbytqljd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqkidavqn.exe ups_run
  2⤵
  PID:4120
- - C:\Temp\ysqkidavqn.exe
    C:\Temp\ysqkidavqn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5216
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:432
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqkidavqn.exe ups_ins
  2⤵
  PID:5480
- - C:\Temp\i_ysqkidavqn.exe
    C:\Temp\i_ysqkidavqn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnlfdxsq.exe ups_run
  2⤵
  PID:5332
- - C:\Temp\xvpnlfdxsq.exe
    C:\Temp\xvpnlfdxsq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5896
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3936
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnlfdxsq.exe ups_ins
  2⤵
  PID:1564
- - C:\Temp\i_xvpnlfdxsq.exe
    C:\Temp\i_xvpnlfdxsq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fusmkhcaxs.exe ups_run
  2⤵
  PID:200
- - C:\Temp\fusmkhcaxs.exe
    C:\Temp\fusmkhcaxs.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6020
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:792
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fusmkhcaxs.exe ups_ins
  2⤵
  PID:2196
- - C:\Temp\i_fusmkhcaxs.exe
    C:\Temp\i_fusmkhcaxs.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\khfzxupmke.exe ups_run
  2⤵
  PID:5772
- - C:\Temp\khfzxupmke.exe
    C:\Temp\khfzxupmke.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1480
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1724
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_khfzxupmke.exe ups_ins
  2⤵
  PID:716
- - C:\Temp\i_khfzxupmke.exe
    C:\Temp\i_khfzxupmke.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhecwusm.exe ups_run
  2⤵
  PID:1868
- - C:\Temp\rpjhecwusm.exe
    C:\Temp\rpjhecwusm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3456
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3764
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhecwusm.exe ups_ins
  2⤵
  PID:5804
- - C:\Temp\i_rpjhecwusm.exe
    C:\Temp\i_rpjhecwusm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomheywro.exe ups_run
  2⤵
  PID:1804
- - C:\Temp\wuomheywro.exe
    C:\Temp\wuomheywro.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3420
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4856
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomheywro.exe ups_ins
  2⤵
  PID:3036
- - C:\Temp\i_wuomheywro.exe
    C:\Temp\i_wuomheywro.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3388
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywtrljgbz.exe ups_run
  2⤵
  PID:1304
- - C:\Temp\eywtrljgbz.exe
    C:\Temp\eywtrljgbz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2580
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5460
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywtrljgbz.exe ups_ins
  2⤵
  PID:4316
- - C:\Temp\i_eywtrljgbz.exe
    C:\Temp\i_eywtrljgbz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljdbytrlj.exe ups_run
  2⤵
  PID:1772
- - C:\Temp\rljdbytrlj.exe
    C:\Temp\rljdbytrlj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4764
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1924
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljdbytrlj.exe ups_ins
  2⤵
  PID:3852
- - C:\Temp\i_rljdbytrlj.exe
    C:\Temp\i_rljdbytrlj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqoigaytql.exe ups_run
  2⤵
  PID:2488
- - C:\Temp\wqoigaytql.exe
    C:\Temp\wqoigaytql.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2700
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4704
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5420

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2652

C:\Temp\ojgbztrljd.sys
C:\Temp\ojgbztrljd.sys
1⤵
- Executes dropped EXE
PID:3940

C:\Temp\ytqligbvtn.sys
C:\Temp\ytqligbvtn.sys
1⤵
- Executes dropped EXE
PID:3432

C:\Temp\vqnlfdavtn.sys
C:\Temp\vqnlfdavtn.sys
1⤵
- Executes dropped EXE
PID:120

C:\Temp\kidaysnkid.sys
C:\Temp\kidaysnkid.sys
1⤵
- Executes dropped EXE
PID:2452

C:\Temp\caxspkicxu.sys
C:\Temp\caxspkicxu.sys
1⤵
- Executes dropped EXE
PID:2796

C:\Temp\xrpnhfcxup.sys
C:\Temp\xrpnhfcxup.sys
1⤵
- Executes dropped EXE
PID:2236

C:\Temp\omkecwupmg.sys
C:\Temp\omkecwupmg.sys
1⤵
- Executes dropped EXE
PID:4452

C:\Temp\rojgezwuom.sys
C:\Temp\rojgezwuom.sys
1⤵
- Executes dropped EXE
PID:3444

C:\Temp\ojgbztrojg.sys
C:\Temp\ojgbztrojg.sys
1⤵
- Executes dropped EXE
PID:1384

C:\Temp\wtolgdyvtn.sys
C:\Temp\wtolgdyvtn.sys
1⤵
- Executes dropped EXE
PID:264

C:\Temp\ytqligaysq.sys
C:\Temp\ytqligaysq.sys
1⤵
PID:4104

C:\Temp\vsnlfdaysq.sys
C:\Temp\vsnlfdaysq.sys
1⤵
PID:3824

C:\Temp\fcausqnhfa.sys
C:\Temp\fcausqnhfa.sys
1⤵
PID:2964

C:\Temp\pjhezwusmk.sys
C:\Temp\pjhezwusmk.sys
1⤵
PID:3348

C:\Temp\hbzurpjhbz.sys
C:\Temp\hbzurpjhbz.sys
1⤵
PID:5420

C:\Temp\geywurljeb.sys
C:\Temp\geywurljeb.sys
1⤵
PID:692

C:\Temp\omgdbvtrlj.sys
C:\Temp\omgdbvtrlj.sys
1⤵
PID:3684

C:\Temp\aytqlidbvt.sys
C:\Temp\aytqlidbvt.sys
1⤵
PID:5600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

caxspkicxu.sys

Path C:\Temp\caxspkicxu.sys
Size 141KB
SHA256 7189ab6a68c877ac233cdf78cf6774d2d0bdfde4c28930358a3ae76e34c85d89
MD5 bf56d197b0d5f79c80bb87956efe4665
SHA1 679e7029b8147a376382a1ad1312b6c5bd97a5a1
SHA512 39631cbc720a9232e979f646a2fc49238ce5b1d9655b3939b2784b5b8773cc07db0b979bf2cc74c0cb090e4984614cc1bbd02c96a469032b9b527e5b78b17276
SSDEEP 1536:la3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:la3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DBE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwuomgbzu.exe

Path C:\Temp\ecwuomgbzu.exe
Size 243KB
SHA256 50908a3bcccb3f0312cefbdb8307c5818fd5c40c0b4af9e2fc96047f0deefd93
MD5 05580ee66e0c831e131bf960903b5b5c
SHA1 39791f5a871ba1596980ad997d19777da588c7dd
SHA512 6035d272b1c37b80c89f6731c2f92c119bcf01784729398b5a378e42ba10af3beaa0cb50a417f24f4e6cbce418b87788dc80ac9038f8e17540f74442cd52e714
SSDEEP 3072:7CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7t:uvMsLaOa3lLNngoqRttA7t
TLSH
T1DE345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ecwuomgbzu.exe

Path C:\Temp\i_ecwuomgbzu.exe
Size 243KB
SHA256 560cf97e62930f1a1c10464a60bbe22d5368da6f7e18a96a117d12b1cc81a339
MD5 c94227881cd9774c05a2cf02fd7683b3
SHA1 7ba21e1b6cd74600cfb62a80c0c613a4101633a2
SHA512 b51dd55dc46199c7a814103c4fc2776ce3cb75c2b049317ae78219bd586212115f128113b6583aacffe678031b7bf6d421a5d6690cdc992098b30b468ff13a96
SSDEEP 3072:fCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA75:qvMsLaOa3lLNngoqRttA75
TLSH
T1A1345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nifdaysqni.exe

Path C:\Temp\i_nifdaysqni.exe
Size 243KB
SHA256 31ef9e32b43ffb153bd37905309ed2c9174db2c6c30eac7c8a8ad71f47fb2c14
MD5 44514425710746318c9921a068df943f
SHA1 0bd2f360bf8d27ef4253c0e9b366f9ec7924b79a
SHA512 43a439ef48243c326fa86d356f55f828f788520c780a34c53a32007dbb3bcc76bbc257f791c9cd4a898901f65ec1a3bd5e8776b69728e7b7268ca4624472a6e6
SSDEEP 3072:rCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7N:evMsLaOa3lLNngoqRttA7N
TLSH
T10C345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_spkicausmk.exe

Path C:\Temp\i_spkicausmk.exe
Size 243KB
SHA256 1447cd7e33b4c9905fedd9536237b1f3a1ba15e3e65fa1764fc31e4d8c4af455
MD5 30fb08b51e8a5e0fa91ebceb84a37322
SHA1 2c4bab1accc9e54c5b7dfe35ed494e8f26649818
SHA512 a937b3ac6b9da8bdd15b06e86b447ba8e0396d9c93f2a8f163bea2f641806b519136968e7c382bda5f74f3c787928369c83e6d5307c9f67c1d556517be9158e8
SSDEEP 3072:ICvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7G:zvMsLaOa3lLNngoqRttA7G
TLSH
T18B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnlfdbvqoi.exe

Path C:\Temp\i_tnlfdbvqoi.exe
Size 243KB
SHA256 09cce2c9b65e5c63665c8f8ea8703c7d6dbb5c9c958fb81bc37e930edf954384
MD5 de8cc533b6f0e37e7f57e1830bbf3485
SHA1 7538b4984ccdab4c1ba86fb54c295152d169a935
SHA512 8a36e62a073384a46cb09325aab5fcc2918b484a9bc3973aebfe3ce958ead756b7550de55b4b8e1e39d058ac51abfbd274ef144d26b7af7360550290b83314d0
SSDEEP 3072:lCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7P:ovMsLaOa3lLNngoqRttA7P
TLSH
T1A3345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywtojdbwto.exe

Path C:\Temp\i_ywtojdbwto.exe
Size 243KB
SHA256 b48e73e74e70b9410b8616f1e632d549cd15c9d094eb41f7573e36e95deb4961
MD5 d5d2bbdec29922492bca1e71b42a2240
SHA1 41b9246ad8151cd9d70f9f55c1f53da11c10de03
SHA512 20b15c0f2f92e3e239e1f54a5c6f127a1e5444578d5bb31f0471e96a2561382a2f6d64c868728f23ded41852fdaddca691b2ed5b9bf5643a6a768c359573e675
SSDEEP 3072:iCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA70:dvMsLaOa3lLNngoqRttA70
TLSH
T179345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kidaysnkid.sys

Path C:\Temp\kidaysnkid.sys
Size 141KB
SHA256 d8e4908fca8feacd056695283a7976ff43d06bcb4470364633e4979ac99c84c7
MD5 9aff8dc17f6c17c3f1cde2507a8f6bfe
SHA1 52bae1bb07ed4f0954a31692deb264a837af8b0c
SHA512 d0b25089314a70b41ea8000772c77085a51047932dcce5f9bab2637825053ea444c4c8738ca2d1f116a9de9fba3c7083b03636b00f31823052ac36f133fc575f
SSDEEP 1536:fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B7E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifdaysqni.exe

Path C:\Temp\nifdaysqni.exe
Size 243KB
SHA256 1c2ba0853819b79c327e7923a8cb08a1583a08af7da49f22dd242c292644eaee
MD5 7a3d140378f5e35371ca1b2acbfda7b2
SHA1 97521d8cb5eb6992d322106480a0ee9f82e5ff41
SHA512 f25c3e6d0cc9f149ee3b48e9a2e4b93d2f8030f04d65d0e818f7964b43429ff32334f78277a456622fabb7f3d42372d6b879afa9bcba27f0a125164f7f666fdc
SSDEEP 3072:gCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7u:bvMsLaOa3lLNngoqRttA7u
TLSH
T1B9345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojgbztrljd.sys

Path C:\Temp\ojgbztrljd.sys
Size 141KB
SHA256 ec2dd052df8283e40ae57971efb6257a082a30f98c69744d92b1d6dc6a2bbd69
MD5 68fb821f0d3752c1f600b84127cc17ab
SHA1 511a2c44a7e9a579d39423f41fe94894cee420c0
SHA512 61b2cb068daa5ea73f36bbcac0719627bb3363bc0864dd802318e89ca8a6cd28953bb40093d24af0395c6293d5f66ead455351d8cd7e32a464a96cdfad78a97e
SSDEEP 1536:Za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A8E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spkicausmk.exe

Path C:\Temp\spkicausmk.exe
Size 243KB
SHA256 88ea1dfaeb95ae3b5107084857015b8ea17ca0fd9430483d9104550fc1be1a13
MD5 146ac5899456fd3114bf11f3f4685edd
SHA1 d7de06b3d8d822ca87ecf923d2b2a82a6351adce
SHA512 01c250239d54772dcd4eb51d6a1a8a3f913ac2b8d944c4ac54a36315a4173538c0aa3a7c03cc6c244b7a3709f96d6a9b288d1f0809730270c9acb06edfba0c71
SSDEEP 3072:xCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7j:MvMsLaOa3lLNngoqRttA7j
TLSH
T1AE345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlfdbvqoi.exe

Path C:\Temp\tnlfdbvqoi.exe
Size 243KB
SHA256 4246d471e70e0f2247659395e35d1b81ca3e5ef55d801e226e7569e2c07dedd0
MD5 7f5939ab3b17ff059ffa554a44889235
SHA1 bdac270be72bf88671280799ee14258ef91835d6
SHA512 5775a76979a22e82751517b556f5e14ee2dab77ca91226204352000082a1dd5c8d2bea3a7c80439c2eae9a7488b3ade6fe2c5a7e80867c9bf4aa2a3ec49000e4
SSDEEP 3072:8CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7i:fvMsLaOa3lLNngoqRttA7i
TLSH
T17B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqnlfdavtn.sys

Path C:\Temp\vqnlfdavtn.sys
Size 141KB
SHA256 fe33f0c174f99d2c849210f6396e4e23c8abd347d81754799388a0df60a50b77
MD5 87d19ced83d6665d71a117034fea1d42
SHA1 7a4115c82fbeabd66f066ac392e4fa87290e1c98
SHA512 5ce995850617a46269acd2fed309578bbb79fe7fec3d089a89acfe1fbe282c8c40da5247a0ce2e168df455a8c1efb1a30c324c21a7d43f7667276ee3a6b4f0a3
SSDEEP 1536:0a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:0a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A2E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xspkfcausm.exe

Path C:\Temp\xspkfcausm.exe
Size 243KB
SHA256 ced0857c8ae638364bda0ed9a37bb9b43e9b554f36187595258ba2baade2be72
MD5 e61d9317352081a7f4e133bc4ee191d4
SHA1 055beda2b380fdfaf86c2e725187b25c2a93af17
SHA512 23278706aea32b43ea5d4c469893c86863db964463513b5580e8fff9a15cf35e10cdc4b267fcf6df3e617901d726b36ceea31f963ef1d6772ce5c89db06e9410
SSDEEP 3072:3CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7V:SvMsLaOa3lLNngoqRttA7V
TLSH
T132345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytqligbvtn.sys

Path C:\Temp\ytqligbvtn.sys
Size 141KB
SHA256 35f8646f8209f5ad793a97f0863c59ba5ecb6e22ce3d3c8eab2ced6de3ccc623
MD5 96bad921ccb646be5ecaa98fa6b2735c
SHA1 f245553e2169c57e92dc336b0eb09586bb5012c6
SHA512 11f759154ac0b9cf55d76c07039e2184f973b0ccea0c9f5be211baea5d2103f9163abb591fb845b43cf8e77197f8b9620273d39175377bc69a2826261b5af5ac
SSDEEP 1536:ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T170E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywtojdbwto.exe

Path C:\Temp\ywtojdbwto.exe
Size 243KB
SHA256 337eacc6e9f4c89dae914b5b759626e58528f502346b858561d536d4dd13ba5b
MD5 172e087f8818e9d7ed60f1dba20b4209
SHA1 9d866106ae42a68dc4e25d68ce01221d85f54123
SHA512 aefc087b4433a4c4fc5a633a5161bcbc82888497c9afbbe656f5badbc6c3478cbae235864bc465906bb6103c058876fff1c739d425ec202483634a3a39042af7
SSDEEP 3072:9CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7n:wvMsLaOa3lLNngoqRttA7n
TLSH
T1CF345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

49aa143a-b808-475e-bb8c-e71c2c84b51d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\49aa143a-b808-475e-bb8c-e71c2c84b51d.tmp
Size 14KB
SHA256 c2c5bfc16a24bd62d796936d544963d95d675e051846922e976723bba1fa523c
MD5 0c2324e81e4de2f11f7b709cf0133c9a
SHA1 c652444b87fcfea2a3c3543b0a2962b2b5983c0f
SHA512 ab02f364e714e249100ee0598f78c16d83808125c7d907eb6464394ff678e71d455ed7f379943ba18cbff4ef6cb89a0a0270bd62a55f753e9c35adcc0ef35724
SSDEEP 192:sxRDRNyM/jK1Ml8UQvCS/f0sBxgpiZ7iEzoD8pr7/g6+WNIYCpuOzGsIgD6J:sxRD9q6S/f0sTgpk7Jv/5IJVq
TLSH
T12162D8166A245D77DCDBD209FA55BF93D6F85463A1901E44AAFCCB0C00E66DC6213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 c47b926d63bbb9d06a25e80e47257c5d09752162ee310a5fd8eb20c6580764b1
MD5 fd4c57e70b768e5af54bafcfdf9ee8db
SHA1 b4efdc07991ca6bb924ceb86cd93444d17f28ef1
SHA512 8cab4e9f94d90ee07e696d909ef64125ad2605af8f0f0674bc759b46818086bf60ffa707652d0d47e4d97d0ebc296d3c4b1ab4cf3bcf9825a58a06c9b0bc5085
TLSH
T16951548203263AC1E77955F297D944C8B7F9B399080B5EFA120C1C7A4D4EF4480C812F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a147.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a147.TMP
Size 2KB
SHA256 88d75e8dd2bbfb1550fa43e19585224f49d0dc9713b15e8bac84d15eb0c97421
MD5 6af4e0a0f044fbb96a470043bbf5f1df
SHA1 8abfe0cbb75c0d1dd422052b8497f47800dc034e
SHA512 a4a113767baf2600415427af3df65d9932642c13d8b80de8dac8bc1ef1a08cb56d582552a6a255f6d2ab2ebb09b2c54cbf30350f3f207b9d5b631eb5fee74227
TLSH
T1BC51328203263AC1E77955F29BE944C8B7F9B7A9480B5EFA120C1C7A5E4EF4494C912F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9283b93e1ab14e3c1a7cab20e3698a62d132b30674a9016a307ce5d2506c2243
MD5 fd8213bbb31a57e91812281dd5f90a12
SHA1 e03bf6389974290437adb36242475f50bd2567b1
SHA512 e5b7e077ca98111ce63588a17c1f22fd18422b7ae81d4eb6d875408ed38c1d62fd75a3caa88e8e90e29d4eebc1a27e6d0619739fe343bbc5556126fd6faececa
TLSH
T1B7519EF7C6E8862D890156F0A7147E2FDE2D0914432C3D5AC9E4AF1B97E2471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a04720bf63b91f6bb2b61a82094f3d4aa15a39625d859612cae5223ecb55780b
MD5 4aa2f61a3371844dbee25ec6240688b2
SHA1 e8bb4ed9083c31c5c3537704627cefa9c65ab330
SHA512 5cfe524a9d24175e11eecf20c8e7067ea6da9174a2fe9ec3ee7c270a26164de5b27c7049ab1b1c05b24adb0c741ee75cf69b2fcd9b6fa6a6ebbf6d4d3c786db8
SSDEEP 192:sxR4RNyM/jK1Ml8wCS/f0sBxgGiZ7iczoD8pi/g6+WNIYCsuOzGsIgtJ:sxR498S/f0sTgGk7Bi/5IeV3
TLSH
T19252D9056A345D7BCCDBD20DFA55BF93D6F81563A2901E44AAFC9A1C00E6ADC6213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f5672234e65a5ad232578af65ba6c29c3db5215cf3f6fbf6f3585d6506ae87fc
MD5 32fee2f2535509602bcae5b1629b8f24
SHA1 677390c3b193e8b2b8b428e804cddb7206ed7c43
SHA512 fbbb634a58f4f1f4d61f46a10c26c093fd0f0b3e9567628af1f7384f81aeafab4405292c314ed6d9900deb62fcb835e2184e88950b2050eb53177575a5d19191
SSDEEP 192:sxRDRNyM/jK1Ml8wCS/f0sBxgGiZ7iEzoD8p97/g6+WNIYCyuOzGsIgDUJ:sxRD98S/f0sTgGk7Jt/5IQV8
TLSH
T17962D9066A345D7BCCDBD20DFA55BF93D6F81563A2901E44AAFC9A1C00E66DC6213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 546c078482a3d16a86d234f4bcec8dde16e1a25561786e9c7ca84f5f1c018dd4
MD5 02e8317bf49302fd69ed1af5c6678e6c
SHA1 e03d221ada972d1f5c786043a455fc3ce6e67a65
SHA512 599bf7a823e73765f6cfe219788df5f05290bdcfa8e684cc0ca5fbe9d2a4b8f70c9f2a4fd88d84aac9aaafb32c4eb56c30a0bcc5036de1564e4d829726b41bd9
SSDEEP 768:j/8vNN7pLuL7tQWgQ+fB+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVGOMQqqRrovq:j/8vN7E7tQWgQ+fB+u1jadOMVqqC
TLSH
T15DE2FC3B680CCB7E4F804E9DEC29BD9AADE801CF5698CD5447EA840C03C57EB561A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 75ad2486d6949c23b6275e7ae78d889c3c9389ba6cf396c4370dd89c99d17dd6
MD5 7052782e20b6df3616ee03fb80ed62bd
SHA1 3077da80bc933fdf213f447b0ac073c7e88d3ad3
SHA512 7e933f7c4ccce2877df38e0022e1656a83d83015f19dad62cf159719ba5704a71d5fdb65b4c5792f33389e119205532ee86041c3dbbb94b056ff36c914144577
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHuDSOowg2Ww19gO2K4TgM2cmut8unefmKq:CbEBVj5JAdSp9/EgTK7j6dJOHuDSOowk
TLSH
T18C918100727A0241397D7A0C80B8986ECAC27477355DF96B3BE805A60F27E56EDFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

60f4fd32-7f67-4e24-b8cd-b6e377a49509.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\60f4fd32-7f67-4e24-b8cd-b6e377a49509.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c8c71c597fb31da21f789ba9931759728ddf38a8910b6c6d1515f96d236bd59b
MD5 06754a3fe7c213d0bd9717e060d9d04f
SHA1 ad7f60855ea60144e472f64c182c494e7a3ad667
SHA512 27a292f0f736bc76b1f759d0fcf706dd96248e45b17ad8b6fa5af9c063622562b1a515a812d22b31a88fa5a88e07c6ea0fcebcd7c91b4f0dc2ec8717ae287b88
SSDEEP 768:Irv+4UNbdD3EccNp8+p3bd66j+4BRv86aLIiL2bwCl1:Ibsbp3wL8+p3Z6n4yJ0ww
TLSH
T16003CE73F8A899739CE6C644B2467A437FF811A396C00EC4D5DD2B4E019A19E630BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 16aff1ce7ccec2c74dd0df680023666aa056b87c68d9a441adb93c2f2079ab20
MD5 3a903caf395063270bed6fb3c15d3882
SHA1 a23c3ed97fe948aa9fa03b4c323e7360c20629d9
SHA512 201fdf9483ec196610bc4d79262b265c81029e0897610cb75ad9d3b03610b9afd87a105bc0165c3087980592a0a4f9d79ce3b9ba57c94b64b266b391bf537ca2
SSDEEP 768:kj+9z3iwX1cp8+p3bd66j+4BRv86aLIW/Wb9Mk:z9z3p168+p3Z6n4yFWb+k
TLSH
T1C6F2BE71E89ADE738CE5C755B25A3783AFF811A396C01E88D9D8AF0D018729D5B07836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ebd5143f6e096bbb8f054277c2bffd7ed98f00cd5c6bd67e60492b10ddbf192b
MD5 dbfc29b01a682a10239246efd13f0e13
SHA1 e8e41e7d3d5d6cf24e8ed106e711bdca6360bc01
SHA512 47ee0655278397ec6802e2c174f6a24414b2f7f9bfd7a9053c420cfe32b63d0b97b68fe5dc76f90bb8d01ba7f91ac2e4e7ee9e56b5bcee40370904fb53770b7a
SSDEEP 768:Nj+9z33wX1cp8+p3bd66j+4BRv86aLIW/Wb9Mk:o9z3C168+p3Z6n4yFWb+k
TLSH
T1D4F2BF71F89ADE738CE5C755B25A3783AFF811A396C01E88D9D8AF0D018729D5B07836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 f6aeac7b2458b3823acc11f0bca646ae666c820ae387a98209af74fe27aa300a
MD5 58765fc66abd8182ea38fdc2f6801e15
SHA1 8a4517b925ea2c91428e90597479963aeaa8fd09
SHA512 1c2ed96bba4e12cc24620a20e3172ec9fbf4e7451dfc1ab7eb1bde80a9dd8cf15ea266cc201004a52062c03c92a0e4c6e65f6cd6132bd5651015441744510947
SSDEEP 768:3rv+4UNbd93pwX1Xp8+p3bd66j+4BRv86aLIW/W2bwClP:3bsbP3w1Z8+p3Z6n4yFW0w6
TLSH
T16813BF72F8A9DD739CEAC640B14A76837FF821A395C10E84D5D96B4E014B29E270BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3cb5a830cae7e9eeab3b850a74d28bd8eb3922dc9bcce60234ec0568e4862b95
MD5 3c278b478dd5f8ab1e100a0d04c21829
SHA1 328937cef125379f1df51f55be52069c4e03f4ce
SHA512 4da28f18f7c65cf286e4b8ada85095d9a1fba77021af5a109a05c019dc33570aa82c713ae262617c7c235322cfdb3fde7ab840865aed9797fc796ef245d6b046
SSDEEP 768:7F1j+9J3owg0H+pp8+p3bd66j+4BRv86aLIW/Wb9Mk:a9J3UX8+p3Z6n4yFWb+k
TLSH
T16C03AD72E895CE779CE68B85B34A7787EEE411A386C45DC8EAC8AF4D00871DD070BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

162ce783-b8de-4b70-8978-acd194a2a5d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\162ce783-b8de-4b70-8978-acd194a2a5d2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4132_1079776472\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/120-255-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/120-269-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/264-358-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/692-464-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1384-345-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2236-306-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2452-267-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2796-297-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2964-418-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3348-431-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3432-227-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3444-325-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3684-481-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3824-398-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3940-178-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4104-378-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4452-310-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5420-452-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5600-485-0x0000000000010000-0x0000000000083000-memory.dmp

Download