56ced65e42eb7d536a64e32085a10bf025e7a13f7a6671e892851db1e985e4bf

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_deddf1a381e6acf9d2958367341e37a3_elex_rhadamanthys_stop.exe
Size 243KB
Sample260813-txazwatfla
SHA256 56ced65e42eb7d536a64e32085a10bf025e7a13f7a6671e892851db1e985e4bf
MD5 deddf1a381e6acf9d2958367341e37a3
SHA1 b2cda26d9cb9dfccf05aeba2153e9ae1ad8be42f
SHA512 c6e9bbebfb964348d79883878184f104f6a2a7c82fe2551daad2b6a851c3327072910f4af1aa6792583aaf635028dc8a8c2cdafc1244f8408cc5df214c8f24e5
SSDEEP 3072:wCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7e:rvMsLaOa3lLNngoqRttA7e
TLSH
T106345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4892	CP.exe
4192	urmkecxupn.exe
2436	CP.exe
2844	CP.exe
5684	i_urmkecxupn.exe
1000	jhbzurmkec.sys
4000	CP.exe
1192	wuomgecwur.exe
3816	CP.exe
5876	CP.exe
5216	i_wuomgecwur.exe
2764	trpmgeywro.sys
1552	CP.exe
6116	omgezwrpjh.exe
4540	CP.exe
5648	CP.exe
3560	i_omgezwrpjh.exe
3516	dbztrljdbz.sys
1560	CP.exe
964	dbzwqoigdb.exe
4160	CP.exe
5348	CP.exe
5100	i_dbzwqoigdb.exe
1852	eyvtnligby.sys
1536	CP.exe
4716	ytqoigbytq.exe
2604	CP.exe
3108	CP.exe
2092	i_ytqoigbytq.exe
4252	qoigaysqli.sys
4228	CP.exe
2632	ifaxvqnlid.exe
5412	CP.exe
1956	CP.exe
4640	i_ifaxvqnlid.exe
5668	fdxvtnlida.sys
2404	CP.exe
2096	gaysqkicav.exe
5440	CP.exe
3196	CP.exe
4120	i_gaysqkicav.exe
2308	fzxspkicau.sys
2928	CP.exe
1848	caxsqkicau.exe
1264	CP.exe
8	CP.exe
6044	i_caxsqkicau.exe
2540	causpkhczx.sys
3000	CP.exe
1448	uspkhcausm.exe
4980	CP.exe
4200	CP.exe
6112	i_uspkhcausm.exe
4676	wusmkecxup.sys
4996	CP.exe
1256	jhbzurmjec.exe
6120	CP.exe
2348	CP.exe
4508	i_jhbzurmjec.exe
3804	rpjhbzurmj.sys
6044	CP.exe
5324	pjgecwurpj.exe
4452	CP.exe
2456	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5456_1701182107\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5456_1701182107\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5456_275288534\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5456_1119636527\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5456_1119636527\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5456_371951163\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5456_275288534\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5456_1119636527\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5456_1119636527\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_deddf1a381e6acf9d2958367341e37a3_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ykidavtqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqoigbytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjgecwurpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ykidavtqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmkecaujhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaxvqnlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqnigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkecxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgecwur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjgecwurpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqnigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_romkecxrom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uspkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbzurmjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbzurmjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmkecaujhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojgbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgecwur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljebwqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljebwqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicavpnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojgbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkecxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaxvqnlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caxsqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uspkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	romkecxrom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbzwqoigdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbzwqoigdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytqoigbytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caxsqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicavpnhfz.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5704	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3804	ipconfig.exe
3604	ipconfig.exe
5712	ipconfig.exe
2580	ipconfig.exe
5808	ipconfig.exe
3856	ipconfig.exe
3624	ipconfig.exe
4676	ipconfig.exe
1436	ipconfig.exe
2352	ipconfig.exe
1256	ipconfig.exe
3064	ipconfig.exe
5360	ipconfig.exe
1228	ipconfig.exe
1544	ipconfig.exe
4252	ipconfig.exe
2776	ipconfig.exe
5808	ipconfig.exe
616	ipconfig.exe
2184	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311119508523989"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{B5FFA3CC-DACF-429C-A1B9-D923030BC663}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2808	msedge.exe
2808	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5456	msedge.exe
5456	msedge.exe
5456	msedge.exe
5456	msedge.exe
5456	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5684	i_urmkecxupn.exe
Token: SeDebugPrivilege	5216	i_wuomgecwur.exe
Token: SeDebugPrivilege	3560	i_omgezwrpjh.exe
Token: SeDebugPrivilege	5100	i_dbzwqoigdb.exe
Token: SeDebugPrivilege	2092	i_ytqoigbytq.exe
Token: SeDebugPrivilege	4640	i_ifaxvqnlid.exe
Token: SeDebugPrivilege	4120	i_gaysqkicav.exe
Token: SeDebugPrivilege	6044	i_caxsqkicau.exe
Token: SeDebugPrivilege	6112	i_uspkhcausm.exe
Token: SeDebugPrivilege	4508	i_jhbzurmjec.exe
Token: SeDebugPrivilege	3976	i_pjgecwurpj.exe
Token: SeDebugPrivilege	2988	i_trljebwqoj.exe
Token: SeDebugPrivilege	4552	i_rljdbvtolg.exe
Token: SeDebugPrivilege	5000	i_ykidavtqli.exe
Token: SeDebugPrivilege	2072	i_yvqnigaysq.exe
Token: SeDebugPrivilege	5056	i_sqkicausnk.exe
Token: SeDebugPrivilege	848	i_kicavpnhfz.exe
Token: SeDebugPrivilege	1044	i_pmkecaujhc.exe
Token: SeDebugPrivilege	5796	i_romkecxrom.exe
Token: SeDebugPrivilege	6060	i_wrojgbztrm.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5456	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 3656	3332	2026-08-13_deddf1a381e6acf9d2958367341e37a3_elex_rhadamanthys_stop.exe	89
PID 3656 wrote to memory of 5456	3656	iexplore.exe	90
PID 5456 wrote to memory of 5080	5456	msedge.exe	91
PID 5456 wrote to memory of 4164	5456	msedge.exe	92
PID 5456 wrote to memory of 5704	5456	msedge.exe	93
PID 5456 wrote to memory of 4164	5456	msedge.exe	92
PID 5456 wrote to memory of 4164	5456	msedge.exe	92
PID 5456 wrote to memory of 832	5456	msedge.exe	94
PID 5456 wrote to memory of 832	5456	msedge.exe	94
PID 5456 wrote to memory of 3844	5456	msedge.exe	96
PID 5456 wrote to memory of 3844	5456	msedge.exe	96
PID 5456 wrote to memory of 3844	5456	msedge.exe	96
PID 5456 wrote to memory of 5656	5456	msedge.exe	97
PID 5456 wrote to memory of 5656	5456	msedge.exe	97
PID 5456 wrote to memory of 5656	5456	msedge.exe	97
PID 5456 wrote to memory of 256	5456	msedge.exe	98
PID 5456 wrote to memory of 256	5456	msedge.exe	98
PID 5456 wrote to memory of 264	5456	msedge.exe	99
PID 5456 wrote to memory of 256	5456	msedge.exe	98
PID 5456 wrote to memory of 264	5456	msedge.exe	99
PID 5456 wrote to memory of 264	5456	msedge.exe	99
PID 5456 wrote to memory of 4788	5456	msedge.exe	100
PID 5456 wrote to memory of 4788	5456	msedge.exe	100
PID 5456 wrote to memory of 4780	5456	msedge.exe	102
PID 5456 wrote to memory of 5660	5456	msedge.exe	103
PID 5456 wrote to memory of 4780	5456	msedge.exe	102
PID 5456 wrote to memory of 5660	5456	msedge.exe	103
PID 3332 wrote to memory of 4892	3332	2026-08-13_deddf1a381e6acf9d2958367341e37a3_elex_rhadamanthys_stop.exe	104
PID 5456 wrote to memory of 1652	5456	msedge.exe	107
PID 4192 wrote to memory of 2436	4192	urmkecxupn.exe	109
PID 5456 wrote to memory of 5648	5456	msedge.exe	112
PID 5456 wrote to memory of 5648	5456	msedge.exe	112
PID 5456 wrote to memory of 2176	5456	msedge.exe	113
PID 5456 wrote to memory of 2176	5456	msedge.exe	113
PID 3332 wrote to memory of 2844	3332	2026-08-13_deddf1a381e6acf9d2958367341e37a3_elex_rhadamanthys_stop.exe	116
PID 3332 wrote to memory of 4000	3332	2026-08-13_deddf1a381e6acf9d2958367341e37a3_elex_rhadamanthys_stop.exe	120
PID 1192 wrote to memory of 3816	1192	wuomgecwur.exe	122
PID 3332 wrote to memory of 5876	3332	2026-08-13_deddf1a381e6acf9d2958367341e37a3_elex_rhadamanthys_stop.exe	125
PID 3332 wrote to memory of 1552	3332	2026-08-13_deddf1a381e6acf9d2958367341e37a3_elex_rhadamanthys_stop.exe	129
PID 6116 wrote to memory of 4540	6116	omgezwrpjh.exe	131
PID 3332 wrote to memory of 5648	3332	2026-08-13_deddf1a381e6acf9d2958367341e37a3_elex_rhadamanthys_stop.exe	134
PID 3332 wrote to memory of 1560	3332	2026-08-13_deddf1a381e6acf9d2958367341e37a3_elex_rhadamanthys_stop.exe	138
PID 964 wrote to memory of 4160	964	dbzwqoigdb.exe	140
PID 3332 wrote to memory of 5348	3332	2026-08-13_deddf1a381e6acf9d2958367341e37a3_elex_rhadamanthys_stop.exe	143
PID 5456 wrote to memory of 3784	5456	msedge.exe	146
PID 5456 wrote to memory of 4896	5456	msedge.exe	147
PID 5456 wrote to memory of 2868	5456	msedge.exe	148
PID 3332 wrote to memory of 1536	3332	2026-08-13_deddf1a381e6acf9d2958367341e37a3_elex_rhadamanthys_stop.exe	151
PID 4716 wrote to memory of 2604	4716	ytqoigbytq.exe	153
PID 3332 wrote to memory of 3108	3332	2026-08-13_deddf1a381e6acf9d2958367341e37a3_elex_rhadamanthys_stop.exe	156
PID 3332 wrote to memory of 4228	3332	2026-08-13_deddf1a381e6acf9d2958367341e37a3_elex_rhadamanthys_stop.exe	160
PID 2632 wrote to memory of 5412	2632	ifaxvqnlid.exe	162
PID 3332 wrote to memory of 1956	3332	2026-08-13_deddf1a381e6acf9d2958367341e37a3_elex_rhadamanthys_stop.exe	165
PID 3332 wrote to memory of 2404	3332	2026-08-13_deddf1a381e6acf9d2958367341e37a3_elex_rhadamanthys_stop.exe	169
PID 2096 wrote to memory of 5440	2096	gaysqkicav.exe	171
PID 3332 wrote to memory of 3196	3332	2026-08-13_deddf1a381e6acf9d2958367341e37a3_elex_rhadamanthys_stop.exe	174
PID 3332 wrote to memory of 2928	3332	2026-08-13_deddf1a381e6acf9d2958367341e37a3_elex_rhadamanthys_stop.exe	178
PID 1848 wrote to memory of 1264	1848	caxsqkicau.exe	180
PID 3332 wrote to memory of 8	3332	2026-08-13_deddf1a381e6acf9d2958367341e37a3_elex_rhadamanthys_stop.exe	183
PID 5456 wrote to memory of 5848	5456	msedge.exe	185
PID 5456 wrote to memory of 5848	5456	msedge.exe	185
PID 3332 wrote to memory of 3000	3332	2026-08-13_deddf1a381e6acf9d2958367341e37a3_elex_rhadamanthys_stop.exe	191
PID 1448 wrote to memory of 4980	1448	uspkhcausm.exe	193
PID 3332 wrote to memory of 4200	3332	2026-08-13_deddf1a381e6acf9d2958367341e37a3_elex_rhadamanthys_stop.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-13_deddf1a381e6acf9d2958367341e37a3_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_deddf1a381e6acf9d2958367341e37a3_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x32c,0x7ffb71e5c188,0x7ffb71e5c194,0x7ffb71e5c1a0
      4⤵
      PID:5080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,390407891968754684,3674622936191939634,262144 --field-trial-handle=2312,i,17656115266358157519,4378381707629720338,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
      4⤵
      PID:4164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,6472168008907668364,18198694154842013783,524288 --field-trial-handle=2312,i,17656115266358157519,4378381707629720338,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:11
      4⤵
      System Time Discovery
      PID:5704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,16511824407885365539,7406165850197248582,524288 --field-trial-handle=2312,i,17656115266358157519,4378381707629720338,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:13
      4⤵
      PID:832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3616,i,7852363648792328559,16327692191469275058,2097152 --field-trial-handle=2312,i,17656115266358157519,4378381707629720338,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
      4⤵
      PID:3844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,10915398867503271898,439493099928157777,2097152 --field-trial-handle=2312,i,17656115266358157519,4378381707629720338,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
      4⤵
      PID:5656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4320,i,15824554947535839133,11497515638026998832,2097152 --field-trial-handle=2312,i,17656115266358157519,4378381707629720338,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:1
      4⤵
      PID:256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,9706632267912256247,11895586716032964922,2097152 --field-trial-handle=2312,i,17656115266358157519,4378381707629720338,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:9
      4⤵
      PID:264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,4919360258719181503,17322763381686879985,524288 --field-trial-handle=2312,i,17656115266358157519,4378381707629720338,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:14
      4⤵
      PID:4788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,15074580196216777982,12369331926703554921,524288 --field-trial-handle=2312,i,17656115266358157519,4378381707629720338,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
      4⤵
      PID:4780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,8580529123335552830,5311986341563103348,524288 --field-trial-handle=2312,i,17656115266358157519,4378381707629720338,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
      4⤵
      PID:5660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,1467578649911603103,14051226645976569788,524288 --field-trial-handle=2312,i,17656115266358157519,4378381707629720338,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
      4⤵
      PID:4452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,1467578649911603103,14051226645976569788,524288 --field-trial-handle=2312,i,17656115266358157519,4378381707629720338,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
      4⤵
      PID:1652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,9257134956472883881,14987227716699561979,524288 --field-trial-handle=2312,i,17656115266358157519,4378381707629720338,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
      4⤵
      PID:5648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,8450831448910964625,14925954561807788038,524288 --field-trial-handle=2312,i,17656115266358157519,4378381707629720338,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
      4⤵
      PID:2176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,10922809430684130404,1809703242856363460,524288 --field-trial-handle=2312,i,17656115266358157519,4378381707629720338,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
      4⤵
      PID:3784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,10011259802665162693,1302644399304802168,524288 --field-trial-handle=2312,i,17656115266358157519,4378381707629720338,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
      4⤵
      PID:4896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4716,i,15028669477343111423,8753125538419122491,524288 --field-trial-handle=2312,i,17656115266358157519,4378381707629720338,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
      4⤵
      PID:2868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2104,i,7605422502616127733,3988408398491862177,524288 --field-trial-handle=2312,i,17656115266358157519,4378381707629720338,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:14
      4⤵
      PID:5848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,12457268695166173480,4321905621768032360,524288 --field-trial-handle=2312,i,17656115266358157519,4378381707629720338,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:14
      4⤵
      PID:4336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=908,i,16632533277918549018,16837585113980143217,524288 --field-trial-handle=2312,i,17656115266358157519,4378381707629720338,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
      4⤵
      PID:2460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,4083299216912995944,10882808676174020372,524288 --field-trial-handle=2312,i,17656115266358157519,4378381707629720338,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:14
      4⤵
      PID:4912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6080,i,7374191948934424204,10575112477654862990,262144 --field-trial-handle=2312,i,17656115266358157519,4378381707629720338,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,13261267259149693473,1263455887496897042,524288 --field-trial-handle=2312,i,17656115266358157519,4378381707629720338,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:14
      4⤵
      PID:5684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urmkecxupn.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4892
- - C:\Temp\urmkecxupn.exe
    C:\Temp\urmkecxupn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4192
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2436
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urmkecxupn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2844
- - C:\Temp\i_urmkecxupn.exe
    C:\Temp\i_urmkecxupn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomgecwur.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4000
- - C:\Temp\wuomgecwur.exe
    C:\Temp\wuomgecwur.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1192
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3816
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomgecwur.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5876
- - C:\Temp\i_wuomgecwur.exe
    C:\Temp\i_wuomgecwur.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgezwrpjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1552
- - C:\Temp\omgezwrpjh.exe
    C:\Temp\omgezwrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6116
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4540
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1436
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgezwrpjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5648
- - C:\Temp\i_omgezwrpjh.exe
    C:\Temp\i_omgezwrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbzwqoigdb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1560
- - C:\Temp\dbzwqoigdb.exe
    C:\Temp\dbzwqoigdb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:964
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4160
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbzwqoigdb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5348
- - C:\Temp\i_dbzwqoigdb.exe
    C:\Temp\i_dbzwqoigdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytqoigbytq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1536
- - C:\Temp\ytqoigbytq.exe
    C:\Temp\ytqoigbytq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4716
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2604
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytqoigbytq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3108
- - C:\Temp\i_ytqoigbytq.exe
    C:\Temp\i_ytqoigbytq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifaxvqnlid.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4228
- - C:\Temp\ifaxvqnlid.exe
    C:\Temp\ifaxvqnlid.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5412
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifaxvqnlid.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1956
- - C:\Temp\i_ifaxvqnlid.exe
    C:\Temp\i_ifaxvqnlid.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gaysqkicav.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2404
- - C:\Temp\gaysqkicav.exe
    C:\Temp\gaysqkicav.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2096
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5440
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gaysqkicav.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3196
- - C:\Temp\i_gaysqkicav.exe
    C:\Temp\i_gaysqkicav.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\caxsqkicau.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2928
- - C:\Temp\caxsqkicau.exe
    C:\Temp\caxsqkicau.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1848
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1264
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_caxsqkicau.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:8
- - C:\Temp\i_caxsqkicau.exe
    C:\Temp\i_caxsqkicau.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uspkhcausm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3000
- - C:\Temp\uspkhcausm.exe
    C:\Temp\uspkhcausm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1448
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4980
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uspkhcausm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4200
- - C:\Temp\i_uspkhcausm.exe
    C:\Temp\i_uspkhcausm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbzurmjec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4996
- - C:\Temp\jhbzurmjec.exe
    C:\Temp\jhbzurmjec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1256
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6120
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbzurmjec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2348
- - C:\Temp\i_jhbzurmjec.exe
    C:\Temp\i_jhbzurmjec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjgecwurpj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6044
- - C:\Temp\pjgecwurpj.exe
    C:\Temp\pjgecwurpj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5324
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4452
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjgecwurpj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2456
- - C:\Temp\i_pjgecwurpj.exe
    C:\Temp\i_pjgecwurpj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljebwqoj.exe ups_run
  2⤵
  PID:2964
- - C:\Temp\trljebwqoj.exe
    C:\Temp\trljebwqoj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5712
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2560
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4676
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljebwqoj.exe ups_ins
  2⤵
  PID:2856
- - C:\Temp\i_trljebwqoj.exe
    C:\Temp\i_trljebwqoj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljdbvtolg.exe ups_run
  2⤵
  PID:5904
- - C:\Temp\rljdbvtolg.exe
    C:\Temp\rljdbvtolg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4300
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4220
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljdbvtolg.exe ups_ins
  2⤵
  PID:2768
- - C:\Temp\i_rljdbvtolg.exe
    C:\Temp\i_rljdbvtolg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ykidavtqli.exe ups_run
  2⤵
  PID:4516
- - C:\Temp\ykidavtqli.exe
    C:\Temp\ykidavtqli.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4280
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6100
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ykidavtqli.exe ups_ins
  2⤵
  PID:4620
- - C:\Temp\i_ykidavtqli.exe
    C:\Temp\i_ykidavtqli.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\yvqnigaysq.exe ups_run
  2⤵
  PID:5880
- - C:\Temp\yvqnigaysq.exe
    C:\Temp\yvqnigaysq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5976
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4932
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_yvqnigaysq.exe ups_ins
  2⤵
  PID:2780
- - C:\Temp\i_yvqnigaysq.exe
    C:\Temp\i_yvqnigaysq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2072
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkicausnk.exe ups_run
  2⤵
  PID:4844
- - C:\Temp\sqkicausnk.exe
    C:\Temp\sqkicausnk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4152
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1992
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkicausnk.exe ups_ins
  2⤵
  PID:1700
- - C:\Temp\i_sqkicausnk.exe
    C:\Temp\i_sqkicausnk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicavpnhfz.exe ups_run
  2⤵
  PID:3088
- - C:\Temp\kicavpnhfz.exe
    C:\Temp\kicavpnhfz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2176
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6080
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicavpnhfz.exe ups_ins
  2⤵
  PID:5544
- - C:\Temp\i_kicavpnhfz.exe
    C:\Temp\i_kicavpnhfz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmkecaujhc.exe ups_run
  2⤵
  PID:4284
- - C:\Temp\pmkecaujhc.exe
    C:\Temp\pmkecaujhc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5016
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5888
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmkecaujhc.exe ups_ins
  2⤵
  PID:2720
- - C:\Temp\i_pmkecaujhc.exe
    C:\Temp\i_pmkecaujhc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\romkecxrom.exe ups_run
  2⤵
  PID:5460
- - C:\Temp\romkecxrom.exe
    C:\Temp\romkecxrom.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2468
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4916
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_romkecxrom.exe ups_ins
  2⤵
  PID:4392
- - C:\Temp\i_romkecxrom.exe
    C:\Temp\i_romkecxrom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrojgbztrm.exe ups_run
  2⤵
  PID:2180
- - C:\Temp\wrojgbztrm.exe
    C:\Temp\wrojgbztrm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5028
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3336
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrojgbztrm.exe ups_ins
  2⤵
  PID:3412
- - C:\Temp\i_wrojgbztrm.exe
    C:\Temp\i_wrojgbztrm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6060

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5348

C:\Temp\jhbzurmkec.sys
C:\Temp\jhbzurmkec.sys
1⤵
- Executes dropped EXE
PID:1000

C:\Temp\trpmgeywro.sys
C:\Temp\trpmgeywro.sys
1⤵
- Executes dropped EXE
PID:2764

C:\Temp\dbztrljdbz.sys
C:\Temp\dbztrljdbz.sys
1⤵
- Executes dropped EXE
PID:3516

C:\Temp\eyvtnligby.sys
C:\Temp\eyvtnligby.sys
1⤵
- Executes dropped EXE
PID:1852

C:\Temp\qoigaysqli.sys
C:\Temp\qoigaysqli.sys
1⤵
- Executes dropped EXE
PID:4252

C:\Temp\fdxvtnlida.sys
C:\Temp\fdxvtnlida.sys
1⤵
- Executes dropped EXE
PID:5668

C:\Temp\fzxspkicau.sys
C:\Temp\fzxspkicau.sys
1⤵
- Executes dropped EXE
PID:2308

C:\Temp\causpkhczx.sys
C:\Temp\causpkhczx.sys
1⤵
- Executes dropped EXE
PID:2540

C:\Temp\wusmkecxup.sys
C:\Temp\wusmkecxup.sys
1⤵
- Executes dropped EXE
PID:4676

C:\Temp\rpjhbzurmj.sys
C:\Temp\rpjhbzurmj.sys
1⤵
- Executes dropped EXE
PID:3804

C:\Temp\tomgeywroj.sys
C:\Temp\tomgeywroj.sys
1⤵
PID:4804

C:\Temp\zwroiywtol.sys
C:\Temp\zwroiywtol.sys
1⤵
PID:1156

C:\Temp\yvtolgdywq.sys
C:\Temp\yvtolgdywq.sys
1⤵
PID:4936

C:\Temp\aysqkigays.sys
C:\Temp\aysqkigays.sys
1⤵
PID:5668

C:\Temp\sqnifdausn.sys
C:\Temp\sqnifdausn.sys
1⤵
PID:1352

C:\Temp\xspkicsmke.sys
C:\Temp\xspkicsmke.sys
1⤵
PID:264

C:\Temp\pnhecausmk.sys
C:\Temp\pnhecausmk.sys
1⤵
PID:3188

C:\Temp\xrpmhbzxrp.sys
C:\Temp\xrpmhbzxrp.sys
1⤵
PID:5128

C:\Temp\rojgeywurl.sys
C:\Temp\rojgeywurl.sys
1⤵
PID:3936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbztrljdbz.sys

Path C:\Temp\dbztrljdbz.sys
Size 141KB
SHA256 5755b965398e9361f08916ff177c994d2ed545cbac2955c58558d2b2aa301686
MD5 eeec8cedcbbeb0c6003ecd5a8de21d78
SHA1 a7b0c2acd5112d7b9c5596177d5cd5eea8dfd1d3
SHA512 e5acfcd0c3921455b2bdce1faf66324b66b8ac68ecb8bb8dff02c7a9947d9c72d77abca956902ed64a1c10481bb83b016bb10d8a7edc445e064b4138f6dc4b56
SSDEEP 1536:8a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:8a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T134E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbzwqoigdb.exe

Path C:\Temp\dbzwqoigdb.exe
Size 243KB
SHA256 ea176265110f464b87e731ae07126aebf90054ad9b97f28e4bb931b88a04bae2
MD5 177a58e0a00116eb7f6d390f87a74e49
SHA1 82c733ddb81da54d4d4ae2c6c9cdbed73df42348
SHA512 3d8be0bbadf65bfef87a84b3da6c75081ab0d0553d8632dc693a57ba91448aa87f185a09770f95789cc0eeac05c92a9af17a5159b75447eeca36658752c29ae6
SSDEEP 3072:GCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA70:pvMsLaOa3lLNngoqRttA70
TLSH
T1C8345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eyvtnligby.sys

Path C:\Temp\eyvtnligby.sys
Size 141KB
SHA256 b6a0b7d56619843bf029e1ad120a2ef35d891a85847534f6332b7f8f7b8d3327
MD5 93a9a87a7d86383c08626a6916465ae8
SHA1 1e1146c704d700759fc7f7054d091a2905ca65c8
SHA512 18049afeeca646dd6d365d3fb3e54480791d5ea92ab76b298f43f77759638607e0851f50f9ea345a73745abe147cba85102b833e667c3535a3d9e847ea5e4905
SSDEEP 1536:ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DBE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvtnlida.sys

Path C:\Temp\fdxvtnlida.sys
Size 141KB
SHA256 b7405fdd7a52bd33547de1cdf34adae00989d34c7ee291d1d28f89ec299fe98d
MD5 8675b52c5d7d95b90595a7df91164947
SHA1 a97367f4f6d518eee228f6d91beed3b0e221b63d
SHA512 d52e39971010d5ba61d2b65ac97376ec2effccc464bacbdc6025800fc82fa51c898bdab7a7b388b40af31bf1f91d462a8b4b3022a9894e57ec04a271b2d35e88
SSDEEP 1536:wa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:wa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T168E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbzwqoigdb.exe

Path C:\Temp\i_dbzwqoigdb.exe
Size 243KB
SHA256 a004066140ee54492a07f57eff3143d5107483dd4498a5e7a2de81cdceb30fa2
MD5 1c0db9f31f8232f3bde294ee69e83608
SHA1 d12e24cb145ca56801d5f5b335cd152499f70bb1
SHA512 b3d27b59f38eaa0032ac03601bfad88ff3febd01417cde85cb911a9aeba6917efdc81fee4d24fffb08784409a37ed9f6a1aa2ee00cea754a27fd74deac916a07
SSDEEP 3072:DCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA79:GvMsLaOa3lLNngoqRttA79
TLSH
T1FF345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ifaxvqnlid.exe

Path C:\Temp\i_ifaxvqnlid.exe
Size 243KB
SHA256 d1841ce91a5e603d794126df9435bc92a449d5b5c397e73cacdce34420bdcfd4
MD5 100ef7f8cd41c33ffa33fdc42fd0be58
SHA1 20f0fac8a311790253850a64f22622a9663a5c52
SHA512 d50e1baacf0cd410c0c8a07415ef93186f61ab6dc37cd71cfdecd899eb9b5329dcf1be243c2779a2725fe400249dd1db063527afcbcd1e2a34d41f79efed0ebc
SSDEEP 3072:0CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7y:HvMsLaOa3lLNngoqRttA7y
TLSH
T12D345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omgezwrpjh.exe

Path C:\Temp\i_omgezwrpjh.exe
Size 243KB
SHA256 79d7602652f4275efaba8d18741574abc84070acf6cd9e7a5d558424bc939559
MD5 1b6a415e83b36d42aacbac4954463ad5
SHA1 29ee59e7d58981c3b58623b1608958885079e1a9
SHA512 1de55a11ff3a316a618daeb08ab75e82984b30ca6ef9fc5857ce5bdf2220aceee7340f3c162d3320d787d7456575416cb2bbdf542df70ab543ac62e2863f2eec
SSDEEP 3072:pCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7P:UvMsLaOa3lLNngoqRttA7P
TLSH
T157345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_urmkecxupn.exe

Path C:\Temp\i_urmkecxupn.exe
Size 243KB
SHA256 492989a8dfd7821c66de3876fce5e5ab73109d9712563fbcf4ed868d23fd8aa9
MD5 af28c1ee47ea46b13c56f2cad1f3c4f6
SHA1 1da6c81394a11fd489dcbf78149a3d9cdea8f6a5
SHA512 99aa15a8ea91710b00c0ab69099dbcd3581de1e9f9e2fb898cc9d128aa6514efe8d737e0526aab7e2b8ef37ef22962c2e2f86b18e00074275c81576ab207ec6d
SSDEEP 3072:jCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7N:mvMsLaOa3lLNngoqRttA7N
TLSH
T171345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wuomgecwur.exe

Path C:\Temp\i_wuomgecwur.exe
Size 243KB
SHA256 2bbd1dfa056edb7f5d8deae1feeb8b8cda3751d63f85d4e715f9211d919f585a
MD5 6213008f76571c4a340d233d5eb4ec7c
SHA1 ea6341b279c853e6b0778361345a111d880d5492
SHA512 d0ad5bb92b5e8abeb0fb8ca718f745b0fad30d28912b425d5042874d716e9425ca9645b880b10329efab73427d6a00ba0706688b62b027cf11f10c986e7743dc
SSDEEP 3072:tCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA77:gvMsLaOa3lLNngoqRttA77
TLSH
T110345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ytqoigbytq.exe

Path C:\Temp\i_ytqoigbytq.exe
Size 243KB
SHA256 5f7442174ff507eb79fd4d05e0e1defafe1dcacb629b4f1214bb84ac3d552f05
MD5 7e829db96103eb12d79c6f359119b9c1
SHA1 345a9bc21883ff7a436983d182f9ee0a66b47cfb
SHA512 63f42674fd6eb8621d7c048d900e6024909c634987f149b481e54ae09d79251f3749dbe12022bf766872c60430e943eb67267ac09c4d3917a7d14d4ffe8c6f14
SSDEEP 3072:CCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA70:9vMsLaOa3lLNngoqRttA70
TLSH
T103345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaxvqnlid.exe

Path C:\Temp\ifaxvqnlid.exe
Size 243KB
SHA256 80a28e0e63a0d37091562b4b8f725e69de67e6a9e9fe4f91010ac95766b615e4
MD5 751e9ad603e9ba8f1ba51a52c2ffeaba
SHA1 adef7fac1391ef1425bcb67c73c57a32da82a049
SHA512 244b3eb2e752e40be9d4a9be4431cd73c3ccaa6901368a0a19ceff26ae5d762f62ae3a42836ae186880166c5b026c634cb211cbb6bd14ee705e43208e5d071c3
SSDEEP 3072:eCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA78:RvMsLaOa3lLNngoqRttA78
TLSH
T174345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbzurmkec.sys

Path C:\Temp\jhbzurmkec.sys
Size 141KB
SHA256 b97cb3dc1522c761d914ac64de065f0c814ef8ed2b5b6485d13b4d17396809a0
MD5 31514d6c8537d0fa541d7ea9c6109af6
SHA1 01cb9443bae8320b59b58c4f1183c568a7de1c54
SHA512 e6bc09bbf0c12235faef92479d14acf2165206e1b745c034b7e771c4778d4214566108211f777b20a844dd9a9acb15f7ab98add5319307ce36e00ddeaf4c75f7
SSDEEP 1536:Ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T11AE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgezwrpjh.exe

Path C:\Temp\omgezwrpjh.exe
Size 243KB
SHA256 4e7c68148bba629f5e7d9d8d830ed71478fb65196b257bd60dd0c18d4a5cb0a5
MD5 589b018070ee250603a3db2bb6275446
SHA1 75b17b20127ac84d1d0d11aefaa248566bb121e9
SHA512 2d25f55444d0cc0ca5a9a64975c2844af6644a92aef8bb8a25c8524cada19bfcaf6bd1e326328329a6cb85f6c1d6c3250246916d316f6da54e9c9cc92034130d
SSDEEP 3072:OCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7c:BvMsLaOa3lLNngoqRttA7c
TLSH
T1FC345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigaysqli.sys

Path C:\Temp\qoigaysqli.sys
Size 141KB
SHA256 26baea4b29b4f29ae8ad1662cb4c41bf9ef03168b667f1f2a7fc13fc3ac9d60d
MD5 b34b17f91318c04ccec49f36c92569f0
SHA1 c62b49d4d497022b09f76e744197f63c4a1770ae
SHA512 1e66cb264f07d5e98fc4c18fa1cb649eeda3d659554ef9a4c90a0ed4d8134e6818cd41887a7d3dff33ff3b28bea761922f25fd631d2b5d39229a8ecd1f42ab2e
SSDEEP 1536:ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T18FE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trpmgeywro.sys

Path C:\Temp\trpmgeywro.sys
Size 141KB
SHA256 508442768a4b55d1ca6bc502f5e1a927e7a902efade0ae283fd5b02cccec0466
MD5 c9b6b04164b2c68729f0b309a9d38ce5
SHA1 0f31576103c75c8043fe51201624a8e4c4fa70bc
SHA512 0e62b442a6bc2ff2313e74c40f17ec42f5b6c8504b49693c4cd103b88b112b755460f4aea71a4371f143b7cf994b592c21a949fbe2b0b3f3d827c222ed969d7a
SSDEEP 1536:7a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:7a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T10BE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmkecxupn.exe

Path C:\Temp\urmkecxupn.exe
Size 243KB
SHA256 1463849fa6182a8ed53d5b4a59b48db2a36896bf48fd23aaced3b453fae670b0
MD5 2a3e9351237599bcbfc1ebae6e6b9d04
SHA1 dd818027714aa4ed354ad681422801a19b748c34
SHA512 c817e51b5605807212f4770f421ab917b5b074379c43cac0b539f1328ad17d7aab29be6ef42e97c03b45bde3b2a28be57f0dd64dff0147af0d36640f28c16e36
SSDEEP 3072:8CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA72:fvMsLaOa3lLNngoqRttA72
TLSH
T1C8345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomgecwur.exe

Path C:\Temp\wuomgecwur.exe
Size 243KB
SHA256 b1ad10ca4af92f7544e482738e0a944066565c91378d3c626953a795c766d2a1
MD5 3319f7e2641122bfe116bb4b55a31365
SHA1 33391042ddf86272c9b2f5eca6fca88c500a38ea
SHA512 03043e9764414528e00e7e90612f1d64f114262d7a671924c31dd6c9ffc7309c9861c4a69d703950f798dff77c76d4d0f10060d113da1edf94404e0ac77873fa
SSDEEP 3072:ECvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:XvMsLaOa3lLNngoqRttA7W
TLSH
T108345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytqoigbytq.exe

Path C:\Temp\ytqoigbytq.exe
Size 243KB
SHA256 b1f6e1c36185064cbc0ca8fcda1121c86bd6d65ae9fed9b4ed526103d8a7bb03
MD5 b65070d98d02faf5364f9bc2bed4f465
SHA1 efd30dd7af917930bf4b47af95d310cf6dd0667a
SHA512 730b1e32c2f5419f4e6a76674527af67c1b3f530d6f691486a72abd983d8159b3d978be9eece896a9011cb01a1cde2cdc424e1225bd7800fc6183a2ebce5f683
SSDEEP 3072:yCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:tvMsLaOa3lLNngoqRttA7Y
TLSH
T1DC345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 0a002bd076442d0ecd032c81e4470cc3f57c979196dbc1a92565575bf6c2b180
MD5 a576a6df4e1fdfa51e1d405dffd7c1e6
SHA1 cce531dc756d28493271ea7556c3b26dddab12a8
SHA512 766733d3518a5c003c8ef88409918699fab06ccc93c145fd298432aaaee0db4403e14024165e3b5992e21131324f15f8edad9eb8e1749177915de1eda5986ab3
TLSH
T1F45151D3132259CFD3E159B121F06468B2FEA87C81176E88417B2D75CA01FCA60E347B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 ac8fc05371288666739a95797114477c5b98da29b4578f2603ff5485a0655ba5
MD5 a5c962877b11858e08657f3473640bd5
SHA1 82f26d3c225a0facea32b4409518fbf2dfb3f2e4
SHA512 49015d1ae1b2281445fb6c93368f644baaea294784318e3795d706e1aba606215fbb6449798182b924af9fbb30dfe6d9f6ba9ba782d762c9c8f29631c75a24e4
TLSH
T1475151D3132259CFD3E159B121F16468B2FEA87C82176E88517B2D75CA01FCA60E347B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 873156589da11491e1d6e47d211da2bd6d5d03cb389c002907551438c3cbcfbf
MD5 333eee639a5bd93051cfaba88cd94a41
SHA1 5b26c92985d494d211094405875144430fc0f9a8
SHA512 b6bbecd5008c1c7d21c6c0cf52ee53dd0acb3d2c7f60a3cddc181c894ff31618b89e2a96f8a36332f1d573594ed2ea36eb3e7a8ad187683894f722418a827850
TLSH
T1F141D2F383F4857E9A0196F0AA186E1FDE2D0521432C7C69C9E0AE2793F3471E041A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 240d5822d381b9519cc1fb8385cb9c307571dbceb71f94fbf36b3afc490f241c
MD5 d51c1f93c29192e49fe7ed50e94965a9
SHA1 4db219b0779d274a55dc3f7c5b2a61ad6b2a3440
SHA512 b20060edbfa48b750630fc8f83012934cfe615f762fa5b6deea3e7d2d065489655fa145ce9ca8157c721b940c87718f334036626426d2fa19f63a070549fcdfb
SSDEEP 192:sxRGrCW/f0sj9qZMNVwzoD8p9C/g6+WNClS/YC+5uOoGFIgVRJ:sxRGeW/f0sj98ays/5L/E11
TLSH
T1BE42C7165D28AD3B8CC7E21CBB65BF53E2F95072A1D41E58FAFD8A1C04E66DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9b78d4318e9b89e627567eab2af59b1893e5cdec8266afafdd2a77d085315871
MD5 b4de14205a81f5169800d6e58dbb8f3c
SHA1 37479a102683adfce81886bb794c3933d2d97ff5
SHA512 880f0c1ca426e182abc51bb42189f4d3864cc8b06e3e4c5a187be977e51a136620e313244c09f6b1261b934d516d009e0935362d6aff1a609f7b6ca88f4fe188
SSDEEP 192:sxRhrCW/f0sKsqZMNVwzoD8p9C/g6+WNClS/YCJzuOoGFIgDXRJ:sxRheW/f0sKs8ays/5L/V1n
TLSH
T16642B7169D28AD3B8CC7E21CBB55BF53E3F95072A0951E48AAFD8B1C05F66DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4b6789ca8f02caad5d891d04081297212e5cd919e3434ab3c431b4392e5b65f5
MD5 ae54a8dac761e8142b6fd4e22c7979b4
SHA1 0b8441bd4acf3f85642314308c0a835788ea25e2
SHA512 87d2eaa5870c469d3e412203b1749c1015ac55fdefc0d9f70472d5138c65184393f899cf620b9466075c178966cce3188367b2c49370a8515bd624f65bf96101
SSDEEP 192:sxRhrCW/f0sK9qZMNVwzoD8p9C/g6+WNClS/YC+5uOoGFIgDtRJ:sxRheW/f0sK98ays/5L/E1J
TLSH
T12742C8159D289D3B8CC7E21CBB55BF53E3F95072A1D41E48BAFD8A1C04E66DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 30ef85ddde830f24cd03bdc198463f2132b86bae68656e3c0afdea8ff1f54481
MD5 29e727f1bedfcf0f5e5732ca46b17efc
SHA1 561d8a55d6c9cded521b29bf738dc3644ab01d7c
SHA512 ed8d92e3ddb9c3c0a3b6b2d72bb66752b574a8a43f094393b9873898c35d77279b9036e1ad38d94d5457d7413473868b69063bcb75a727fc2c9737684fbd3822
SSDEEP 768:jC+vgN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OV250QqcYroZF:jC+vg7E7JQWgQ+f4+u1jaN50Vcjf
TLSH
T11AD2EA7B640DCB7F4F804ADDAC197E9F6DA802CB9698CD4047FA941C02C6BEB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59fa35.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59fa35.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 acfe0eace1b932aa8541969172e96a18ef85bc51770fee9e91fdcd68aa314496
MD5 c33ea16d09588e02ab6464c318617bca
SHA1 0c3cf01ca8f901c0c3983bf619ec0403e95a2732
SHA512 489a8279b09c368531f78caff5e90890ce7857712840475620a36890d104eebe17e5ebeef2e311d18608e805935d443cd611fae47442ddcbc6f95e6962c73007
SSDEEP 768:703ZZf+gEp8+p3bd66j+4BRv86aLIWSPi9P6yt:7035S8+p3Z6n4ygP/yt
TLSH
T139F2BF70E8A9DD739CF9D744B39637836EF415A3A5C01E98E8DDAB0E058315E1B0B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 438fdfa6c6ddbbe28f3d91fc706c3e723687e6f0c096a2fcf2511e9fe2882d68
MD5 3e61e390848fade79056811beb71cf02
SHA1 4bd416fb85d05a562fcb84624153aeee2a5e312f
SHA512 76dea4fa33551cff817a2c3c1c6c4610c57ed13450bf4a8c261aa23880c539443f67da1570d08c0b28e01cc24669e46d0d230859691d95d4fc7e370eb9b56ee8
SSDEEP 768:UFQ03Pwg0+O+4p8+p3bd66j+4BRv86aLIWSPi9P6yt:303G8+p3Z6n4ygP/yt
TLSH
T1C91328F198D79937D8AD8743A37D2E469EBCC0A3B5845894B7C95E0DCC820BFC70A825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7ec9f81029ebe3c4195e06bd6e42a3371d5cb799f52a66d521a0c8101985f398
MD5 a173dc2cc09da9b3da0a2952e5b3092d
SHA1 bc1bbdf23e3667069976dba23e4b6d2d6d9d5e05
SHA512 cc3d75378917e6b4f833a3b4f7ab8eb83007a735f7eb82939c0edd6358831ce6c4974245a801203afb4b9bb767dfa1dad4677a21905594e4b4aa02bc55fcb75c
SSDEEP 768:Irv+4UNbdD3/cfKNp8+p3bd66j+4BRv86aLIib2bwCl1:Ibsbp3bL8+p3Z6n4yh0ww
TLSH
T18003BF33E8A899739CE6C644B24677437FF851A396C10AD4E4DD2B4E416A19E630BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 bca37535be6bf7a9f63025fab71fcd63ffb859eb969d2e3218dce7ff7ac8a845
MD5 bff9d9f9068d0e7d65c532dde17fca67
SHA1 11b2e8d74d0cadab28ab8bfc96a2f545c49e6f42
SHA512 5cf6d033cf5c0972618ab4a8750fb300ebaa3e14503c52bf8bdca9d50aff30a49fdc3ff9d43270a0064fcb000032a14527488f667bfc654cffcd50450af96a92
SSDEEP 768:I03cZf+gzp8+p3bd66j+4BRv86aLIWSPi9P6yt:I03uF8+p3Z6n4ygP/yt
TLSH
T1B2F2BF70E8A99D639CF9D744B35637837EF415A3A5C01E98E8DDAB0E058315E1B0B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 36ce0968d1363960aaba07b9a2e7407afc9e5f2eac43b8577a5ea327723cb2f6
MD5 74e7550c7d17c0b41e4090606672038b
SHA1 bcea4f1c3da7091d30e5b24c466c5533f07b0764
SHA512 94764fae4e2ed2acbcd96b226f7aa317d3f1acdc3b9c1f8ac97cb0175c22bdd5645f45b18b4c53ac833da5f011131f02b8c389978a10a662bccada92f03ae789
SSDEEP 768:Vrv+4UNbdD3Rzf+gNp8+p3bd66j+4BRv86aLITS2bwCl1:Vbsbp3zL8+p3Z6n4yD0ww
TLSH
T12C03BE72E4ADED339CE6C644B24677837FB811A399C10ED4E8D96B4E015A19E270F837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5456_1975543961\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/264-444-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/264-465-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1000-183-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1156-404-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1352-439-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1852-270-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2308-315-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2540-331-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2764-230-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3188-464-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3516-258-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3804-364-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3936-486-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4252-283-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4676-335-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4804-384-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4936-408-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5128-469-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5668-311-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5668-317-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5668-428-0x0000000000010000-0x0000000000083000-memory.dmp

Download