862a0590866f3f53113af18620b2dc63cb21be619ed80d3ce93d47d3e27c2c30

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 22:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe
Size 243KB
Sample260813-2jrdpszdpg
SHA256 862a0590866f3f53113af18620b2dc63cb21be619ed80d3ce93d47d3e27c2c30
MD5 752cd3ce59addf977f937664fda4b0aa
SHA1 ca171a40f8c194959ae962eb2f50d15e73d81282
SHA512 1e35a89b26682a9889f7ebfc21816801f25ad1fdd77a100f70099700300fef1484aa42d19ef1a5742200e6e82b3fbcf581785b10b6a891195509625aacae3d9b
SSDEEP 3072:fCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7B:qvMsLaOa3lLNngoqRttA7B
TLSH
T1BC345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
948	CP.exe
5952	oidbvtoiay.exe
940	CP.exe
4408	CP.exe
5812	i_oidbvtoiay.exe
2008	bytqoigays.sys
1304	CP.exe
4616	fdaysqnifd.exe
2420	CP.exe
4208	CP.exe
4500	i_fdaysqnifd.exe
1268	nigaysqkid.sys
2116	CP.exe
5832	igaysqkida.exe
1832	CP.exe
5420	CP.exe
1868	i_igaysqkida.exe
5728	xusnkfdxvp.sys
5384	CP.exe
4728	usnkicausp.exe
3856	CP.exe
1264	CP.exe
5848	i_usnkicausp.exe
3548	causmkecau.sys
5112	CP.exe
1696	usmkecxupn.exe
2164	CP.exe
1816	CP.exe
4704	i_usmkecxupn.exe
5224	czusmkecwu.sys
3980	CP.exe
5764	rpjhbztrmj.exe
3892	CP.exe
5484	CP.exe
5728	i_rpjhbztrmj.exe
4144	cwurmjeczt.sys
5608	CP.exe
3532	zwuomjhbzw.exe
4628	CP.exe
3868	CP.exe
4868	i_zwuomjhbzw.exe
2328	bztrljebwu.sys
4348	CP.exe
4160	eywqojgbzt.exe
6124	CP.exe
1288	CP.exe
1844	i_eywqojgbzt.exe
5568	tnlgdbywqo.sys
2544	CP.exe
1268	lgdywqoiga.exe
5732	CP.exe
3872	CP.exe
1564	i_lgdywqoiga.exe
5624	dywqoigayk.sys
716	CP.exe
2008	nifdbvtqli.exe
3060	CP.exe
4808	CP.exe
5580	i_nifdbvtqli.exe
200	nlfdavtnlf.sys
1964	CP.exe
5744	lfayvqfaxs.exe
4828	CP.exe
5748	CP.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1227032087\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_282682116\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_282682116\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oidbvtoiay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwuomjhbzw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifdbvtqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfayvqfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkfcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oljdbztqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oljdbztqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwuomjhbzw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicavsnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaysqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usnkicausp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkecxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkecxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomhecwurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdywqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifdbvtqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axusqkhfda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhbzwusmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljebzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdaysqnifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usnkicausp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfayvqfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomhecwurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaysqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdaysqnifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaysqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdywqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhbzwusmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigayvsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigayvsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axusqkhfda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaysqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oidbvtoiay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkfcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljebzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicavsnlfd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1780	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3340	ipconfig.exe
6032	ipconfig.exe
3880	ipconfig.exe
5036	ipconfig.exe
2500	ipconfig.exe
5848	ipconfig.exe
3472	ipconfig.exe
2644	ipconfig.exe
4628	ipconfig.exe
2572	ipconfig.exe
2492	ipconfig.exe
4852	ipconfig.exe
4072	ipconfig.exe
4160	ipconfig.exe
5320	ipconfig.exe
2500	ipconfig.exe
2092	ipconfig.exe
3728	ipconfig.exe
5348	ipconfig.exe
5860	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311342269814423"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{C7E95847-03EA-4386-AB7A-60800BE9062B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4580	msedge.exe
4580	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5812	i_oidbvtoiay.exe
Token: SeDebugPrivilege	4500	i_fdaysqnifd.exe
Token: SeDebugPrivilege	1868	i_igaysqkida.exe
Token: SeDebugPrivilege	5848	i_usnkicausp.exe
Token: SeDebugPrivilege	4704	i_usmkecxupn.exe
Token: SeDebugPrivilege	5728	i_rpjhbztrmj.exe
Token: SeDebugPrivilege	4868	i_zwuomjhbzw.exe
Token: SeDebugPrivilege	1844	i_eywqojgbzt.exe
Token: SeDebugPrivilege	1564	i_lgdywqoiga.exe
Token: SeDebugPrivilege	5580	i_nifdbvtqli.exe
Token: SeDebugPrivilege	1844	i_lfayvqfaxs.exe
Token: SeDebugPrivilege	256	i_axusqkhfda.exe
Token: SeDebugPrivilege	1336	i_smkfcausmk.exe
Token: SeDebugPrivilege	1888	i_mjhbzwusmj.exe
Token: SeDebugPrivilege	2912	i_uomhecwurm.exe
Token: SeDebugPrivilege	2172	i_bztrljebzt.exe
Token: SeDebugPrivilege	3540	i_oljdbztqlj.exe
Token: SeDebugPrivilege	3896	i_igaysqoiga.exe
Token: SeDebugPrivilege	3728	i_oigayvsqki.exe
Token: SeDebugPrivilege	5728	i_kicavsnlfd.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4752	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 2356	4140	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	88
PID 2356 wrote to memory of 4752	2356	iexplore.exe	90
PID 4752 wrote to memory of 4332	4752	msedge.exe	91
PID 4752 wrote to memory of 1780	4752	msedge.exe	92
PID 4752 wrote to memory of 244	4752	msedge.exe	93
PID 4752 wrote to memory of 244	4752	msedge.exe	93
PID 4752 wrote to memory of 244	4752	msedge.exe	93
PID 4752 wrote to memory of 3008	4752	msedge.exe	94
PID 4752 wrote to memory of 3008	4752	msedge.exe	94
PID 4752 wrote to memory of 2336	4752	msedge.exe	96
PID 4752 wrote to memory of 2336	4752	msedge.exe	96
PID 4752 wrote to memory of 5760	4752	msedge.exe	97
PID 4752 wrote to memory of 2336	4752	msedge.exe	96
PID 4752 wrote to memory of 5760	4752	msedge.exe	97
PID 4752 wrote to memory of 5760	4752	msedge.exe	97
PID 4752 wrote to memory of 3740	4752	msedge.exe	98
PID 4752 wrote to memory of 3740	4752	msedge.exe	98
PID 4752 wrote to memory of 2624	4752	msedge.exe	99
PID 4752 wrote to memory of 3740	4752	msedge.exe	98
PID 4752 wrote to memory of 2624	4752	msedge.exe	99
PID 4752 wrote to memory of 2624	4752	msedge.exe	99
PID 4752 wrote to memory of 3524	4752	msedge.exe	101
PID 4752 wrote to memory of 3524	4752	msedge.exe	101
PID 4140 wrote to memory of 948	4140	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	102
PID 4752 wrote to memory of 5136	4752	msedge.exe	104
PID 4752 wrote to memory of 5136	4752	msedge.exe	104
PID 4752 wrote to memory of 5444	4752	msedge.exe	105
PID 4752 wrote to memory of 5444	4752	msedge.exe	105
PID 4752 wrote to memory of 4476	4752	msedge.exe	107
PID 5952 wrote to memory of 940	5952	oidbvtoiay.exe	110
PID 4752 wrote to memory of 1832	4752	msedge.exe	114
PID 4752 wrote to memory of 1832	4752	msedge.exe	114
PID 4752 wrote to memory of 4580	4752	msedge.exe	115
PID 4752 wrote to memory of 4580	4752	msedge.exe	115
PID 4140 wrote to memory of 4408	4140	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	117
PID 4140 wrote to memory of 1304	4140	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	121
PID 4616 wrote to memory of 2420	4616	fdaysqnifd.exe	123
PID 4140 wrote to memory of 4208	4140	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	126
PID 4140 wrote to memory of 2116	4140	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	130
PID 5832 wrote to memory of 1832	5832	igaysqkida.exe	132
PID 4140 wrote to memory of 5420	4140	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	135
PID 4140 wrote to memory of 5384	4140	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	139
PID 4728 wrote to memory of 3856	4728	usnkicausp.exe	141
PID 4140 wrote to memory of 1264	4140	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	144
PID 4752 wrote to memory of 2500	4752	msedge.exe	147
PID 4752 wrote to memory of 4828	4752	msedge.exe	148
PID 4752 wrote to memory of 3780	4752	msedge.exe	149
PID 4140 wrote to memory of 5112	4140	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	152
PID 1696 wrote to memory of 2164	1696	usmkecxupn.exe	154
PID 4140 wrote to memory of 1816	4140	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	157
PID 4140 wrote to memory of 3980	4140	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	161
PID 5764 wrote to memory of 3892	5764	rpjhbztrmj.exe	163
PID 4140 wrote to memory of 5484	4140	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	166
PID 4140 wrote to memory of 5608	4140	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	170
PID 3532 wrote to memory of 4628	3532	zwuomjhbzw.exe	172
PID 4140 wrote to memory of 3868	4140	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	175
PID 4140 wrote to memory of 4348	4140	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	179
PID 4160 wrote to memory of 6124	4160	eywqojgbzt.exe	181
PID 4140 wrote to memory of 1288	4140	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	184
PID 4752 wrote to memory of 1940	4752	msedge.exe	186
PID 4752 wrote to memory of 1940	4752	msedge.exe	186
PID 4140 wrote to memory of 2544	4140	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	192
PID 1268 wrote to memory of 5732	1268	lgdywqoiga.exe	194
PID 4140 wrote to memory of 3872	4140	2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe	197

C:\Users\Admin\AppData\Local\Temp\2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_752cd3ce59addf977f937664fda4b0aa_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffa5a72c188,0x7ffa5a72c194,0x7ffa5a72c1a0
      4⤵
      PID:4332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,1319251999148358170,11147813921669236496,524288 --field-trial-handle=2352,i,18009410791073426950,1474682559739589413,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:11
      4⤵
      System Time Discovery
      PID:1780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,14040056570175566142,10838245789357923163,262144 --field-trial-handle=2352,i,18009410791073426950,1474682559739589413,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
      4⤵
      PID:244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,29816608812416095,12455127111480608077,524288 --field-trial-handle=2352,i,18009410791073426950,1474682559739589413,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:13
      4⤵
      PID:3008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3616,i,16906315570361218074,13964093438147141736,2097152 --field-trial-handle=2352,i,18009410791073426950,1474682559739589413,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      PID:2336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3640,i,14238115770813345168,12445053207248046171,2097152 --field-trial-handle=2352,i,18009410791073426950,1474682559739589413,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
      4⤵
      PID:5760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4332,i,907692961319864586,14182746349956371874,2097152 --field-trial-handle=2352,i,18009410791073426950,1474682559739589413,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:1
      4⤵
      PID:3740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4344,i,6016526159479859771,17960918954663460171,2097152 --field-trial-handle=2352,i,18009410791073426950,1474682559739589413,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:9
      4⤵
      PID:2624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,8724286270846673628,11144138733051343138,524288 --field-trial-handle=2352,i,18009410791073426950,1474682559739589413,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
      4⤵
      PID:3524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,16944656748297010370,10664878065898317207,524288 --field-trial-handle=2352,i,18009410791073426950,1474682559739589413,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
      4⤵
      PID:5136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,3772481044584474507,13648771409940395156,524288 --field-trial-handle=2352,i,18009410791073426950,1474682559739589413,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
      4⤵
      PID:5444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,5196043115568817390,1405465372318269561,524288 --field-trial-handle=2352,i,18009410791073426950,1474682559739589413,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
      4⤵
      PID:1264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,5196043115568817390,1405465372318269561,524288 --field-trial-handle=2352,i,18009410791073426950,1474682559739589413,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
      4⤵
      PID:4476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,10362478997640161324,12746278840433607103,524288 --field-trial-handle=2352,i,18009410791073426950,1474682559739589413,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
      4⤵
      PID:1832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,10020474443157689194,11689139667721041826,524288 --field-trial-handle=2352,i,18009410791073426950,1474682559739589413,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
      4⤵
      PID:4580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,12530626801488566167,11118055587437643576,524288 --field-trial-handle=2352,i,18009410791073426950,1474682559739589413,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:14
      4⤵
      PID:2500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,17889383830904080244,8316339894692683167,524288 --field-trial-handle=2352,i,18009410791073426950,1474682559739589413,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
      4⤵
      PID:4828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,2122307405600877101,8257667379062515299,524288 --field-trial-handle=2352,i,18009410791073426950,1474682559739589413,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
      4⤵
      PID:3780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3824,i,16119972172462578139,3374149703181650313,524288 --field-trial-handle=2352,i,18009410791073426950,1474682559739589413,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
      4⤵
      PID:1940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,3727289566709687569,7074534545723363956,524288 --field-trial-handle=2352,i,18009410791073426950,1474682559739589413,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:14
      4⤵
      PID:2772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6276,i,5410160033709290058,9324505141504522101,262144 --field-trial-handle=2352,i,18009410791073426950,1474682559739589413,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,14944179480539553998,7649724152380100477,524288 --field-trial-handle=2352,i,18009410791073426950,1474682559739589413,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
      4⤵
      PID:6040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oidbvtoiay.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:948
- - C:\Temp\oidbvtoiay.exe
    C:\Temp\oidbvtoiay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5952
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:940
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oidbvtoiay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4408
- - C:\Temp\i_oidbvtoiay.exe
    C:\Temp\i_oidbvtoiay.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdaysqnifd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1304
- - C:\Temp\fdaysqnifd.exe
    C:\Temp\fdaysqnifd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4616
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2420
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdaysqnifd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4208
- - C:\Temp\i_fdaysqnifd.exe
    C:\Temp\i_fdaysqnifd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaysqkida.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2116
- - C:\Temp\igaysqkida.exe
    C:\Temp\igaysqkida.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5832
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1832
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaysqkida.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5420
- - C:\Temp\i_igaysqkida.exe
    C:\Temp\i_igaysqkida.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usnkicausp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5384
- - C:\Temp\usnkicausp.exe
    C:\Temp\usnkicausp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4728
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3856
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usnkicausp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1264
- - C:\Temp\i_usnkicausp.exe
    C:\Temp\i_usnkicausp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkecxupn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5112
- - C:\Temp\usmkecxupn.exe
    C:\Temp\usmkecxupn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2164
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkecxupn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1816
- - C:\Temp\i_usmkecxupn.exe
    C:\Temp\i_usmkecxupn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhbztrmj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3980
- - C:\Temp\rpjhbztrmj.exe
    C:\Temp\rpjhbztrmj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5764
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3892
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhbztrmj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5484
- - C:\Temp\i_rpjhbztrmj.exe
    C:\Temp\i_rpjhbztrmj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwuomjhbzw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5608
- - C:\Temp\zwuomjhbzw.exe
    C:\Temp\zwuomjhbzw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3532
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4628
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwuomjhbzw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3868
- - C:\Temp\i_zwuomjhbzw.exe
    C:\Temp\i_zwuomjhbzw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywqojgbzt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4348
- - C:\Temp\eywqojgbzt.exe
    C:\Temp\eywqojgbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4160
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6124
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywqojgbzt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1288
- - C:\Temp\i_eywqojgbzt.exe
    C:\Temp\i_eywqojgbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgdywqoiga.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2544
- - C:\Temp\lgdywqoiga.exe
    C:\Temp\lgdywqoiga.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1268
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5732
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgdywqoiga.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3872
- - C:\Temp\i_lgdywqoiga.exe
    C:\Temp\i_lgdywqoiga.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nifdbvtqli.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:716
- - C:\Temp\nifdbvtqli.exe
    C:\Temp\nifdbvtqli.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2008
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3060
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nifdbvtqli.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4808
- - C:\Temp\i_nifdbvtqli.exe
    C:\Temp\i_nifdbvtqli.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfayvqfaxs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1964
- - C:\Temp\lfayvqfaxs.exe
    C:\Temp\lfayvqfaxs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5744
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4828
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfayvqfaxs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5748
- - C:\Temp\i_lfayvqfaxs.exe
    C:\Temp\i_lfayvqfaxs.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axusqkhfda.exe ups_run
  2⤵
  PID:4344
- - C:\Temp\axusqkhfda.exe
    C:\Temp\axusqkhfda.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4540
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4564
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axusqkhfda.exe ups_ins
  2⤵
  PID:572
- - C:\Temp\i_axusqkhfda.exe
    C:\Temp\i_axusqkhfda.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkfcausmk.exe ups_run
  2⤵
  PID:5812
- - C:\Temp\smkfcausmk.exe
    C:\Temp\smkfcausmk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5184
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4920
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5036
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkfcausmk.exe ups_ins
  2⤵
  PID:2124
- - C:\Temp\i_smkfcausmk.exe
    C:\Temp\i_smkfcausmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjhbzwusmj.exe ups_run
  2⤵
  PID:1640
- - C:\Temp\mjhbzwusmj.exe
    C:\Temp\mjhbzwusmj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3608
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3768
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjhbzwusmj.exe ups_ins
  2⤵
  PID:1136
- - C:\Temp\i_mjhbzwusmj.exe
    C:\Temp\i_mjhbzwusmj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomhecwurm.exe ups_run
  2⤵
  PID:1308
- - C:\Temp\uomhecwurm.exe
    C:\Temp\uomhecwurm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2440
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3880
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomhecwurm.exe ups_ins
  2⤵
  PID:5916
- - C:\Temp\i_uomhecwurm.exe
    C:\Temp\i_uomhecwurm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrljebzt.exe ups_run
  2⤵
  PID:208
- - C:\Temp\bztrljebzt.exe
    C:\Temp\bztrljebzt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:916
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3444
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrljebzt.exe ups_ins
  2⤵
  PID:1952
- - C:\Temp\i_bztrljebzt.exe
    C:\Temp\i_bztrljebzt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oljdbztqlj.exe ups_run
  2⤵
  PID:2324
- - C:\Temp\oljdbztqlj.exe
    C:\Temp\oljdbztqlj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4656
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1472
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oljdbztqlj.exe ups_ins
  2⤵
  PID:4460
- - C:\Temp\i_oljdbztqlj.exe
    C:\Temp\i_oljdbztqlj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaysqoiga.exe ups_run
  2⤵
  PID:4568
- - C:\Temp\igaysqoiga.exe
    C:\Temp\igaysqoiga.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2224
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1236
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4072
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaysqoiga.exe ups_ins
  2⤵
  PID:1772
- - C:\Temp\i_igaysqoiga.exe
    C:\Temp\i_igaysqoiga.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3896
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigayvsqki.exe ups_run
  2⤵
  PID:4600
- - C:\Temp\oigayvsqki.exe
    C:\Temp\oigayvsqki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2828
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3780
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigayvsqki.exe ups_ins
  2⤵
  PID:4496
- - C:\Temp\i_oigayvsqki.exe
    C:\Temp\i_oigayvsqki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicavsnlfd.exe ups_run
  2⤵
  PID:2872
- - C:\Temp\kicavsnlfd.exe
    C:\Temp\kicavsnlfd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4580
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2764
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicavsnlfd.exe ups_ins
  2⤵
  PID:4664
- - C:\Temp\i_kicavsnlfd.exe
    C:\Temp\i_kicavsnlfd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5728

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4312

C:\Temp\bytqoigays.sys
C:\Temp\bytqoigays.sys
1⤵
- Executes dropped EXE
PID:2008

C:\Temp\nigaysqkid.sys
C:\Temp\nigaysqkid.sys
1⤵
- Executes dropped EXE
PID:1268

C:\Temp\xusnkfdxvp.sys
C:\Temp\xusnkfdxvp.sys
1⤵
- Executes dropped EXE
PID:5728

C:\Temp\causmkecau.sys
C:\Temp\causmkecau.sys
1⤵
- Executes dropped EXE
PID:3548

C:\Temp\czusmkecwu.sys
C:\Temp\czusmkecwu.sys
1⤵
- Executes dropped EXE
PID:5224

C:\Temp\cwurmjeczt.sys
C:\Temp\cwurmjeczt.sys
1⤵
- Executes dropped EXE
PID:4144

C:\Temp\bztrljebwu.sys
C:\Temp\bztrljebwu.sys
1⤵
- Executes dropped EXE
PID:2328

C:\Temp\tnlgdbywqo.sys
C:\Temp\tnlgdbywqo.sys
1⤵
- Executes dropped EXE
PID:5568

C:\Temp\dywqoigayk.sys
C:\Temp\dywqoigayk.sys
1⤵
- Executes dropped EXE
PID:5624

C:\Temp\nlfdavtnlf.sys
C:\Temp\nlfdavtnlf.sys
1⤵
- Executes dropped EXE
PID:200

C:\Temp\xvpnkicaxs.sys
C:\Temp\xvpnkicaxs.sys
1⤵
PID:1180

C:\Temp\zxspkicaus.sys
C:\Temp\zxspkicaus.sys
1⤵
PID:5868

C:\Temp\xupmhfcauk.sys
C:\Temp\xupmhfcauk.sys
1⤵
PID:5080

C:\Temp\uomkhbzxrp.sys
C:\Temp\uomkhbzxrp.sys
1⤵
PID:2920

C:\Temp\bwuomgebwu.sys
C:\Temp\bwuomgebwu.sys
1⤵
PID:4500

C:\Temp\trljdbztro.sys
C:\Temp\trljdbztro.sys
1⤵
PID:5228

C:\Temp\ytqojdbvto.sys
C:\Temp\ytqojdbvto.sys
1⤵
PID:4136

C:\Temp\nigaysqkig.sys
C:\Temp\nigaysqkig.sys
1⤵
PID:2792

C:\Temp\lfdavsnlid.sys
C:\Temp\lfdavsnlid.sys
1⤵
PID:4352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bytqoigays.sys

Path C:\Temp\bytqoigays.sys
Size 141KB
SHA256 6896ee538a54349aa7de79975fe6d3d85c93d13b5778cebad5dd32bd26155ed0
MD5 ae103ce8c39d35d82c769b27c54b4b54
SHA1 2dada6c95b73de1d6d17a45da1f62f50c5ca7866
SHA512 ae5154461323a9f5b893b173d492714220daed6e3947b3c61fd31e7cdbe050df2604f9d60455d84dc499b361fd31361a35d9cebc7a1b8d41a2ceb0b21a0f23c6
SSDEEP 1536:Ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CEE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

causmkecau.sys

Path C:\Temp\causmkecau.sys
Size 141KB
SHA256 df670f8028a6e93ced4660d75aa3c7a1e053a5cff2fbd8ac6df7910b616da978
MD5 8a4d9e5143b3375fd201b40b7a6e2b44
SHA1 28dddf393ed48cc2b8b132eec98ba120486ff4ec
SHA512 d7b6b7ac129c7e56cbe29b9d66843348b56a40ffa14dbeb4b2fbbf81cd765aee63f56ce0fab263ef3fc708f6e05fd810d6c81912e8e86aef19a49e6673bdd2d3
SSDEEP 1536:/a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:/a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T121E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwurmjeczt.sys

Path C:\Temp\cwurmjeczt.sys
Size 141KB
SHA256 9d4f9d9bdb9454cc002b382311238ddc5fd8de36327d6818cec8cf1d23362f39
MD5 dc19b86100b73e5983a0cc6cc02a49d5
SHA1 9bb58d8cf1f6dfaa961e4610186d02261df3308e
SHA512 cde2a5bbad77fc7fa52f9f57acc65a980d93aad15318ad2e954268baf903027a80efcd348066abd2229df0630e9e843e80a620bb93a5097079e5c2b35db114d4
SSDEEP 1536:ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T144E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czusmkecwu.sys

Path C:\Temp\czusmkecwu.sys
Size 141KB
SHA256 33dc2fdd7a561844a20d3c1dd7eda81554a9558c2b7e19bd2092a2b4b73d3711
MD5 0aeab67d965c6f4d5cedac58dbcbf433
SHA1 362a8e540c5b730e7ea699474a3f67d6d40a225f
SHA512 296979e67d15e96038b0e4d6b7b5a08a85b27bf9c012ceccebe121000930f4f04aad8376dec5e0abaf494ee233df8470cbd86a2f43930c3eba335ae707af9385
SSDEEP 1536:la3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:la3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T112E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdaysqnifd.exe

Path C:\Temp\fdaysqnifd.exe
Size 243KB
SHA256 b11ae7752db7c3eb0d9760dee9fae51a2ed70bf9365764a2bd5e31915761035b
MD5 df08ba74da3142409d2a64872f40636f
SHA1 bf52099b37c4c3142199626670e42317efdca388
SHA512 6d99798813cc9357210d602b7e2d2a9f2c1dd16daec2462c72bdf1a24d2460fce907e77526a918a84d4275c62d32796957b461c9006a65111ab359f0eee09d87
SSDEEP 3072:ECvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7q:XvMsLaOa3lLNngoqRttA7q
TLSH
T177345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdaysqnifd.exe

Path C:\Temp\i_fdaysqnifd.exe
Size 243KB
SHA256 cf766479adee4b534efb24cf8ef1ceed953f20136f9abd9aa13ddd138ee7022d
MD5 164920e8db54c90eec3b9f886652694c
SHA1 17537a9c132bde45be3d91f3cfddada3124ec692
SHA512 9e267287c909709043c3f10974b3473e99b736309984819bc9b5b75d2c2a6c07fcbc65a7066fe73206047034a83b920579a0ec654301cc7df7a4b4bcd1941533
SSDEEP 3072:DCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Z:GvMsLaOa3lLNngoqRttA7Z
TLSH
T1E2345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igaysqkida.exe

Path C:\Temp\i_igaysqkida.exe
Size 243KB
SHA256 c9275278a99ff47be2ebd10056299b910e7393e7231b750a0d4319bfc64fafd8
MD5 54e2fead23b7fa8a3cb04e967d98f393
SHA1 e53f84b0177708e5ae99fe97a7d0acb8384ae298
SHA512 9233340fe6a21b2cf40d6e763f39bbaa46ecd9fefdfc7e2c675ddd1661cacde731c7572f2ce210e1dc55c5567a3319c4a67ac059e72bd63c8973766a5acd3384
SSDEEP 3072:PCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7t:avMsLaOa3lLNngoqRttA7t
TLSH
T160345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oidbvtoiay.exe

Path C:\Temp\i_oidbvtoiay.exe
Size 243KB
SHA256 1b493e7ac28b4369fbf8afe4643f83110bb7053eb8fe793ca128d4ec3bbfc8e6
MD5 d7a45535abd44ffdff3ca604ce2a0e19
SHA1 1801a2ad97fb7d38ef9297468652f3b48880345c
SHA512 1febdd40882e8347cd9803be372087538cdd7f725c4790c2cf69fdb07fd9072a8549467a40aaf64649adb2031e9e3d50c1199903b3bff02625de1297a5fba9e0
SSDEEP 3072:LCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7F:+vMsLaOa3lLNngoqRttA7F
TLSH
T1F7345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpjhbztrmj.exe

Path C:\Temp\i_rpjhbztrmj.exe
Size 243KB
SHA256 5e8b2923c5e9e5d5ae59e0c1fccb27413d2d436eb2e704a5dadc0d55c92063f8
MD5 ee1c6ea0dbd7556ed0818d30ee8e1c92
SHA1 72b7c52b1d828cdcb1ab3602be691d2e4fa7ae8f
SHA512 c0a5db5e08ce27a51899a2f8730e3126a8c61b26669018469de030f917f8a2d26077caee0fb35aed6fd2cc23a09ab65222662c6c98852b8559f13d5ddc059489
SSDEEP 3072:1CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7P:4vMsLaOa3lLNngoqRttA7P
TLSH
T1F0345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_usmkecxupn.exe

Path C:\Temp\i_usmkecxupn.exe
Size 243KB
SHA256 0b267252229c979e2e70f189b3aa44dcd1c4979f8fcebba5238bed3ffe012cea
MD5 5a4062cc8e4685972ec0c0fe1535fb4c
SHA1 42eb0288a9a090e0be5c91b14da4a7a5255b4f7b
SHA512 e76b777c50f34577f5a5f2e626c0c8e1aecef49f8d2a361846f8e9ad1cb8b6b48c439c820707a24ed4bbb3a858a92b82b839b29e16d51e9babca3fb57f0667d1
SSDEEP 3072:eCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7c:RvMsLaOa3lLNngoqRttA7c
TLSH
T1C5345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_usnkicausp.exe

Path C:\Temp\i_usnkicausp.exe
Size 243KB
SHA256 e1cf8d66ed06eca0bdf914724552b81587725e4b9387de2f9ce82158a7521c6f
MD5 c75b243d149c133beec34a829b498bbd
SHA1 e132f14aafdf76dd5ba7fe6c630f9d5f52e9be75
SHA512 50cd6993181dad5e039f43a4754906d4bf6f2c59cc5bc55661fc792502d7a1d657d3ad3fd4b9ccc3e8bd8374f2ad8a91358f9c7ec51d0e5b1951b94d5b6fdd38
SSDEEP 3072:3CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7x:SvMsLaOa3lLNngoqRttA7x
TLSH
T1D9345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igaysqkida.exe

Path C:\Temp\igaysqkida.exe
Size 243KB
SHA256 8840f1f05811a220a6e2bbff5412a9808f91eef910b435fe713379e6ab13221a
MD5 19d3024d6c84ef93c1d684cca55f8f74
SHA1 24691dad7256d8f1331b258a98b0fc0ddade33e4
SHA512 53b43aa484a948ef126a6d68330107cad3d75a299b4e7fa5266aacfbe7575f456874dc711442ff2beffe1deb266d4e09ba1d87931382b7c17b7913c0b5a6d3f9
SSDEEP 3072:qCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Q:VvMsLaOa3lLNngoqRttA7Q
TLSH
T1CA345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nigaysqkid.sys

Path C:\Temp\nigaysqkid.sys
Size 141KB
SHA256 72a8d4fd5927bd944720b371d8f1f7f3eb9f9c1922c14b1bf5e1063bd269e112
MD5 4469cd17850b0285e18f13f4598adad0
SHA1 6b53d08fe24b37b9aba07bdc595344e56cf19636
SHA512 296f8a895e878787745fcee6b9aeb890ad8962883cb75613ed7efdbc995e962d0eac9c92c8a2cf82f4ea775765c46d17b93d5a755c02aa3855823a2dcddce0a5
SSDEEP 1536:Xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T189E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oidbvtoiay.exe

Path C:\Temp\oidbvtoiay.exe
Size 243KB
SHA256 efa62d90e1e178da2ae3de1436512e12a969888a5618514d1ad1bb5e36bd1c81
MD5 b46a45661533d47e241b12cbc10931fa
SHA1 527c7d979839c6eeceb77c3cdf6e93a31833dd35
SHA512 7af136274e7da1da8da459bc7492c8db25f24d14ef7e88e0ec38799fccce777d9fb7b2080f9dc7d4e52a33725dbdc915612593b0684ace449f53ce1ca221815c
SSDEEP 3072:zCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7N:2vMsLaOa3lLNngoqRttA7N
TLSH
T1B5345A017281C031E7160B78045AE7A1467EBC384BA9E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhbztrmj.exe

Path C:\Temp\rpjhbztrmj.exe
Size 243KB
SHA256 68aee1470f5e5404d5498ada8a5d5a3398f2d7e97d7ad395d5e694e009716934
MD5 41c524fcf0d0416a8a5b44fd5867ac95
SHA1 0be49c804724990439535e6eb9a09d7fffd2952f
SHA512 8546b00088bbb04c4c43ed901782de3f39c9f56d2c7a2d00a87e5a6d728d93e1979d9305f19034f997619590077f35633ca57555ad14550115c0e4168644f9d2
SSDEEP 3072:OCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7E:BvMsLaOa3lLNngoqRttA7E
TLSH
T18F345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkecxupn.exe

Path C:\Temp\usmkecxupn.exe
Size 243KB
SHA256 50525801ef305397b1df42b1d4f5f384f70f7916e15ae96340878111b33daac2
MD5 cc5a29af20c16fe833642147c2df41fa
SHA1 d624b7020028f9a6ad13e8956cb0d294e0ebdc2d
SHA512 137d2ee84c5e33ded1454d7bfe9ac4f63393cc6df367ef90f94c5da8dbe8a15d4818f0084779f0e0c8ea8a566406f782e2258d9a11fb8b817e6d916bb8620d92
SSDEEP 3072:tCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA73:gvMsLaOa3lLNngoqRttA73
TLSH
T1B2345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usnkicausp.exe

Path C:\Temp\usnkicausp.exe
Size 243KB
SHA256 eea01bc4d5612c39ceeb838b8a4fdb39b717e510c5d9eb660a55f777e28ae9bb
MD5 94995646b05bc0eaa7634030b1e393a8
SHA1 4338e81d2653389fb3a82fe39fa9cbbe662d20de
SHA512 3ce393718d685ac37656e7dd1fb0925ae295a1e65e09c88202c21f550b5783ad0d64b5fb011d587629a793597c4bde44ebe46fc600cc87924f290af650fa1cfe
SSDEEP 3072:5CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7v:kvMsLaOa3lLNngoqRttA7v
TLSH
T11E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xusnkfdxvp.sys

Path C:\Temp\xusnkfdxvp.sys
Size 141KB
SHA256 dccff9fd8769e3b5b29102d7a02b37f57783ffe7c728667c7db861a46e227d71
MD5 125ecf83456faf51861c394e3728a0b4
SHA1 0baf4599e789fa5fed757a3172e57be82558f20b
SHA512 6bfc19551cdb2159b2311391f6ec2b64a05bbcd9a24f94f9948ddb58fab3c41f839ec6d12d4a92ec8b8a95543a7f8b9c61266aadfe9cf60c2670da9165ede6be
SSDEEP 1536:Wa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Wa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T13BE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 243efeedf3734c30da15daade2428d85258c9ff9c64874656a9ffd03468f983a
MD5 12f8b26d5a2af02b78e2b00caca200d4
SHA1 9c826eaa7dad725fccc030db7c960c4a8a863e7e
SHA512 0762e4cbd0be7650bd91d1b10892362f7945201308a4a8a1433fdb029c8abf8bc63a690e9bcafaf4e73f085a6636b5350749451daf727777aa36b1a43cc55f5e
TLSH
T1F6515E1D133A3DDDE3A406F12EE1D6A43BFD88AE02072E1062442DFCEA42F3841D21A7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d603.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59d603.TMP
Size 2KB
SHA256 fa82ec8990afabeb7fbd5cdf89436f161aa1ace9970e23da93a3567750bde897
MD5 ab0c4147aedf889921babe0bf446adb8
SHA1 57f37c74ee758de21ff63a4dbc00a442d36f7b8a
SHA512 402ab4a4ce26304afbef0c36fe30deb2c3a9ec02ba8a3db8dbc94b15ba604ae862f7fe6a5f3ea4e3a2aef757a97ad84c27393f5b1a2ff875af3d888965bdffa4
TLSH
T18A516F5D133A3DDCE3A506F16EE1D6A43BFD88AE02072E1062442DFCDA42F3851D21A7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 72ec558b784db2f63fa7e5649c4aa7763c438cbc311c4b0c1df57af48d2e3686
MD5 3f8ca0a3ce9534e2bc4ef26a98851cc8
SHA1 c4186af3d74354929d29f0492354670b15dcc564
SHA512 0c1bc907b839885558c9ea2ecb8655a7c8141b91d94be177a0fd06c131653ef6f9af1348cc5a9678385eee8009652af2220464a98b48fffaac5aa85dacb41f22
TLSH
T1A141AFF387F4856E8A0196F0AB146E1FCE2C0515432C7D5AC9E0AE2B93E3871E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c82aa30d831806a95d892cb08611ae4e6541d9e8bd4bdec90dae8afa0c069e2e
MD5 19da91c0a704901d621c8116a11cae48
SHA1 f5324ac789e1748f449d826b0cbd827133e246d6
SHA512 9aa8197e18c31d0ee65d5660f6c878e9248bc915a7d54efdeab9b609f93be7d43e2b06a5f1beed981ea8e09d6234ff059f56124a1781306e2f8c4d30c4cc707b
SSDEEP 192:sxRaRXCt/fJsQQPoZTlOzoA8p9q/g6+WNCKj1/YnAsuaTGhIgDf85J:sxRaEt/fJsTPWTlzA/5F/9g4oj
TLSH
T19D42C8156E68A93B4CCBE219BB15BF53D3F95072A1D11E48AAFC8B1C04E76CD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 317093d7093705ee3031007e37e8dc5993d313060eeb252daac14fdc388d0e8f
MD5 0730ad23c45ab0cccad8b2ffa83bc533
SHA1 9f85ae5053cf50afa10cc1c1ec80c7411958aa78
SHA512 4e1232ddcd103811302ac38dfe418fdc0529c640a8ad13fa0c91c4b2e6c88e775ef18a1c7a53af330fc5d474f84fd9bf9616cbca9202a0651ff57345325dd422
SSDEEP 192:sxRxRXCt/fJsWloZTlOzoA8p9q/g6+WNCKj1/YnAUMaTGhIgV85J:sxRxEt/fJsWlWTlzA/5F/9Y4mj
TLSH
T1D942B7156E68A93B4CC7E219BB25BF53D3F95072A1D11E48EAFC8A1C04E76DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d23ecb00b0255deb32da94e818feb40a102ab2ccf7e1a618f5d71944fab29677
MD5 756d36b2c92b13fa445411e83ad3eff9
SHA1 b5bfb2e462c8740b369f9aaf2f9251522d617874
SHA512 95d2e542c5837cd6ba202e1dbca632f3d34f90849772b75ebe6ca3b8770cff0fcde0940a32df86003e5da5937a2c19a3244c0d2d12136e4716b73f062fa29197
SSDEEP 192:sxRaRXCt/fJsQQloZTlOzoA8p9q/g6+WNCKj1/YnAUMaTGhIgDF85J:sxRaEt/fJsTlWTlzA/5F/9Y4aj
TLSH
T17342C6156E68A93B4CCBE219BB55BF53D3F95072A1D11E48AAFC8A1C04E76CD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 87415590bfa9f8c2a704595c7667d104a5324e54dba2027920020d438d6cbebc
MD5 659a074e2588728ebbbb8f57d295ae12
SHA1 7221f37bab89f15b86a0ce57c51bd130e907264c
SHA512 ad2f3f2b1405799495f7cc0a0fd406f85502fe85808b1e4f2a903037be3737c6b21e9c937c514acefa44bbe767565684fc45b1d7622c5281251c82b7309c745a
SSDEEP 768:wb8dsig7pLuL7r6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVE9Ru467roh4/v:wb8dsisE7r6Wgouf6Mu1jaj9RV6It0
TLSH
T19BD2DA7B740DCB7E4F800ADDAC19BE9F6DA802CB96D8C94447FE851C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 6acbe3f3afa4f673591284fcead6a62394bd986060392be2612fdab5232e0d24
MD5 a8396617aab395e7b020bd937cacef96
SHA1 b672e11ebc8ab9fb3358de5b33e92f1659f9d5fb
SHA512 80f2bbbc8cff98c050ec56b57c5ed9ed700476c93a7e20ccbfb391048507ff82dc2c8c252ff4d1a665013d1da1a2ad2a1f3ca01dd66bd6a907383fb39c793ba3
SSDEEP 96:KRv4dZvtNhW528gBhK4Igvhc3f+BtiHKoKZKsK4KqK2K6KgWKeKDKzgKgKgK4K14:Cv4dZvtNs529BLIgvO3f+BtiHN6zn9XB
TLSH
T1CBC1E014323B06443C7DB60985789D6A86D278B2B55AA42F37E843760F6BE438DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 104f737e11ec8de113b8d96e9a7e9c0a28e9761fbcf214f1acd6a672627ae900
MD5 0030ffe7cdd9537b304edecbbe1567ad
SHA1 a63cb1e7e8d7d497bc863fe9401fa2ca64e53d5f
SHA512 655dc4278364837c275c48192d7b84c87c912123bd677e7416d41e06959822446ad3458553d53a9218c9b1a04d772770cf96fb415ba465ef4f97d81334f7cce5
SSDEEP 768:brv+4UNbds32aDZIO0crINzc4ReyIs2eeVH1S5D:bbsbS3ctc44bsREH1Y
TLSH
T19003BE32E878DD23ACEA6686B14776937EF8212B81840ED4C9DA5F0C4A071DE175F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3888d6b2745591748ebd17883f3af131688e1fe9af98a15701536404f69cd09c
MD5 0623005837caf6d735b002a191e60a1b
SHA1 9206809a75926eb23dafe1a29f699e3e6a54fdd0
SHA512 509d42e03e2daca152c391d53e6b7d7002b712e6053fe40ca1cb880a96bbfdf5b2c0a691dc28222a01ded91fafeb4a728302df3450a457bbd7cff597201e8e4e
SSDEEP 768:6rv+4UNbds3fVDZIO0cdNzc4ReyIsXNeVH1S5D:6bsbS3ttc44bsdEH1Y
TLSH
T19303CF32E8688937ACF6A686B50775537EF8512B82C81ED4C9DE6F0C4A4B1DD130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ab612a05c03dd60b47d53b736921125c87732785d47aabb030f1f4a45f9b1422
MD5 96d6c03afe71a5d54ce8217c3710c600
SHA1 a14b2a4512e207b19ddbb2eb224c99aaec10fec6
SHA512 aa28e2b9525fab2488b6e97123b539bdd98bd64f3e2666bf7b34d7d74ea0381b185fc002cf768764873ceb39086ec27d1e2faf91d326af34c70deb5d21c4fc62
SSDEEP 384:ntZcI238NFOWJY1AJDZNfNoXOVSUU0XtdXqFqETRzcoXfK86sfxEZxxsIj4lBePd:123lwDZIO0crMNzc4ReyIsPePi9Pzg1
TLSH
T115F2BF71F838DC53ACEAB346B6063682BEF51167C0C45E84DADD9F0C094329E0B5B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2c7308aa31b0a0ad872ab025f55bf4ce0969c8eda7b2a754a3220f34291edd57
MD5 fe2bd9dc055f0f05508fa09c9b90cb1a
SHA1 bf169dedb4b3b052cef3af29d05fbf27cb184f44
SHA512 c749beaab356fe036cfbea5771118a31d7a0a49d0190d28915639e7ce9f57f479178766fe2fbf720a23efc82543e4619b4997060927a0bad0d98f79557af323c
SSDEEP 768:Crv+4UNbd534wDZIO0crINzc4ReyIsPe5:Cbsbb3Atc44bsW5
TLSH
T11C03BE31F828DD67ACEA6246F10B75937EF4216B80C51E94DADA5F0C09471DE271F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 454ed579c8cb3035ed4530289a83439a11c5d1fd6c7b6e68cc42f50fd8eafd33
MD5 8ddbd9ec776fbfac0f19b15a65a67c05
SHA1 5fb5d03ca484e74018396facc2ac3d61842b72d8
SHA512 237b02b5cb30aa621a74cd6efc2a075c5393fe0a7d43833168341ec02c5a9158e7f2e4a8233210919ccf2e776299a5778e90188a8427718796f192b5813025d5
SSDEEP 768:+rv+4UNbd53+wDZIO0crMNzc4ReyIsPe5:+bsbb3atc44bsW5
TLSH
T18A03BE32F828DD67ACEA6246B1077593BFF4216B80C51E94DADA5F0C09471DE271F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 ee72d2a4740c0cc48778e793acbba840a372c9449448e3eaf994ac594252dd0d
MD5 b4c7f4a4b92c6f4e650411e1981db039
SHA1 f52e26239b4d1e92cedc3e4446a1c94a271e70b1
SHA512 acdb1119211af6e4a3f3361f9eeda843e1cd90f0bedf6a3ae08b8b140d74a37c391c1ae7ed29668408e08edb4aae520d1988505eacb4eb2013c6e928c36657a8
SSDEEP 384:nDZcIP38NFOWJm1+2Z/fQxXOVSUU0XtdXqFmETRzcoXfK86sfxEZxxsIj4lBePOg:bP3DZZw5O0crmNzc4ReyIsPePi9Pzg1
TLSH
T14C1307F4A4E79976E8AE6343633D6D42ADFCD113B1885984B7D95E0CCC4217FC70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4752_1766977357\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/200-356-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/200-370-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1180-368-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1268-232-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1268-268-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2008-183-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2328-321-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2792-458-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2792-436-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2920-411-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2920-417-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3548-310-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3548-275-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4136-425-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4144-317-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4352-456-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4476-229-0x000001C60D370000-0x000001C60D72B000-memory.dmp

Download

memory/4476-220-0x000001C60D370000-0x000001C60D72B000-memory.dmp

Download

memory/4500-415-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5080-390-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5224-296-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5228-421-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5568-325-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5624-331-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5728-260-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5868-382-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5868-392-0x0000000000010000-0x0000000000083000-memory.dmp

Download